From 5ec7ee21e036f7bc1cbdec714271c619cb3fdb3d Mon Sep 17 00:00:00 2001
From: seth <getchoo@tuta.io>
Date: Sun, 27 Oct 2024 20:12:19 -0400
Subject: modules: restructure (#487)

* seth: remove unused pkgs

* modules: restructure

from archetypes back to profiles
make less actual modules for everything
use lib.mkDefault like it's supposed to
move mixins out of server

* nixos/resolved: use modern options
---
 modules/nixos/profiles/default.nix  |  6 ++++
 modules/nixos/profiles/personal.nix | 22 +++++++++++++
 modules/nixos/profiles/server.nix   | 66 +++++++++++++++++++++++++++++++++++++
 3 files changed, 94 insertions(+)
 create mode 100644 modules/nixos/profiles/default.nix
 create mode 100644 modules/nixos/profiles/personal.nix
 create mode 100644 modules/nixos/profiles/server.nix

(limited to 'modules/nixos/profiles')

diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
new file mode 100644
index 0000000..0d11285
--- /dev/null
+++ b/modules/nixos/profiles/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./personal.nix
+    ./server.nix
+  ];
+}
diff --git a/modules/nixos/profiles/personal.nix b/modules/nixos/profiles/personal.nix
new file mode 100644
index 0000000..df52696
--- /dev/null
+++ b/modules/nixos/profiles/personal.nix
@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+let
+  cfg = config.profiles.personal;
+in
+{
+  options.profiles.personal = {
+    enable = lib.mkEnableOption "the Personal profile";
+  };
+
+  config = lib.mkIf cfg.enable {
+    traits = {
+      home-manager.enable = true;
+
+      secrets.enable = true;
+      tailscale.enable = true;
+
+      users = {
+        seth.enable = true;
+      };
+    };
+  };
+}
diff --git a/modules/nixos/profiles/server.nix b/modules/nixos/profiles/server.nix
new file mode 100644
index 0000000..e3e785b
--- /dev/null
+++ b/modules/nixos/profiles/server.nix
@@ -0,0 +1,66 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  cfg = config.profiles.server;
+in
+{
+  options.profiles.server = {
+    enable = lib.mkEnableOption "the Server profile";
+
+    hostUser = lib.mkEnableOption "a default interactive user" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        # All servers are most likely on stable, so we want to pull in some newer packages from time to time
+        _module.args.unstable = inputs.nixpkgs.legacyPackages.${pkgs.stdenv.hostPlatform.system};
+
+        boot.tmp.cleanOnBoot = lib.mkDefault true;
+
+        # We don't need it here
+        documentation.enable = false;
+
+        environment.defaultPackages = lib.mkForce [ ];
+
+        mixins = {
+          cloudflared.enable = true;
+          nginx.enable = true;
+        };
+
+        nix.gc = {
+          # Every ~2 days
+          dates = "Mon,Wed,Fri *-*-* 00:00:00";
+          options = "-d --delete-older-than 2d";
+        };
+
+        traits = {
+          autoUpgrade.enable = true;
+          secrets.enable = true;
+          tailscale = {
+            enable = true;
+            ssh.enable = true;
+          };
+          zram.enable = true;
+        };
+      }
+
+      (lib.mkIf cfg.hostUser {
+        # Hardening access to `nix` as no other users *should* ever really touch it
+        nix.settings.allowed-users = [ config.networking.hostName ];
+
+        users.users.${config.networking.hostName} = {
+          isNormalUser = true;
+          extraGroups = [ "wheel" ];
+        };
+      })
+    ]
+  );
+}
-- 
cgit v1.2.3