Omni/Os/Base.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

{ config, ... }:

# This module defines common default settings that all OS builds should include.

let ports = import ../Cloud/Ports.nix;
in {
  boot.tmp.cleanOnBoot = true;
  networking.firewall.allowPing = true;
  nix.settings.substituters =
    [ "https://cache.nixos.org" ]; # "ssh://dev.simatime.com" ];
  nix.gc.automatic = true;
  nix.gc.dates = "Sunday 02:15";
  nix.optimise.automatic = true;
  nix.optimise.dates = [ "Sunday 02:30" ];
  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
  nix.settings.trusted-users = [ "ben" ];
  programs.ccache.enable = true;
  programs.mosh.enable = true;
  programs.mosh.withUtempter = true;
  security.acme.defaults.email = "ben@bsima.me";
  security.acme.acceptTerms = true;
  security.sudo.wheelNeedsPassword = false;
  services.clamav.daemon.enable = true; # security
  services.clamav.updater.enable = true; # security
  services.fail2ban.enable = true; # security
  services.fail2ban.ignoreIP = [ ports.bensIp ]; # my home IP
  services.fail2ban.maxretry = 10;
  services.openssh.enable = true;
  services.openssh.openFirewall = true;
  services.openssh.settings.X11Forwarding = true;
  services.openssh.settings.PasswordAuthentication = false;
  services.openssh.settings.PermitRootLogin = "prohibit-password";
  system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin
  zramSwap.enable = true;
}