iofq/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sept rice

Browse source
This commit is contained in:
iofq 2025-08-03 10:38:37 -05:00
parent 89ab499605
commit 66ba28aaf3
12 changed files with 572 additions and 293 deletions
Download patch file Download diff file Expand all files Collapse all files

55
nixos/consensus/configuration.nix
View file

@ -3,14 +3,17 @@
pkgs,
config,
...
}: {
}:
{
imports = [
./hardware-configuration.nix
./backups.nix
];
sops = {
secrets = {
"env" = {sopsFile = ../../secrets/cf-acme.yaml;};
"env" = {
sopsFile = ../../secrets/cf-acme.yaml;
};
};
};
documentation = {
@ -55,7 +58,7 @@
};
openssh = {
enable = true;
ports = [2022];
ports = [ 2022 ];
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
@ -81,19 +84,19 @@
];
};
immich = {
# enable = true;
enable = false;
port = 2283;
host = "localhost";
openFirewall = true;
machine-learning.enable = true;
mediaLocation = "/rice/immich";
mediaLocation = "/srv/immich";
};
nginx = {
enable = true;
virtualHosts."img.10110110.xyz" = {
useACMEHost = "10110110.xyz";
forceSSL = true;
enable = false;
virtualHosts."img.consensus.tailc353f.ts.net" = {
# forceSSL = true;
# sslCertificate = "/etc/nginx/certs/consensus.tailc353f.ts.net.crt";
# sslCertificateKey = "/etc/nginx/certs/consensus.tailc353f.ts.net.key";
locations."/" = {
proxyPass = "http://localhost:${toString config.services.immich.port}";
proxyWebsockets = true;
@ -145,31 +148,33 @@
};
users.users = {
root = {
openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
];
};
e = {
isNormalUser = true;
extraGroups = ["wheel"];
extraGroups = [ "wheel" ];
home = "/home/e";
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdo4PS8myKaKAdyIqSFj2VJ+oZ9DNRIp7PBz8IWKjjy''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJou+k8HtIWdlztpWog7fVfJgxJnRIo7c5xVPUBhBxhi'' # phone
];
};
};
security.sudo-rs.wheelNeedsPassword = false;
security.acme = {
acceptTerms = true;
defaults.email = "acme@10110110.xyz";
certs = {
"10110110.xyz" = {
domain = "*.10110110.xyz";
group = config.services.nginx.group;
dnsProvider = "cloudflare";
environmentFile = config.sops.secrets."env".path;
};
};
};
nix.settings.trusted-users = ["e"];
# security.acme = {
# acceptTerms = true;
# defaults.email = "acme@10110110.xyz";
# certs = {
# "10110110.xyz" = {
# domain = "*.10110110.xyz";
# group = config.services.nginx.group;
# dnsProvider = "cloudflare";
# environmentFile = config.sops.secrets."env".path;
# };
# };
# };
nix.settings.trusted-users = [ "e" ];
system.stateVersion = "23.11";
}