blob: 9521f578846d45f6bddcb877722ce30079040e09 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
../modules/common.nix
../modules/tvl.nix
(modulesPath + "/installer/scan/not-detected.nix")
];
networking.hostName = "mugwump";
boot = {
loader.systemd-boot.enable = true;
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
initrd = {
availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
kernelModules = [
"uas" "usbcore" "usb_storage" "vfat" "nls_cp437" "nls_iso8859_1"
];
postDeviceCommands = pkgs.lib.mkBefore ''
mkdir -m 0755 -p /key
sleep 2
mount -n -t vfat -o ro `findfs UUID=9048-A9D5` /key
'';
luks.devices."cryptroot" = {
device = "/dev/disk/by-uuid/803a9028-339c-4617-a213-4fe138161f6d";
keyFile = "/key/keyfile";
preLVM = false;
};
};
};
fileSystems = {
"/" = {
device = "/dev/mapper/cryptroot";
fsType = "btrfs";
};
"/boot" = {
device = "/dev/disk/by-uuid/7D74-0E4B";
fsType = "vfat";
};
};
networking.interfaces = {
enp0s25.useDHCP = false;
wlp2s0.useDHCP = false;
};
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 22 ];
security.sudo.extraRules = [{
groups = ["wheel"];
commands = [{ command = "ALL"; options = ["NOPASSWD"]; }];
}];
services.fail2ban = {
enable = true;
ignoreIP = [
"172.16.0.0/16"
];
};
services.openssh = {
allowSFTP = false;
passwordAuthentication = false;
permitRootLogin = "no";
};
}
|