jet/extremist-software
jet/extremist-software
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: format and fix noisebell config

Browse source
This commit is contained in:
Jet 2026-03-23 00:04:46 -07:00
parent 3e78c835cc
commit d0b29c1244
No known key found for this signature in database
10 changed files with 211 additions and 101 deletions
Download patch file Download diff file Expand all files Collapse all files

59
configuration.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, modulesPath, ... }:
{
config,
pkgs,
modulesPath,
...
}:
{
imports = [
@ -19,13 +24,25 @@
# Agenix secrets
age.secrets = {
forgejo-db.file = ./secrets/forgejo-db.age;
stalwart-admin = { file = ./secrets/stalwart-admin.age; owner = "stalwart-mail"; };
stalwart-admin = {
file = ./secrets/stalwart-admin.age;
owner = "stalwart-mail";
};
searx-env.file = ./secrets/searx-env.age;
tailscale-key.file = ./secrets/tailscale-key.age;
grafana-secret = { file = ./secrets/grafana-secret.age; owner = "grafana"; };
matrix-macaroon = { file = ./secrets/matrix-macaroon.age; owner = "matrix-synapse"; };
grafana-secret = {
file = ./secrets/grafana-secret.age;
owner = "grafana";
};
matrix-macaroon = {
file = ./secrets/matrix-macaroon.age;
owner = "matrix-synapse";
};
ntfy-admin-hash.file = ./secrets/ntfy-admin-hash.age;
mymx-webhook = { file = ./secrets/mymx-webhook.age; owner = "mymx"; };
mymx-webhook = {
file = ./secrets/mymx-webhook.age;
owner = "mymx";
};
};
# Bootloader
@ -35,13 +52,16 @@
# Networking
networking.hostName = "extremist-software";
networking.firewall.allowedTCPPorts = [ 22 80 443 ]; # SSH, HTTP, HTTPS
networking.firewall.allowedTCPPorts = [
22
80
443
]; # SSH, HTTP, HTTPS
# Tailscale
services.tailscale.enable = true;
# We assume the user will authenticate manually or via a one-time key service
# For now, let's enable it and allow the user to run `tailscale up` or provision via key
# Users
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu"
@ -52,10 +72,12 @@
enable = true;
settings.PasswordAuthentication = false;
settings.PermitRootLogin = "prohibit-password";
hostKeys = [{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}];
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
# Fail2ban
@ -94,7 +116,10 @@
# System
system.stateVersion = "24.05";
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.settings.max-jobs = "auto";
nix.settings.cores = 0;
services.postgresql.package = pkgs.postgresql_15;
@ -105,19 +130,19 @@
# ZRAM for limited RAM
zramSwap.enable = true;
zramSwap.memoryPercent = 50;
zramSwap.memoryPercent = 50;
services.tailscale.authKeyFile = config.age.secrets.tailscale-key.path;
# MyMX
services.jetpham-website.enable = true;
services.jetpham-website.tor.enable = true;
services.jetpham-website.enable = false;
services.jetpham-website.tor.enable = false;
services.mymx = {
enable = true;
webhookSecretFile = config.age.secrets.mymx-webhook.path;
};
# Allow Tailscale traffic
networking.firewall.trustedInterfaces = [ "tailscale0" ];
# Required for Tailscale subnet routing and exit nodes, and often helpful for connectivity