hosts/thrall/default.nix

@@ -4,19 +4,21 @@
 
 { config, pkgs, ... }:
 let
-  authorityFromUrl = url:
-    builtins.head (pkgs.lib.drop 1 (pkgs.lib.splitString "://" url));
+  extIface = "ens3";
+  ledgerVHost = "ledger.failco.de";
 in {
   imports = [
     ./hardware-configuration.nix
     ../../modules/upgrade-pg-cluster.nix
     ../../modules/nix-config.nix
-    ../../modules/iohk.nix
-    ../../modules/timezone.nix
-    ../../modules/keybase.nix
-    ../../modules/ssh.nix
   ];
 
+  # Binary Cache for Haskell.nix
+  nix.settings.trusted-public-keys =
+    [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
+
+  #nix.binaryCaches = [ "https://hydra.iohk.io" ];
+
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   # boot.loader.grub.efiSupport = true;
@@ -26,6 +28,9 @@ in {
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
   # boot.loader.systemd-boot.enable = true;
 
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
   age.secrets = {
     mailPass.file = ../../secrets/mailPass.age;
     paperless-mail.file = ../../secrets/paperless-mail.age;
@@ -41,8 +46,7 @@ in {
   # The global useDHCP flag is deprecated, therefore explicitly set to false here.
   # Per-interface useDHCP will be mandatory in the future, so this generated config
   # replicates the default behaviour.
-  networking = let extIface = "ens3";
-  in {
+  networking = {
     hostName = "thrall";
     domain = "failco.de";
     wireless.enable = false;
@@ -141,12 +145,14 @@ in {
     htop
     tmux
     git
+    #agenix.defaultPackage.x86_64-linux
     restic # fast and secure backup
     rclone
   ];
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
+  # programs.mtr.enable = true;
   programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;
@@ -165,15 +171,20 @@ in {
 
   # List services that you want to enable:
 
+  # depending on wireguard
   services.kresd = {
     enable = true;
     listenPlain = [ "[::1]:53" "127.0.0.1:53" "10.0.0.1:53" ];
   };
 
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
   services.lorri.enable = true;
 
   # configure backup via restic to gdrive
   services.restic.backups = { };
+  services.keybase = { enable = true; };
 
   services.nginx = {
     enable = true;
@@ -223,31 +234,27 @@ in {
     };
 
     # gitea
-    "${config.services.gitea.settings.server.DOMAIN}" = {
+    "git.failco.de" = {
       forceSSL = true;
       enableACME = true;
       locations."/" = {
-        proxyPass = "http://127.0.0.1:${
-            toString config.services.gitea.settings.server.HTTP_PORT
-          }/";
+        proxyPass = "http://127.0.0.1:3001/";
         proxyWebsockets = true;
       };
     };
 
     # paperless
-    "${authorityFromUrl config.services.paperless.extraConfig.PAPERLESS_URL}" =
-      {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass =
-            "http://127.0.0.1:${toString config.services.paperless.port}/";
-          proxyWebsockets = true;
-        };
+    "docs.failco.de" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3002/";
+        proxyWebsockets = true;
       };
+    };
 
     # hledger
-    "${authorityFromUrl config.services.hledger-web.baseUrl}" = {
+    "${ledgerVHost}" = {
       forceSSL = true;
       enableACME = true;
       basicAuthFile = config.age.secrets.hledger-web.path;
@@ -298,7 +305,7 @@ in {
 
   services.hledger-web = {
     enable = true;
-    baseUrl = "https://ledger.failco.de";
+    baseUrl = "https://${ledgerVHost}";
     port = 3003;
     capabilities = {
       view = true;

modules/iohk.nix

@@ -1,9 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  # Binary Cache for Haskell.nix
-  nix.settings.trusted-public-keys =
-    [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
-
-  nix.settings.substituters = lib.mkAfter [ "https://hydra.iohk.io" ];
-}

modules/keybase.nix

@@ -1,5 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.keybase.enable = true;
-}

modules/ssh.nix

@@ -1,5 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.openssh.enable = true;
-}

modules/timezone.nix

@@ -1,5 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  time.timeZone = lib.mkDefault "Europe/Berlin";
-}