81 lines
2.3 KiB
Nix
81 lines
2.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
{
|
|
imports = [ ../common.nix ./hardware-configuration.nix ];
|
|
boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
|
|
users.users.bogale.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
|
|
];
|
|
networking = {
|
|
hostName = "nixos-server";
|
|
networkmanager.ensureProfiles.profiles.home-wifi = {
|
|
wifi.ssid = "bogale_2.4";
|
|
wifi-security.psk = builtins.readFile "/root/secrets/home-wifi.psk";
|
|
};
|
|
firewall = {
|
|
allowedTCPPorts = [ 80 ];
|
|
extraInputRules = ''
|
|
ip saddr 192.168.1.0/24 tcp dport 22 accept
|
|
'';
|
|
};
|
|
};
|
|
#environment.systemPackages = with pkgs; [
|
|
#php
|
|
#];
|
|
services = {
|
|
postgresql.enable = true;
|
|
openssh = {
|
|
enable = true;
|
|
openFirewall = false;
|
|
settings = {
|
|
PermitRootLogin = "no";
|
|
PasswordAuthentication = false;
|
|
};
|
|
};
|
|
phpfpm.pools.main = {
|
|
user = "nginx";
|
|
group = "nginx";
|
|
settings = {
|
|
"pm" = "ondemand";
|
|
"pm.max_children" = 8;
|
|
"listen.owner" = "nginx";
|
|
"listen.group" = "nginx";
|
|
};
|
|
};
|
|
nginx = {
|
|
enable = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedBrotliSettings = true;
|
|
virtualHosts."_" = {
|
|
default = true;
|
|
root = "/srv/http/_";
|
|
locations."~ \\.php$".extraConfig = ''
|
|
fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
|
|
'';
|
|
};
|
|
};
|
|
vaultwarden = {
|
|
enable = true;
|
|
configureNginx = true;
|
|
dbBackend = "postgresql";
|
|
configurePostgres = true;
|
|
package = pkgs.vaultwarden-postgresql;
|
|
domain = "https://wg.bogaledev.ru/vault";
|
|
environmentFile = "/root/secrets/vaultwarden.env";
|
|
config = {
|
|
EMAIL_TOKEN_SIZE = 8;
|
|
SMTP_SECURITY = "off";
|
|
SMTP_HOST = "localhost";
|
|
SIGNUPS_ALLOWED = false;
|
|
REQUIRE_DEVICE_EMAIL = true;
|
|
TRASH_AUTO_DELETE_DAYS = 90;
|
|
ROCKET_ADDRESS = "127.0.0.1";
|
|
PASSWORD_HINTS_ALLOWED = false;
|
|
EMERGENCY_ACCESS_ALLOWED = false;
|
|
SMTP_FROM = "vaultwarden@bogaledev.ru";
|
|
};
|
|
};
|
|
};
|
|
}
|