base.nix
1# Base configuration for every standard-layout host: SSH, firewall, resolver,
2# nix GC, admin keys. Taken from moods' nix/modules/base.nix so adopting
3# infra.mymood.at changes nothing. stateVersion comes from hosts.json (per
4# host, never shared).
5{ pkgs, ... }:
6
7{
8 imports = [ ./secrets.nix ];
9
10 nix.settings = {
11 experimental-features = [ "nix-command" "flakes" ];
12 trusted-users = [ "root" ];
13 };
14 nix.gc = {
15 automatic = true;
16 dates = "weekly";
17 options = "--delete-older-than 30d";
18 };
19
20 time.timeZone = "UTC";
21 i18n.defaultLocale = "C.UTF-8";
22
23 # Admin access is root over SSH with the keys in keys/admins.pub.
24 users.users.root.openssh.authorizedKeys.keyFiles = [ ../keys/admins.pub ];
25 users.mutableUsers = false;
26
27 services.openssh = {
28 enable = true;
29 settings = {
30 PasswordAuthentication = false;
31 KbdInteractiveAuthentication = false;
32 PermitRootLogin = "prohibit-password";
33 };
34 # ed25519 only. `just new-host` pre-generates this key and pins it in
35 # hosts.json, so known_hosts never needs hand edits.
36 hostKeys = [
37 {
38 path = "/etc/ssh/ssh_host_ed25519_key";
39 type = "ed25519";
40 }
41 ];
42 };
43
44 # Sole packet filter. Roles open their own ports.
45 networking.firewall = {
46 enable = true;
47 allowedTCPPorts = [ 22 ];
48 };
49
50 # The provider module sets the provider's resolvers as DNS; Quad9 is the
51 # fallback everywhere.
52 services.resolved = {
53 enable = true;
54 settings.Resolve = {
55 FallbackDNS = [
56 "9.9.9.10"
57 "149.112.112.10"
58 ];
59 DNSSEC = "allow-downgrade";
60 LLMNR = false;
61 MulticastDNS = false;
62 };
63 };
64
65 services.journald.settings.Journal.SystemMaxUse = "2G";
66
67 environment.systemPackages = with pkgs; [
68 curl
69 jq
70 sqlite
71 htop
72 ];
73}
