From e037e164c5c45ff33525d0c8575e8d9e0315ac7b Mon Sep 17 00:00:00 2001 From: Alexander Kassouni Date: Sun, 27 Sep 2026 22:07:56 -0700 Subject: move nix modules --- configuration.nix | 31 ------------------------ git.nix | 51 --------------------------------------- hardware-configuration.nix | 30 ----------------------- minecraft.nix | 54 ------------------------------------------ nix/configuration.nix | 31 ++++++++++++++++++++++++ nix/git.nix | 51 +++++++++++++++++++++++++++++++++++++++ nix/hardware-configuration.nix | 30 +++++++++++++++++++++++ nix/minecraft.nix | 54 ++++++++++++++++++++++++++++++++++++++++++ nix/options.nix | 33 ++++++++++++++++++++++++++ nix/ssh.nix | 15 ++++++++++++ nix/web.nix | 8 +++++++ options.nix | 33 -------------------------- ssh.nix | 15 ------------ web.nix | 8 ------- 14 files changed, 222 insertions(+), 222 deletions(-) delete mode 100644 configuration.nix delete mode 100644 git.nix delete mode 100644 hardware-configuration.nix delete mode 100644 minecraft.nix create mode 100644 nix/configuration.nix create mode 100644 nix/git.nix create mode 100644 nix/hardware-configuration.nix create mode 100644 nix/minecraft.nix create mode 100644 nix/options.nix create mode 100644 nix/ssh.nix create mode 100644 nix/web.nix delete mode 100644 options.nix delete mode 100644 ssh.nix delete mode 100644 web.nix diff --git a/configuration.nix b/configuration.nix deleted file mode 100644 index 96c5e48..0000000 --- a/configuration.nix +++ /dev/null @@ -1,31 +0,0 @@ -{config, ...}: { - imports = [ - ./hardware-configuration.nix - ./minecraft.nix - ./options.nix - ./git.nix - ./ssh.nix - ./web.nix - ]; - - boot.loader = { - systemd-boot = { - enable = true; - graceful = true; # TODO: drop after v261+ - }; - efi.canTouchEfiVariables = true; - }; - - nix.settings.experimental-features = [ "nix-command" "flakes" ]; - - networking.hostName = "chariot"; - networking.networkmanager.enable = true; - - users.users.kassouni = { - extraGroups = [ "wheel" ]; - isNormalUser = true; - openssh.authorizedKeys.keys = config.my.adminKeys; - }; - - system.stateVersion = "26.05"; -} diff --git a/git.nix b/git.nix deleted file mode 100644 index 4b3b493..0000000 --- a/git.nix +++ /dev/null @@ -1,51 +0,0 @@ -{config, pkgs, ...}: let - domain = "git.kassouni.net"; - repoRoot = "/srv/git"; -in { - users.users.git = { - isSystemUser = true; - group = "git"; - home = repoRoot; - createHome = true; - homeMode = "750"; - shell = "${pkgs.git}/bin/git-shell"; - openssh.authorizedKeys.keys = config.my.gitKeys; - }; - users.groups.git = { }; - - environment.systemPackages = [ pkgs.git ]; - - services.openssh.extraConfig = '' - Match user git - AllowTcpForwarding no - AllowAgentForwarding no - PermitTTY no - ''; - - services.cgit.${domain} = { - enable = true; - scanPath = repoRoot; - group = "git"; # so cgit can traverse a non-world-readable repoRoot - gitHttpBackend.checkExportOkFiles = true; - settings = { - strict-export = "git-daemon-export-ok"; - remove-suffix = true; - readme = [ ":README.md" ":README" ":readme.md" ]; - clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL"; - source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py"; - about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh"; - }; - }; - - services.nginx.virtualHosts.${domain} = { - forceSSL = true; - enableACME = true; - }; - - security.acme = { - acceptTerms = true; - defaults.email = "alex@kassouni.net"; - }; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; -} diff --git a/hardware-configuration.nix b/hardware-configuration.nix deleted file mode 100644 index 321c3d1..0000000 --- a/hardware-configuration.nix +++ /dev/null @@ -1,30 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; - - boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/39d32404-1fa3-42ef-9eb4-a2a41b532258"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/1129-26CF"; - fsType = "vfat"; - options = [ "fmask=0022" "dmask=0022" ]; - }; - - swapDevices = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; -} diff --git a/minecraft.nix b/minecraft.nix deleted file mode 100644 index 0022ec6..0000000 --- a/minecraft.nix +++ /dev/null @@ -1,54 +0,0 @@ -{inputs, lib, pkgs, ...