nix/nixos/consensus/configuration.nix

{
  lib,
  pkgs,
  config,
  ...
}:
{
  imports = [
    ./hardware-configuration.nix
    ./backups.nix
  ];
  sops = {
    secrets = {
      "env" = {
        sopsFile = ../../secrets/cf-acme.yaml;
      };
    };
  };
  documentation = {
    enable = lib.mkDefault false;
    info.enable = lib.mkDefault false;
    man.enable = lib.mkDefault false;
    nixos.enable = lib.mkDefault false;
  };
  environment.systemPackages = with pkgs; [
    git
    vim
    docker-compose
    tmux
  ];
  services = {
    # zfs.autoScrub.enable = true;
    # zfs.autoSnapshot.enable = true;
    fstrim.enable = true;
    tailscale.enable = true;
    k3s = {
      enable = true;
      role = "server";
      extraFlags = toString [
        "--disable=traefik"
      ];
    };
    fail2ban = {
      enable = true;
      maxretry = 5;
      bantime = "1h";
      ignoreIP = [
        "172.16.0.0/12"
        "192.168.0.0/16"
        "10.0.0.0/8"
        "tailc353f.ts.net"
      ];

      bantime-increment = {
        enable = true;
        multipliers = "1 2 4 8 16 32 64 128 256";
        maxtime = "24h";
        overalljails = true;
      };
    };
    openssh = {
      enable = true;
      ports = [ 2022 ];
      settings = {
        PasswordAuthentication = false;
        PermitRootLogin = "prohibit-password";
        PermitEmptyPasswords = false;
        PermitTunnel = false;
        UseDns = false;
        KbdInteractiveAuthentication = false;
        X11Forwarding = false;
        MaxAuthTries = 3;
        MaxSessions = 2;
        ClientAliveInterval = 300;
        ClientAliveCountMax = 0;
        TCPKeepAlive = false;
        AllowTcpForwarding = false;
        AllowAgentForwarding = false;
        LogLevel = "VERBOSE";
      };
      hostKeys = [
        {
          path = "/etc/ssh/ssh_host_ed25519_key";
          type = "ed25519";
        }
      ];
    };
    immich = {
      enable = false;
      port = 2283;
      host = "localhost";
      openFirewall = true;
      machine-learning.enable = true;
      mediaLocation = "/srv/immich";
    };
    nginx = {
      enable = true;
      # virtualHosts."img.10110110.xyz" = {
      #   forceSSL = true;
      #   useACMEHost = "10110110.xyz";
      #   locations."/" = {
      #     proxyPass = "http://localhost:${toString config.services.immich.port}";
      #     proxyWebsockets = true;
      #     recommendedProxySettings = true;
      #     extraConfig = ''
      #       client_max_body_size 50000M;
      #       proxy_read_timeout   600s;
      #       proxy_send_timeout   600s;
      #       send_timeout         600s;
      #     '';
      #   };
      # };
      virtualHosts."fs.10110110.xyz" = {
        forceSSL = true;
        useACMEHost = "10110110.xyz";
        root = "/var/www/nginx";
        extraConfig = "autoindex on;";
      };
    };
  };
  boot = {
    kernel.sysctl = {
      "vm.swappiness" = 6;
    };
    tmp.cleanOnBoot = true;
    # supportedFilesystems = ["zfs"];
    # zfs.forceImportRoot = false;
    # zfs.extraPools = ["rice"];
  };
  networking = {
    hostId = "91238132";
    hostName = "consensus";
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22
        80
        443
        2022
        8080
        8443
        10001
        6443
        25565
        25566
        9001
        30303
      ];
      allowedUDPPorts = [
        9001
        30303
      ];
      logRefusedConnections = true;
    };

  };
  zramSwap.enable = false;
  swapDevices = [
    {
      device = "/swapfile";
      size = 16 * 1024;
    }
  ];
  virtualisation.docker.enable = true;

  users.users = {
    root = {
      openssh.authorizedKeys.keys = [
        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
      ];
    };
    e = {
      isNormalUser = true;
      extraGroups = [ "wheel" ];
      home = "/home/e";
      openssh.authorizedKeys.keys = [
        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJou+k8HtIWdlztpWog7fVfJgxJnRIo7c5xVPUBhBxhi'' # phone
      ];
    };
  };
  security.sudo-rs.wheelNeedsPassword = false;
  security.acme = {
    acceptTerms = true;
    defaults.email = "acme@10110110.xyz";
    certs = {
      "10110110.xyz" = {
        domain = "*.10110110.xyz";
        group = config.services.nginx.group;
        dnsProvider = "cloudflare";
        environmentFile = config.sops.secrets."env".path;
      };
    };
  };
  nix.settings.trusted-users = [ "e" ];
  system.stateVersion = "23.11";
}