init kuribo

flake.lock

···
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1764517877,
+        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

···
+{
+  description = "bates64";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs =
+    inputs@{ nixpkgs, ... }:
+    {
+      nixosConfigurations = {
+        kuribo = nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          modules = [
+            ./servers/kuribo/configuration.nix
+          ];
+        };
+      };
+    };
+}

modules/auto-upgrade.nix

···
+{
+  system.autoUpgrade = {
+    enable = false; # TODO
+    flake = "git+https://tangled.org/starhaven.dev/infra"; # TODO
+    flags = [
+      "-L" # print build logs
+    ];
+    allowReboot = true;
+    rebootWindow = {
+      lower = "03:00";
+      upper = "06:00";
+    };
+  };
+}

modules/gc.nix

···
+{
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d -d";
+  };
+  nix.extraOptions = ''
+    min-free = ${toString (100 * 1024 * 1024)}
+    max-free = ${toString (1024 * 1024 * 1024)}
+  '';
+  nix.optimise.automatic = true;
+  nix.optimise.dates = [ "06:00" ];
+}

modules/hetzner-aarch64.nix

···
+# Hardware configuration for Hetzner Ampere VMs
+{
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+  networking.useDHCP = lib.mkDefault true;
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+  ];
+  boot.initrd.kernelModules = [
+    "nvme"
+    #"virtio_gpu"
+  ];
+  boot.kernelParams = [ "console=tty" ];
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+    device = "nodev";
+  };
+
+  # Filesystems made by nixos-infect(?)
+  fileSystems."/boot" = {
+    device = "/dev/sda15";
+    fsType = "vfat";
+  };
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+}

servers/kuribo/configuration.nix

···
+{
+  imports = [
+    ../../modules/hetzner-aarch64.nix
+    ../../modules/auto-upgrade.nix
+    ../../modules/gc.nix
+    ../../users/users.nix
+  ];
+
+  networking.hostName = "kuribo";
+
+  nix.extraOptions = ''
+    experimental-features = nix-command flakes
+  '';
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+  services.fail2ban.enable = true;
+
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+  };
+
+  system.stateVersion = "25.11";
+}

users/bates64.pub

···
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINsDTVCIkcFjkaDm5RoWG1uSNJBanUWGmoKHIRHvSsQq [e-mail]

users/users.nix

···
+{
+  users.users = {
+    bates64 = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keyFiles = [ ./bates64.pub ];
+    };
+  };
+}