7 files changed, 222 insertions, 0 deletions
diff --git a/nix/configuration.nix b/nix/configuration.nix
new file mode 100644
index 0000000..96c5e48
--- /dev/null
+++ b/nix/configuration.nix
@@ -0,0 +1,31 @@
+{config, ...}: {
+  imports = [
+    ./hardware-configuration.nix
+    ./minecraft.nix
+    ./options.nix
+    ./git.nix
+    ./ssh.nix
+    ./web.nix
+  ];
+  
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      graceful = true; # TODO: drop after v261+
+    };
+    efi.canTouchEfiVariables = true;
+  };
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  networking.hostName = "chariot";
+  networking.networkmanager.enable = true;
+
+  users.users.kassouni = {
+    extraGroups = [ "wheel" ];
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = config.my.adminKeys;
+  };
+
+  system.stateVersion = "26.05";
+}
diff --git a/nix/git.nix b/nix/git.nix
new file mode 100644
index 0000000..4b3b493
--- /dev/null
+++ b/nix/git.nix
@@ -0,0 +1,51 @@
+{config, pkgs, ...}: let
+  domain = "git.kassouni.net";
+  repoRoot = "/srv/git";
+in {
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = repoRoot;
+    createHome = true;
+    homeMode = "750"; 
+    shell = "${pkgs.git}/bin/git-shell";
+    openssh.authorizedKeys.keys = config.my.gitKeys;
+  };
+  users.groups.git = { };
+
+  environment.systemPackages = [ pkgs.git ];
+
+  services.openssh.extraConfig = ''
+    Match user git
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      PermitTTY no
+  '';
+
+  services.cgit.${domain} = {
+    enable = true;
+    scanPath = repoRoot;
+    group = "git"; # so cgit can traverse a non-world-readable repoRoot
+    gitHttpBackend.checkExportOkFiles = true;
+    settings = {
+      strict-export = "git-daemon-export-ok";
+      remove-suffix = true;
+      readme = [ ":README.md" ":README" ":readme.md" ];
+      clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL";
+      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
+      about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "alex@kassouni.net";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
diff --git a/nix/hardware-configuration.nix b/nix/hardware-configuration.nix
new file mode 100644
index 0000000..321c3d1
--- /dev/null
+++ b/nix/hardware-configuration.nix
@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/39d32404-1fa3-42ef-9eb4-a2a41b532258";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/1129-26CF";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/nix/minecraft.nix b/nix/minecraft.nix
new file mode 100644
index 0000000..0022ec6
--- /dev/null
+++ b/nix/minecraft.nix
@@ -0,0 +1,54 @@
+{inputs, lib, pkgs, ...}: let
+  allowMinecraft = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
+
+  unstable = import inputs.nixpkgs-unstable {
+    inherit (pkgs.stdenv.hostPlatform) system;
+    config.allowUnfreePredicate = allowMinecraft;
+  };
+in {
+  nixpkgs.config.allowUnfreePredicate = allowMinecraft;
+
+  environment.systemPackages = [ pkgs.mcrcon ];
+
+  networking.firewall.allowedTCPPorts = [ 25565 ];
+  networking.firewall.allowedUDPPorts = [ 25565 ];
+
+  services.minecraft-server = {
+    enable = true;
+    package = unstable.minecraft-server;
+    eula = true;
+    # openFirewall would also open rcon.port, so open the game port by hand
+    openFirewall = false;
+    declarative = true;
+    whitelist = {
+      mr_5aturn = "2b811fad-e419-401e-9185-70ab279219b5";
+      CiderDonuts = "7a992778-71bc-4650-83a1-53069369481b";
+    };
+    serverProperties = {
+      server-port = 25565;
+      difficulty = "normal";
+      gamemode = "survival";
+      max-players = 5;
+      white-list = true;
+
+      enable-rcon = true;
+      "rcon.port" = 25575;
+      "rcon.password" = "mooshroom";
+    };
+    jvmOpts = "-Xms4096M -Xmx4096M";
+  };
+
+  systemd.services.minecraft-server = {
+    startLimitBurst = 5;
+    startLimitIntervalSec = 300;
+    serviceConfig = {
+      NoNewPrivileges = true;
+
+      ProtectSystem = "full";
+
+      MemoryMax = "6G";
+      TasksMax = 512;
+      RestartSec = "10s";
+    };
+  };
+}
diff --git a/nix/options.nix b/nix/options.nix
new file mode 100644
index 0000000..faaf2c8
--- /dev/null
+++ b/nix/options.nix
@@ -0,0 +1,33 @@
+{config, lib, ...}: let
+  magician = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII42yGEm1u3FxKdgox6Kkp9IBgBERVKrcIjQkrVbEO3m alex@kassouni.net";
+  hierophant = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqok+IgFuByRuoKM8HbiM919QmAVFvB2rI7ewgGsCiJ kassouni@hierophant";
+in {
+  options.my = {
+    adminKeys = lib.mkOption {
+      type = with lib.types; listOf singleLineStr;
+      description = ''
+        Keys granted an interactive shell in the wheel group, i.e. root by way
+        of sudo. Only add a key you would trust with the whole machine.
+      '';
+    };
+
+    gitKeys = lib.mkOption {
+      type = with lib.types; listOf singleLineStr;
+      description = ''
+        Keys granted git-shell access to the repositories under /srv/git.
+        No interactive shell and no sudo, so this is the list to grow when
+        someone needs to push.
+      '';
+    };
+  };
+
+  config.my = {
+    adminKeys = [ 
+      hierophant 
+      magician 
+    ];
+
+    # Admins push too; collaborator keys belong here and nowhere else.
+    gitKeys = config.my.adminKeys;
+  };
+}
diff --git a/nix/ssh.nix b/nix/ssh.nix
new file mode 100644
index 0000000..d58a2a1
--- /dev/null
+++ b/nix/ssh.nix
@@ -0,0 +1,15 @@
+{...}:{
+  services.fail2ban.enable = true;
+
+  services.openssh = {
+    enable = true;
+    authorizedKeysInHomedir = false;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "kassouni" "git" ];
+      KbdInteractiveAuthentication = false;
+      PubkeyAuthentication = true;
+    };
+  };
+}
diff --git a/nix/web.nix b/nix/web.nix
new file mode 100644
index 0000000..b34f8d8
--- /dev/null
+++ b/nix/web.nix
@@ -0,0 +1,8 @@
+{...}: {
+  # dont serve git.kassouni.net traffic to other subdomains
+  services.nginx.virtualHosts."_" = {
+    default = true;
+    rejectSSL = true;
+    locations."/".return = 444;
+  };
+}