From 6513755670892983db88a6633b8c1ea6019c03d1 Mon Sep 17 00:00:00 2001
From: Ben Sima <ben@bsima.me>
Date: Fri, 15 Nov 2024 14:55:37 -0500
Subject: Re-namespace some stuff to Omni

I was getting confused about what is a product and what is internal
infrastructure; I think it is good to keep those things separate. So I moved a
bunch of stuff to an Omni namespace, actually most stuff went there. Only things
that are explicitly external products are still in the Biz namespace.
---
 Omni/OsBase.nix | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 Omni/OsBase.nix

(limited to 'Omni/OsBase.nix')

diff --git a/Omni/OsBase.nix b/Omni/OsBase.nix
new file mode 100644
index 0000000..3e69d8e
--- /dev/null
+++ b/Omni/OsBase.nix
@@ -0,0 +1,42 @@
+{ pkgs, config, ... }:
+let ports = import ./Cloud/Ports.nix;
+in {
+  boot.tmp.cleanOnBoot = true;
+  fonts.fonts = with pkgs; [
+    google-fonts
+    mononoki
+    source-code-pro
+    fantasque-sans-mono
+    hack-font
+    fira
+    fira-code
+    fira-code-symbols
+  ];
+  networking.firewall.allowPing = true;
+  nix.settings.substituters =
+    [ "https://cache.nixos.org" ]; # "ssh://dev.simatime.com" ];
+  nix.gc.automatic = true;
+  nix.gc.dates = "Sunday 02:15";
+  nix.optimise.automatic = true;
+  nix.optimise.dates = [ "Sunday 02:30" ];
+  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
+  nix.settings.trusted-users = [ "ben" ];
+  programs.ccache.enable = true;
+  programs.mosh.enable = true;
+  programs.mosh.withUtempter = true;
+  security.acme.defaults.email = "ben@bsima.me";
+  security.acme.acceptTerms = true;
+  security.sudo.wheelNeedsPassword = false;
+  services.clamav.daemon.enable = true; # security
+  services.clamav.updater.enable = true; # security
+  services.fail2ban.enable = true; # security
+  services.fail2ban.ignoreIP = [ ports.bensIp ]; # my home IP
+  services.fail2ban.maxretry = 10;
+  services.openssh.enable = true;
+  services.openssh.openFirewall = true;
+  services.openssh.settings.X11Forwarding = true;
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin
+  zramSwap.enable = true;
+}
-- 
cgit v1.2.3