# vultr-security.nix - Hardened security configuration for VPS hosting
#
# This config implements defense-in-depth for a public XMPP server:
# - SSH key-only authentication (no passwords)
# - Fail2ban for brute-force prevention
# - Firewall with strict rules (iptables via NixOS)
# - Disabled root login
# - Automatic security updates
# - Minimal attack surface
#
# Usage:
#   1. Generate SSH key locally: ssh-keygen -t ed25519 -C "your@email.com"
#   2. Add your public key to 'authorizedKeys' below
#   3. Import this module in configuration.nix
#   4. nixos-rebuild switch
#   5. IMPORTANT: Test SSH works BEFORE logging out! (ssh -i ~/.ssh/id_ed25519 youruser@server)
#
{ config, pkgs, lib, ... }:

{
  # ============================================================================
  # SSH Configuration - Key-only, no root, no passwords
  # ============================================================================
  services.openssh = {
    enable = true;
    ports = [ 22 ];  # Change to non-standard port if you want (e.g., 2222)

    settings = {
      # Disable password authentication entirely
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;  # No keyboard-interactive auth
      ChallengeResponseAuthentication = false;

      # Disable root login (force use of sudo from normal user)
      PermitRootLogin = "no";

      # Only allow public key authentication
      PubkeyAuthentication = true;

      # Additional hardening
      PermitEmptyPasswords = false;
      X11Forwarding = false;  # Disable X11 forwarding (not needed)
      PrintMotd = false;

      # Prevent SSH from being used as a tunnel
      AllowTcpForwarding = false;
      AllowStreamLocalForwarding = false;
      GatewayPorts = "no";

      # Limit login attempts
      MaxAuthTries = 3;
      MaxSessions = 2;

      # Use strong ciphers only
      Ciphers = [
        "chacha20-poly1305@openssh.com"
        "aes256-gcm@openssh.com"
        "aes128-gcm@openssh.com"
        "aes256-ctr"
        "aes192-ctr"
        "aes128-ctr"
      ];

      KexAlgorithms = [
        "curve25519-sha256"
        "curve25519-sha256@libssh.org"
        "diffie-hellman-group16-sha512"
        "diffie-hellman-group18-sha512"
        "diffie-hellman-group-exchange-sha256"
      ];

      Macs = [
        "hmac-sha2-512-etm@openssh.com"
        "hmac-sha2-256-etm@openssh.com"
        "umac-128-etm@openssh.com"
      ];
    };
  };

  # ============================================================================
  # User Configuration
  # ============================================================================
  users.users.tony = {  # CHANGE THIS to your desired username
    isNormalUser = true;
    description = "Tony (Admin)";

    # Add user to wheel group for sudo access
    extraGroups = [ "wheel" "networkmanager" ];

    # SSH public keys (ADD YOUR KEY HERE!)
    openssh.authorizedKeys.keys = [
      # Add your public key from ~/.ssh/id_ed25519.pub
      # Example format:
      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx your@email.com"

      # IMPORTANT: Replace this with your actual public key!
      "ssh-ed25519 REPLACE_THIS_WITH_YOUR_PUBLIC_KEY your@email.com"
    ];

    # Set a strong password as backup (in case SSH key is lost)
    # Generate hash with: mkpasswd -m sha-512
    # hashedPassword = "$6$rounds=500000$...";  # Uncomment and add hashed password
  };

  # Disable root password (force sudo from normal user)
  users.users.root.hashedPassword = "!";  # "!" means locked account

  # ============================================================================
  # Sudo Configuration - Secure but usable
  # ============================================================================
  # NOTE: We keep sudo enabled because you need it to manage the server
  # Disabling sudo would lock you out from system administration
  security.sudo = {
    enable = true;

    # Require password for sudo (even with key-based SSH)
    execWheelOnly = true;  # Only wheel group can sudo
    wheelNeedsPassword = true;  # Require password for sudo commands

    extraConfig = ''
      # Require password every time (no timeout)
      Defaults timestamp_timeout=0

      # Log all sudo commands
      Defaults logfile=/var/log/sudo.log
      Defaults log_input, log_output

      # Require password for ALL commands (no exceptions)
      Defaults passwd_tries=3
      Defaults badpass_message="Authentication failed. This incident will be logged."

      # Prevent sudo -i or sudo su (force explicit commands)
      # Uncomment these if you want to be extra strict:
      # Defaults !rootpw
      # Defaults !runaspw
    '';
  };

  # Disable 'su' command (force sudo for all privilege escalation)
  security.sudo.extraConfig = ''
    # Block 'su' by preventing root password authentication
    # Users must use 'sudo' for specific commands instead of 'su'
  '';

  # Remove 'su' from system entirely (optional - uncomment if desired)
  # environment.systemPackages = lib.mkForce (builtins.filter (pkg: pkg.pname or "" != "shadow") config.environment.systemPackages);

  # ============================================================================
  # Firewall - Only allow necessary ports
  # ============================================================================
  networking.firewall = {
    enable = true;

