common.nix

@@ -13,32 +13,31 @@
     "/boot" = { options = [ "noatime" ]; };
   };
   swapDevices = [ { device = "/var/swapfile"; } ];
-  boot = {
+  boot.loader.limine = {
-    kernelModules = [ "amneziawg" ];
-    kernelPackages = pkgs.linuxPackages_latest;
-    extraModulePackages = [ config.boot.kernelPackages.amneziawg ];
-    loader.limine = {
     enable = true;
-      maxGenerations = 20;
     secureBoot.enable = true;
-      panicOnChecksumMismatch = true;
+  };
+  users.users = {
+    root = {
+      home = "/root";
+      hashedPasswordFile = "/root/secrets/root.passwd";
+    };
+    bogale = {
+      isNormalUser = true;
+      home = "/home/bogale";
+      extraGroups = [ "wheel" ];
+      hashedPasswordFile = "/root/secrets/bogale.passwd";
     };
   };
-  users.users.root.hashedPasswordFile = "/secrets/root.passwd";
   networking = {
-    firewall = {
+    nftables.enable = true;
-      allowedTCPPorts = [ 53 80 ];
+    #networking.wg-quick.interfaces.awg0 = {
-      allowedUDPPorts = [ 53 67 69 547 ];
+      #type = "amneziawg";
-    };
+      #configFile = "/root/secrets/awg0.conf";
-    wg-quick.interfaces.awg0 = {
+    #};
-      type = "amneziawg";
-      configFile = "/secrets/awg0.conf";
-    };
     networkmanager = {
       enable = true;
-      ensureProfiles = {
+      ensureProfiles.profiles.home-wifi = {
-        environmentFiles = [ "/secrets/wifi.env" ];
-        profiles.home-wifi = {
         wifi-security.key-mgmt = "sae";
         connection = {
           id = "home-wifi";
@@ -47,38 +46,12 @@
       };
     };
   };
-  };
   environment.systemPackages = with pkgs; [
+    amneziawg-go
+    amneziawg-tools
     sbctl
   ];
-  systemd.tmpfiles.rules = [ "d /srv/tftp 0755 root root -" ];
   services = {
     logind.settings.Login.HandleLidSwitch = "ignore";
-    nginx = {
-      enable = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedBrotliSettings = true;
-    };
-    dnsmasq = {
-      enable = true;
-      settings = {
-        enable-ra = true;
-        no-resolv = true;
-        cache-size = 1024;
-        bogus-priv = true;
-        enable-tftp = true;
-        interface = "enp1s0";
-        domain-needed = true;
-        tftp-root = "/srv/tftp";
-        dhcp-boot = "grubx64.efi";
-        dhcp-range = [ "10.2.0.2,10.2.255.254,12h"
-        "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ];
-        server = [ "1.0.0.1" "2606:4700:4700::1001"
-        "1.1.1.1" "2606:4700:4700::1111" ];
-      };
-    };
   };
 }

desktop/configuration.nix

@@ -1,15 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  imports = [ ../common.nix ./hardware-configuration.nix ];
-  networking = {
-    hostName = "nixos-desktop";
-  };
-  users.users = {
-    bogale = {
-      isNormalUser = true;
-      home = "/home/bogale";
-      extraGroups = [ "wheel" ];
-      hashedPasswordFile = "/secrets/bogale.passwd";
-    };
-  };
-}

flake.nix

@@ -1,36 +0,0 @@
-{
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    home-manager = {
-      url = "github:nix-community/home-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-  outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
-    nixosConfigurations = {
-      nixos-server = nixpkgs.lib.nixosSystem {
-        modules = [
-          ./server/configuration.nix
-          home-manager.nixosModules.home-manager {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-            home-manager.extraSpecialArgs = { inherit inputs; };
-            home-manager.users.root = ./home/server/root.nix;
-          }
-        ];
-      };
-      nixos-desktop = nixpkgs.lib.nixosSystem {
-        modules = [
-          ./desktop/configuration.nix
-          home-manager.nixosModules.home-manager {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-            home-manager.extraSpecialArgs = { inherit inputs; };
-            home-manager.users.root = ./home/desktop/root.nix;
-            home-manager.users.bogale = ./home/desktop/bogale.nix;
-          }
-        ];
-      };
-    };
-  };
-}

home/bogale.nix

@@ -0,0 +1,6 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ./common.nix ];
+  home.username = "bogale";
+  home.homeDirectory = "/home/bogale";
+}

