oracle rice

nixos/oracle/configuration.nix

@@ -2,13 +2,18 @@
 {
   imports = [
     ./hardware-configuration.nix
+    ./forgejo.nix
   ];
   boot.tmp.cleanOnBoot = true;
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
   zramSwap.enable = true;
   swapDevices = [
     {
       device = "/swapfile";
-      size = 16 * 1024;
+      size = 2 * 1024;
     }
   ];
   services = {
@@ -29,12 +34,43 @@
       overalljails = true;
     };
     tailscale.enable = true;
-    openssh.enable = true;
+    openssh = {
+      enable = true;
+      ports = [
+        2022
+      ];
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+        PermitEmptyPasswords = false;
+        UseDns = false;
+        KbdInteractiveAuthentication = false;
+        X11Forwarding = false;
+        AllowTcpForwarding = false;
+        AllowAgentForwarding = false;
+      };
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
+    };
   };
   networking = {
     domain = "";
     hostId = "81238132";
-    hostName = "iofq-oracle-x840";
+    hostName = "oracle1";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        2022
+        80
+        443
+      ];
+      logRefusedConnections = true;
+    };
   };
   users.users.root.openssh.authorizedKeys.keys = [
     ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcL53Gdrj5V9YDwKlCBIcgqiS+zHtOQpJlnOHTevJCJ e@t14''