nixos-systems/sovr/etc/nixos/configuration.nix

# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).

{ config, pkgs, inputs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      inputs.sovr.nixosModules.default
    ];

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  boot.loader.grub.efiSupport = false;
  # boot.loader.grub.efiInstallAsRemovable = true;
  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
  # Define on which hard drive you want to install Grub.
  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only

  environment.systemPackages = with pkgs; [
    fish
    git
    neovim
    tmux
    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
    wget
    inputs.sovr.packages."${pkgs.system}".sovr-server
  ];

  i18n.defaultLocale = "en_US.UTF-8";

  networking = {
    hostName = "sovr";
    useNetworkd = true;
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  programs.neovim.enable = true;
  programs.neovim.defaultEditor = true;

  security.acme = {
    acceptTerms = true;
    certs."_.sovr.cloud" = {
      dnsProvider = "porkbun";
      domain = "*.sovr.cloud";
      environmentFile = "/opt/keys/porkbun";
      group = "nginx";
    };
    certs."sovr.cloud" = {
      dnsProvider = "porkbun";
      domain = "sovr.cloud";
      environmentFile = "/opt/keys/porkbun";
      group = "nginx";
    };
    defaults.email = "eli@theribbles.org";
  };
  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  services.cloud-init = {
    enable = true;
    network.enable = false;
  };
  services.openssh = {
    enable = true;
    # require public key authentication for better security
    settings.PasswordAuthentication = false;
    settings.KbdInteractiveAuthentication = false;
    settings.PermitRootLogin = "no";
  };
  services.sovr-server = {
    enable = true;
    sessionSecret = "secret";
  };

  systemd.network = {
    enable = true;
    networks."09-wan" = {
      address = [
        "194.135.104.85/24"
        "2605:e440::2:1d5/64"
        "2605:e440::2:3e/64"
      ];
      dns = [
        "8.8.8.8"
	"8.8.4.4"
	"2001:4860:4860::8888"
	"2001:4860::8844"
      ];
      linkConfig.RequiredForOnline = "routable";
      matchConfig.Name = "eth0";
      routes = [
        { Gateway = "194.135.104.1"; }
	{ Gateway = "2605:e440::1"; }
      ];
    };
  };


  # Set your time zone.
  time.timeZone = "America/Phoenix";

  users.groups.deploy = {};
  users.users.deploy = {
    extraGroups = [ "deploy" ];
    isNormalUser = true;
  };
  users.users.eliribble = {
    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
    initialHashedPassword = "$y$j9T$XYOMZR8RZEiTnpaF8lsxv1$H7YbWDpzbnYXTLN0ZMhvtKOlSMy64P7C/RdLBaeaNf/";
    isNormalUser = true;
    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBvhtF6nRWlA6PVs71Eek7p0p2PxTd3P6ZEGFV2t75MB eliribble@nixos"];
  };
  users.users.root.initialHashedPassword = "$y$j9T$Ti26ax34797JfBHz.qOF20$Ft.w/amrklqfOxs1Q44udCON6qo8Yj51CqLSksOYAQ2";


  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  networking.firewall.enable = false;

  # Copy the NixOS configuration file and link it from the resulting system
  # (/run/current-system/configuration.nix). This is useful in case you
  # accidentally delete configuration.nix.
  # system.copySystemConfiguration = true;

  # This option defines the first version of NixOS you have installed on this particular machine,
  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
  #
  # Most users should NEVER change this value after the initial install, for any reason,
  # even if you've upgraded your system to a new NixOS release.
  #
  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
  # to actually do that.
  #
  # This value being lower than the current NixOS release does NOT mean your system is
  # out of date, out of support, or vulnerable.
  #
  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
  # and migrated your data accordingly.
  #
  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
  system.stateVersion = "24.11"; # Did you read the comment?

}