nixos-config/hosts/thrall/default.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];

  nix.package = pkgs.nixUnstable;
  nix.extraOptions = ''
    experimental-features = nix-command flakes
  '';
  #nix.registry.nixpkgs.flake = nixpkgs;
  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  # boot.loader.grub.efiSupport = true;
  # boot.loader.grub.efiInstallAsRemovable = true;
  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
  # Define on which hard drive you want to install Grub.
  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
  boot.loader.systemd-boot.enable = true;

  # networking.hostName = "nixos"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Set your time zone.
  time.timeZone = "Europe/Berlin";

  age.secrets = {
    mailPass.file = ../../secrets/mailPass.age;
    wireguard-thrall.file = ../../secrets/wireguard-thrall.age;
  };

  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
  # Per-interface useDHCP will be mandatory in the future, so this generated config
  # replicates the default behaviour.
  networking = {
    hostName = "thrall";
    domain = "failco.de";
    wireless.enable = false;
    useDHCP = false;
    enableIPv6 = false;
    interfaces.ens3.ipv4.addresses = [{
      address = "195.90.211.228";
      prefixLength = 22;
    }];
    defaultGateway = "195.90.208.1";
    nameservers = [ "1.1.1.1" "8.8.8.8" ];
    firewall = {
      allowedTCPPorts = [ 22 80 443 ];
      allowedUDPPorts = [ ];
    };
  };

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  security.acme = {
    acceptTerms = true;
    email = "alex@jakalx.net";
  };

  security.sudo = {
    enable = true;
    execWheelOnly = true;
    extraRules = [
      { groups = [ "wheel" ];
        commands = [
	  { command = "/run/current-system/sw/bin/nixos-rebuild";
	    options = [ "NOPASSWD" ];
	  }
	];
      }
    ];
  };

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "us";
  };

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.alex = {
    isNormalUser = true;
    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
  };

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    wget

    rsync

    htop

    tmux

    git

    #agenix.defaultPackage.x86_64-linux
  ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
  };

  programs.mosh.enable = true;
  programs.neovim = {
    enable = true;
    defaultEditor = true;
    viAlias = true;
    vimAlias = true;
  };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  services.nginx.enable = true;
  services.nginx = {
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
  };
  services.nginx.virtualHosts = {
    "failco.de" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/blog";
      serverAliases = [ "www.failco.de" "mail.failco.de" ];
    };
  };

  mailserver = {
    enable = true;
    fqdn = "thrall.failco.de";
    domains = [ "failco.de" ];

    loginAccounts = {
      "me@failco.de" = {
        hashedPasswordFile = config.age.secrets.mailPass.path;

	aliases = [
          "jakalx@failco.de"
	];

	catchAll = [ "failco.de" ];
      };
    };

    certificateScheme = 3;

    enableImapSsl = true;
    enableManageSieve = true;
    virusScanning = true;
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "20.09"; # Did you read the comment?

}