ssh-agent, rspamd

common.nix

@@ -13,45 +13,72 @@
     "/boot" = { options = [ "noatime" ]; };
   };
   swapDevices = [ { device = "/var/swapfile"; } ];
-  boot.loader.limine = {
+  boot = {
-    enable = true;
+    kernelModules = [ "amneziawg" ];
-    secureBoot.enable = true;
+    kernelPackages = pkgs.linuxPackages_latest;
-  };
+    extraModulePackages = [ config.boot.kernelPackages.amneziawg ];
-  users.users = {
+    loader.limine = {
-    root = {
+      enable = true;
-      home = "/root";
+      maxGenerations = 20;
-      hashedPasswordFile = "/root/secrets/root.passwd";
+      secureBoot.enable = true;
-    };
+      panicOnChecksumMismatch = true;
-    bogale = {
-      isNormalUser = true;
-      home = "/home/bogale";
-      extraGroups = [ "wheel" ];
-      hashedPasswordFile = "/root/secrets/bogale.passwd";
     };
   };
+  users.users.root.hashedPasswordFile = "/secrets/root.passwd";
   networking = {
-    nftables.enable = true;
+    firewall = {
-    #networking.wg-quick.interfaces.awg0 = {
+      allowedTCPPorts = [ 53 80 ];
-      #type = "amneziawg";
+      allowedUDPPorts = [ 53 67 69 547 ];
-      #configFile = "/root/secrets/awg0.conf";
+    };
-    #};
+    wg-quick.interfaces.awg0 = {
+      type = "amneziawg";
+      configFile = "/secrets/awg0.conf";
+    };
     networkmanager = {
       enable = true;
-      ensureProfiles.profiles.home-wifi = {
+      ensureProfiles = {
-        wifi-security.key-mgmt = "sae";
+        environmentFiles = [ "/secrets/wifi.env" ];
-        connection = {
+        profiles.home-wifi = {
-          id = "home-wifi";
+          wifi-security.key-mgmt = "sae";
-          type = "wifi";
+          connection = {
+            id = "home-wifi";
+            type = "wifi";
+          };
         };
       };
     };
   };
   environment.systemPackages = with pkgs; [
-    amneziawg-go
-    amneziawg-tools
     sbctl
   ];
+  systemd.tmpfiles.rules = [ "d /srv/tftp 0755 root root -" ];
   services = {
     logind.settings.Login.HandleLidSwitch = "ignore";
+    nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedBrotliSettings = true;
+    };
+    dnsmasq = {
+      enable = true;
+      settings = {
+        enable-ra = true;
+        no-resolv = true;
+        cache-size = 1024;
+        bogus-priv = true;
+        enable-tftp = true;
+        interface = "enp1s0";
+        domain-needed = true;
+        tftp-root = "/srv/tftp";
+        dhcp-boot = "grubx64.efi";
+        dhcp-range = [ "10.2.0.2,10.2.255.254,12h"
+        "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ];
+        server = [ "1.0.0.1" "2606:4700:4700::1001"
+        "1.1.1.1" "2606:4700:4700::1111" ];
+      };
+    };
   };
 }

desktop/configuration.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [ ../common.nix ./hardware-configuration.nix ];
+  networking = {
+    hostName = "nixos-desktop";
+  };
+  users.users = {
+    bogale = {
+      isNormalUser = true;
+      home = "/home/bogale";
+      extraGroups = [ "wheel" ];
+      hashedPasswordFile = "/secrets/bogale.passwd";
+    };
+  };
+}

flake.lock

@@ -7,32 +7,31 @@
         ]
       },
       "locked": {
-        "lastModified": 1789267039,
+        "lastModified": 1789618856,
-        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
+        "narHash": "sha256-OSqj7eOijvCZfN7owFWRxLWRhej5lZI+Kt82q3INLvc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
+        "rev": "afa6821c70560bb19d1a8c577bff398f7f239869",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1789459628,
+        "lastModified": 1789546076,
-        "narHash": "sha256-JOaadoI/IC9qEvwlnjwAhwdcWkCDqEeOJ+cOtUH/8RQ=",
+        "narHash": "sha256-zVxLZiSnmaaPLwnhj7pwmqe3axBg/C6nG5JZsJMh2g4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b67c7a60c3732edd4b947a7df8af06215851a614",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -0,0 +1,36 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+  outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
+    nixosConfigurations = {
+      nixos-server = nixpkgs.lib.nixosSystem {
+        modules = [
+          ./server/configuration.nix
+          home-manager.nixosModules.home-manager {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = { inherit inputs; };
+            home-manager.users.root = ./home/server/root.nix;
+          }
+        ];
+      };
+      nixos-desktop = nixpkgs.lib.nixosSystem {
+        modules = [
+          ./desktop/configuration.nix
+          home-manager.nixosModules.home-manager {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = { inherit inputs; };
+            home-manager.users.root = ./home/desktop/root.nix;
+            home-manager.users.bogale = ./home/desktop/bogale.nix;
+          }
+        ];
+      };
+    };
+  };
+}

