From dfade51c25e36f2b117683d83a2f432c72f6bcea Mon Sep 17 00:00:00 2001
From: Christoph Hollizeck <christoph.hollizeck@hey.com>
Date: Mon, 25 Nov 2024 23:02:09 +0100
Subject: [PATCH] rp5: move things in separate configs, to be reused

---
 modules/nixos/services/openssh/default.nix    | 29 +++++++++
 .../nixos/services/remotebuild/default.nix    | 48 ++++++++++++++
 systems/aarch64-linux/nixberry/default.nix    | 65 ++++---------------
 systems/x86_64-linux/loptland/default.nix     | 13 +---
 4 files changed, 92 insertions(+), 63 deletions(-)
 create mode 100644 modules/nixos/services/openssh/default.nix
 create mode 100644 modules/nixos/services/remotebuild/default.nix

diff --git a/modules/nixos/services/openssh/default.nix b/modules/nixos/services/openssh/default.nix
new file mode 100644
index 0000000..4ec9816
--- /dev/null
+++ b/modules/nixos/services/openssh/default.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.services.openssh;
+  inherit (lib) mkIf mkEnableOption;
+in
+{
+  options.${namespace}.services.openssh = {
+    enable = mkEnableOption "Enable SSH";
+  };
+
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+
+    services.fail2ban = {
+      enable = true;
+    };
+  };
+}
diff --git a/modules/nixos/services/remotebuild/default.nix b/modules/nixos/services/remotebuild/default.nix
new file mode 100644
index 0000000..cd6b8ab
--- /dev/null
+++ b/modules/nixos/services/remotebuild/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.services.remotebuild;
+  inherit (lib) mkIf mkEnableOption;
+in
+{
+  options.${namespace}.services.remotebuild = {
+    enable = mkEnableOption "Enable remotebuild";
+  };
+
+  config = mkIf cfg.enable {
+    users.users.remotebuild = {
+      isNormalUser = true;
+      createHome = false;
+      group = "remotebuild";
+
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil"
+      ];
+    };
+
+    users.groups.remotebuild = { };
+
+    nix = {
+      nrBuildUsers = 64;
+      settings = {
+        trusted-users = [ "remotebuild" ];
+
+        min-free = 10 * 1024 * 1024;
+        max-free = 200 * 1024 * 1024;
+
+        max-jobs = "auto";
+        cores = 0;
+      };
+    };
+
+    systemd.services.nix-daemon.serviceConfig = {
+      MemoryAccounting = true;
+      MemoryMax = "90%";
+      OOMScoreAdjust = 500;
+    };
+  };
+}
diff --git a/systems/aarch64-linux/nixberry/default.nix b/systems/aarch64-linux/nixberry/default.nix
index 5c7cb07..25f1f58 100644
--- a/systems/aarch64-linux/nixberry/default.nix
+++ b/systems/aarch64-linux/nixberry/default.nix
@@ -19,38 +19,6 @@ in
     raspberry-pi-5
   ];
 
-  security.sudo.wheelNeedsPassword = false;
-  users.users.remotebuild = {
-    isNormalUser = true;
-    createHome = false;
-    group = "remotebuild";
-
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil"
-    ];
-  };
-
-  users.groups.remotebuild = { };
-
-  nix = {
-    nrBuildUsers = 64;
-    settings = {
-      trusted-users = [ "remotebuild" ];
-
-      min-free = 10 * 1024 * 1024;
-      max-free = 200 * 1024 * 1024;
-
-      max-jobs = "auto";
-      cores = 0;
-    };
-  };
-
-  systemd.services.nix-daemon.serviceConfig = {
-    MemoryAccounting = true;
-    MemoryMax = "90%";
-    OOMScoreAdjust = 500;
-  };
-
   networking = {
     interfaces.wlan0 = {
       ipv4.addresses = [
@@ -74,16 +42,15 @@ in
         };
       };
     };
-  };
-
-  networking.firewall = {
-    allowedTCPPorts = [
-      53
-      80
-    ];
-    allowedUDPPorts = [
-      53
-    ];
+    firewall = {
+      allowedTCPPorts = [
+        53
+        80
+      ];
+      allowedUDPPorts = [
+        53
+      ];
+    };
   };
 
   services.adguardhome = {
@@ -125,7 +92,6 @@ in
             "https://adguardteam.github.io/HostlistsRegistry/assets/filter_24.txt"
             "https://adguardteam.github.io/HostlistsRegistry/assets/filter_47.txt"
           ];
-
     };
   };
 
@@ -156,17 +122,14 @@ in
     };
   };
 
-  services.openssh = {
-    enable = true;
-    settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-    };
-  };
-
   ${namespace} = {
     submodules.basics = enabled;
 
+    services = {
+      openssh = enabled;
+      remotebuild = enabled;
+    };
+
     system = {
       # cachemiss for webkit gtk
       hardware.networking.enable = mkForce false;
diff --git a/systems/x86_64-linux/loptland/default.nix b/systems/x86_64-linux/loptland/default.nix
index d275c7b..f503838 100644
--- a/systems/x86_64-linux/loptland/default.nix
+++ b/systems/x86_64-linux/loptland/default.nix
@@ -29,18 +29,6 @@ in
     };
   };
 
-  services.openssh = {
-    enable = true;
-    settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-    };
-  };
-
-  services.fail2ban = {
-    enable = true;
-  };
-
   services.nginx = {
     enable = true;
     recommendedProxySettings = true;
@@ -101,6 +89,7 @@ in
         enable = true;
         inherit sopsFile;
       };
+      openssh = enabled;
     };
 
     security = {