1 files changed, 105 insertions, 0 deletions
diff --git a/hostnix/creep/configuration.nix b/hostnix/creep/configuration.nix
new file mode 100644
index 0000000..7fa748d
--- /dev/null
+++ b/hostnix/creep/configuration.nix
@@ -0,0 +1,105 @@
+# NetComm router (CG-NAT) - 192.168.20.1
+
+{ pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./wifi-vpn.nix
+  ];
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  boot.loader.systemd-boot.enable = true;
+  # Raspberry Pi has no NVRAM.
+  boot.loader.efi.canTouchEfiVariables = false;
+
+  boot.kernelPackages = pkgs.linuxPackages_rpi4;
+  # https://github.com/NixOS/nixpkgs/issues/122130#issuecomment-1568815007
+  # It's unclear if these are strictly necessary with the downstream kernel,
+  # but let's leave them in to keep working with mainline.
+  boot.initrd.availableKernelModules = [ "uas" "pcie-brcmstb" "reset-raspberrypi" ];
+
+  networking.hostName = "creep";
+  networking.domain = "mou.fo";
+
+  networking.wireless = {
+    enable = true;
+    interfaces = [ "wlan0" ];
+    networks = {
+      "Girls Gone Wireless".psk = "Paddlepops103!";
+      "Cali's internet".psk = "calibanthetempest2019";
+    };
+  };
+
+  time.timeZone = "Australia/Sydney";
+  users.users.joe = {
+    isNormalUser = true;
+    description = "Joe Mou";
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHcqQDnH0LcUWFV+cd9aABfM55+72UAn1ZY5x5bHwPL4IEgT1nagbi1X3FwCJkh2rEcDsHl4FflcNfh+IyU2VyuQfRIXl7CKP040ovXmPVzgU8JiEDrrRebpZ7aHCKk+4Q6cJ8dzAI1sRogVyYrV0hLB4yeMnVexkIcsQMt5pXQ1zodlzHfW1W7OWQDbKjIyh4pv1KJ/IIjiBIt7l+OCqi7wZK4ubmxyMhmZx1xpRC5mz2/29Mpt+1VgCmxC7Hv1SG7yu+U0s4eJ3kbzFKNcZ/bCYqFxK48dT66qhS3qZFg09omumG8IbEUcx+WqM1V7WhiJYig9x5ovmMToQXTJ5uxLtcovnxO/53IgwV7INvmr8+NhD+LlkQfSjjUAW09bhVj9sKIW2bbrIxlOT8z6CQY9zGXNXi8u1oxPt3Q7d3rMxoWhWnr2l3Ok7OIkWooOK3e0NdhgIAxZKlYJAmIYaX391sGTyiuwUy96mg5JcYsLYMfkEg/Sv+2vQp8kkvB0E= joe@sparky"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    dig
+    file
+    gitFull
+    libraspberrypi
+    psmisc
+    tmux
+    tree
+  ];
+
+  programs.vim.defaultEditor = true;
+  programs.nano.enable = false;
+
+  services.openssh.enable = true;
+
+  # Note: seems to leave stale connections open on server on dirty poweroff.
+  systemd.services.reverse-ssh = {
+    description = "SSH reverse tunnel";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      RestartSec = 60;
+      Restart = "always";
+    };
+    script = ''
+      ${pkgs.openssh}/bin/ssh \
+          -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes \
+          -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
+          -i /etc/ssh/ssh_host_ed25519_key \
+          -q -N -R 19422:localhost:22 joe@creepgw.mou.fo
+    '';
+  };
+
+  systemd.services.dyndns = {
+    description = "Dynamic DNS update";
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      TimeoutStartSec = "60s";
+    };
+    script = ''
+      ${pkgs.curl}/bin/curl -4 -fsS https://dyn.dns.he.net/nic/update -d hostname=creep.he.mou.fo -d password=FriE83Y4HPWmwdYn
+    '';
+  };
+
+  systemd.timers.dyndns = {
+    wantedBy = [ "multi-user.target" ];
+    timerConfig = {
+      OnStartupSec = "10";
+      OnUnitActiveSec = "5min";
+    };
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+}