home/common.nix

@@ -1,12 +1,6 @@
 { config, pkgs, ... }:
 {
-  home = {
+  home.stateVersion = "26.05";
-    stateVersion = "26.05";
-    packages = with pkgs; [
-      gh
-    ];
-  };
-  services.ssh-agent.enable = true;
   programs = {
     home-manager.enable = true;
     bash = {
@@ -45,11 +39,13 @@
       extraConfig = ''
         unbind C-b
         set -g mouse on
+        set -g prefix M-d
         set -g prefix M-f
         set-option -g focus-events on
         set -s set-clipboard external
         set-option -a terminal-features "xterm-256color:RGB"
         bind f send-prefix
+        bind d send-prefix
         bind h select-pane -L
         bind j select-pane -D
         bind k select-pane -U

home/desktop/bogale.nix

@@ -1,8 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ../common.nix ];
-  home = {
-    username = "bogale";
-    homeDirectory = "/home/bogale";
-  };
-}

home/desktop/root.nix

@@ -1,8 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ../common.nix ];
-  home = {
-    username = "root";
-    homeDirectory = "/root";
-  };
-}

home/root.nix

@@ -0,0 +1,6 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ./common.nix ];
+  home.username = "root";
+  home.homeDirectory = "/root";
+}

home/server/bogale.nix

@@ -0,0 +1,4 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ../bogale.nix ];
+}

home/server/root.nix

@@ -1,8 +1,7 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../common.nix ];
+  imports = [ ../root.nix ];
-  home = {
+  programs.bash = {
-    username = "root";
+    shellAliases = { "nixos-rebuild" = "nixos-rebuild --impure --flake /etc/nixos/server#nixos-server"; };
-    homeDirectory = "/root";
   };
 }

marks

@@ -12,6 +12,4 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
 systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
 
