Ayo the pizza here (restructuring)

hosts/remilia/boot.nix

@@ -0,0 +1,14 @@
+{config, ...}:
+{
+  boot = {
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
+    initrd.kernelModules = [ "bochs_drm" ];
+    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" ];
+    kernelModules = [ "kvm-amd" ];
+    kernelParams = [ "console=ttyS0" "console=tty1" "nvme.shutdown_timeout=10" "libiscsi.debug_libiscsi_eh=1" ];
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+  };
+}

hosts/remilia/default.nix

@@ -0,0 +1,12 @@
+{lib, config, ...}:
+{
+  imports = 
+  [
+    ./networking.nix
+    ./hardware.nix
+    ./boot.nix
+    ./services.nix
+    ./mailserver.nix
+  ];
+  system.stateVersion = "21.11";
+}

hosts/remilia/hardware.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/d91adce2-9059-4a8a-86e7-dee6ecc85b2b";
+      fsType = "ext4";
+    };
+
+  swapDevices = [
+    { 
+      device="/swapfile";
+      size = 7168;
+      priority = 0;
+    }
+  ];
+}

hosts/remilia/mailserver.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+{
+  mailserver = {
+    enable = true;
+    fqdn = "mail.weirdnatto.in";
+    domains = [ "weirdnatto.in" ];
+    loginAccounts = {
+      "natto@weirdnatto.in" = {
+        hashedPasswordFile = "/var/secrets/natto@weirdnatto.in.key";
+        aliases = ["@weirdnatto.in"];
+      };
+    };
+    enablePop3 = false;
+    enablePop3Ssl = false;
+  };
+}

hosts/remilia/networking.nix

@@ -0,0 +1,55 @@
+{config, pkgs, ...}:
+{
+  networking = {
+    useDHCP = false;
+    hostName = "Remilia";
+    firewall = {
+      interfaces = {
+        ens3 = {
+          allowedTCPPorts = [ 
+            22
+            80 81
+            443 444
+            993 465 143 25 
+          ];
+          allowedUDPPorts = [ 17840 ];
+        };
+      };
+    };
+    interfaces = {
+      ens3 = {
+        useDHCP = true;
+      };
+    };
+    nat = {
+      enable = true;
+      externalInterface = "ens3";
+      internalInterfaces = [ "wg0" ];
+    };
+    wireguard.interfaces = {
+      wg0 = {
+        ips = [ "10.55.0.1/24" ];
+        listenPort = 17840;
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.55.0.0/24 -o ${config.networking.nat.externalInterface} -j MASQUERADE
+        '';
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.55.0.0/24 -o ${config.networking.nat.externalInterface} -j MASQUERADE
+        '';
+        privateKeyFile = "/var/secrets/wg.key";
+        peers = [
+          {
+            publicKey = "m9SSpkj+r2QY4YEUMEoTkbOI/L7C39Kh6m45QZ5mkw4=";
+            allowedIPs = [ "10.55.0.2/32" ];
+          }
+          {
+            publicKey = "SqskEH7hz7Gv9ZS+FYLRFgKZyJCFbBFCyuvzBYnbfVU=";
+            allowedIPs = [ "10.55.0.3/32" ];
+          }
+        ];
+      };
+    };
+  };
+}

hosts/remilia/services.nix

@@ -0,0 +1,79 @@
+{config, pkgs, ...}:
+{
+  services = {
+    openssh = { enable = true;
+      permitRootLogin = "yes";
+    };
+    nginx = {
+      enable = true;
+      package = (pkgs.nginx.overrideAttrs(oa: {
+        configureFlags = oa.configureFlags ++ [ "--with-mail" "--with-mail_ssl_module" ];
+      }));
+      virtualHosts = {
+        "weirdnatto.in" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/".proxyPass = "http://10.55.0.2:80";
+          serverAliases = [ "www.weirdnatto.in" ];
+        };
+        "git.weirdnatto.in" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://10.55.0.2:5001";
+            extraConfig = ''
+              proxy_set_header Host $host;
+            '';
+          };
+        };
+      };
+    };
+    vault-agent = {
+      enable = true;
+      settings = {
+        vault = {
+          address = "https://10.55.0.2:8800";
+          client_cert = "/var/vault/cert.pem";
+          client_key = "/var/vault/key.pem";
+        };
+        auto_auth = {
+          method = [
+            {
+              "cert" = {
+                name = "Remilia";
+              };
+            }
+          ];
+        };
+        template = [
+          {
+            source = pkgs.writeText "wg.tpl" ''
+              {{ with secret "kv/systems/Remilia/wg" }}{{ .Data.data.private }}{{ end }}
+            '';
+            destination = "/var/secrets/wg.key";
+          }
+          {
+            source = pkgs.writeText "natto@weirdnatto.in.tpl" ''
+              {{ with secret "kv/systems/Remilia" }}{{ .Data.data.nattomail }}{{ end }}
+            '';
+            destination = "/var/secrets/natto@weirdnatto.in.key";
+          }
+        ];
+      };
+    };
+
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHingN2Aho+KGgEvBMjtoez+W1svl9uVoa4vG0d646j"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILCH975XCps+VCzo8Fpp5BkbtiFmj9y3//FBVYlQ7/yo"
+  ];
+  security.acme = {
+    acceptTerms = true;
+    certs = {
+      "weirdnatto.in".email = "natto+acme@weirdnatto.in";    
+      "git.weirdnatto.in".email = "git+acme@weirdnatto.in";    
+    };
+  };
+  security.pki.certificateFiles = [ ../../cert.pem ];
+}