home/bogale.nix

@@ -1,6 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ./common.nix ];
-  home.username = "bogale";
-  home.homeDirectory = "/home/bogale";
-}

home/common.nix

@@ -1,6 +1,12 @@
 { config, pkgs, ... }:
 {
-  home.stateVersion = "26.05";
+  home = {
+    stateVersion = "26.05";
+    packages = with pkgs; [
+      gh
+    ];
+  };
+  services.ssh-agent.enable = true;
   programs = {
     home-manager.enable = true;
     bash = {
@@ -39,13 +45,11 @@
       extraConfig = ''
         unbind C-b
         set -g mouse on
-        set -g prefix M-d
         set -g prefix M-f
         set-option -g focus-events on
         set -s set-clipboard external
         set-option -a terminal-features "xterm-256color:RGB"
         bind f send-prefix
-        bind d send-prefix
         bind h select-pane -L
         bind j select-pane -D
         bind k select-pane -U

home/desktop/bogale.nix

@@ -0,0 +1,8 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ../common.nix ];
+  home = {
+    username = "bogale";
+    homeDirectory = "/home/bogale";
+  };
+}

home/desktop/root.nix

@@ -0,0 +1,8 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ../common.nix ];
+  home = {
+    username = "root";
+    homeDirectory = "/root";
+  };
+}

home/root.nix

@@ -1,6 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ./common.nix ];
-  home.username = "root";
-  home.homeDirectory = "/root";
-}

home/server/bogale.nix

@@ -1,4 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ../bogale.nix ];
-}

home/server/root.nix

@@ -1,7 +1,8 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../root.nix ];
+  imports = [ ../common.nix ];
-  programs.bash = {
+  home = {
-    shellAliases = { "nixos-rebuild" = "nixos-rebuild --impure --flake /etc/nixos/server#nixos-server"; };
+    username = "root";
+    homeDirectory = "/root";
   };
 }

marks

@@ -12,4 +12,6 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
 systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
 
