| 1 | { |
| 2 | pkgs, |
| 3 | lib, |
| 4 | ... |
| 5 | }: |
| 6 | |
| 7 | { |
| 8 | imports = [ |
| 9 | ../modules/common.nix |
| 10 | ../modules/nftables.nix |
| 11 | ../modules/prometheus |
| 12 | ../modules/rasdaemon.nix |
| 13 | ]; |
| 14 | |
| 15 | nixpkgs.config.allowUnfree = true; |
| 16 | |
| 17 | hardware.enableAllFirmware = true; |
| 18 | hardware.cpu.amd.updateMicrocode = true; |
| 19 | hardware.cpu.intel.updateMicrocode = true; |
| 20 | |
| 21 | boot.kernel.sysctl = { |
| 22 | # reboot on kernel panic |
| 23 | "kernel.panic" = 60; |
| 24 | "kernel.panic_on_oops" = 1; |
| 25 | }; |
| 26 | |
| 27 | documentation.nixos.enable = false; |
| 28 | |
| 29 | environment = { |
| 30 | enableDebugInfo = true; |
| 31 | systemPackages = with pkgs; [ |
| 32 | # debugging |
| 33 | gdb |
| 34 | lsof |
| 35 | sqlite-interactive |
| 36 | |
| 37 | # editors |
| 38 | helix |
| 39 | neovim |
| 40 | |
| 41 | # utilities |
| 42 | ripgrep |
| 43 | fd |
| 44 | |
| 45 | # system introspection |
| 46 | dmidecode |
| 47 | hdparm |
| 48 | htop |
| 49 | iotop |
| 50 | lm_sensors |
| 51 | nvme-cli |
| 52 | powerstat |
| 53 | smartmontools |
| 54 | sysstat |
| 55 | tcpdump |
| 56 | tmux |
| 57 | ]; |
| 58 | }; |
| 59 | |
| 60 | services.openssh = { |
| 61 | enable = true; |
| 62 | authorizedKeysFiles = lib.mkForce [ "/etc/ssh/authorized_keys.d/%u" ]; |
| 63 | }; |
| 64 | |
| 65 | nix.extraOptions = '' |
| 66 | allowed-impure-host-deps = /etc/protocols /etc/services /etc/nsswitch.conf |
| 67 | allowed-uris = https://github.com/ https://git.savannah.gnu.org/ github: https://releases.nixos.org/ |
| 68 | ''; |
| 69 | |
| 70 | # we use networkd |
| 71 | networking.useDHCP = false; |
| 72 | |
| 73 | services.resolved = { |
| 74 | enable = true; |
| 75 | settings.Resolve.FallbackDNS = [ |
| 76 | # https://docs.hetzner.com/de/dns-console/dns/general/recursive-name-servers/ |
| 77 | "185.12.64.1" |
| 78 | "185.12.64.2" |
| 79 | "2a01:4ff:ff00::add:1" |
| 80 | "2a01:4ff:ff00::add:2" |
| 81 | ]; |
| 82 | }; |
| 83 | |
| 84 | security.acme = { |
| 85 | acceptTerms = true; |
| 86 | defaults.email = "infra@nixos.org"; |
| 87 | }; |
| 88 | |
| 89 | services.zfs.autoScrub.enable = true; |
| 90 | |
| 91 | boot.zfs.forceImportRoot = false; |
| 92 | } |