ssh-agent, rspamd

common.nix

@@ -24,20 +24,12 @@
       panicOnChecksumMismatch = true;
     };
   };
-  users.users = {
-    root = {
-      home = "/root";
-      hashedPasswordFile = "/secrets/root.passwd";
-    };
-    bogale = {
-      isNormalUser = true;
-      home = "/home/bogale";
-      extraGroups = [ "wheel" ];
-      hashedPasswordFile = "/secrets/bogale.passwd";
-    };
-  };
+  users.users.root.hashedPasswordFile = "/secrets/root.passwd";
   networking = {
-    nftables.enable = true;
+    firewall = {
+      allowedTCPPorts = [ 53 80 ];
+      allowedUDPPorts = [ 53 67 69 547 ];
+    };
     wg-quick.interfaces.awg0 = {
       type = "amneziawg";
       configFile = "/secrets/awg0.conf";
@@ -62,6 +54,14 @@
   systemd.tmpfiles.rules = [ "d /srv/tftp 0755 root root -" ];
   services = {
     logind.settings.Login.HandleLidSwitch = "ignore";
+    nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedBrotliSettings = true;
+    };
     dnsmasq = {
       enable = true;
       settings = {