feat: add initial config

system/boot.nix

@@ -0,0 +1,5 @@
+{ ... }:
+{
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+}

system/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./sops.nix
+    ./users.nix
+    ./network.nix
+    ./boot.nix
+  ];
+}

system/network.nix

@@ -0,0 +1,15 @@
+{ config, pkgs, lib, ... }:
+
+{
+  networking.hostName = "nixos-proxy";
+  networking.useDHCP = false;
+  networking.interfaces.eth0.ipv4.addresses = [
+    { address = "193.31.24.99"; prefixLength = 22; }
+  ];
+  networking.defaultGateway = "193.31.24.1";
+  networking.interfaces.eth0.ipv6.addresses = [
+    { address = "2a03:4000:2b:1836:748d:84ff:fe53:2a09"; prefixLength = 64; }
+  ];
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
+  networking.nameservers = [ "1.1.1.1" "9.9.9.9" "2606:4700:4700::1111" "2620:fe::fe" ];
+}

system/sops.nix

@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+let
+  secretData = import ../intermediate/secrets.nix;
+in
+{
+  sops = {
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+    secrets = secretData.byName;
+  };
+
+  warnings = lib.optional (secretData.missing != [])
+    "Some SOPS source files are missing or not yet encrypted; no runtime secrets will be provisioned for: ${builtins.concatStringsSep ", " (map (item: builtins.concatStringsSep "_" item.path) secretData.missing)}";
+}

system/users.nix

@@ -0,0 +1,32 @@
+{ config, pkgs, lib, ... }:
+
+{
+  users.mutableUsers = false;
+
+  users.users.nudelerde = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    hashedPassword = "$y$j9T$NiaiVxQKs0C1V4VdCFKBO.$P6RfBDTyJfPJJzKyHf9PJEy9Ku5M6AU57U98nVD6wP6";
+  };
+
+  users.users.autossh-incoming = {
+    isSystemUser = true;
+    group = "autossh-incoming";
+    createHome = true;
+    home = "/var/lib/autossh-incoming";
+  };
+
+  users.groups.autossh-incoming = {};
+
+  security.sudo.extraRules = [
+    {
+      users = [ "nudelerde" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+}