Modularised configs

nixos/homeserver/environment.nix

@@ -0,0 +1,39 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  unstablePkgs,
+  ...
+}: {
+  environment.etc =
+    lib.mapAttrs'
+    (name: value: {
+      name = "nix/path/${name}";
+      value.source = value.flake;
+    })
+    config.nix.registry
+    // {
+      "justfile" = {
+        text = ''
+          default:
+              @just -g --list
+
+          update-root:
+              if `/usr/bin/env grep -Rq "nixos" /etc/*-release`; then \
+                  nixos-rebuild switch --flake /home/cianh/.config/nix/#$HOSTNAME; \
+              fi
+        '';
+        mode = "0644";
+      };
+      "root_gitconfig" = {
+        text = ''
+          [safe]
+              directory = /home/cianh/.config/nix
+        '';
+      };
+    };
+  environment.systemPackages = [
+    pkgs.pinentry-tty
+  ];
+}

nixos/homeserver/packages.nix

@@ -0,0 +1,9 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  unstablePkgs,
+  ...
+}: {
+}

nixos/homeserver/programs.nix

@@ -0,0 +1,14 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  unstablePkgs,
+  ...
+}: {
+  programs.gnupg.agent = {
+    enable = true;
+    pinentryPackage = pkgs.pinentry-tty;
+    enableSSHSupport = true;
+  };
+}

nixos/homeserver/services.nix

@@ -0,0 +1,51 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  unstablePkgs,
+  ...
+}: {
+  services = {
+    # Enable the OpenSSH daemon and other remote tools.
+    openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+      extraConfig = "UsePAM yes";
+      # Enable GPG signing
+      pcscd.enable = true;
+    };
+  };
+  # Modify the SSH service to prioritise because server is headless
+  systemd.services.sshd = {
+    requires = []; # Remove any non-essential dependencies
+    after = ["network.target"]; # Only need to wait for networking (obviously)
+    serviceConfig = {
+      # If SSH dies, we want to restart it asap
+      Restart = "always";
+      RestartSec = "3";
+      StartLimitIntervalSec = "0";
+      # The CPU should never be too busy to respond to SSH
+      CPUSchedulingPolicy = "rr";
+      CPUSchedulingPriority = "99";
+      IOSchedulingClass = "realtime";
+      IOSchedulingPriority = "0";
+      # Finally, if the system hits an OOM, for the love of god dont kill SSH until last
+      OOMScoreAdjust = "-1000";
+    };
+  };
+
+  # Add custom services
+  systemd.services.pueued = {
+    enable = true;
+    description = "Pueue Daemon - CLI process scheduler and manager";
+    wantedBy = ["default.target"];
+    serviceConfig = {
+      Restart = "no";
+      ExecStart = "${pkgs.pueue.outPath}/bin/pueued -vv";
+    };
+  };
+}

nixos/homeserver/virtualisation.nix

@@ -0,0 +1,21 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  unstablePkgs,
+  ...
+}: {
+  virtualisation = {
+    containers.enable = true;
+
+    podman = {
+      enable = true;
+      # Create a `docker` alias for podman, to use it as a drop-in replacement
+      dockerCompat = true;
+      dockerSocket.enable = true;
+      # Required for containers under podman-compose to be able to talk to each other.
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+}