133 lines
4.4 KiB
Nix
133 lines
4.4 KiB
Nix
{ config, lib, pkgs, ... }: {
|
||
imports = [
|
||
./hardware-configuration.nix
|
||
./networking.nix # generated at runtime by nixos-infect
|
||
|
||
];
|
||
|
||
boot.tmp.cleanOnBoot = true;
|
||
environment.systemPackages = with pkgs; [
|
||
fish
|
||
git
|
||
neovim
|
||
tmux
|
||
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||
wget
|
||
];
|
||
i18n.defaultLocale = "en_US.UTF-8";
|
||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||
|
||
programs.neovim.enable = true;
|
||
programs.neovim.defaultEditor = true;
|
||
|
||
security.acme = {
|
||
acceptTerms = true;
|
||
#certs."new.anythingforafriend.com" = {
|
||
#dnsProvider = "porkbun";
|
||
#domain = "anythingforafriend.com";
|
||
#environmentFile = "/opt/keys/porkbun";
|
||
#group = "nginx";
|
||
#};
|
||
defaults.email = "eli@gleipnir.technology";
|
||
};
|
||
# Configure network proxy if necessary
|
||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||
|
||
services.cloud-init = {
|
||
enable = true;
|
||
network.enable = false;
|
||
};
|
||
services.phpfpm.pools.anythingforafriend = {
|
||
user = "www-data";
|
||
settings = {
|
||
"listen.owner" = config.services.nginx.user;
|
||
"pm" = "dynamic";
|
||
"pm.max_children" = 32;
|
||
"pm.max_requests" = 500;
|
||
"pm.start_servers" = 2;
|
||
"pm.min_spare_servers" = 2;
|
||
"pm.max_spare_servers" = 5;
|
||
"php_admin_value[error_log]" = "stderr";
|
||
"php_admin_flag[log_errors]" = true;
|
||
"catch_workers_output" = true;
|
||
};
|
||
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
|
||
};
|
||
services.nginx = {
|
||
enable = true;
|
||
virtualHosts."new.anythingforafriend.com" = {
|
||
addSSL = true;
|
||
enableACME = true;
|
||
locations."/" = {
|
||
extraConfig = ''
|
||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||
fastcgi_pass unix:${config.services.phpfpm.pools.anythingforafriend.socket};
|
||
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||
'';
|
||
root = "/var/www/new.anythingforafriend.com";
|
||
};
|
||
};
|
||
};
|
||
services.openssh = {
|
||
enable = true;
|
||
# require public key authentication for better security
|
||
settings.PasswordAuthentication = false;
|
||
settings.KbdInteractiveAuthentication = false;
|
||
settings.PermitRootLogin = "no";
|
||
};
|
||
|
||
|
||
# Set your time zone.
|
||
time.timeZone = "America/Phoenix";
|
||
|
||
users.groups.deploy = {};
|
||
users.groups.www-data = {};
|
||
users.users.www-data = {
|
||
isSystemUser = true;
|
||
createHome = true;
|
||
home = "/var/www/new.anythingforafriend.com";
|
||
group = "www-data";
|
||
};
|
||
users.users.deploy = {
|
||
extraGroups = [ "deploy" ];
|
||
isNormalUser = true;
|
||
};
|
||
users.users.eliribble = {
|
||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||
initialHashedPassword = "$y$j9T$XYOMZR8RZEiTnpaF8lsxv1$H7YbWDpzbnYXTLN0ZMhvtKOlSMy64P7C/RdLBaeaNf/";
|
||
isNormalUser = true;
|
||
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBvhtF6nRWlA6PVs71Eek7p0p2PxTd3P6ZEGFV2t75MB eliribble@nixos"];
|
||
};
|
||
users.users.root.openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBvhtF6nRWlA6PVs71Eek7p0p2PxTd3P6ZEGFV2t75MB eliribble@nixos'' ];
|
||
zramSwap.enable = true;
|
||
|
||
|
||
|
||
|
||
# Copy the NixOS configuration file and link it from the resulting system
|
||
# (/run/current-system/configuration.nix). This is useful in case you
|
||
# accidentally delete configuration.nix.
|
||
# system.copySystemConfiguration = true;
|
||
|
||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||
#
|
||
# Most users should NEVER change this value after the initial install, for any reason,
|
||
# even if you've upgraded your system to a new NixOS release.
|
||
#
|
||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||
# to actually do that.
|
||
#
|
||
# This value being lower than the current NixOS release does NOT mean your system is
|
||
# out of date, out of support, or vulnerable.
|
||
#
|
||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||
# and migrated your data accordingly.
|
||
#
|
||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||
system.stateVersion = "23.11";
|
||
|
||
}
|