 todo:
-- lanzaboote
+- gitea, mediawiki
+- email tracking
+- redirect randomizer

server/configuration.nix

@@ -2,35 +2,200 @@
 {
   imports = [ ../common.nix ./hardware-configuration.nix ];
   boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
+  users = {
+    groups.vmail.gid = 1819;
+    users = {
+      nginx.extraGroups = [ "acme" ];
+      root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
+      vmail = {
+        uid = 1819;
+        group = "vmail";
+        isSystemUser = true;
+      };
+    };
+  };
   networking = {
     hostName = "nixos-server";
+    firewall = {
+      allowedTCPPorts = [ 25 443 587 993 ];
+      allowedUDPPorts = [ 443 ];
+    };
     networkmanager.ensureProfiles.profiles.home-wifi = {
       wifi.ssid = "bogale_2.4";
-      wifi-security.psk = builtins.readFile "/root/secrets/home-wifi.psk";
+      wifi-security.psk = "$BOGALE_2_4_PSK";
+      ipv4 = {
+        method = "manual";
+        gateway = "10.1.0.1";
+        addresses = "10.1.0.2/16";
+      };
+      ipv6 = {
+        method = "manual";
+        gateway = "fc01::1";
+        addresses = "fc01::2/64";
+      };
     };
-    firewall = {
+  };
-      allowedTCPPorts = [ 80 ];
+  security.acme = {
-      extraInputRules = ''
+    acceptTerms = true;
-        ip saddr 192.168.1.0/24 tcp dport 22 accept
+    defaults.email = "letsencrypt@bogaledev.ru";
+    certs."bogaledev.ru" = {
+      validMinDays = 3;
+      dnsProvider = "cloudflare";
+      extraDomainNames = [ "*.bogaledev.ru" ];
+      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
+      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
+    };
+  };
+  systemd = {
+    tmpfiles.rules = [
+      "d /var/spool/postfix 0755 postfix postfix -"
+      "d /var/spool/postfix/private 0755 postfix postfix -"
+    ];
+    timers.network-watchdog = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = 5;
+        AccuracySec = 1;
+        OnUnitActiveSec = 5;
+        Unit = "network-watchdog.service";
+      };
+    };
+    services.network-watchdog = {
+      path = [ pkgs.iputils ];
+      serviceConfig = {
+        Type = "oneshot";
+        LogLevelMax = "notice";
+      };
+      script = ''
+        if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
+          failures=0
+        else
+          failures=$(($(cat /run/network.failures)+1))
+          if [ $failures -ge 3 ]; then
+            systemctl restart NetworkManager.service
+            failures=0
+          fi
+        fi
+        echo $failures > /run/network.failures
+        if [ $failures -ge 0 ]; then
+          echo "<5>failures = $failures"
+        fi
       '';
     };
   };
-  services = {
+  services = let
+    saslSocket = "/var/spool/postfix/private/auth";
+    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
+  in {
     openssh = {
       enable = true;
-      openFirewall = false;
+      settings.PasswordAuthentication = false;
     };
-    nginx = {
+    postgresql.enable = true;
+    phpfpm.pools.main = {
+      user = "nginx";
+      group = "nginx";
+      settings = {
+        "pm" = "ondemand";
+        "pm.max_children" = 8;
+        "listen.owner" = "nginx";
+        "listen.group" = "nginx";
+      };
+    };
+    vaultwarden = {
       enable = true;
-      virtualHosts."_".default = true;
+      dbBackend = "postgresql";
-      virtualHosts."_" = {
+      configurePostgres = true;
-        locations."/" = {
+      package = pkgs.vaultwarden-postgresql;
-          return = "200 '<html><body>It works</body></html>'";
+      environmentFile = "/secrets/vaultwarden.env";
+      config = {
+        SIGNUPS_ALLOWED = false;
+        TRASH_AUTO_DELETE_DAYS = 90;
+        PASSWORD_HINTS_ALLOWED = false;
+        EMERGENCY_ACCESS_ALLOWED = false;
+        DOMAIN = "https://bogaledev.ru/vw";
+      };
+    };
+    nginx.virtualHosts."bogaledev.ru" = {
+      quic = true;
+      default = true;
+      forceSSL = true;
+      root = "/srv/http";
+      useACMEHost = "bogaledev.ru";
+      extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
+      locations = {
+        "/".index = "index.php index.html";
+        "~ \\.php$".extraConfig = ''
+          fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
+        '';
+        "/vw" = {
+          proxyPass = "http://127.0.0.1:8000";
+          proxyWebsockets = true;
           extraConfig = ''
-            default_type text/html;
+            allow fc00::/64;
+            allow fc01::/64;
+            allow 10.0.0.0/24;
+            allow 10.1.0.0/24;
+            deny all;
           '';
         };
       };
     };
+    rspamd = {
+      enable = true;
+      postfix.enable = true;
+    };
+    dovecot2 = {
+      enable = true;
+      settings = {
+        ssl = "required";
+        mail_gid = "vmail";
+        mail_uid = "vmail";
+        protocols.imap = true;
+        mail_driver = "maildir";
+        auth_mechanisms = [ "plain" ];
+        dovecot_storage_version = "2.4.5";
+        mail_path = "/var/spool/mail/vmail";
+        ssl_server_key_file = "${sslCertDir}/key.pem";
+        ssl_server_cert_file = "${sslCertDir}/fullchain.pem";
+        dovecot_config_version = config.services.dovecot2.package.version;
+        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd";
+        "service auth"."unix_listener ${saslSocket}" = {
+          mode = "0660";
+          user = "postfix";
+          group = "postfix";
+        };
+      };
+    };
+    postfix = {
+      enable = true;
+      enableSubmission = true;
+      virtualMapType = "regexp";
+      virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru";
+      mapFiles = {
+        smtp_passwd = "/secrets/smtp_passwd";
+        mailbox = pkgs.writeText "mailbox" "mail@bogaledev.ru /";
+      };
+      settings.main = {
+        smtpd_sasl_type = "dovecot";
+        smtpd_sasl_path = saslSocket;
+        smtp_sasl_auth_enable = "yes";
+        smtpd_sasl_auth_enable = "yes";
+        virtual_uid_maps = "static:1819";
+        virtual_gid_maps = "static:1819";
+        smtp_tls_security_level = "encrypt";
+        smtpd_tls_security_level = "encrypt";
+        relayhost = [ "smtp.resend.com:2587" ];
+        virtual_mailbox_domains = "bogaledev.ru";
+        virtual_mailbox_base = "/var/spool/mail/vmail";
+        smtp_sasl_tls_security_options = "noanonymous";
+        virtual_mailbox_maps = "hash:/etc/postfix/mailbox";
+        smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";
+        smtpd_tls_chain_files = [
+          "${sslCertDir}/key.pem"
+          "${sslCertDir}/fullchain.pem"
+        ];
+      };
+    };
   };
 }

server/flake.nix

@@ -1,24 +0,0 @@
-{
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-    home-manager = {
-      url = "github:nix-community/home-manager/release-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-  outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
-    nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem {
-      modules = [
-        ./configuration.nix
-        home-manager.nixosModules.home-manager
-        {
-          home-manager.useGlobalPkgs = true;
-          home-manager.useUserPackages = true;
-          home-manager.extraSpecialArgs = { inherit inputs; };
-          home-manager.users.root = ../home/server/root.nix;
-          home-manager.users.bogale = ../home/server/bogale.nix;
-        }
-      ];
-    };
-  };
-}