nix-server/configuration.nix at main · nikil0dion/nix-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
{ config, lib, pkgs, modulesPath, ... }:

{
  imports = [
    "${modulesPath}/profiles/minimal.nix"
    "${modulesPath}/profiles/headless.nix"
    "${modulesPath}/profiles/perlless.nix"  # -242MB  delete Perl/Python
  ];

  # Boot - systemd-boot
  boot.loader = {
    systemd-boot.enable = true;
    efi.canTouchEfiVariables = true;
  };

  # Network
  networking = {
    hostName = "server";
    useDHCP = true;
    firewall = {
      enable = true;
      allowedTCPPorts = [ 22 ];
    };
  };

  # SSH
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "prohibit-password";
      PasswordAuthentication = false;
    };
  };

  # User
  users.users.deploy = {
    isNormalUser = true;
    extraGroups = [ "docker" ];
    openssh.authorizedKeys.keys = [
      # "ssh-ed25519 AAAA..."
    ];
  };

  security.sudo.enable = false;

  nix.settings.allowed-users = [ "root" ];

  # No udev - no hotplug on VPS
  services.udev.enable = false;

  # No LVM
  services.lvm.enable = false;
  boot.initrd.services.lvm.enable = false;

  # Tailscale
  services.tailscale.enable = true;
  networking.firewall.trustedInterfaces = [ "tailscale0" ];

  # Docker
  virtualisation.docker = {
    enable = true;
    autoPrune.enable = true;
  };

  environment.variables.BAT_THEME = "ansi";

  environment.systemPackages = with pkgs; [
    # core
    git
    curl

    # files
    bat
    fd
    ripgrep
    eza

    # system
    btop
    dust
    duf

    # docker
    lazydocker
  ];

  programs.bash = {
    interactiveShellInit = ''
      # prompt: root=red, user=green
      if [ "$UID" -eq 0 ]; then
        PS1='\[\e[31m\]\u@\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]# '
      else
        PS1='\[\e[32m\]\u@\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]$ '
      fi

      alias ls='eza'
      alias ll='eza -la'
      alias cat='bat --paging=never'
      alias grep='rg'
      alias find='fd'
      alias dc='docker compose'
      alias dps='docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"'
    '';
  };

  documentation.enable = false;
  programs.command-not-found.enable = false;

  # Timezone
  time.timeZone = "UTC";

  system.stateVersion = "25.11";
}