1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

{ config, pkgs, lib, authKeys, ... }:

let
  tailscaleInterface = "tailscale0";

  hostname = "leguin";

in

{
  imports = [
    ./base-server.nix
    (import ./profpatsch-thinkpad.nix { cpuType = "intel"; })
  ];

  config = {

    boot.initrd.luks.devices.cryptroot.device = "/dev/disk/by-label/root";

    fileSystems."/" = {
      device = "/dev/disk/by-label/nixos";
      fsType = "btrfs";
      options = [ "ssd" ];
    };

    fileSystems."/boot" = {
      device = "/dev/disk/by-label/BOOT";
      fsType = "vfat";
      options = ["nofail"];
    };

    users.users = {
      root.openssh.authorizedKeys.keys = authKeys;
    };

    security.acme.acceptTerms = true;
    security.acme.defaults.email = "mail@profpatsch.de";

    networking = {

      hostName = hostname;
      firewall = {
        allowedTCPPorts = [
          80 443
        ];
        allowedUDPPorts = [
        ];

        interfaces.${tailscaleInterface} = {
          allowedTCPPorts = [
          ];
        };
      };

    };

    services.logind.extraConfig = lib.generators.toKeyValue {} {

      # I don’t want the machine to go off immediately
      # when I accidentally touch the power button.
      HandlePowerKey = "ignore";
      HandlePowerKeyLongPress = "poweroff";

      # as long as the machine is connected to power,
      # it needs to be closed to preserve the monitor
      HandleLidSwitchExternalPower = "ignore";
      HandleLidSwitchDocked = "ignore";

    };

    services.tailscale = {
      enable = true;
      interfaceName = tailscaleInterface;
    };
    # strict filtering breaks some tailscale features
    networking.firewall.checkReversePath = "loose";
  };
}