Something went wrong. Try again.
Sovereign infrastructure from one typed specification: a server, its websites, DNS, git, backups and recovery
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869# Machine-independent base of a sov server: login, firewall, identity, secrets, housekeeping.{ lib, pkgs, sov, instance, ... }:let adminKeys = sov.spec.owner.sshKeys;in{ networking.hostName = sov.spec.server.hostname;
# The server's identity is its SSH host key (placed at install time, kept across reinstalls): it # decrypts the instance's secrets/server.yaml and is the only key that reaches the source bucket. sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; sops.defaultSopsFile = instance + "/secrets/server.yaml";
time.timeZone = "UTC"; i18n.defaultLocale = "en_US.UTF-8";
# --- Login: one admin user, SSH keys only --- users.mutableUsers = false; users.users.admin = { isNormalUser = true; extraGroups = [ "wheel" ]; openssh.authorizedKeys.keys = adminKeys; }; security.sudo.wheelNeedsPassword = false;
services.openssh = { enable = true; openFirewall = true; settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; PermitRootLogin = "no"; AllowUsers = [ "admin" ]; }; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; } ]; };
# --- Firewall: SSH, HTTP, HTTPS (+HTTP/3); drop everything else --- networking.nftables.enable = true; networking.firewall = { enable = true; allowedTCPPorts = [ 80 443 ]; allowedUDPPorts = [ 443 ]; };
# --- Memory safety net for builds --- swapDevices = [ { device = "/var/lib/swapfile"; size = 2048; } ]; boot.kernel.sysctl."vm.swappiness" = 10;
# --- Nix housekeeping --- nix.settings = { experimental-features = [ "nix-command" "flakes" ]; trusted-users = [ "root" "@wheel" ]; auto-optimise-store = true; }; nix.gc = { automatic = true; dates = "weekly"; options = "--delete-older-than 30d"; }; boot.loader.grub.configurationLimit = 10;
services.journald.extraConfig = "SystemMaxUse=500M";
environment.systemPackages = with pkgs; [ git htop sqlite curl ];}