Sergei Poljanski
71047d179d
Some checks failed
nixos / asxpio-services (push) Failing after 54s
Renovate now runs from its own repository for every repo, with the shared rules in its preset. Extend that preset here and keep only what is specific to this repo (the Ansible var manager, the Paper JRE, the runner and nix notes); drop the workflow that ran it for iac alone. Assisted-by: Claude:opus-5-5
125 lines
3.6 KiB
Nix
125 lines
3.6 KiB
Nix
# Shared by every server: users, SSH, baseline services.
|
|
{ lib, pkgs, ... }:
|
|
let
|
|
keys = {
|
|
asxpi-meow = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC//ljrf65xbFyGmy/xeZs5GZvkmufCioqIGYguR3c8c/Ff9HiA4oMRT53Qs16KMuXRg62NusVQvJsvyPRSARpBFsoPiZ/YNBteWlqT1aVqeZwPOfUfFycQ2T8a9qtDnZ0WhamSlJMSAHQPkxXNA6S2ZE9y+dMzMc5qPeRwdsQmuvkxjual/35t9qTgCAG7LvKCKPJkLL5YpwLoqWYWTqSJ6RxNLTYNgIhJBZirzB5rNiFDDupnOuTKSpyRJNxyBSapNge5rCnGQYIeoJ4fi+FTi5wzjlC3hC0BN4Oc/zrm1nS9lyPXQS8KV5/vcQlPrvYZmv0LneeQ/gH/jJsSlwRp2qIatoASSfTlz1y1bOOYtPFojJPikXiXeZMCdlam1II6B94z1ybOIO8TqyKDVs4eHRFfYO72zv0sGsTr7t0C7+N9Wrpmhk38zdlLagZ6HO7KSyoAHm+fQc58fXmOhz4vfYrbmYRPgO0VO03fEb7lSFPPLaSseT0tayli05irJpc= asxpi";
|
|
deploy = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTDPg3mV55lO8uBnvpcGRxJ2vMRP0qB3Pxhg+C8rwj9 asxpio-deploy";
|
|
zerrtika-workstation = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB7fAC+8PwqEb1+B523nsdxvUPcTHd3ezHTp9XVe0CP zerrtika@cult-workstation";
|
|
zerrtika-mac = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac";
|
|
};
|
|
|
|
admin = uid: sshKeys: {
|
|
inherit uid;
|
|
isNormalUser = true;
|
|
extraGroups = [
|
|
"wheel"
|
|
"docker"
|
|
];
|
|
openssh.authorizedKeys.keys = sshKeys;
|
|
};
|
|
|
|
# Shell access only from WireGuard and the private network
|
|
trustedNetworks = [
|
|
"10.20.0.0/24"
|
|
"10.10.0.0/20"
|
|
];
|
|
shellUsers = [
|
|
"asxpi"
|
|
"zerrtika"
|
|
"deploy"
|
|
"root"
|
|
];
|
|
in
|
|
{
|
|
time.timeZone = "UTC";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
# Users exist only as declared here
|
|
users.mutableUsers = false;
|
|
users.users = {
|
|
root.openssh.authorizedKeys.keys = [
|
|
keys.asxpi-meow
|
|
keys.deploy
|
|
keys.zerrtika-workstation
|
|
];
|
|
asxpi = admin 1000 [ keys.asxpi-meow ];
|
|
deploy = admin 1001 [ keys.deploy ];
|
|
zerrtika = admin 1002 [ keys.zerrtika-mac ];
|
|
};
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
openFirewall = false; # opened per interface by each host
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
PermitRootLogin = "prohibit-password";
|
|
X11Forwarding = false;
|
|
MaxAuthTries = 3;
|
|
MaxSessions = 5;
|
|
ClientAliveInterval = 300;
|
|
ClientAliveCountMax = 2;
|
|
AllowUsers = lib.mkDefault (
|
|
lib.concatMap (user: map (net: "${user}@${net}") trustedNetworks) shellUsers
|
|
);
|
|
Ciphers = [
|
|
"chacha20-poly1305@openssh.com"
|
|
"aes256-gcm@openssh.com"
|
|
"aes128-gcm@openssh.com"
|
|
"aes256-ctr"
|
|
"aes192-ctr"
|
|
"aes128-ctr"
|
|
];
|
|
Macs = [
|
|
"hmac-sha2-512-etm@openssh.com"
|
|
"hmac-sha2-256-etm@openssh.com"
|
|
"hmac-sha2-512"
|
|
"hmac-sha2-256"
|
|
];
|
|
KexAlgorithms = [
|
|
"sntrup761x25519-sha512@openssh.com"
|
|
"curve25519-sha256"
|
|
"curve25519-sha256@libssh.org"
|
|
"diffie-hellman-group-exchange-sha256"
|
|
"diffie-hellman-group16-sha512"
|
|
"diffie-hellman-group18-sha512"
|
|
];
|
|
};
|
|
};
|
|
|
|
services.fail2ban.enable = true;
|
|
services.journald.extraConfig = "SystemMaxUse=500M";
|
|
|
|
networking.firewall.enable = true;
|
|
services.resolved.llmnr = "false"; # no name resolution service on the LAN side
|
|
|
|
nix = {
|
|
settings = {
|
|
experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
trusted-users = [
|
|
"root"
|
|
"@wheel"
|
|
];
|
|
};
|
|
gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
curl
|
|
git
|
|
htop
|
|
ncdu
|
|
rclone
|
|
zstd
|
|
tree
|
|
vim
|
|
];
|
|
}
|