infra/configuration.nix

{
  config,
  modulesPath,
  pkgs,
  lib,
  ...
}:

{
  imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];

  systemd.suppressedSystemUnits = [
    "dev-mqueue.mount"
    "sys-kernel-debug.mount"
    "sys-fs-fuse-connections.mount"
  ];

  nix = {
    optimise = {
      automatic = true;
      dates = [ "11:00" ];
    };
    settings = {
      auto-optimise-store = true;
      sandbox = false;
      # Allow remote updates
      trusted-users = [
        "root"
        "@wheel"
      ];
      experimental-features = [
        "nix-command"
        "flakes"
      ];
    };
    gc = {
      automatic = true;
      options = "--delete-older-then 14d";
    };
  };

  nixpkgs.hostPlatform = "x86_64-linux";

  environment.systemPackages = with pkgs; [
    vim
    git
  ];

  proxmoxLXC = {
    manageNetwork = false;
    manageHostName = false;
    privileged = true;
  };

  users.users.root = {
    packages = with pkgs; [
      kitty # for terminfo
      fastfetch # for shits and giggles
      tmux
    ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILwYcSxbP6Hon//kZFIZJSHdqvsJ6AyCwH4JP9/t4q46 xengi@yuka_2020-12-16"
    ];
  };

  networking = {
    hostname = "matrix";
    domain = "berlin.ccc.de";
    nameservers = [
      "2606:4700:4700::1111#one.one.one.one"
      "2620:fe::fe#dns.quad9.net"
    ];
    useDHCP = false;
    useNetworkd = true;
    dhcpcd.enable = false;
    nftables.enable = true;
    tempAddresses = "disabled";
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22
        80 # HTTP/1
        443 # HTTP/2
        8448 # Matrix federation
        10022 # SSH
      ];
      allowedUDPPorts = [
        443 # HTTP/3
      ];
    };
  };

  time.timeZone = "Europe/Berlin";
  i18n.defaultLocale = "en_US.UTF-8";
  console.font = "Lat2-Terminus16";

  services = {
    fstrim.enable = false; # Let Proxmox host handle fstrim
    openssh = {
      enable = true;
      ports = [ 22 10022 ];
      settings = {
        PermitEmptyPasswords = "no";
        PermitRootLogin = "prohibit-password";
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
      };
      banner = ''
                            __                                               __
                           /\ \__         __                                /\ \
          ___ ___      __  \ \ ,_\  _ __ /\_\   __  _      ___    ___    ___\ \ \____
        /' __` __`\  /'__`\ \ \ \/ /\`'__\/\ \ /\ \/'\    /'___\ /'___\ /'___\ \ '__`\
        /\ \/\ \/\ \/\ \L\.\_\ \ \_\ \ \/ \ \ \\/>  </   /\ \__//\ \__//\ \__/\ \ \L\ \
        \ \_\ \_\ \_\ \__/.\_\\ \__\\ \_\  \ \_\/\_/\_\  \ \____\ \____\ \____\\ \_,__/
         \/_/\/_/\/_/\/__/\/_/ \/__/ \/_/   \/_/\//\/_/   \/____/\/____/\/____/ \/___/
      '';
    };
    sshguard = {
      enable = true;
      services = [ "sshd" ];
    };
    # Cache DNS lookups to improve performance
    resolved = {
      enable = true;
      fallbackDns = [
        "1.1.1.1#one.one.one.one"
        "9.9.9.9#dns.quad9.net"
      ];
      dnssec = "allow-downgrade";
      dnsovertls = "true";
      extraConfig = ''
        Cache=true
        CacheFromLocalhost=true
      '';
    };
  };

  programs = {
    vim = {
      enable = true;
      defaultEditor = true;
    };
    htop = {
      enable = true;
    };
    ssh.startAgent = true;
  };

  security = {
    acme = {
      acceptTerms = true;
      defaults = {
        validMinDays = 14;
        renewInterval = "daily";
        email = "acme@xengi.de";
        group = "nginx";
      };
    };
  };

  system.stateVersion = "25.05";
}