mostly formatting

README.md

@@ -0,0 +1,17 @@
+# nix-server
+
+nix flake config! this is just used on my personal server at the moment
+
+## users
+
+this flake is built for a multi-user experience per host, enforced by [`modules/users.nix`](./modules/users.nix), and found in the `default.nix` file for each host.
+
+## todo
+  - remove the lua static stuff from nginx + maybe cloudflare ips too + redis
+  - per-host architecture selection, atm it is hardcoded to `aarch64`
+  - some weird perl error abt locales when building using doas - `keepEnv` might fix this
+  - move common config such as bootloader and networking settings to [`default.nix`](./default.nix)
+  - swap back to hardened kernel
+  - leverage nixos-hardware
+  - unscuff metrics
+  - wtaf is going on w/ our user management??

default.nix

@@ -19,7 +19,7 @@ in {
     nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
     registry.nixpkgs.flake = inputs.nixpkgs;
   
-  	settings = {
+    settings = {
       experimental-features = [ "nix-command" "flakes" ];
       auto-optimise-store = true;
       keep-outputs = true;
@@ -28,9 +28,9 @@ in {
         "https://nix-community.cachix.org" 
       ];
       trusted-public-keys = [
-      	"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
-  	};
+    };
   };
 
   # set our git revision inside `nixos-version`

hosts/nixos-server-reid/hardware.nix

@@ -21,7 +21,7 @@
   };
 
   fileSystems."/" = {
-  	  device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+      device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
       fsType = "ext4";
     };
 

lib/default.nix

@@ -9,8 +9,8 @@
     modules = import ./modules.nix {
       inherit lib;
       self.attrs = import ./attrs.nix {
-      	inherit lib;
+        inherit lib;
-      	self = {};
+        self = {};
       };
     };
     mylib =

modules/security.nix

@@ -13,55 +13,55 @@ in {
 		tmp.useTmpfs = lib.mkDefault true;
 		tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
 		
-    	kernel.sysctl = {
+    kernel.sysctl = {
-    	  # magic sysrq key, allows low-level commands through keyboard input
+      # magic sysrq key, allows low-level commands through keyboard input
-      	  "kernel.sysrq" = 0;
+      "kernel.sysrq" = 0;
 
-          ## TCP hardening
+      ## TCP hardening
-          # prevent bogus ICMP errors from filling up logs
+      # prevent bogus ICMP errors from filling up logs
-          "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+      "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
-          # do not accept IP source packets (we are not a router)
+      # do not accept IP source packets (we are not a router)
-          "net.ipv4.conf.all.accept_source_route" = 0;
+      "net.ipv4.conf.all.accept_source_route" = 0;
-          "net.ipv6.conf.all.accept_source_route" = 0;
+      "net.ipv6.conf.all.accept_source_route" = 0;
-          # don't send ICMP redirects (again, we're not a router)
+      # don't send ICMP redirects (again, we're not a router)
-          "net.ipv4.conf.all.send_redirects" = 0;
+      "net.ipv4.conf.all.send_redirects" = 0;
-          "net.ipv4.conf.default.send_redirects" = 0;
+      "net.ipv4.conf.default.send_redirects" = 0;
-          # refuse ICMP redirects (MITM mitigations)
+      # refuse ICMP redirects (MITM mitigations)
-          "net.ipv4.conf.all.accept_redirects" = 0;
+      "net.ipv4.conf.all.accept_redirects" = 0;
-          "net.ipv4.conf.default.accept_redirects" = 0;
+      "net.ipv4.conf.default.accept_redirects" = 0;
-          "net.ipv4.conf.all.secure_redirects" = 0;
+      "net.ipv4.conf.all.secure_redirects" = 0;
-          "net.ipv4.conf.default.secure_redirects" = 0;
+      "net.ipv4.conf.default.secure_redirects" = 0;
-          "net.ipv6.conf.all.accept_redirects" = 0;
+      "net.ipv6.conf.all.accept_redirects" = 0;
-          "net.ipv6.conf.default.accept_redirects" = 0;
+      "net.ipv6.conf.default.accept_redirects" = 0;
-          # protects against SYN flood attacks
+      # protects against SYN flood attacks
-          "net.ipv4.tcp_syncookies" = 1;
+      "net.ipv4.tcp_syncookies" = 1;
-          # incomplete protection against TIME-WAIT assassination
+      # incomplete protection against TIME-WAIT assassination
-          "net.ipv4.tcp_rfc1337" = 1;
+      "net.ipv4.tcp_rfc1337" = 1;
 
-          ## TCP optimization
+      ## TCP optimization
-          # TCP fastopen
+      # TCP fastopen
-          "net.ipv4.tcp_fastopen" = 3;
+      "net.ipv4.tcp_fastopen" = 3;
-          # bufferbloat mitigations + improvement in throughput and latency
+      # bufferbloat mitigations + improvement in throughput and latency
-          "net.ipv4.tcp_conjestion_control" = "bbr";
+      "net.ipv4.tcp_conjestion_control" = "bbr";
-          "net.core.default_qdisc" = "cake";
+      "net.core.default_qdisc" = "cake";
-        };
-        kernelModules = [ "tcp_bbr" ];
       };
+      kernelModules = [ "tcp_bbr" ];
+    };
 
-      security = {
+    security = {
-        # prevents replacing the kernel without a reboot
+      # prevents replacing the kernel without a reboot
-      	protectKernelImage = true;
+      protectKernelImage = true;
-      	# rtkit allows unprivileged processes to use realtime scheduling
+      # rtkit allows unprivileged processes to use realtime scheduling
-        # polkit allows unprivileged processes to speak to privileged processes (ex. nmtui, reboot)
+      # polkit allows unprivileged processes to speak to privileged processes (ex. nmtui, reboot)
-      	rtkit.enable = true;
+      rtkit.enable = true;
-        polkit.enable = true;
+      polkit.enable = true;
-      };
+    };
 
-      # while this is on by default, i am going to explicitly specify this
+    # while this is on by default, i am going to explicitly specify this
-      networking.firewall.enable = true;
+    networking.firewall.enable = true;
-    } // (mkIf cfg.useDoas {
+  } // (mkIf cfg.useDoas {
-    	security.sudo.enable = false;
+    security.sudo.enable = false;
-    	security.doas.enable = true;
+    security.doas.enable = true;
-    	environment.systemPackages = with pkgs; [ doas-sudo-shim ];
+    environment.systemPackages = with pkgs; [ doas-sudo-shim ];
-    });
+  });
 }

modules/services/forgejo.nix

@@ -30,7 +30,7 @@ in {
         database.type = "postgres";
         settings = {
           "DEFAULT" = {
-          	APP_NAME = "reidlab's git instance";
+            APP_NAME = "reidlab's git instance";
           };
           "security" = {
             INSTALL_LOCK = true;

readme.md

@@ -1,17 +0,0 @@
-# nix-server
-
-nix flake config! this is just used on my personal server at the moment
-
-## users
-
-this flake is built for a multi-user experience per host, enforced by [`modules/users.nix`](./modules/users.nix), and found in the `default.nix` file for each host.
-
-## todo
-
-- remove the lua static stuff from nginx + maybe cloudflare ips too + redis
-- per-host architecture selection, atm it is hardcoded to `aarch64`
-- some weird perl error abt locales when building using doas - `keepEnv` might fix this
-- move common config such as bootloader and networking settings to [`default.nix`](./default.nix)
-- swap back to hardened kernel
-- leverage nixos-hardware
-- unscuff metrics