path: root/machines/nixos/x86_64-linux/do-rproxy/default.nix

{
  adminUser,
  config,
  lib,
  modulesPath,
  self,
  ...
}:
{

  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
    (modulesPath + "/virtualisation/digital-ocean-config.nix")
    ./disks.nix
    ./digitalocean.nix
    ./secrets.nix
    {
      home-manager.users.${adminUser.name} = {
        imports = [
          ./home.nix
          { home.stateVersion = "25.05"; }
        ];
      };
    }
    "${self}/profiles/programs/home-manager.nix"
    "${self}/profiles/admin-user/user.nix"
    "${self}/profiles/admin-user/home-manager.nix"
    "${self}/profiles/core/base-server.nix"
    "${self}/profiles/nix/nix.nix"
    "${self}/profiles/nix/gc.nix"
    "${self}/profiles/network/networkd.nix"
    "${self}/profiles/network/firewall.nix"
    "${self}/profiles/network/fail2ban.nix"
    "${self}/profiles/services/podman.nix"
    "${self}/profiles/programs/fish.nix"
    ./profiles/nginx.nix
  ];

  deployment = {
    targetHost = "code.fcuny.net"; # I need to fix the mismatch
    targetUser = "fcuny";
    buildOnTarget = true;
    allowLocalDeployment = false;
  };

  # do not use DHCP, as DigitalOcean provisions IPs using cloud-init
  networking.useDHCP = lib.mkForce false;

  networking.hostName = "do-rproxy";

  boot.loader.grub = {
    efiSupport = true;
    efiInstallAsRemovable = true;
  };

  networking.wireguard = {
    enable = true;
    interfaces.wg0 = {
      ips = [ "10.100.0.50/32" ];
      listenPort = 51871;
      privateKeyFile = config.age.secrets.wireguard.path;
      peers = [
        {
          publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
          allowedIPs = [ "10.100.0.0/24" ];
          persistentKeepalive = 25;
        }
      ];
    };
  };

  networking.firewall.trustedInterfaces = [ "wg0" ];
  networking.firewall.allowedUDPPorts = [ 51871 ];

  system.stateVersion = "25.05"; # Did you read the comment?
}