chaos/nixfiles
1
0
Fork 0
Code Issues 2 Releases Activity

format nix files

Browse source
This commit is contained in:
ChaotiCryptidz 2021-12-31 12:53:52 +00:00
parent e37126b016
commit f1568d0914
4 changed files with 19 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
hosts/hetzner-vm/services/nginx.nix
View file

@ -1,8 +1,6 @@
{ ... }: { { ... }: {
security.acme = { security.acme = {
defaults = { defaults = { email = "chaoticryptidz@owo.monster"; };
email = "chaoticryptidz@owo.monster";
};
acceptTerms = true; acceptTerms = true;
}; };
services.nginx = { services.nginx = {

14
hosts/hetzner-vm/services/restic.nix
View file

@ -1,13 +1,11 @@
{ ... }: { ... }:
let let
backupUser = "root"; backupUser = "root";
backupPaths = [ backupPaths = [ "/var/lib/postgresql" "/var/lib/vault" ];
"/var/lib/postgresql" "/var/lib/vault" timerConfig = {
]; OnBootSec = "1m";
timerConfig = { OnCalendar = "daily";
OnBootSec = "1m"; };
OnCalendar = "daily";
};
in { in {
services.restic.backups.hetzner-vm = { services.restic.backups.hetzner-vm = {
user = backupUser; user = backupUser;

3
profiles/hardening/hardening.nix
View file

@ -15,7 +15,8 @@
security.forcePageTableIsolation = true; security.forcePageTableIsolation = true;
# This is required by podman to run containers in rootless mode. # This is required by podman to run containers in rootless mode.
security.unprivilegedUsernsClone = lib.mkDefault config.virtualisation.containers.enable; security.unprivilegedUsernsClone =
lib.mkDefault config.virtualisation.containers.enable;
security.virtualisation.flushL1DataCache = "always"; security.virtualisation.flushL1DataCache = "always";

12
users/chaoticryptidz.nix
View file

@ -1,8 +1,16 @@
{ config, ... }: { { config, ... }: {
users.users.chaoticryptidz = { users.users.chaoticryptidz = {
isNormalUser = true; isNormalUser = true;
extraGroups = extraGroups = [
[ "wheel" "disk" "video" "systemd-journal" "plugdev" "vfio" "input" "uinput" ]; "wheel"
"disk"
"video"
"systemd-journal"
"plugdev"
"vfio"
"input"
"uinput"
];
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4L1eBZzYXZNGBucTn/eOFp48el9JPiYt9iXQDpBSg/ chaoticryptidz@owo.monster" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4L1eBZzYXZNGBucTn/eOFp48el9JPiYt9iXQDpBSg/ chaoticryptidz@owo.monster"
]; ];