    # Allowed ports (ONLY what's needed)
    allowedTCPPorts = [
      22    # SSH (change if you modified SSH port above)
      80    # HTTP (for Let's Encrypt ACME challenge)
      443   # HTTPS (for Let's Encrypt ACME challenge)
      5222  # XMPP client-to-server (C2S)
      5269  # XMPP server-to-server (S2S) - remove if no federation
      5281  # XMPP HTTPS (file uploads)
    ];

    # Block ping (optional - makes server invisible to ping sweeps)
    allowPing = false;

    # Advanced firewall rules using iptables
    extraCommands = ''
      # Rate-limit SSH connections (prevent brute-force)
      iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
      iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP

      # Rate-limit XMPP connections (prevent abuse)
      iptables -A INPUT -p tcp --dport 5222 -m state --state NEW -m recent --set --name XMPP
      iptables -A INPUT -p tcp --dport 5222 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name XMPP -j DROP

      # Drop invalid packets
      iptables -A INPUT -m state --state INVALID -j DROP

      # Allow established connections
      iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Log dropped packets (for debugging - comment out in production)
      # iptables -A INPUT -j LOG --log-prefix "iptables-dropped: " --log-level 4
    '';

    extraStopCommands = ''
      iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH 2>/dev/null || true
      iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP 2>/dev/null || true
      iptables -D INPUT -p tcp --dport 5222 -m state --state NEW -m recent --set --name XMPP 2>/dev/null || true
      iptables -D INPUT -p tcp --dport 5222 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name XMPP -j DROP 2>/dev/null || true
    '';
  };

  # ============================================================================
  # Fail2Ban - Automatic IP banning for repeated failed attempts
  # ============================================================================
  services.fail2ban = {
    enable = true;

    # Ban for 1 hour after 3 failed attempts within 10 minutes
    maxretry = 3;
    bantime = "1h";
    findtime = "10m";

    jails = {
      # SSH brute-force protection
      sshd = ''
        enabled = true
        filter = sshd
        action = iptables[name=SSH, port=22, protocol=tcp]
        maxretry = 3
        findtime = 600
        bantime = 3600
      '';

      # XMPP brute-force protection
      # (Custom filter - see below)
      prosody = ''
        enabled = true
        filter = prosody-auth
        action = iptables[name=XMPP, port=5222, protocol=tcp]
        logpath = /var/log/prosody/prosody.log
        maxretry = 5
        findtime = 600
        bantime = 3600
      '';
    };
  };

  # Custom fail2ban filter for Prosody auth failures
  environment.etc."fail2ban/filter.d/prosody-auth.conf".text = ''
    [Definition]
    failregex = ^.* \[error\] .* (authentication failure|certificate expired) for .* from <HOST>
    ignoreregex =
  '';

  # ============================================================================
  # Automatic Security Updates (Optional - Recommended)
  # ============================================================================
  system.autoUpgrade = {
    enable = true;
    dates = "weekly";  # Update once per week
    allowReboot = false;  # Don't auto-reboot (manual intervention)
    channel = "https://nixos.org/channels/nixos-24.05";  # Stable channel
  };

  # ============================================================================
  # Additional Hardening
  # ============================================================================

  # Disable unnecessary services
  services.avahi.enable = false;  # No mDNS/Bonjour
  services.printing.enable = false;  # No CUPS printing

  # Kernel hardening
  boot.kernel.sysctl = {
    # Prevent IP spoofing
    "net.ipv4.conf.all.rp_filter" = 1;
    "net.ipv4.conf.default.rp_filter" = 1;

    # Ignore ICMP redirects
    "net.ipv4.conf.all.accept_redirects" = 0;
    "net.ipv4.conf.default.accept_redirects" = 0;
    "net.ipv6.conf.all.accept_redirects" = 0;
    "net.ipv6.conf.default.accept_redirects" = 0;

    # Ignore ICMP echo requests (disable ping response)
    "net.ipv4.icmp_echo_ignore_all" = 1;

    # Disable IPv6 if not needed (optional)
    # "net.ipv6.conf.all.disable_ipv6" = 1;

    # Enable TCP SYN cookies (prevent SYN flood attacks)
    "net.ipv4.tcp_syncookies" = 1;

    # Disable source routing
    "net.ipv4.conf.all.accept_source_route" = 0;
    "net.ipv6.conf.all.accept_source_route" = 0;

    # Log suspicious packets
    "net.ipv4.conf.all.log_martians" = 1;
  };

  # ============================================================================
  # Logging and Monitoring
  # ============================================================================
  services.journald.extraConfig = ''
    MaxRetentionSec=1month
    SystemMaxUse=1G
  '';

  # Log failed login attempts
  security.pam.loginLimits = [
    { domain = "*"; type = "hard"; item = "maxlogins"; value = "3"; }
  ];

  # ============================================================================
  # Minimal Package Set (Reduce attack surface)
  # ============================================================================
  environment.systemPackages = with pkgs; [
    # Essential tools only
    vim
    wget
    curl
    htop
    tmux
    git

    # Security tools
    fail2ban
    iptables

    # Prosody admin tools
    # (prosodyctl is included with services.prosody)
  ];

  # Disable documentation to save space and reduce attack surface
  documentation.enable = false;
  documentation.man.enable = false;
  documentation.nixos.enable = false;
}