Skip to content

Commit 0496d43

Browse files
kclejeunekclejeune
authored
add gateway-nixos + hetzner machine config (#413)
* add nixos gateway device + hetzner config * harden ssh config * move 1pw config out of shared server * limit resources to avoid throttling hetzner machines * fix nftables rules, drop ffmpeg-full * monkeypatch hetzner ipv6 detection
1 parent ee4dba2 commit 0496d43

File tree

8 files changed

+298
-104
lines changed

8 files changed

+298
-104
lines changed

‎flake.nix‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,20 @@
196196
./modules/hardware/phil.nix
197197
inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t460s
198198
];
199-
extraModules = [ ./profiles/personal ];
199+
extraModules = [
200+
./modules/nixos/desktop.nix
201+
./profiles/personal
202+
];
203+
};
204+
gateway = mkNixosConfig {
205+
system = "x86_64-linux";
206+
hardwareModules = [
207+
./modules/nixos/hetzner.nix
208+
];
209+
extraModules = [
210+
./modules/nixos/gateway.nix
211+
./profiles/personal
212+
];
200213
};
201214
}
202215
];

‎modules/common.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@
3232
hm = {
3333
imports = [
3434
./home-manager
35-
./home-manager/1password.nix
3635
];
3736
};
3837

‎modules/darwin/default.nix‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@
3838
};
3939
};
4040

41+
hm.imports = [ ../home-manager/1password.nix ];
42+
4143
hm.home.sessionVariables = {
4244
SDKROOT = "$(xcrun --show-sdk-path)";
4345
};

‎modules/home-manager/default.nix‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
./tldr.nix
2020
./tmux.nix
2121
./yazi
22-
./gnome.nix
2322
./nixpkgs.nix
2423
];
2524

@@ -66,7 +65,7 @@
6665
doxx
6766
dust
6867
fd
69-
ffmpeg-full
68+
ffmpeg
7069
findutils
7170
flamegraph
7271
flamelens

‎modules/nixos/default.nix‎

Lines changed: 0 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
{
77
# bundles essential nixos modules
88
imports = [
9-
./keybase.nix
109
../common.nix
1110
];
1211

@@ -22,116 +21,17 @@
2221
keep-derivations = true;
2322
};
2423

25-
services.syncthing = {
26-
enable = true;
27-
user = config.user.name;
28-
group = "users";
29-
openDefaultPorts = true;
30-
dataDir = config.user.home;
31-
};
32-
33-
environment.systemPackages = with pkgs; [
34-
vscode
35-
brave
36-
gnome-tweaks
37-
];
38-
39-
hm =
40-
{ ... }:
41-
{
42-
imports = [ ../home-manager/gnome.nix ];
43-
};
44-
45-
# Define a user account. Don't forget to set a password with ‘passwd’.
4624
users = {
4725
defaultUserShell = pkgs.zsh;
48-
mutableUsers = false;
49-
users = {
50-
"${config.user.name}" = {
51-
isNormalUser = true;
52-
extraGroups = [
53-
"sudo"
54-
"wheel"
55-
"networkmanager"
56-
]; # Enable ‘sudo’ for the user.
57-
hashedPassword = "$6$1kR9R2U/NA0.$thN8N2sTo7odYaoLhipeuu5Ic4CS7hKDt1Q6ClP9y0I3eVMaFmo.dZNpPfdwNitkElkaLwDVsGpDuM2SO2GqP/";
58-
};
59-
};
6026
};
6127

62-
networking.hostName = "Phil"; # Define your hostname.
63-
networking.networkmanager.enable = true;
64-
65-
# Use the GRUB 2 boot loader.
66-
boot.loader.grub.enable = true;
67-
# Define on which hard drive you want to install Grub.
68-
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
69-
# boot.loader.grub.efiSupport = true;
70-
# boot.loader.grub.efiInstallAsRemovable = true;
71-
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
72-
73-
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
74-
# Per-interface useDHCP will be mandatory in the future, so this generated config
75-
# replicates the default behaviour.
76-
networking.useDHCP = false;
77-
networking.interfaces.enp0s31f6.useDHCP = true;
78-
networking.interfaces.wlp4s0.useDHCP = true;
79-
80-
# Configure network proxy if necessary
81-
# networking.proxy.default = "http://user:password@proxy:port/";
82-
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
83-
84-
# Select internationalisation properties.
8528
i18n.defaultLocale = "en_US.UTF-8";
86-
# console = {
87-
# font = pkgs.jetbrains-mono;
88-
# keyMap = "us";
89-
# };
90-
91-
# Set your time zone.
92-
# time.timeZone = "EST";
93-
services.geoclue2.enable = true;
94-
services.localtimed.enable = true;
9529

96-
# Some programs need SUID wrappers, can be configured further or are
97-
# started in user sessions.
98-
# programs.mtr.enable = true;
9930
programs.gnupg.agent = {
10031
enable = true;
10132
enableSSHSupport = true;
102-
pinentryPackage = pkgs.pinentry-gnome3;
10333
};
10434

