Merge branch 'nixops' of ssh://git.fudo.org:2222/fudosys/NixOS into nixops

config/host-config/clunk.nix

@@ -6,9 +6,7 @@ let
 
   dns-proxy-port = 5335;
 
-  host-packages = with pkgs; [
-    nixops
-  ];
+  host-packages = with pkgs; [ nixops ];
 
   site-name = config.fudo.hosts.${config.instance.hostname}.site;
   site = config.fudo.site.${site-name};
@@ -53,13 +51,9 @@ in {
     network-definition = config.fudo.networks."rus.selby.ca";
   };
 
-  networking = {
-    firewall = {
-      enable = true;
-      trustedInterfaces = [ "intif0" "docker0" ];
-      allowedTCPPorts = [ 22 ];
-    };
+  fudo.hosts.clunk.external-interfaces = [ "enp1s0" ];
 
+  networking = {
     interfaces = {
       enp1s0.useDHCP = true;
 

config/host-config/limina.nix

@@ -20,13 +20,9 @@ in {
       "openssh-with-gssapi-8.4p1" # CVE-2021-28041
     ];
 
-    networking = {
-      firewall = {
-        enable = true;
-        trustedInterfaces = [ "intif0" "intif1" "intif2" "lo" ];
-        allowedTCPPorts = [ 22 ];
-      };
+    fudo.hosts.limina.external-interfaces = [ "enp1s0" ];
 
+    networking = {
       interfaces = {
         enp1s0 = { useDHCP = true; };
 

config/hosts/limina.nix

@@ -13,4 +13,5 @@
   profile = "server";
   ssh-pubkey =
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMqymGZ5dI6ChI1Qx1QfjBo/h0+xFwpRx/wQSDxWQprI";
+  tmp-on-tmpfs = false;
 }

config/hosts/plato.nix

@@ -16,4 +16,5 @@
   build-pubkeys = [
     "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMPjwpcktL0Rhjc/D3ZmzwkSRqSJX5TGjMXVstpg8nNqQQrj9DxPq7gV4a+1LxMtQGPUv4gYx7De1a5LMVk8u6qJJnaLlt3TB1e1SUCBxxeh5sWIY5BMx8Q0/aRTkyTchyczX6FX0LXM7FP6yvxZVZSn2WHRp7REr8G1PUAwuIGy2a4bKOUSh5Uj4riXFXnROW2mp1vUfe5oH4X5HP3ACCXWRVUFdqDt1ldcrqqi+7/8x2G1eOHJcQ7B5FdL3uuq0nBrUzFQTt6KCHy0C2Jc3DFwOS1+ZdGKZpao+/arh/fH+LQfMUePx/AQOkYrJwvuRwbxg8XmlZ89u2gyDuqapzjBmsu+wyd5pF2QglyTRZW9Ijy1NTuzduPm6wgqN0Q09evFJvM9ZjShcIY3xTcCGDxpwTeYgMVXMF79sV9u+JwCSBpaIyteIJ7M/J/NWmaKoUF6Ia9mNts889Ba9TKzQFek19KYetOB2hfXV+7bvXrH+OBppzpdrztJFavBceQTs="
   ];
+  tmp-on-tmpfs = false;
 }

config/profile-config/common.nix

@@ -31,7 +31,7 @@ in {
     };
 
     libdefaults = {
-      allow_weak_crypto = false;
+      allow_weak_crypto = true;
       dns_lookup_kdc = true;
       dns_lookup_realm = true;
       forwardable = true;

config/profile-config/server.nix

@@ -2,11 +2,7 @@
 
 with lib;
 let
-  serverPackages = with pkgs; [
-    emacs-nox
-    reboot-if-necessary
-    test-config
-  ];
+  serverPackages = with pkgs; [ emacs-nox reboot-if-necessary test-config ];
 
   reboot-if-necessary = pkgs.writeShellScriptBin "reboot-if-necessary" ''
     if [ $# -ne 1 ]; then
@@ -50,9 +46,7 @@ in {
   imports = [ ./common.nix ];
 
   config = {
-    environment = {
-      systemPackages = serverPackages;
-    };
+    environment = { systemPackages = serverPackages; };
 
     system.autoUpgrade.enable = false;
 
@@ -60,8 +54,6 @@ in {
 
     networking.networkmanager.enable = mkForce false;
 
-    boot.tmpOnTmpfs = true;
-
     services = {
       xserver.enable = false;