NixOS configuration added

configuration.nix

@@ -0,0 +1,78 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+
+      # Services
+      ./services/ssh.nix
+      ./services/nginx.nix
+      ./services/nextcloud.nix
+      ./services/tt-rss.nix
+      ./services/owncast.nix
+
+      # Sites
+      ./sites/hermitcollective.net
+      ./sites/blog.hermitcollective.net
+      ./sites/hertog.hermitcollective.net
+
+      # Users
+      ./users/hertog.nix
+      ./users/sara.nix
+    ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "HermitCollective"; 
+  networking.domain = "hermitcollective.net";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Amsterdam";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # Configure keymap in X11
+  services.xserver = {
+    layout = "us";
+    xkbVariant = "";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Accept ACME terms
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "hertog@fsfe.org";  
+
+  environment.systemPackages = with pkgs; [
+     neofetch
+     helix
+     hyfetch
+     bottom
+     iftop
+     openssl     
+     git
+  ];
+
+  # Open ports in the firewall.
+   networking.firewall.allowedTCPPorts = [ 22 80 443 8080 8181 1935 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+}

services/nextcloud.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+
+{
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud27;
+    appstoreEnable = true;
+    hostName = "cloud.hermitcollective.net";
+    config.adminpassFile = "/etc/nextcloud-admin-pass";
+    https = true;
+  };
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+    forceSSL = true;
+    enableACME = true;
+  };
+}

services/nginx.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }:
+
+{
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+} 

services/owncast.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, ... }:
+
+{
+  services.owncast = {
+    enable = true;
+    port = 8181;
+    openFirewall = true;
+  };
+  # Homepage
+  services.nginx.virtualHosts."live.hermitcollective.net" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:8181";
+        proxyWebsockets = true; # needed if you need to use WebSocket
+        extraConfig =
+          # required when the target is also TLS server with multiple hosts
+          "proxy_ssl_server_name on;" +
+          # required when the server wants to use HTTP Authentication
+          "proxy_pass_header Authorization;"
+          ;
+      };
+  };
+}

services/ssh.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+
+{  # Enable and configure openssh
+   services.openssh = {
+     enable = true;
+     settings = {
+       PasswordAuthentication = false;
+       PermitRootLogin = "no";
+       X11Forwarding = false;
+     };
+   };
+}

services/tt-rss.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, lib, ... }:
+
+{
+
+  services.tt-rss = {
+    enable = true;                                           # Enable TT-RSS
+    database = {                                             # Configure the database
+      type = "pgsql";                                        # Database type
+      passwordFile = "/etc/tt-rss-pass";                     # Where to find the password
+    };
+    email = {
+      fromAddress = "feeds@hermitcollective.net"; # Address for outgoing email
+      fromName = "Feeds from HermitCollective";   # Display name for outgoing email
+    };
+    selfUrlPath = "https://feeds.hermitcollective.net/"; # Root web URL
+    virtualHost = "feeds.hermitcollective.net";          # Setup a virtualhost
+  };
+
+  services.postgresql = {
+    enable = true;                            # Ensure postgresql is enabled
+    authentication = ''
+      local tt_rss all ident map=tt_rss-users
+    '';
+    identMap =                                # Map the tt-rss user to postgresql
+      ''
+        tt_rss-users tt_rss tt_rss
+      '';
+  };
+  
+  services.nginx.virtualHosts."feeds.hermitcollective.net" = {                              # TT-RSS hostname
+      enableACME = true;                                                       # Use ACME certs
+      forceSSL = true;                                                         # Force SSL
+    };
+  };
+}

sites/blog.hermitcollective.net

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  # Reqeusts SSL and adds the site to nginx
+  services.nginx.virtualHosts."blog.hermitcollective.net" = {
+     forceSSL = true;
+     enableACME = true;
+     root = "/var/www/blog.hermitcollective.net";
+  };
+} 

sites/hermitcollective.net

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  # Reqeusts SSL and adds the site to nginx
+  services.nginx.virtualHosts."hermitcollective.net" = {
+     forceSSL = true;
+     enableACME = true;
+     root = "/var/www/hermitcollective.net";
+  };
+} 

sites/hertog.hermitcollective.net

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  # Reqeusts SSL and adds the site to nginx
+  services.nginx.virtualHosts."hertog.hermitcollective.net" = {
+     forceSSL = true;
+     enableACME = true;
+     root = "/var/www/hertog.hermitcollective.net";
+  };
+} 

users/hertog.nix

@@ -0,0 +1,10 @@
+  { config, pkgs, ... }:
+{
+  users.users.hertog = {
+    isNormalUser = true;
+    description = "Johannes Hendrik Gerard van der Weide";    
+    extraGroups = [ "networkmanager" "wheel" "podman" ];
+    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEjpvCSpIUMsZ8pmz2LbvsJUdYroenTp6PYXw9ACiYBq hertog@fsfe.org"];
+  packages = with pkgs; [];
+  };
+}

users/sara.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  users.users.sara = {
+    isNormalUser = true;
+    description = "Sara Gerretsen";
+    extraGroups = [ "networkmanager" "wheel" "podman" ];
+    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBhmYV/SSGScbig1xXa7EHFwaxtD0e0QCorPUromR0nM sara@fedora-fw"];
+    packages = with pkgs; [
+       # User packages go here
+    ];
+  };
+}