nixos-dotfiles

# home-server-base.nix - Base configuration for home server

#

# This provides the foundation for your homelab:

# - Cloudflare DDNS (updates chat.tonybtw.com to your home IP)

# - Nginx reverse proxy (handles SSL for all services)

# - Fail2ban (basic protection)

# - SSH hardening (less strict than VPS since it's on your LAN)

#

# Import this in your configuration.nix along with service-specific configs

#

{ config, pkgs, lib, ... }:

{

  # ============================================================================

  # Cloudflare Dynamic DNS - Keeps your domain pointing to home IP

  # ============================================================================

  services.cloudflare-dyndns = {

    enable = true;

    apiTokenFile = "/root/secrets/cloudflare-token";

    domains = [

      "chat.tonybtw.com"

      # Add more as you expand:

      # "jellyfin.tonybtw.com"

      # "cloud.tonybtw.com"

    ];

    ipv4 = true;

    ipv6 = false;  # Enable if you have IPv6

  };

  # ============================================================================

  # Nginx Reverse Proxy - Handle SSL and route to services

  # ============================================================================

  services.nginx = {

    enable = true;

    recommendedProxySettings = true;

    recommendedTlsSettings = true;

    recommendedOptimisation = true;

    recommendedGzipSettings = true;

    # Shared SSL configuration (Let's Encrypt)

    # Individual vhosts will reference this

  };

  # ============================================================================

  # Let's Encrypt SSL Certificates

  # ============================================================================

  security.acme = {

    acceptTerms = true;

    defaults = {

      email = "tony@tonybtw.com";  # CHANGE THIS to your email

      dnsProvider = "cloudflare";  # Use Cloudflare DNS challenge (works behind NAT)

      credentialsFile = "/root/secrets/cloudflare-acme-credentials";

    };

    certs."chat.tonybtw.com" = {

      domain = "chat.tonybtw.com";

      extraDomainNames = [

        "conference.chat.tonybtw.com"

        "upload.chat.tonybtw.com"

      ];

      group = "prosody";

      postRun = "systemctl reload prosody.service";

    };

    # Add more certs as you expand:

    # certs."jellyfin.tonybtw.com" = {

    #   domain = "jellyfin.tonybtw.com";

    #   group = "jellyfin";

    # };

  };

  # ============================================================================

  # Firewall - Allow necessary ports

  # ============================================================================

  networking.firewall = {

    enable = true;

    # Open ports for services

    allowedTCPPorts = [

      22    # SSH (consider changing to non-standard port)

      80    # HTTP (ACME challenges + redirect to HTTPS)

      443   # HTTPS (Nginx reverse proxy)

      5222  # XMPP client-to-server (C2S)

      5269  # XMPP server-to-server (S2S) - optional, for federation

      5281  # XMPP HTTPS (file uploads)

      # Add more as needed:

      # 8096  # Jellyfin (or proxy via Nginx)

    ];

    # Basic rate limiting

    extraCommands = ''

      # Rate-limit SSH (4 attempts per minute)

      iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH

      iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP

      # Rate-limit XMPP connections

      iptables -A INPUT -p tcp --dport 5222 -m state --state NEW -m recent --set --name XMPP

      iptables -A INPUT -p tcp --dport 5222 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name XMPP -j DROP

    '';

    extraStopCommands = ''

      iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH 2>/dev/null || true

      iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP 2>/dev/null || true

      iptables -D INPUT -p tcp --dport 5222 -m state --state NEW -m recent --set --name XMPP 2>/dev/null || true

      iptables -D INPUT -p tcp --dport 5222 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name XMPP -j DROP 2>/dev/null || true

    '';

  };

  # ============================================================================

  # Fail2ban - Basic Protection

  # ============================================================================

  services.fail2ban = {

    enable = true;

    maxretry = 5;  # Less strict than VPS (you might fat-finger your password)

    bantime = "10m";

    findtime = "10m";

    jails = {

      sshd = ''

        enabled = true

        filter = sshd

        action = iptables[name=SSH, port=22, protocol=tcp]

        maxretry = 5

      '';

    };

  };

  # ============================================================================

  # SSH Configuration - Moderate Security (it's on your LAN)

  # ============================================================================

  services.openssh = {

    enable = true;

    settings = {

      PasswordAuthentication = true;  # Allow passwords on LAN (change to false if paranoid)

      PermitRootLogin = "no";

      PubkeyAuthentication = true;

    };

  };

  # ============================================================================

  # Automatic Garbage Collection

  # ============================================================================

  nix.gc = {

    automatic = true;

    dates = "weekly";

    options = "--delete-older-than 30d";

  };

  # ============================================================================

  # System Packages

  # ============================================================================

  environment.systemPackages = with pkgs; [

    vim

    wget

    curl

    htop

    tmux

    git

    btop

    ncdu  # Disk usage analyzer

  ];

  # ============================================================================

  # Secrets Management

  # ============================================================================

  # You'll need to create these files manually (see deployment guide)

  system.activationScripts.secrets = ''

    mkdir -p /root/secrets

    chmod 700 /root/secrets

  '';

}