flake-parts: Almost done with yggdrasil

modules/server/acme.nix

@@ -0,0 +1,60 @@
+{
+  flake.modules.nixos.server =
+    {
+      config,
+      lib,
+      ...
+    }:
+    let
+      sopsFile = ../../secrets/secrets-loptland.yaml;
+      domainname = "christophhollizeck.dev";
+    in
+    {
+      sops = {
+        secrets = {
+          "netcup/customer_number" = {
+            inherit sopsFile;
+          };
+
+          "netcup/api/key" = {
+            inherit sopsFile;
+          };
+
+          "netcup/api/password" = {
+            inherit sopsFile;
+          };
+        };
+
+        templates = {
+          "netcup.env" = {
+            content = ''
+              NETCUP_CUSTOMER_NUMBER=${config.sops.placeholder."netcup/customer_number"}
+              NETCUP_API_KEY=${config.sops.placeholder."netcup/api/key"}
+              NETCUP_API_PASSWORD=${config.sops.placeholder."netcup/api/password"}
+              NETCUP_PROPAGATION_TIMEOUT=1200
+            '';
+          };
+        };
+
+      };
+
+      security.acme = {
+        acceptTerms = true;
+        defaults = {
+          inherit (config.flake.meta.users.cholli) email;
+
+          group = lib.optional config.services.nginx.enable "nginx";
+          reloadServices = lib.optional config.services.nginx.enable "nginx.service";
+
+          dnsProvider = "netcup";
+          environmentFile = config.sops.templates."netcup.env".path;
+        };
+
+        certs."${domainname}" = {
+          dnsResolver = "1.1.1.1:53";
+          extraDomainNames = [ "*.${domainname}" ];
+        };
+      };
+
+    };
+}

modules/server/factorio-server.nix

@@ -0,0 +1,63 @@
+{
+  flake.modules.nixos.factorio-server =
+    { config, ... }:
+    let
+      sopsFile = ../../secrets/secrets-loptland.yaml;
+    in
+    {
+      sops = {
+        secrets = {
+          "factorio/token" = {
+            restartUnits = [ "factorio.service" ];
+            inherit sopsFile;
+          };
+          "factorio/username" = {
+            restartUnits = [ "factorio.service" ];
+            inherit sopsFile;
+          };
+          "factorio/game_password" = {
+            restartUnits = [ "factorio.service" ];
+            inherit sopsFile;
+          };
+        };
+        templates."extraSettingsFile.json".content = ''
+          {
+            "name": "Pyanodons Holli",
+            "description": "Trying to run a factorio-headless-server on my nix system",
+            "tags": ["vanilla"],
+            "max_players": 10,
+            "game_password": "${config.sops.placeholder."factorio/game_password"}",
+            "allow_commands": "admins-only",
+            "autosave_slots": 5,
+            "ignore_player_limit_for_returning_players": true,
+            "username" : "${config.sops.placeholder."factorio/username"}",
+            "token": "${config.sops.placeholder."factorio/token"}"
+          }
+        '';
+        templates."extraSettingsFile.json".mode = "0444";
+      };
+
+      systemd.tmpfiles.rules = [
+        "Z /var/lib/factorio/mods 770 65400 65400 - -"
+        "Z /var/lib/factorio/saves 770 65400 65400 - -"
+      ];
+
+      services.factorio = {
+        enable = true;
+        openFirewall = true;
+        public = true;
+        lan = true;
+        nonBlockingSaving = true;
+        autosave-interval = 5;
+        saveName = "Pyanodons";
+        loadLatestSave = true;
+        admins = [
+          "daholli"
+          "galbrain"
+          "geigeabc"
+        ];
+        extraSettingsFile = config.sops.templates."extraSettingsFile.json".path;
+      };
+
+    };
+}

modules/server/hydra.nix

@@ -0,0 +1,25 @@
+{
+  flake.modules.nixos.hydra =
+    { ... }:
+    let
+      httpPort = 2000;
+    in
+    {
+      services.nix-serve = {
+        enable = true;
+        secretKeyFile = "/var/cache-priv-key.pem";
+      };
+
+      services.hydra = {
+        enable = true;
+        hydraURL = "http://localhost:${toString httpPort}";
+        port = httpPort;
+        notificationSender = "hydra@localhost";
+        useSubstitutes = true;
+        extraConfig = ''
+          allow-import-from-derivation = 1
+        '';
+      };
+
+    };
+}

modules/server/remotebuild.nix

@@ -0,0 +1,41 @@
+{
+  flake.modules.nixos.server =
+    { lib, ... }:
+    {
+      users.users.remotebuild = {
+        isNormalUser = true;
+        createHome = false;
+        group = "remotebuild";
+
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil"
+        ];
+      };
+
+      users.groups.remotebuild = { };
+
+      nix = {
+        nrBuildUsers = 64;
+        settings = {
+          trusted-users = [ "remotebuild" ];
+
+          min-free = 10 * 1024 * 1024;
+          max-free = 200 * 1024 * 1024;
+
+          max-jobs = "auto";
+          cores = 0;
+        };
+
+        daemonIOSchedClass = lib.mkDefault "idle";
+        daemonCPUSchedPolicy = lib.mkDefault "idle";
+      };
+
+      systemd.services.nix-daemon.serviceConfig = {
+        MemoryAccounting = true;
+        MemoryMax = "90%";
+        OOMScoreAdjust = 500;
+        Slice = "-.slice";
+      };
+
+    };
+}

modules/server/ssh.nix

@@ -0,0 +1,17 @@
+{
+  flake.modules.nixos.server =
+    { ... }:
+    {
+      services.openssh = {
+        enable = true;
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+        };
+      };
+
+      services.fail2ban = {
+        enable = true;
+      };
+    };
+}