Configuring Your Server with NixOS¶

{ config, pkgs, ... }: {
  networking.hostName = "web1";
  system.stateVersion = "26.05";
  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    trusted-users = [ "me" ];
  };
  nix.gc = { automatic = true; options = "--delete-older-than 14d"; };

  # Access
  users.users.me = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... me@laptop" ];
  };
  security.sudo.wheelNeedsPassword = false;
  services.openssh = {
    enable = true;
    settings = { PasswordAuthentication = false; PermitRootLogin = "no"; };
  };
  services.fail2ban.enable = true;
  networking.firewall = { enable = true; allowedTCPPorts = [ 22 80 443 ]; };

  # Secrets
  sops.defaultSopsFile = ./secrets.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.secrets.app1_db_password.restartUnits = [ "podman-app1.service" ];
  sops.secrets.app1_api_key.restartUnits = [ "podman-app1.service" ];
  sops.templates."app1.env".content = ''
    DB_PASSWORD=${config.sops.placeholder.app1_db_password}
    API_KEY=${config.sops.placeholder.app1_api_key}
  '';

  # Containers
  virtualisation.oci-containers = {
    backend = "podman";
    containers = {
      app1 = {                                  # built from private repo
        image = "localhost/app1:latest";
        ports = [ "127.0.0.1:8081:8080" ];
        environmentFiles = [ config.sops.templates."app1.env".path ];
      };
      app2 = {                                  # public image
        image = "ghcr.io/me/app2:0.9.0";
        ports = [ "127.0.0.1:8082:3000" ];
      };
    };
  };

  # Build app1 from private git using the server's host key
  systemd.services.build-app1 = {
    description = "Build app1 image from private repo";
    path = [ pkgs.git pkgs.openssh pkgs.podman ];
    environment.GIT_SSH_COMMAND =
      "ssh -i /etc/ssh/ssh_host_ed25519_key -o IdentitiesOnly=yes "
      + "-o StrictHostKeyChecking=accept-new "
      + "-o UserKnownHostsFile=/var/lib/app1-build/known_hosts";
    serviceConfig = {
      Type = "oneshot";
      StateDirectory = "app1-build";
      WorkingDirectory = "/var/lib/app1-build";
    };
    script = ''
      if [ -d src/.git ]; then
        git -C src fetch origin main && git -C src reset --hard origin/main
      else
        git clone git@github.com:me/app1.git src
      fi
      podman build -t localhost/app1:latest src
    '';
  };
  # Restarting the container rebuilds it first
  systemd.services.podman-app1 = {
    requires = [ "build-app1.service" ];
    after = [ "build-app1.service" "network-online.target" ];
  };

  # Proxy
  services.caddy = {
    enable = true;
    virtualHosts."app1.example.com".extraConfig = "reverse_proxy 127.0.0.1:8081";
    virtualHosts."app2.example.com".extraConfig = "reverse_proxy 127.0.0.1:8082";
  };
}

host := "web1"
user := "me"
ip := "255.255.255.255"
target := user + "@" + ip

default:
    @just --list

# Apply config to the server
deploy:
    git add -A
    nixos-rebuild switch --flake .#{{host}} \
      --target-host {{target}} --build-host {{target}} --sudo

# Build on the server without activating
check:
    git add -A
    nixos-rebuild build --flake .#{{host}} \
      --target-host {{target}} --build-host {{target}} --sudo

# Update flake inputs, then deploy
upgrade:
    nix flake update
    just deploy

# Edit encrypted secrets
secrets:
    nix run nixpkgs#sops -- secrets.yaml

# Pull latest app1 code, rebuild image, restart
app1-release:
    ssh {{target}} sudo systemctl restart podman-app1

# Follow logs for a unit (default app1)
logs unit="podman-app1":
    ssh {{target}} sudo journalctl -u {{unit}} -f

# Show failed units and disk usage
status:
    ssh {{target}} 'systemctl --failed; df -h /'

# Roll back to the previous generation
rollback:
    ssh {{target}} sudo nixos-rebuild switch --rollback

# List generations
generations:
    ssh {{target}} sudo nix-env --list-generations -p /nix/var/nix/profiles/system

# Reboot the server
reboot:
    ssh {{target}} sudo reboot

# Garbage-collect old generations now
gc:
    ssh {{target}} sudo nix-collect-garbage --delete-older-than 14d

# First install on a fresh VPS (wipes disk!)
install ip:
    git add -A
    nix run github:nix-community/nixos-anywhere -- \
      --flake .#{{host}} --extra-files ./extra \
      --build-on remote --target-host root@{{ip}}