server/hosts/kamoshi/configuration.nix

{ config, pkgs, ... }:
{
  imports =
    [
      /etc/nixos/hardware-configuration.nix
      # /profiles/freshrss.nix
      # ./profiles/cgit.nix
      # ./profiles/kotori.nix
    ];

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  # boot.loader.grub.efiSupport = true;
  # boot.loader.grub.efiInstallAsRemovable = true;
  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
  # Define on which hard drive you want to install Grub.
  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only

  system = {
    autoUpgrade = {
      enable = true;
      allowReboot = true;
    };
  };

  nix = {
    optimise.automatic = true;
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 30d";
    };
  };

  networking = {
    hostName = "kamoshi";
    # nat = {
    #   enable = true;
    #   externalInterface = "eth0";
    #   internalInterfaces = [ "wg0" ];
    # };
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22           # endlessh
        80           # nginx
        443          # nginx TLS
        2222         # ssh
        # 22070 22067  # syncthing relay
      ];
      # allowedUDPPorts = [
      #   42069 # wireguard
      # ];
      # interfaces = {
      #   "wg0" = {
      #     allowedTCPPorts = [
      #       8384 22000    # syncthing
      #     ];
      #     allowedUDPPorts = [
      #       22000 21027   # syncthing
      #     ];
      #   };
      # };
    };
    # wireguard.interfaces = {
    #   "wg0" = {
    #     ips = [ "10.100.0.1/24" ];
    #     listenPort = 42069;
    #     postSetup = ''
    #       ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
    #     '';
    #     postShutdown = ''
    #       ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
    #     '';
    #     privateKeyFile = "/root/secrets/wireguard/kamoshi";
    #
    #     peers = [
    #       {
    #         publicKey = "26lQ3qCZrZ3hAqLIDfQNrmFQSQv983TeyXpJUY59QkI=";
    #         allowedIPs = [ "10.100.0.2/32" ];
    #       }
    #       {
    #         publicKey = "W3HCbtf/m/MUZSTTq/Dr9w0mfHjH5eYfOxWtq+eLFXw=";
    #         allowedIPs = [ "10.100.0.3/32" ];
    #       }
    #     ];
    #   };
    # };
  };

  time.timeZone = "Europe/Warsaw";
  i18n.defaultLocale = "en_US.UTF-8";

  users.users.kamov = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keyFiles = [ /root/secrets/ssh/kamov.pub ];
  };

  environment.systemPackages = with pkgs; [
    git
    vim
    wget
    neovim
    # neofetch
    # nushell
    # wireguard-tools
  ];

  services = {
    endlessh = {
      enable = true;
      port = 22;
    };
    openssh = {
      enable = true;
      ports = [ 2222 ];
      settings = {
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
      };
    };
    nginx = {
      enable = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      virtualHosts = {
        "kamoshi.org" = {
          root = "/var/www/kamoshi.org";
          forceSSL = true;
          enableACME = true;
        };
      };
    };
    # syncthing = {
    #   enable = true;
    #   user = "kamov";
    #   dataDir = "/home/kamov/sync";
    #   configDir = "/home/kamov/sync/.config";
    #   guiAddress = "0.0.0.0:8384";
    #   extraOptions.gui = {
    #     user = "admin";
    #     password = "admin";
    #   };
    #   # public relay options
    #   relay = {
    #     enable = true;
    #     providedBy = "kamoshi.org";
    #     statusPort = 22070;
    #     port = 22067;
    #     globalRateBps = 25000;
    #   };
    # };
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "maciej@kamoshi.org";
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?

}