nixos-config/config/host-config/limina.nix

{ config, lib, pkgs, ... }:

with lib;
let
  primary-ip = "10.0.0.6";

  host-config = config.fudo.hosts.${config.instance.hostname};
  site-name = host-config.site;
  site = config.fudo.sites.${site-name};
  domain-name = host-config.domain;
  domain = config.fudo.domains.${domain-name};

  dns-proxy-port = 5335;

in {
  config = {

    # TODO: remove?
    nixpkgs.config.permittedInsecurePackages = [
      "openssh-with-gssapi-8.4p1" # CVE-2021-28041
    ];

    networking = {
      firewall = {
        enable = true;
        trustedInterfaces = [ "intif0" "intif1" "intif2" "lo" ];
        allowedTCPPorts = [ 22 ];
      };

      interfaces = {
        extif0 = { useDHCP = true; };

        intif0 = {
          useDHCP = false;
          ipv4.addresses = [{
            address = primary-ip;
            prefixLength = 22;
          }];
        };
        intif1 = { useDHCP = false; };
        intif2 = { useDHCP = false; };
      };

      nat = {
        enable = true;
        externalInterface = "extif0";
        internalInterfaces = [ "intif0" ];
      };
    };

    fudo = {
      local-network = {
        enable = false;
        domain = domain-name;
        dns-servers = [ primary-ip ];
        gateway = primary-ip;
        dhcp-interfaces = [ "intif0" ];
        dns-listen-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
        recursive-resolver = "1.1.1.1";
        network = site.network;
        dhcp-dynamic-network = site.dynamic-network;
        search-domains = [ domain-name "fudo.org" ];
        enable-reverse-mappings = true;
        network-definition = config.fudo.networks.${domain-name};
      };

      client.dns = {
        enable = true;
        ipv4 = true;
        ipv6 = true;
        user = "fudo-client";
        external-interface = "extif0";
        password-file = "/srv/client/secure/client.passwd";
      };

      garbage-collector = {
        enable = true;
        timing = "weekly";
      };

      secure-dns-proxy = {
        enable = true;
        listen-port = dns-proxy-port;
        upstream-dns =
          [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
        bootstrap-dns = "1.1.1.1";
        allowed-networks =
          [ "1.1.1.1/32" "1.0.0.1/32" "10.0.0.0/16" "localhost" "link-local" ];
        listen-ips = [ primary-ip ];
      };
    };

    virtualisation = {
      docker = {
        enable = true;
        autoPrune.enable = true;
        enableOnBoot = true;
      };

      oci-containers = {
        backend = "docker";
        containers = {
          pihole = {
            image = "pihole/pihole:v5.7";
            autoStart = true;
            ports = [ "5353:53/tcp" "5353:53/udp" "3080:80/tcp" ];
            environment = {
              # ServerIP = primary-ip;
              VIRTUAL_HOST = "dns-hole.sea.fudo.org";
              DNS1 = "${primary-ip}#${toString dns-proxy-port}";
            };
            volumes = [
              "/srv/pihole/etc-pihole/:/etc/pihole/"
              "/srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
            ];
          };
        };
      };
    };

    services.nginx = {
      enable = true;

      recommendedOptimisation = true;
      recommendedGzipSettings = true;
      recommendedProxySettings = true;

      virtualHosts = {
        "dns-hole.${domain-name}" = {
          serverAliases = [
            "pihole.${domain-name}"
            "hole.${domain-name}"
            "pihole"
            "dns-hole"
            "hole"
          ];

          locations."/" = { proxyPass = "http://127.0.0.1:3080"; };
        };
      };
    };

    # Support for statelessness
    environment.etc = {
      nixos.source = "/state/nixos";
      adjtime.source = "/state/etc/adjtime";
      NIXOS.source = "/state/etc/NIXOS";
      machine-id.source = "/state/etc/machine-id";
      "host-config.nix".source = "/state/etc/host-config.nix";
    };

    boot.initrd.postDeviceCommands = lib.mkAfter ''
      ${pkgs.zfs}/bin/zfs rollback -r zroot/transient/root@blank
    '';

    security.sudo.extraConfig = ''
      # rollback results in sudo lectures after each reboot
      Defaults lecture = never
    '';

    systemd.tmpfiles.rules = [
      "L /root/.gnupg - - - - /state/root/gnupg"
      "L /root/.emacs.d - - - - /state/root/emacs.d"
      "L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
      "L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
      "L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
      "L /etc/ssh/ssh_host_ed25519_key - - - - /state/ssh/ssh_host_ed25519_key"
      "L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
    ];

    services.openssh = {
      hostKeys = [
        {
          path = "/state/ssh/ssh_host_ed25519_key";
          type = "ed25519";
        }
        {
          path = "/state/ssh/ssh_host_rsa_key";
          type = "rsa";
          bits = 4096;
        }
      ];
    };
  };
}