new box

2026-01-01 07:20:43 +01:00
parent 92c4e1f7cf
commit 7f4bac8208
4 changed files with 96 additions and 113 deletions
--- a/machines/109-199-104-83/configuration.nix
+++ b/machines/109-199-104-83/configuration.nix
@@ -0,0 +1,93 @@
+{
+  modulesPath,
+  machine,
+  ...
+}: {
+  system.stateVersion = "25.11";
+  nix.settings.experimental-features = ["flakes" "nix-command"];
+
+  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+  fileSystems = {
+    "/" = {
+      device = "none";
+      fsType = "tmpfs";
+      options = ["defaults" "size=30%" "mode=755"];
+    };
+    "/mnt" = {
+      device = "/dev/sda1";
+      fsType = "ext4";
+    };
+    "/boot" = {
+      device = "/mnt/boot";
+      fsType = "none";
+      options = ["bind"];
+    };
+    "/nix" = {
+      device = "/mnt/nix";
+      fsType = "none";
+      options = ["bind"];
+    };
+  };
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.timeout = 30;
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = ["nvme"];
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+
+  networking = {
+    useNetworkd = true;
+    usePredictableInterfaceNames = true;
+    hostName = machine.hostname;
+    domain = "galaxious.de";
+  };
+  systemd.network = {
+    enable = true;
+    networks."40-wan" = {
+      matchConfig.Name = "enx0050565f4fff";
+      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
+      routes = [
+        {
+          Gateway = "109.199.96.1";
+          GatewayOnLink = true;
+        }
+        {Gateway = "fe80::1";}
+      ];
+      dns = ["2620:fe::fe" "9.9.9.9"];
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    allowSFTP = false;
+    ports = [5522];
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = true;
+    };
+    extraConfig = ''
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      MaxAuthTries 3
+      MaxSessions 4
+      TCPKeepAlive no
+    '';
+  };
+  users.users.root.openssh.authorizedKeys.keys = [];
+  age.secrets.secret2.file = ../../secrets/secret2.age;
+  environment.persistence."/nix/persist" = {
+    enable = true;
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/nixos"
+      "/var/lib/systemd/coredump"
+      "/etc/NetworkManager/system-connections"
+    ];
+    files = [
+      "/etc/machine-id"
+    ];
+  };
+  programs.noshell.enable = true;
+}