73 lines
2.2 KiB
Nix
73 lines
2.2 KiB
Nix
{pkgs, ...}: let
|
|
# Helper script to update the system based on local copy of flake
|
|
updateScript = pkgs.writeShellScriptBin "rebuild" ''
|
|
nixos-rebuild switch --flake /etc/nixos#distrust
|
|
'';
|
|
# Helper script to clear /var/log and systemd journal
|
|
clearLogsScript = pkgs.writeShellScriptBin "clear_logs" ''
|
|
${pkgs.coreutils}/bin/rm -rf /var/log/*
|
|
${pkgs.systemd}/bin/journalctl --vacuum-time=0s
|
|
'';
|
|
# Currently unused, calculates TOR .onion hostname based on secret key
|
|
tor-hostname = import ../helpers/tor-hostname.nix {inherit pkgs;};
|
|
in {
|
|
environment.systemPackages = with pkgs; [vim btop git alejandra statix deadnix] ++ [updateScript tor-hostname];
|
|
|
|
# Necessary for flake support
|
|
nix.settings.experimental-features = ["nix-command" "flakes"];
|
|
|
|
networking.hostName = "distrust";
|
|
zramSwap.enable = true;
|
|
boot.tmp.cleanOnBoot = true;
|
|
|
|
users.users = {
|
|
# Disables root login by setting an invalid password
|
|
root.hashedPassword = "!";
|
|
anon = {
|
|
isNormalUser = true;
|
|
extraGroups = ["wheel"];
|
|
hashedPassword = "$6$GAyfgaTQgaBipAbb$gF/9YBh2ucVa/9vDQvEu9DVjSbsqdvSoXwA5RX0kP7.xdCfLqXhGBLlSXHg0e4rkLLd6zI1gRTWd4TfMjnnpS/";
|
|
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxah5pnxmk+P7HtwRsryDoAHZsDs5RcGP9IPCNg1KFe cardno:16_179_196"];
|
|
};
|
|
};
|
|
|
|
security.sudo.wheelNeedsPassword = true;
|
|
|
|
services = {
|
|
openssh = {
|
|
enable = true;
|
|
ports = [292];
|
|
settings.PasswordAuthentication = false;
|
|
};
|
|
fail2ban.enable = true;
|
|
endlessh = {
|
|
enable = true;
|
|
port = 22;
|
|
openFirewall = true;
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
services.clear-var-log = {
|
|
description = "Clear /var/log directory";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${clearLogsScript}/bin/clear_logs";
|
|
User = "root";
|
|
Group = "root";
|
|
};
|
|
};
|
|
timers.clear-var-log = {
|
|
description = "Hourly timer to clear /var/log";
|
|
wants = ["clear-var-log.service"];
|
|
timerConfig = {
|
|
OnCalendar = "hourly";
|
|
Persistent = true;
|
|
Unit = "clear-var-log.service";
|
|
};
|
|
wantedBy = ["timers.target"];
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "25.05";
|
|
}
|