}: let - allowMinecraft = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ]; - - unstable = import inputs.nixpkgs-unstable { - inherit (pkgs.stdenv.hostPlatform) system; - config.allowUnfreePredicate = allowMinecraft; - }; -in { - nixpkgs.config.allowUnfreePredicate = allowMinecraft; - - environment.systemPackages = [ pkgs.mcrcon ]; - - networking.firewall.allowedTCPPorts = [ 25565 ]; - networking.firewall.allowedUDPPorts = [ 25565 ]; - - services.minecraft-server = { - enable = true; - package = unstable.minecraft-server; - eula = true; - # openFirewall would also open rcon.port, so open the game port by hand - openFirewall = false; - declarative = true; - whitelist = { - mr_5aturn = "2b811fad-e419-401e-9185-70ab279219b5"; - CiderDonuts = "7a992778-71bc-4650-83a1-53069369481b"; - }; - serverProperties = { - server-port = 25565; - difficulty = "normal"; - gamemode = "survival"; - max-players = 5; - white-list = true; - - enable-rcon = true; - "rcon.port" = 25575; - "rcon.password" = "mooshroom"; - }; - jvmOpts = "-Xms4096M -Xmx4096M"; - }; - - systemd.services.minecraft-server = { - startLimitBurst = 5; - startLimitIntervalSec = 300; - serviceConfig = { - NoNewPrivileges = true; - - ProtectSystem = "full"; - - MemoryMax = "6G"; - TasksMax = 512; - RestartSec = "10s"; - }; - }; -} diff --git a/nix/configuration.nix b/nix/configuration.nix new file mode 100644 index 0000000..96c5e48 --- /dev/null +++ b/nix/configuration.nix @@ -0,0 +1,31 @@ +{config, ...}: { + imports = [ + ./hardware-configuration.nix + ./minecraft.nix + ./options.nix + ./git.nix + ./ssh.nix + ./web.nix + ]; + + boot.loader = { + systemd-boot = { + enable = true; + graceful = true; # TODO: drop after v261+ + }; + efi.canTouchEfiVariables = true; + }; + + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + + networking.hostName = "chariot"; + networking.networkmanager.enable = true; + + users.users.kassouni = { + extraGroups = [ "wheel" ]; + isNormalUser = true; + openssh.authorizedKeys.keys = config.my.adminKeys; + }; + + system.stateVersion = "26.05"; +} diff --git a/nix/git.nix b/nix/git.nix new file mode 100644 index 0000000..4b3b493 --- /dev/null +++ b/nix/git.nix @@ -0,0 +1,51 @@ +{config, pkgs, ...}: let + domain = "git.kassouni.net"; + repoRoot = "/srv/git"; +in { + users.users.git = { + isSystemUser = true; + group = "git"; + home = repoRoot; + createHome = true; + homeMode = "750"; + shell = "${pkgs.git}/bin/git-shell"; + openssh.authorizedKeys.keys = config.my.gitKeys; + }; + users.groups.git = { }; + + environment.systemPackages = [ pkgs.git ]; + + services.openssh.extraConfig = '' + Match user git + AllowTcpForwarding no + AllowAgentForwarding no + PermitTTY no + ''; + + services.cgit.${domain} = { + enable = true; + scanPath = repoRoot; + group = "git"; # so cgit can traverse a non-world-readable repoRoot + gitHttpBackend.checkExportOkFiles = true; + settings = { + strict-export = "git-daemon-export-ok"; + remove-suffix = true; + readme = [ ":README.md" ":README" ":readme.md" ]; + clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL"; + source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py"; + about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh"; + }; + }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + }; + + security.acme = { + acceptTerms = true; + defaults.email = "alex@kassouni.net"; + }; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; +} diff --git a/nix/hardware-configuration.nix b/nix/hardware-configuration.nix new file mode 100644 index 0000000..321c3d1 --- /dev/null +++ b/nix/hardware-configuration.nix @@ -0,0 +1,30 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/39d32404-1fa3-42ef-9eb4-a2a41b532258"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/1129-26CF"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nix/minecraft.nix b/nix/minecraft.nix new file mode 100644 index 0000000..0022ec6 --- /dev/null +++ b/nix/minecraft.nix @@ -0,0 +1,54 @@ +{inputs, lib, pkgs, ...}: let + allowMinecraft = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ]; + + unstable = import inputs.nixpkgs-unstable { + inherit (pkgs.stdenv.hostPlatform) system; + config.allowUnfreePredicate = allowMinecraft; + }; +in { + nixpkgs.config.allowUnfreePredicate = allowMinecraft; + + environment.systemPackages = [ pkgs.mcrcon ]; + + networking.firewall.allowedTCPPorts = [ 25565 ]; + networking.firewall.allowedUDPPorts = [ 25565 ]; + + services.minecraft-server = { + enable = true; + package = unstable.minecraft-server; + eula = true; + # openFirewall would also open rcon.port, so open the game port by hand + openFirewall = false; + declarative = true; + whitelist = { + mr_5aturn = "2b811fad-e419-401e-9185-70ab279219b5"; + CiderDonuts = "7a992778-71bc-4650-83a1-53069369481b"; + }; + serverProperties = { + server-port = 25565; + difficulty = "normal"; + gamemode = "survival"; + max-players = 5; + white-list = true; + + enable-rcon = true; + "rcon.port" = 25575; + "rcon.password" = "mooshroom"; + }; + jvmOpts = "-Xms4096M -Xmx4096M"; + }; + + systemd.services.minecraft-server = { + startLimitBurst = 5; + startLimitIntervalSec = 300; + serviceConfig = { + NoNewPrivileges = true; + + ProtectSystem = "full"; + + MemoryMax = "6G"; + TasksMax = 512; + RestartSec = "10s"; + }; + }; +} diff --git a/nix/options.nix b/nix/options.nix new file mode 100644 index 0000000..faaf2c8 --- /dev/null +++ b/nix/options.nix @@ -0,0 +1,33 @@ +{config, lib, ...}: let + magician = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII42yGEm1u3FxKdgox6Kkp9IBgBERVKrcIjQkrVbEO3m alex@kassouni.net"; + hierophant = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqok+IgFuByRuoKM8HbiM919QmAVFvB2rI7ewgGsCiJ kassouni@hierophant"; +in { + options.my = { + adminKeys = lib.mkOption { + type = with lib.types; listOf singleLineStr; + description = '' + Keys granted an interactive shell in the wheel group, i.e. root by way + of sudo. Only add a key you would trust with the whole machine. + ''; + }; + + gitKeys = lib.mkOption { + type = with lib.types; listOf singleLineStr; + description = '' + Keys granted git-shell access to the repositories under /srv/git. + No interactive shell and no sudo, so this is the list to grow when + someone needs to push. + ''; + }; + }; + + config.my = { + adminKeys = [ + hierophant + magician + ]; + + # Admins push too; collaborator keys belong here and nowhere else. + gitKeys = config.my.adminKeys; + }; +} diff --git a/nix/ssh.nix b/nix/ssh.nix new file mode 100644 index 0000000..d58a2a1 --- /dev/null +++ b/nix/ssh.nix @@ -0,0 +1,15 @@ +{...}:{ + services.fail2ban.enable = true; + + services.openssh = { + enable = true; + authorizedKeysInHomedir = false; + settings = { + PasswordAuthentication = false; + PermitRootLogin = "no"; + AllowUsers = [ "kassouni" "git" ]; + KbdInteractiveAuthentication = false; + PubkeyAuthentication = true; + }; + }; +} diff --git a/nix/web.nix b/nix/web.nix new file mode 100644 index 0000000..b34f8d8 --- /dev/null +++ b/nix/web.nix @@ -0,0 +1,8 @@ +{...}: { + # dont serve git.kassouni.net traffic to other subdomains + services.nginx.virtualHosts."_" = { + default = true; + rejectSSL = true; + locations."/".return = 444; + }; +} diff --git a/options.nix b/options.nix deleted file mode 100644 index faaf2c8..0000000 --- a/options.nix +++ /dev/null @@ -1,33 +0,0 @@ -{config, lib, ...}: let - magician = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII42yGEm1u3FxKdgox6Kkp9IBgBERVKrcIjQkrVbEO3m alex@kassouni.net"; - hierophant = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqok+IgFuByRuoKM8HbiM919QmAVFvB2rI7ewgGsCiJ kassouni@hierophant"; -in { - options.my = { - adminKeys = lib.mkOption { - type = with lib.types; listOf singleLineStr; - description = '' - Keys granted an interactive shell in the wheel group, i.e. root by way - of sudo. Only add a key you would trust with the whole machine. - ''; - }; - - gitKeys = lib.mkOption { - type = with lib.types; listOf singleLineStr; - description = '' - Keys granted git-shell access to the repositories under /srv/git. - No interactive shell and no sudo, so this is the list to grow when - someone needs to push. - ''; - }; - }; - - config.my = { - adminKeys = [ - hierophant - magician - ]; - - # Admins push too; collaborator keys belong here and nowhere else. - gitKeys = config.my.adminKeys; - }; -} diff --git a/ssh.nix b/ssh.nix deleted file mode 100644 index d58a2a1..0000000 --- a/ssh.nix +++ /dev/null @@ -1,15 +0,0 @@ -{...}:{ - services.fail2ban.enable = true; - - services.openssh = { - enable = true; - authorizedKeysInHomedir = false; - settings = { - PasswordAuthentication = false; - PermitRootLogin = "no"; - AllowUsers = [ "kassouni" "git" ]; - KbdInteractiveAuthentication = false; - PubkeyAuthentication = true; - }; - }; -} diff --git a/web.nix b/web.nix deleted file mode 100644 index b34f8d8..0000000 --- a/web.nix +++ /dev/null @@ -1,8 +0,0 @@ -{...}: { - # dont serve git.kassouni.net traffic to other subdomains - services.nginx.virtualHosts."_" = { - default = true; - rejectSSL = true; - locations."/".return = 444; - }; -} -- cgit v1.3.1