Nix-Vibe public snapshot (squashed history)

Current state of main at 0240060 feat(hp-laptop): install TeleportFling from its flake. History intentionally collapsed to a single commit; this repo mirrors only the latest state.
2026-09-19 13:53:39 +01:00
commit eb08cd4282
118 changed files with 18716 additions and 0 deletions
@@ -0,0 +1,55 @@
+# NixOS configuration for mcf-server
+# Headless server environment (Command Line Interface only)
+
+{ config
+, pkgs
+, lib
+, inputs
+, ...
+}:
+
+{
+  imports = [
+    ../../modules/core/common.nix
+    (import ../../modules/storage/disko.nix {
+      inherit inputs lib config;
+      diskoConfigPath = ./disko-config.nix;
+    })
+    ./hardware-configuration.nix
+    ../../modules/core/management.nix
+    ../../modules/core/podman.nix
+  ];
+
+  networking.hostName = "mcf-server";
+
+  # Create restic user for homeserver-1 backups
+  users.users.restic-homeserver1 = {
+    isSystemUser = true;
+    group = "restic-homeserver1";
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICwGZFEr6OMm7SIPrYlt6wuuesvlmBIezqQVDxhXOHjD restic@homeserver-1"
+    ];
+  };
+
+  users.groups.restic-homeserver1 = { };
+
+  # Standard user account (shared definition in modules/core/users.nix).
+  # SSH-key-only access; no password on this host.
+
+  # SSH configuration
+  services.openssh.enable = true;
+
+  # Glances system monitor - exposed to the tailnet so homeserver-1's
+  # Homepage dashboard can display real-time stats for this machine.
+  services.glances = {
+    enable = true;
+    port = 61208;
+    # Webserver mode (default). Binds to 0.0.0.0; the firewall rule below
+    # restricts access to the Tailscale interface only.
+    extraArgs = [ "--webserver" ];
+  };
+
+  # Expose Glances (61208) on Tailscale only
+  networking.firewall.interfaces.tailscale.allowedTCPPorts = [ 61208 ];
+}