more things added

flake.lock

@@ -22,16 +22,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1734119587,
+        "lastModified": 1734536697,
-        "narHash": "sha256-AKU6qqskl0yf2+JdRdD0cfxX4b9x3KKV5RqA6wijmPM=",
+        "narHash": "sha256-G/HnRTtU+ob8x967kjzMRqjNFbAdllrcjYc+IcaR15Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3566ab7246670a43abd2ffa913cc62dad9cdf7d5",
+        "rev": "9c40bef08a5bdc0ccc3207f4282a1ded83e77a7a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -13,11 +13,14 @@
   outputs =
     inputs@{ self, nixpkgs, ... }:
     let
-      kclib = (import ./lib.nix);
+      kclib = import ./lib.nix {
+        nixpkgs = inputs.nixpkgs;
+        inputs = inputs;
+      };
     in
     {
       nixosConfigurations = {
-        gateway = kclib.mkHost "gateway" "x86_64-linux";
+        tailscale-proxy = kclib.mkHost "tailscale-proxy" "x86_64-linux";
         entrypoint = kclib.mkHost "entrypoint" "x86_64-linux";
       };
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;

hosts/base.nix

@@ -0,0 +1,23 @@
+{
+  ...
+}:
+{
+  nixpkgs.config.allowUnfree = true;
+
+  kropcloud = {
+    admin = {
+      user = "krop";
+      sshKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl0Rdo2kHliBeIiPuiO4kYO5M0VZFNXw4siepV1p6Pj krop@wenar-nix"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOUnlAjPnMwJYgZb7YuholdTxifOEFnAyXVqI+xFlHw6 krop@lenar"
+      ];
+    };
+    services = {
+      ssh = {
+        enable = true;
+      };
+    };
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/gateway.nix

@@ -1 +0,0 @@
-{ }: { }

hosts/tailscale-proxy.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  kropcloud = {
+    services = {
+      tailscale = {
+        enable = true;
+        asRouter.enable = true;
+      };
+    };
+  };
+}

lib.nix

@@ -1,19 +1,27 @@
 {
   nixpkgs,
-  lib,
   inputs,
 }:
 {
-  mkHost = name: arch: {
+  mkHost =
-    nixpkgs.lib.nixosSystem = {
+    name: arch:
+    nixpkgs.lib.nixosSystem {
       system = arch;
       modules = [
+        ./hosts/base.nix
         ./hosts/${name}.nix
         ./nixosModules
+        (
+          { ... }:
+          {
+            config = {
+              networking.hostName = name;
+            };
+          }
+        )
       ];
       specialArgs = {
         inherit inputs;
       };
     };
-  };
 }

nixosModules/default.nix

@@ -1 +1,9 @@
-{ }: { }
+{ ... }:
+{
+  imports = [
+    ./services
+    ./networking
+    ./users
+    ./locale
+  ];
+}

nixosModules/locale/default.nix

@@ -0,0 +1,52 @@
+{ config, lib, ... }:
+let
+  cfg = config.kropcloud.locale;
+in
+{
+  options.kropcloud.locale = {
+    timeZone = lib.mkOption {
+      type = lib.types.str;
+      default = "Europe/Prague";
+      description = "The timezone for the system.";
+    };
+    keyMap = lib.mkOption {
+      type = lib.types.str;
+      default = "cz-lat2";
+      description = "The keymap to use for console input.";
+    };
+    defaultLocale = lib.mkOption {
+      type = lib.types.str;
+      default = "en_GB.UTF-8";
+      description = "The default locale for the system.";
+    };
+    extraLocale = lib.mkOption {
+      type = lib.types.str;
+      default = "cs_CZ.UTF-8";
+      description = "The locale to apply uniformly to all LC_* categories.";
+    };
+  };
+
+  config = {
+    # Set the system timezone.
+    time.timeZone = cfg.timeZone;
+
+    # Set the default locale.
+    i18n.defaultLocale = cfg.defaultLocale;
+
+    # Apply the same locale to all LC_* categories.
+    i18n.extraLocaleSettings = lib.genAttrs [
+      "LC_ADDRESS"
+      "LC_IDENTIFICATION"
+      "LC_MEASUREMENT"
+      "LC_MONETARY"
+      "LC_NAME"
+      "LC_NUMERIC"
+      "LC_PAPER"
+      "LC_TELEPHONE"
+      "LC_TIME"
+    ] (_: cfg.extraLocale);
+
+    # Set the console keymap.
+    console.keyMap = cfg.keyMap;
+  };
+}

nixosModules/networking/default.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.kropcloud.networking;
+in
+{
+  options.kropcloud.networking = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      description = "Whence to configure networking";
+      default = true;
+      example = false;
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    networking = {
+      nftables.enable = true;
+      firewall = {
+        checkReversePath = "loose";
+      };
+    };
+  };
+}

nixosModules/services/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./ssh
+    ./tailscale
+  ];
+}

nixosModules/services/ssh/default.nix

@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.kropcloud.services.ssh;
+in
+{
+  options.kropcloud.services.ssh = {
+    enable = lib.mkEnableOption "Whence to enable sshd service.";
+  };
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+      };
+    };
+  };
+}

nixosModules/services/tailscale/default.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.kropcloud.services.tailscale;
+in
+{
+  options.kropcloud.services.tailscale = {
+    enable = lib.mkEnableOption "Whence to enable tailscale service.";
+    asRouter = {
+      enable = lib.mkEnableOption "Whence to configure tailscale as router.";
+      subnet = lib.mkOption {
+        type = lib.types.str;
+        default = "192.168.1.0/24";
+        example = "192.168.1.0/24";
+        description = "The subnet to expose";
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = lib.mkIf cfg.asRouter.enable "server";
+      extraSetFlags = lib.mkIf cfg.asRouter.enable [ "--advertise-routes=${cfg.asRouter.subnet}" ];
+    };
+  };
+}

nixosModules/users/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+let
+  cfg = config.kropcloud.admin;
+in
+{
+  options.kropcloud.admin = {
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "krop";
+      description = "Name of the admin user to be created.";
+    };
+    sshKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "List of SSH public keys to authorize for the admin user.";
+    };
+  };
+
+  config = {
+    # Define the admin user
+    users.users.${cfg.user} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = cfg.sshKeys;
+    };
+  };
+}