{ config, pkgs, ... }: { imports = [ # Include the results of the hardware scan. ./hardware-configuration.nix ./data/secrets/secrets.nix ../../common/configuration/nix.nix ../../common/configuration/documentation.nix ../../common/services/ssh.nix ../../common/services/tailscale.nix ../../common/users.nix ./services/acme.nix ./services/borg.nix ./services/coturn.nix ./services/nginx.nix ./services/synapse.nix ./services/postgres.nix #./services/mail.nix #./services/containers.nix #./services/redis.nix ]; boot.loader.grub.enable = true; boot.loader.grub.device = "/dev/vda"; boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; networking = { hostName = "grondahl"; useDHCP = false; interfaces = { "ens3" = { ipv4.addresses = [ { address = "107.189.30.157"; prefixLength = 24; } ]; ipv6.addresses = [ { address = "2605:6400:30:ef32::1"; prefixLength = 48; } ]; }; }; defaultGateway = "107.189.30.1"; defaultGateway6 = { address = "2605:6400:30::1"; interface = "ens3"; }; nameservers = [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ]; }; time.timeZone = "Europe/Copenhagen"; security.sudo.wheelNeedsPassword = false; nix.settings = { auto-optimise-store = true; trusted-users = [ "root" "@wheel" ]; }; users.groups.acme.members = [ "nginx" "turnserver" ]; users.groups.backup.members = [ "matrix-synapse" "postgres" ]; # List packages installed in system profile. To search, run: # $ nix search wget environment.systemPackages = with pkgs; [ vim wget htop iotop dig ]; networking.firewall = { enable = true; checkReversePath = "loose"; trustedInterfaces = [ "tailscale0" ]; allowedUDPPorts = [ config.services.tailscale.port ]; allowedTCPPorts = [ 22 80 443 ]; allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ]; allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ]; }; system.stateVersion = "21.05"; }