105-
# List services that you want to enable:
106-
10735
# Enable the OpenSSH daemon.
10836
services.openssh.enable = true;
109-
110-
# Open ports in the firewall.
111-
# networking.firewall.allowedTCPPorts = [ ... ];
112-
# networking.firewall.allowedUDPPorts = [ ... ];
113-
# Or disable the firewall altogether.
114-
# networking.firewall.enable = false;
115-
116-
# Enable CUPS to print documents.
117-
services.printing.enable = true;
118-
119-
services.pulseaudio.enable = false;
120-
121-
# Enable touchpad support.
122-
services.libinput.enable = true;
123-
124-
# Enable the X11 windowing system.
125-
services.xserver.enable = true;
126-
services.xserver.xkb.layout = "us";
127-
services.desktopManager.gnome.enable = true;
128-
services.displayManager.gdm.enable = true;
129-
130-
# This value determines the NixOS release from which the default
131-
# settings for stateful data, like file locations and database versions
132-
# on your system were taken. It‘s perfectly fine and recommended to leave
133-
# this value at the release version of the first install of this system.
134-
# Before changing this value read the documentation for this option
135-
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
136-
system.stateVersion = "24.11";
13737
}

‎modules/nixos/desktop.nix‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
config,
3+
pkgs,
4+
...
5+
}:
6+
{
7+
imports = [ ./keybase.nix ];
8+
9+
services.syncthing = {
10+
enable = true;
11+
user = config.user.name;
12+
group = "users";
13+
openDefaultPorts = true;
14+
dataDir = config.user.home;
15+
};
16+
17+
environment.systemPackages = with pkgs; [
18+
vscode
19+
brave
20+
gnome-tweaks
21+
];
22+
23+
hm =
24+
{ ... }:
25+
{
26+
imports = [
27+
../home-manager/gnome.nix
28+
../home-manager/1password.nix
29+
];
30+
};
31+
32+
# Define a user account. Don't forget to set a password with 'passwd'.
33+
users = {
34+
mutableUsers = false;
35+
users = {
36+
"${config.user.name}" = {
37+
isNormalUser = true;
38+
extraGroups = [
39+
"sudo"
40+
"wheel"
41+
"networkmanager"
42+
];
43+
hashedPassword = "$6$1kR9R2U/NA0.$thN8N2sTo7odYaoLhipeuu5Ic4CS7hKDt1Q6ClP9y0I3eVMaFmo.dZNpPfdwNitkElkaLwDVsGpDuM2SO2GqP/";
44+
};
45+
};
46+
};
47+
48+
networking.hostName = "Phil";
49+
networking.networkmanager.enable = true;
50+
51+
# Use the GRUB 2 boot loader.
52+
boot.loader.grub.enable = true;
53+
boot.loader.grub.device = "/dev/sda";
54+
55+
networking.useDHCP = false;
56+
networking.interfaces.enp0s31f6.useDHCP = true;
57+
networking.interfaces.wlp4s0.useDHCP = true;
58+
59+
services.geoclue2.enable = true;
60+
services.localtimed.enable = true;
61+
62+
programs.gnupg.agent.pinentryPackage = pkgs.pinentry-gnome3;
63+
64+
services.printing.enable = true;
65+
services.pulseaudio.enable = false;
66+
services.libinput.enable = true;
67+
68+
services.xserver.enable = true;
69+
services.xserver.xkb.layout = "us";
70+
services.desktopManager.gnome.enable = true;
71+
services.displayManager.gdm.enable = true;
72+
73+
system.stateVersion = "24.11";
74+
}

‎modules/nixos/gateway.nix‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
config,
3+
...
4+
}:
5+
{
6+
networking.hostName = "gateway";
7+
networking.domain = "";
8+
9+
# Open additional ports beyond the SSH default from hetzner.nix
10+
networking.firewall = {
11+
allowedTCPPorts = [
12+
80 # HTTP
13+
443 # HTTPS
14+
];
15+
allowedUDPPorts = [
16+
443 # QUIC / HTTP/3
17+
];
18+
};
19+
20+
# User account
21+
users.users = {
22+
root.openssh.authorizedKeys.keys = [
23+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM48VQYrCQErK9QdC/mZ61Yzjh/4xKpgZ2WU5G19FpBG"
24+
];
25+
"${config.user.name}" = {
26+
isNormalUser = true;
27+
extraGroups = [
28+
"wheel"
29+
];
30+
openssh.authorizedKeys.keys = [
31+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM48VQYrCQErK9QdC/mZ61Yzjh/4xKpgZ2WU5G19FpBG"
32+
];
33+
};
34+
};
35+
36+
# TODO: Authelia - authentication server (disabled until secrets/domains are configured)
37+
# services.authelia.instances.main = {
38+
# enable = true;
39+
# settings = { ... };
40+
# secrets = { ... };
41+
# };
42+
43+
# Passwordless sudo via SSH agent forwarding
44+
security.pam.rssh.enable = true;
45+
security.pam.services.sudo.rssh = true;
46+
47+
# Netbird - mesh VPN
48+
services.netbird.enable = true;
49+
50+
system.stateVersion = "25.11";
51+
}

0 commit comments

Comments
 (0)
⚡