nixos-config/hosts/x86_64-linux/beleth/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:
with lib; {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./monitoring.nix
    ./jellyfin.nix
    ./calibre-web.nix
    ./transmission.nix
    ./lanrarari.nix
    ./uptime.nix
    ./networking.nix
    ./git.nix
    ./nextcloud.nix
    ./paperless.nix
    ./docker.nix
    # ./borg.nix
    # ./nfs.nix
    ../../gc.nix
    ../../../common
  ];

  services.caddy = {
    enable = true;
    email = "xqtc@tutanota.com";
    # configFile = pkgs.writeText "Caddyfile" ''
    #                 heroin.trade {
    #                 	root * /var/www/website/public/
    #      		handle_errors {
    #      	rewrite * /404.html
    #      	file_server
    #      }
    #                 	file_server
    #                 }
    #                 syncthing.heroin.trade {
    #            reverse_proxy http://localhost:8384 {
    #     	header_up Host {upstream_hostport}
    #            }
    #                 }
    #                 demos.heroin.trade {
    #            root * /var/www/demos/
    #            file_server browse
    #                 }
    #   git.heroin.trade {
    #    reverse_proxy http://localhost:3002
    #   }
    #
    #                 jellyfin.heroin.trade {
    #                 	reverse_proxy http://127.0.0.1:8096
    #                 }
    #
    #                 calibre.heroin.trade {
    #            reverse_proxy http://localhost:3000
    #                 }
    #
    #                 grafana.heroin.trade {
    #            reverse_proxy http://127.0.0.1:2342
    #                 }
    #
    #      	   uptime.heroin.trade {
    #      	      reverse_proxy 127.0.0.1:3001
    #      	    }
    # '';
    virtualHosts = {
      "heroin.trade" = {
        extraConfig = ''
               root * /var/www/website/public/
               handle_errors {
          rewrite * /404.html
                 file_server
               }
               file_server
        '';
      };
      "syncthing.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://localhost:8384 {
            header_up Host {upstream_hostport}
          }
        '';
      };
      "demos.heroin.trade" = {
        extraConfig = ''
          root * /var/www/demos/
          file_server browse
        '';
      };
      "git.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://localhost:3002
        '';
      };
      "jellyfin.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://127.0.0.1:8096
	  redir /metrics* /
        '';
      };
      "calibre.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://localhost:3000
        '';
      };
      "grafana.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://127.0.0.1:2342
        '';
      };
      "uptime.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://127.0.0.1:3001
        '';
      };
      "paperless.heroin.trade" = {
        extraConfig = ''
          reverse_proxy http://127.0.0.1:28981
        '';
      };
      "servers" = {
	extraConfig = ''
	  metrics
	'';
      };
    };
  };

  services.syncthing.settings.gui.insecureSkipHostcheck = true;

  nix.settings.experimental-features = ["nix-command" "flakes"];

  nix.settings = {
    trusted-users = ["xqtc"];
    substituters = [
      "https://nix-community.cachix.org"
    ];
    trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
    ];
  };
  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "beleth"; # Define your hostname.
  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
  networking.wireguard.enable = true;

  # Set your time zone.
  time.timeZone = "Europe/Berlin";

  users.users.xqtc = {
    isNormalUser = true;
    extraGroups = ["wheel" "docker"];
    packages = with pkgs; [
      tree
    ];
    openssh.authorizedKeys.keys = [
      # TODO: Add remaining keys from https://meta.sr.ht/~xqrc.keys
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJTLJqIVwnqFO64rnc66d234TFOdFXpDS9fJUA4/f4in xqtc@alastor"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN7UkcmSVo+SeB5Obevz3mf3UHruYxn0UHUzoOs2gDBy xqtc@asmodeus"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPf3w5bHAssHthg9SPXVpG4w9v8m16X/0J3bjg08P6EA xqtc@seraphim"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYa+LoHGGvu12iBufUcr3GD8tsq4LuJdwLjaDkTr0SL xqtc@lilith"
    ];
  };
  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJTLJqIVwnqFO64rnc66d234TFOdFXpDS9fJUA4/f4in xqtc@alastor"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN7UkcmSVo+SeB5Obevz3mf3UHruYxn0UHUzoOs2gDBy xqtc@asmodeus"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPf3w5bHAssHthg9SPXVpG4w9v8m16X/0J3bjg08P6EA xqtc@seraphim"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYa+LoHGGvu12iBufUcr3GD8tsq4LuJdwLjaDkTr0SL xqtc@lilith"
  ];

  programs.bash.blesh.enable = true;
  # programs.bash.shellInit = "cd /home/xqtc/nixos-config/; export GIT_REVISION_CONFIG=$(nix flake metadata --json | jq -r '.locked.rev'); echo $GIT_REVISION_CONFIG; cd;";

  environment.systemPackages = with pkgs; [
    neovim
    vim
    git
    wget
    jq
    zola
  ];

  programs.mtr.enable = true;
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
  };

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;
  programs.ssh.extraConfig = ''
    Host frotting
      HostName 	2a0f:be01:0:100::a3
      User 	communism
  '';

  services.mullvad-vpn.enable = true;

  # Open ports in the firewall.
  networking.nftables.enable = true;
  networking.firewall.allowedTCPPorts = [22 80 443];
  networking.firewall.allowedUDPPorts = [51820];

  system.stateVersion = "24.05"; # Did you read the comment?
}