diff --git a/configuration.nix b/configuration.nix index 87efe0f..9a731f9 100644 --- a/configuration.nix +++ b/configuration.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ pkgs, ... }: { imports = [ @@ -14,7 +14,10 @@ ./modules/fail2ban.nix ]; - nix.settings.experimental-features = [ "nix-command" "flakes" ]; + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; environment.systemPackages = with pkgs; [ git diff --git a/hardware-configuration.nix b/hardware-configuration.nix index 783ff16..c0dc920 100644 --- a/hardware-configuration.nix +++ b/hardware-configuration.nix @@ -1,28 +1,37 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ lib, modulesPath, ... }: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "ata_piix" + "uhci_hcd" + "virtio_pci" + "virtio_scsi" + "sd_mod" + ]; boot.initrd.kernelModules = [ "dm-snapshot" ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/7a81e9fe-a727-4979-b63f-209ec593bd1d"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/7a81e9fe-a727-4979-b63f-209ec593bd1d"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/FFAB-FF4F"; - fsType = "vfat"; - options = [ "fmask=0022" "dmask=0022" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/FFAB-FF4F"; + fsType = "vfat"; + options = [ + "fmask=0022" + "dmask=0022" + ]; + }; swapDevices = [ ]; diff --git a/modules/boot.nix b/modules/boot.nix index 49f0880..93cebed 100644 --- a/modules/boot.nix +++ b/modules/boot.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ pkgs, ... }: { boot.loader.grub = { @@ -9,7 +9,7 @@ boot.kernelPackages = pkgs.linuxPackages_latest; boot.kernelModules = [ "tcp_bbr" ]; - + boot.kernel.sysctl = { "net.core.default_qdisc" = "fq"; "net.ipv4.tcp_congestion_control" = "bbr"; diff --git a/modules/hardware.nix b/modules/hardware.nix index a4b2d44..4d04bb9 100644 --- a/modules/hardware.nix +++ b/modules/hardware.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ ... }: { hardware.enableRedistributableFirmware = true; diff --git a/modules/locale.nix b/modules/locale.nix index d75cedc..0856015 100644 --- a/modules/locale.nix +++ b/modules/locale.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ ... }: let settings = import ../settings.nix; diff --git a/modules/matrix.nix b/modules/matrix.nix index 4c35d0a..e824fd3 100644 --- a/modules/matrix.nix +++ b/modules/matrix.nix @@ -1,4 +1,4 @@ -{ config, pkgs, lib, ... }: +{ pkgs, ... }: let livekitKeyFile = "/run/livekit.key"; @@ -12,13 +12,19 @@ in settings = { global = { server_name = serverName; - address = [ "127.0.0.1" "::1" ]; + address = [ + "127.0.0.1" + "::1" + ]; port = [ 6167 ]; max_request_size = 104857600; allow_registration = false; allow_encryption = true; allow_federation = true; - trusted_servers = [ "matrix.org" "chat.blahaj.zone" ]; + trusted_servers = [ + "matrix.org" + "chat.blahaj.zone" + ]; ip_range_denylist = [ "127.0.0.0/8" "10.0.0.0/8" @@ -98,9 +104,16 @@ in systemd.services.livekit.requires = [ "acme-${matrixRtcDomain}.service" ]; systemd.services.livekit-key = { - before = [ "lk-jwt-service.service" "livekit.service" ]; + before = [ + "lk-jwt-service.service" + "livekit.service" + ]; wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ livekit coreutils gawk ]; + path = with pkgs; [ + livekit + coreutils + gawk + ]; script = '' echo "Key missing, generating key" echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}" @@ -110,10 +123,17 @@ in }; networking.firewall = { - allowedTCPPorts = [ 7880 7881 5349 ]; + allowedTCPPorts = [ + 7880 + 7881 + 5349 + ]; allowedUDPPorts = [ 3478 ]; allowedUDPPortRanges = [ - { from = 50000; to = 60000; } + { + from = 50000; + to = 60000; + } ]; }; } diff --git a/modules/services.nix b/modules/services.nix index 33e7fb9..5a9d567 100644 --- a/modules/services.nix +++ b/modules/services.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ ... }: { services.openssh = { diff --git a/modules/users.nix b/modules/users.nix index 6827db2..2588b7f 100644 --- a/modules/users.nix +++ b/modules/users.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ ... }: let settings = import ../settings.nix; @@ -8,10 +8,14 @@ in isNormalUser = true; description = settings.userDescription; extraGroups = settings.userGroups; - openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" + ]; }; - users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ]; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" + ]; security.sudo.execWheelOnly = true; }