From f5ed731abbc38d765333b005b9815a5f6d3e59c2 Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Tue, 10 Dec 2024 13:24:51 -0500
Subject: Finalize working configs and prior to adding secrets

System configurations in a known good state. Secrets still have to be
integrated, at this point the nixos-anywhere project will likely handle
this to keep the bootstrap completely automatic since it can copy ssh
host keys to the host prior to install/activation. This would work
nicely with the sops secret module, but a good way to manage host keys
for each machine still has to be decided.
---
 modules/xnet/default.nix           | 26 ++++++------
 modules/xnet/gitserver/default.nix |  1 +
 modules/xnet/gitserver/gitweb.nix  |  1 +
 modules/xnet/nginx.nix             |  2 -
 modules/xnet/users.nix             | 84 ++++++++++++++++++++++----------------
 5 files changed, 63 insertions(+), 51 deletions(-)

(limited to 'modules/xnet')

diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix
index 6cb2e5e..a2fb336 100644
--- a/modules/xnet/default.nix
+++ b/modules/xnet/default.nix
@@ -16,24 +16,24 @@ in
   i18n.defaultLocale = mkDefault "en_US.UTF-8";
   time.timeZone = mkDefault "America/Toronto";
 
-  nix.settings = {
-    auto-optimise-store = true;
-    experimental-features = [ "nix-command" "flakes" ];
-    warn-dirty = false;
-  };
+  nix = {
+    settings = {
+      allowUnfree = true;
+      auto-optimise-store = true;
+      experimental-features = [ "nix-command" "flakes" ];
+      warn-dirty = false;
 
-  nix.gc = {
-    automatic = true;
-    options = mkDefault "--delete-older-than 30d";
+      # timeout fast from binary cache
+      connect-timeout = 5;
+    };
+    gc = {
+      automatic = true;
+      options = mkDefault "--delete-older-than 30d";
+    };
   };
 
   documentation = {
     doc.enable = mkDefault false;
     info.enable = mkDefault false;
   };
-
-  security.sudo = {
-    execWheelOnly = true;
-    extraConfig = "Defaults lecture = never";
-  };
 }
diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix
index 5e04398..da83f73 100644
--- a/modules/xnet/gitserver/default.nix
+++ b/modules/xnet/gitserver/default.nix
@@ -31,6 +31,7 @@ in
       initialPassword = "";
       isSystemUser = true;
       home = cfg.path;
+      homeMode = "755";
       createHome = true;
       shell = "${pkgs.git}/bin/git-shell";
       openssh.authorizedKeys.keys = cfg.keys;
diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
index c3696ab..bfd593d 100644
--- a/modules/xnet/gitserver/gitweb.nix
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -21,6 +21,7 @@ in
   config = mkIf cfg.enable {
     xnet.nginx.enable = true;
 
+    users.users.nginx.extraGroups = [ "git" ];
     services.cgit.main = {
       enable = true;
       scanPath = config.xnet.gitServer.path;
diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix
index 1a3df78..64c1d65 100644
--- a/modules/xnet/nginx.nix
+++ b/modules/xnet/nginx.nix
@@ -19,12 +19,10 @@ in
 
     services.nginx = {
       enable = true;
-      recommendedBrotliSettings = true;
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      recommendedZstdSettings = true;
     };
   };
 }
diff --git a/modules/xnet/users.nix b/modules/xnet/users.nix
index d9f6081..53aa15b 100644
--- a/modules/xnet/users.nix
+++ b/modules/xnet/users.nix
@@ -14,48 +14,60 @@ in
   };
 
   config = {
-    users.mutableUsers = false;
+    users = {
+      mutableUsers = false;
+      users.kle = mkIf (builtins.elem "kle" cfg.enable) {
+        hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
+        isNormalUser = true;
+        createHome = true;
+        extraGroups = [ "wheel" "users" "networkmanager" "video" ];
+        packages = with pkgs; [
+          btop
+          curl
+          fzf
+          jq
+          lynx
+          neovim
+          ranger
+          rsync
+          sshfs
+          tree
+          zip
+        ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
+        ];
+      };
+    };
 
-    users.users.kle = mkIf (builtins.elem "kle" cfg.enable) {
-      hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
-      isNormalUser = true;
-      createHome = true;
-      extraGroups = [ "wheel" "users" "networkmanager" "video" ];
-      packages = with pkgs; [
-        btop
-        curl
-        fzf
-        git
-        jq
-        lynx
-        neovim
-        ranger
-        rsync
-        sshfs
-        tree
-        zip
-      ];
+    security.sudo = {
+      execWheelOnly = true;
+      extraConfig = "Defaults lecture = never";
     };
 
-    programs.ssh.extraConfig = ''
-      Host github
-        HostName github.com
-        User git
-        PreferredAuthentications publickey
-    '';
+    programs.ssh = {
+      knownHosts = {
+        "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+      };
+      extraConfig = ''
+        Host github
+          HostName github.com
+          User git
+          PreferredAuthentications publickey
+      '';
+    };
 
     programs.git = {
       config = {
-        init = {
-          defaultBranch = "master";
-        };
-        push = {
-          default = "upstream";
-          autoSetupRemote = true;
-        };
-        fetch = {
-          prune = true;
-        };
+        init.defaultBranch = "master";
+        fetch.prune = true;
+        core.excludesFile = pkgs.writeText "gitignore" ''
+          # dev shell caching
+          .direnv/
+          .envrc
+        '';
+        push.default = "upstream";
+        push.autoSetupRemote = true;
       };
     };
   };
-- 
cgit v1.3.1