153 lines
3.0 KiB
Nix
153 lines
3.0 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
./modules/atproto-pds.nix
|
|
./modules/wafrn.nix
|
|
./modules/cloudflare.nix
|
|
./modules/tangled.nix
|
|
../../modules/force.nix
|
|
./modules/gitea.nix
|
|
./modules/vaultwarden.nix
|
|
./slop/openclaw.nix
|
|
./slop/brave.nix
|
|
];
|
|
|
|
# gcc. shit breaks. wtf
|
|
environment.sessionVariables.LD_LIBRARY_PATH = "${pkgs.gcc15}/lib";
|
|
|
|
services.vscode-server.enable = true;
|
|
|
|
systemd.services.ocbwoy3-start-pm2 = {
|
|
enable = true;
|
|
description = "Start PM2";
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "forking";
|
|
User = "ocbwoy3";
|
|
LimitNOFILE = "infinity";
|
|
LimitNPROC = "infinity";
|
|
LimitCORE = "infinity";
|
|
Environment = "PM2_HOME=/home/ocbwoy3/.pm2";
|
|
PIDFile = "/home/ocbwoy3/.pm2/pm2.pid";
|
|
Restart = "on-failure";
|
|
|
|
ExecStart = "${pkgs.pm2}/bin/pm2 resurrect";
|
|
ExecReload = "${pkgs.pm2}/bin/pm2 reload all";
|
|
ExecStop = "${pkgs.pm2}/bin/pm2 kill";
|
|
};
|
|
};
|
|
|
|
services.openssh.settings = lib.mkDefault {
|
|
PubkeyAuthentication = "yes";
|
|
TrustedUserCAKeys = "/etc/ssh/ca.pub";
|
|
PermitRootLogin = lib.mkDefault "prohibit-password";
|
|
KbdInteractiveAuthentication = lib.mkDefault false;
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = lib.mkForce true;
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
fastfetch
|
|
hyfetch
|
|
pm2
|
|
steam-run
|
|
opencode
|
|
bun
|
|
nodejs
|
|
node-gyp
|
|
playwright
|
|
chromium
|
|
brave
|
|
(pkgs.callPackage ./slop/rocksky-cli.nix { })
|
|
];
|
|
|
|
users.users.ocbwoy3 = {
|
|
initialPassword = "thisisapassword42069!"; # not the type passwords i use
|
|
isNormalUser = true;
|
|
extraGroups = [
|
|
"wheel"
|
|
"networkmanager"
|
|
"docker"
|
|
];
|
|
shell = pkgs.zsh;
|
|
};
|
|
|
|
virtualisation.docker = {
|
|
enable = true;
|
|
daemon.settings = {
|
|
"log-driver" = "local";
|
|
"log-opts" = {
|
|
"max-size" = "10m";
|
|
"max-file" = "3";
|
|
};
|
|
"live-restore" = true;
|
|
};
|
|
};
|
|
|
|
systemd.services.docker.serviceConfig = {
|
|
CPUQuota = "200%";
|
|
MemoryMax = "12G";
|
|
};
|
|
|
|
services.mongodb = {
|
|
enable = true;
|
|
enableAuth = false;
|
|
package = pkgs.mongodb-ce;
|
|
replSetName = "rs0"; # dangerous
|
|
bind_ip = "0.0.0.0";
|
|
};
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
22
|
|
443
|
|
3000
|
|
3001
|
|
4067
|
|
8080
|
|
25565
|
|
];
|
|
allowedUDPPorts = [
|
|
22
|
|
443
|
|
3000
|
|
3001
|
|
4067
|
|
8080
|
|
25565
|
|
];
|
|
};
|
|
|
|
# Lock /etc/nixos to read-only mode (config lives in /home/ocbwoy3/config).
|
|
systemd.tmpfiles.rules = [
|
|
"z /etc/nixos 0555 root root - -"
|
|
];
|
|
|
|
# Force resolver config to Cloudflare only.
|
|
networking.nameservers = lib.mkForce [ "1.1.1.1" "1.0.0.1" ];
|
|
environment.etc."resolv.conf".text = lib.mkForce ''
|
|
nameserver 1.1.1.1
|
|
nameserver 1.0.0.1
|
|
'';
|
|
|
|
catppuccin = {
|
|
enable = true;
|
|
flavor = "mocha";
|
|
accent = "blue";
|
|
gitea.enable = false;
|
|
};
|
|
|
|
system.stateVersion = "23.05"; # DO NOT TOUCH
|
|
|
|
}
|