hosts/mermet/users/julm.nix

   1 { lib, config, ... }:
   2 let
   3   inherit (config.users) users;
   4 in
   5 {
   6   imports = [
   7     ../../../users/julm.nix
   8   ];
   9
  10   users.users.julm = {
  11     hashedPassword = lib.readFile julm/hashedPassword.clear;
  12     openssh.authorizedKeys.keys = map lib.readFile [
  13       ../../../users/julm/ssh/mob.pub
  14       ../../../users/julm/ssh/losurdo.pub
  15     ];
  16     extraGroups = [
  17       "tor"
  18       "wheel"
  19     ];
  20   };
  21
  22   users.users.root.openssh.authorizedKeys.keys =
  23       users."julm".openssh.authorizedKeys.keys;
  24
  25   nix.settings.trusted-users = [
  26     users."julm".name
  27   ];
  28
  29   services.sanoid.datasets = {
  30     "rpool/home/julm/mail" = {
  31       use_template = [ "snap" ];
  32       # Not until https://github.com/jimsalterjrs/sanoid/pull/342#issuecomment-980494511 has been fixed
  33       #hourly = 12;
  34       daily = 7;
  35     };
  36     "rpool/home/julm/log" = {
  37       use_template = [ "snap" ];
  38       # Not until https://github.com/jimsalterjrs/sanoid/pull/342#issuecomment-980494511 has been fixed
  39       #hourly = 12;
  40       daily = 7;
  41       monthly = 1;
  42     };
  43     "rpool/backup/losurdo/home/julm/work" = {
  44       use_template = [ "prune" ];
  45       daily = 31;
  46     };
  47   };
  48
  49   networking.nftables.ruleset = ''
  50     table inet filter {
  51       chain output-net-julm {
  52         tcp dport {smtp, submissions} counter accept comment "SMTP"
  53         tcp dport nicname counter accept comment "Whois"
  54         tcp dport imaps counter accept comment "IMAPS"
  55         tcp dport ircs-u counter accept comment "IRCS"
  56         tcp dport 2222 counter accept comment "SSH(boot)"
  57         tcp dport xmpp-client counter accept comment "XMPP"
  58         tcp dport hkp counter accept comment "HKP"
  59         tcp dport {9009,9010,9011,9012,9013} counter accept comment "croc"
  60         udp dport 33434-33523 counter accept comment "traceroute"
  61         udp dport 60000-61000 counter accept comment "Mosh"
  62       }
  63       chain output-net {
  64         skuid ${users.julm.name} jump output-net-julm
  65       }
  66     }
  67   '';
  68 }