lor.sh/configuration.nix

{ config, pkgs, lib, ... }:

let
  secrets = import ./secrets.nix;
in {
  imports = [
    ./hardware-configuration.nix
    ./mastodon.nix
  ];

  boot.loader = {
    efi.canTouchEfiVariables = true;
    grub = {
      enable = true;
      efiSupport = true;
      device = "nodev";
      mirroredBoots = [{
        devices = [ "nodev" ];
        path = "/boot-fallback";
      }];
    };
  };

  networking = {
    hostName = "lor-sh";
    hostId = (builtins.substring 0 8 (builtins.readFile "/etc/machine-id"));

    useDHCP = false;

    interfaces.eno1 = {
      ipv4 = secrets.ipv4;
      ipv6 = secrets.ipv6;
    };

    nameservers = [ "1.1.1.1" ];

    firewall =  {
      enable = true;
      allowedTCPPorts = [ 80 443 ];
    };
  };

  users.extraUsers.root = {
    openssh.authorizedKeys.keys = secrets.pubkeys;
  };

  services.openssh.enable = true;

  environment.systemPackages = with pkgs; [
    vim htop git
  ];

  services.postgresql.settings = {
    max_connections = "512";
    shared_buffers = "4096MB";
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = secrets.letsencryptEmail;
  };

  services.zfs = {
    autoScrub.enable = true;
    trim.enable = true;
  };

  time.timeZone = "UTC";

  system.autoUpgrade = {
    enable = true;
    allowReboot = true;
  };

  system.stateVersion = "22.11";

  nix = {
    optimise.automatic = true;
    gc = {
      automatic = true;
      options = "--delete-older-than 7d";
    };
  };
}