petere
eb08cd4282
Current state of main at 0240060 feat(hp-laptop): install TeleportFling from its flake. History intentionally collapsed to a single commit; this repo mirrors only the latest state.
56 lines
1.5 KiB
Nix
56 lines
1.5 KiB
Nix
# NixOS configuration for mcf-server
|
|
# Headless server environment (Command Line Interface only)
|
|
|
|
{ config
|
|
, pkgs
|
|
, lib
|
|
, inputs
|
|
, ...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
../../modules/core/common.nix
|
|
(import ../../modules/storage/disko.nix {
|
|
inherit inputs lib config;
|
|
diskoConfigPath = ./disko-config.nix;
|
|
})
|
|
./hardware-configuration.nix
|
|
../../modules/core/management.nix
|
|
../../modules/core/podman.nix
|
|
];
|
|
|
|
networking.hostName = "mcf-server";
|
|
|
|
# Create restic user for homeserver-1 backups
|
|
users.users.restic-homeserver1 = {
|
|
isSystemUser = true;
|
|
group = "restic-homeserver1";
|
|
shell = pkgs.zsh;
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICwGZFEr6OMm7SIPrYlt6wuuesvlmBIezqQVDxhXOHjD restic@homeserver-1"
|
|
];
|
|
};
|
|
|
|
users.groups.restic-homeserver1 = { };
|
|
|
|
# Standard user account (shared definition in modules/core/users.nix).
|
|
# SSH-key-only access; no password on this host.
|
|
|
|
# SSH configuration
|
|
services.openssh.enable = true;
|
|
|
|
# Glances system monitor - exposed to the tailnet so homeserver-1's
|
|
# Homepage dashboard can display real-time stats for this machine.
|
|
services.glances = {
|
|
enable = true;
|
|
port = 61208;
|
|
# Webserver mode (default). Binds to 0.0.0.0; the firewall rule below
|
|
# restricts access to the Tailscale interface only.
|
|
extraArgs = [ "--webserver" ];
|
|
};
|
|
|
|
# Expose Glances (61208) on Tailscale only
|
|
networking.firewall.interfaces.tailscale.allowedTCPPorts = [ 61208 ];
|
|
}
|