 todo:
-- gitea, mediawiki
+- lanzaboote
-- email tracking
-- redirect randomizer

server/configuration.nix

@@ -2,200 +2,35 @@
 {
   imports = [ ../common.nix ./hardware-configuration.nix ];
   boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
-  users = {
-    groups.vmail.gid = 1819;
-    users = {
-      nginx.extraGroups = [ "acme" ];
-      root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
-      vmail = {
-        uid = 1819;
-        group = "vmail";
-        isSystemUser = true;
-      };
-    };
-  };
   networking = {
     hostName = "nixos-server";
-    firewall = {
-      allowedTCPPorts = [ 25 443 587 993 ];
-      allowedUDPPorts = [ 443 ];
-    };
     networkmanager.ensureProfiles.profiles.home-wifi = {
       wifi.ssid = "bogale_2.4";
-      wifi-security.psk = "$BOGALE_2_4_PSK";
+      wifi-security.psk = builtins.readFile "/root/secrets/home-wifi.psk";
-      ipv4 = {
-        method = "manual";
-        gateway = "10.1.0.1";
-        addresses = "10.1.0.2/16";
     };
-      ipv6 = {
+    firewall = {
-        method = "manual";
+      allowedTCPPorts = [ 80 ];
-        gateway = "fc01::1";
+      extraInputRules = ''
-        addresses = "fc01::2/64";
+        ip saddr 192.168.1.0/24 tcp dport 22 accept
-      };
-    };
-  };
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "letsencrypt@bogaledev.ru";
-    certs."bogaledev.ru" = {
-      validMinDays = 3;
-      dnsProvider = "cloudflare";
-      extraDomainNames = [ "*.bogaledev.ru" ];
-      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
-      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
-    };
-  };
-  systemd = {
-    tmpfiles.rules = [
-      "d /var/spool/postfix 0755 postfix postfix -"
-      "d /var/spool/postfix/private 0755 postfix postfix -"
-    ];
-    timers.network-watchdog = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = 5;
-        AccuracySec = 1;
-        OnUnitActiveSec = 5;
-        Unit = "network-watchdog.service";
-      };
-    };
-    services.network-watchdog = {
-      path = [ pkgs.iputils ];
-      serviceConfig = {
-        Type = "oneshot";
-        LogLevelMax = "notice";
-      };
-      script = ''
-        if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
-          failures=0
-        else
-          failures=$(($(cat /run/network.failures)+1))
-          if [ $failures -ge 3 ]; then
-            systemctl restart NetworkManager.service
-            failures=0
-          fi
-        fi
-        echo $failures > /run/network.failures
-        if [ $failures -ge 0 ]; then
-          echo "<5>failures = $failures"
-        fi
       '';
     };
   };
-  services = let
+  services = {
-    saslSocket = "/var/spool/postfix/private/auth";
-    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
-  in {
     openssh = {
       enable = true;
-      settings.PasswordAuthentication = false;
+      openFirewall = false;
     };
-    postgresql.enable = true;
+    nginx = {
-    phpfpm.pools.main = {
-      user = "nginx";
-      group = "nginx";
-      settings = {
-        "pm" = "ondemand";
-        "pm.max_children" = 8;
-        "listen.owner" = "nginx";
-        "listen.group" = "nginx";
-      };
-    };
-    vaultwarden = {
       enable = true;
-      dbBackend = "postgresql";
+      virtualHosts."_".default = true;
-      configurePostgres = true;
+      virtualHosts."_" = {
-      package = pkgs.vaultwarden-postgresql;
+        locations."/" = {
-      environmentFile = "/secrets/vaultwarden.env";
+          return = "200 '<html><body>It works</body></html>'";
-      config = {
-        SIGNUPS_ALLOWED = false;
-        TRASH_AUTO_DELETE_DAYS = 90;
-        PASSWORD_HINTS_ALLOWED = false;
-        EMERGENCY_ACCESS_ALLOWED = false;
-        DOMAIN = "https://bogaledev.ru/vw";
-      };
-    };
-    nginx.virtualHosts."bogaledev.ru" = {
-      quic = true;
-      default = true;
-      forceSSL = true;
-      root = "/srv/http";
-      useACMEHost = "bogaledev.ru";
-      extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
-      locations = {
-        "/".index = "index.php index.html";
-        "~ \\.php$".extraConfig = ''
-          fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
-        '';
-        "/vw" = {
-          proxyPass = "http://127.0.0.1:8000";
-          proxyWebsockets = true;
           extraConfig = ''
-            allow fc00::/64;
+            default_type text/html;
-            allow fc01::/64;
-            allow 10.0.0.0/24;
-            allow 10.1.0.0/24;
-            deny all;
           '';
         };
       };
     };
-    rspamd = {
-      enable = true;
-      postfix.enable = true;
-    };
-    dovecot2 = {
-      enable = true;
-      settings = {
-        ssl = "required";
-        mail_gid = "vmail";
-        mail_uid = "vmail";
-        protocols.imap = true;
-        mail_driver = "maildir";
-        auth_mechanisms = [ "plain" ];
-        dovecot_storage_version = "2.4.5";
-        mail_path = "/var/spool/mail/vmail";
-        ssl_server_key_file = "${sslCertDir}/key.pem";
-        ssl_server_cert_file = "${sslCertDir}/fullchain.pem";
-        dovecot_config_version = config.services.dovecot2.package.version;
-        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd";
-        "service auth"."unix_listener ${saslSocket}" = {
-          mode = "0660";
-          user = "postfix";
-          group = "postfix";
-        };
-      };
-    };
-    postfix = {
-      enable = true;
-      enableSubmission = true;
-      virtualMapType = "regexp";
-      virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru";
-      mapFiles = {
-        smtp_passwd = "/secrets/smtp_passwd";
-        mailbox = pkgs.writeText "mailbox" "mail@bogaledev.ru /";
-      };
-      settings.main = {
-        smtpd_sasl_type = "dovecot";
-        smtpd_sasl_path = saslSocket;
-        smtp_sasl_auth_enable = "yes";
-        smtpd_sasl_auth_enable = "yes";
-        virtual_uid_maps = "static:1819";
-        virtual_gid_maps = "static:1819";
-        smtp_tls_security_level = "encrypt";
-        smtpd_tls_security_level = "encrypt";
-        relayhost = [ "smtp.resend.com:2587" ];
-        virtual_mailbox_domains = "bogaledev.ru";
-        virtual_mailbox_base = "/var/spool/mail/vmail";
-        smtp_sasl_tls_security_options = "noanonymous";
-        virtual_mailbox_maps = "hash:/etc/postfix/mailbox";
-        smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";
-        smtpd_tls_chain_files = [
-          "${sslCertDir}/key.pem"
-          "${sslCertDir}/fullchain.pem"
-        ];
-      };
-    };
   };
 }

server/flake.lock

@@ -7,31 +7,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1789618856,
+        "lastModified": 1789267039,
-        "narHash": "sha256-OSqj7eOijvCZfN7owFWRxLWRhej5lZI+Kt82q3INLvc=",
+        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "afa6821c70560bb19d1a8c577bff398f7f239869",
+        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1789546076,
+        "lastModified": 1789459628,
-        "narHash": "sha256-zVxLZiSnmaaPLwnhj7pwmqe3axBg/C6nG5JZsJMh2g4=",
+        "narHash": "sha256-JOaadoI/IC9qEvwlnjwAhwdcWkCDqEeOJ+cOtUH/8RQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
+        "rev": "b67c7a60c3732edd4b947a7df8af06215851a614",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }

server/flake.nix

@@ -0,0 +1,24 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    home-manager = {
+      url = "github:nix-community/home-manager/release-26.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+  outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
+    nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem {
+      modules = [
+        ./configuration.nix
+        home-manager.nixosModules.home-manager
+        {
+          home-manager.useGlobalPkgs = true;
+          home-manager.useUserPackages = true;
+          home-manager.extraSpecialArgs = { inherit inputs; };
+          home-manager.users.root = ../home/server/root.nix;
+          home-manager.users.bogale = ../home/server/bogale.nix;
+        }
+      ];
+    };
+  };
+}