move a few more things back as profiles

3 files changed, 207 insertions, 0 deletions

diff --git a/profiles/cgroups.nix b/profiles/cgroups.nix
new file mode 100644
index 0000000..07dc964
--- /dev/null
+++ b/profiles/cgroups.nix
@@ -0,0 +1,75 @@
+# Stolen from https://git.lix.systems/the-distro/infra/src/branch/main/common/cgroups.nix
+# Relatively inspired by fbtax2:
+# https://facebookmicrosites.github.io/cgroup2/docs/fbtax-results.html
+{ ... }:
+let
+  systemCriticalSliceConfig = {
+    ManagedOOMMemoryPressure = "kill";
+
+    # guarantee availability of memory
+    MemoryMin = "192M";
+    # default 100
+    IOWeight = 1000;
+    # default 100
+    CPUWeight = 1000;
+  };
+in
+{
+  systemd.oomd = {
+    enable = true;
+    enableRootSlice = true;
+    enableSystemSlice = true;
+    enableUserSlices = true;
+  };
+
+  systemd.services.nix-daemon = {
+    serviceConfig = {
+      CPUWeight = 10;
+      IOWeight = 10;
+    };
+  };
+
+  systemd.slices.hostcritical = {
+    description = "Ensures that services to keep the system alive remain alive";
+
+    unitConfig = {
+      # required to avoid a dependency cycle on systemd-oomd. systemd will
+      # actually guess this right but we should fix it anyway.
+      DefaultDependencies = false;
+    };
+
+    sliceConfig = systemCriticalSliceConfig;
+  };
+
+  # make root logins higher priority for resources
+  systemd.slices."user-0" = {
+    sliceConfig = systemCriticalSliceConfig;
+  };
+
+  systemd.slices.system = {
+    sliceConfig = {
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "50%";
+
+      IOWeight = 100;
+    };
+  };
+
+  systemd.services.sshd = {
+    serviceConfig = {
+      Slice = "hostcritical.slice";
+    };
+  };
+
+  systemd.services.systemd-oomd = {
+    serviceConfig = {
+      Slice = "hostcritical.slice";
+    };
+  };
+
+  systemd.services.systemd-journald = {
+    serviceConfig = {
+      Slice = "hostcritical.slice";
+    };
+  };
+}
diff --git a/profiles/defaults.nix b/profiles/defaults.nix
new file mode 100644
index 0000000..7c8a7fb
--- /dev/null
+++ b/profiles/defaults.nix
@@ -0,0 +1,88 @@
+{
+  self,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  boot = {
+    kernelPackages = pkgs.linuxPackages_latest;
+    kernel.sysctl = {
+      "net.ipv4.tcp_congestion_control" = "bbr";
+      "net.ipv4.tcp_ecn" = 1;
+      "net.ipv4.tcp_fastopen" = 3;
+      "net.ipv4.tcp_tw_reuse" = 1;
+    };
+  };
+
+  networking = {
+    useNetworkd = true;
+    # Used by systemd-resolved, not directly by resolv.conf.
+    nameservers = [
+      "8.8.8.8#dns.google"
+      "1.0.0.1#cloudflare-dns.com"
+    ];
+    firewall = {
+      enable = true;
+      allowPing = true;
+      logRefusedConnections = false;
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+  };
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    supportedLocales = [
+      "en_US.UTF-8/UTF-8"
+    ];
+  };
+
+  time.timeZone = "America/Los_Angeles";
+
+  users.motdFile = "/etc/motd";
+
+  environment.etc.motd.text = ''
+    Machine  ${config.networking.hostName}
+     NixOS   ${config.system.nixos.release}
+       @     ${self.shortRev or self.dirtyShortRev}
+  '';
+
+  ## disable that slow "building man-cache" step
+  documentation.man.generateCaches = lib.mkForce false;
+
+  users = {
+    mutableUsers = false;
+    users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
+    ];
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  environment.systemPackages = with pkgs; [
+    curl
+    dysk
+    fd
+    fish
+    git
+    htop
+    jq
+    mtr
+    pciutils
+    powertop
+    ripgrep
+    tcpdump
+    traceroute
+    vim
+    wireguard-tools
+  ];
+}
diff --git a/profiles/server.nix b/profiles/server.nix
new file mode 100644
index 0000000..fe59484
--- /dev/null
+++ b/profiles/server.nix
@@ -0,0 +1,44 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    ignoreIP = [
+      "10.100.0.0/24" # wireguard
+    ];
+    bantime = "1h";
+    bantime-increment = {
+      enable = true;
+      maxtime = "168h";
+      factor = "4";
+    };
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    autoPrune.enable = true;
+    autoPrune.flags = [
+      "--all"
+    ];
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+
+      PermitRootLogin = "prohibit-password";
+    };
+    openFirewall = true;
+    hostKeys = [
+      {
+        path = "/etc/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }
+    ];
+  };
+}