summaryrefslogtreecommitdiff
path: root/Biz/OsBase.nix
diff options
context:
space:
mode:
authorBen Sima <ben@bsima.me>2024-11-15 14:55:37 -0500
committerBen Sima <ben@bsima.me>2024-12-21 10:06:49 -0500
commit6513755670892983db88a6633b8c1ea6019c03d1 (patch)
tree44e9eccdb7a3a74ab7e96a8fee7572dd6a78dc73 /Biz/OsBase.nix
parentae7b7e0186b5f2e0dcd4d5fac0a71fa264caedc2 (diff)
Re-namespace some stuff to Omni
I was getting confused about what is a product and what is internal infrastructure; I think it is good to keep those things separate. So I moved a bunch of stuff to an Omni namespace, actually most stuff went there. Only things that are explicitly external products are still in the Biz namespace.
Diffstat (limited to 'Biz/OsBase.nix')
-rw-r--r--Biz/OsBase.nix42
1 files changed, 0 insertions, 42 deletions
diff --git a/Biz/OsBase.nix b/Biz/OsBase.nix
deleted file mode 100644
index 3e69d8e..0000000
--- a/Biz/OsBase.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ pkgs, config, ... }:
-let ports = import ./Cloud/Ports.nix;
-in {
- boot.tmp.cleanOnBoot = true;
- fonts.fonts = with pkgs; [
- google-fonts
- mononoki
- source-code-pro
- fantasque-sans-mono
- hack-font
- fira
- fira-code
- fira-code-symbols
- ];
- networking.firewall.allowPing = true;
- nix.settings.substituters =
- [ "https://cache.nixos.org" ]; # "ssh://dev.simatime.com" ];
- nix.gc.automatic = true;
- nix.gc.dates = "Sunday 02:15";
- nix.optimise.automatic = true;
- nix.optimise.dates = [ "Sunday 02:30" ];
- nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
- nix.settings.trusted-users = [ "ben" ];
- programs.ccache.enable = true;
- programs.mosh.enable = true;
- programs.mosh.withUtempter = true;
- security.acme.defaults.email = "ben@bsima.me";
- security.acme.acceptTerms = true;
- security.sudo.wheelNeedsPassword = false;
- services.clamav.daemon.enable = true; # security
- services.clamav.updater.enable = true; # security
- services.fail2ban.enable = true; # security
- services.fail2ban.ignoreIP = [ ports.bensIp ]; # my home IP
- services.fail2ban.maxretry = 10;
- services.openssh.enable = true;
- services.openssh.openFirewall = true;
- services.openssh.settings.X11Forwarding = true;
- services.openssh.settings.PasswordAuthentication = false;
- services.openssh.settings.PermitRootLogin = "prohibit-password";
- system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin
- zramSwap.enable = true;
-}