Initial NixOS infra flake skeleton

modules/common.nix

@@ -0,0 +1,31 @@
+{ config, pkgs, lib, ... }:
+
+{
+  # Basic sane defaults
+  time.timeZone = "Europe/Stockholm";
+
+  # SSH access (you’ll tweak users later)
+  services.openssh.enable = true;
+  services.openssh.settings = {
+    PasswordAuthentication = false;
+    KbdInteractiveAuthentication = false;
+    PermitRootLogin = "no";
+  };
+
+  # Helpful tools on the server
+  environment.systemPackages = with pkgs; [
+    git
+    curl
+    jq
+    vim
+  ];
+
+  # Firewall on by default
+  networking.firewall.enable = true;
+
+  # Nix settings (good defaults)
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+  };
+}

modules/flowback-options.nix

@@ -0,0 +1,16 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options.services.flowback = {
+    nextcloudHost = mkOption {
+      type = types.str;
+      description = "Hostname for Nextcloud";
+    };
+    forgejoHost = mkOption {
+      type = types.str;
+      description = "Hostname for Forgejo";
+    };
+  };
+}

modules/forgejo.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [ ./flowback-options.nix ];
+
+  services.nginx.enable = true;
+
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "me@example.com";
+
+  services.forgejo = {
+    enable = true;
+    settings = {
+      server = {
+        DOMAIN = config.services.flowback.forgejoHost;
+        ROOT_URL = "https://${config.services.flowback.forgejoHost}/";
+        HTTP_PORT = 3000;
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+      };
+    };
+    # Database defaults are okay to start; you can move to Postgres if desired
+  };
+
+  services.nginx.virtualHosts.${config.services.flowback.forgejoHost} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3000";
+      proxyWebsockets = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 22 ];
+}

modules/nextcloud.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [ ./flowback-options.nix ];
+
+  # Enable nginx + ACME (TLS). Works when DNS points correctly.
+  services.nginx.enable = true;
+
+  security.acme.acceptTerms = true;
+  # I will change this email later
+  security.acme.defaults.email = "me@example.com";
+
+  services.nextcloud = {
+    enable = true;
+    hostName = config.services.flowback.nextcloudHost;
+    https = true;
+
+    # Performance / reliability
+    configureRedis = true;
+
+    # DB locally (Postgres) — production-ready baseline
+    database.createLocally = true;
+
+    # Admin bootstrap secret will be wired via sops later.
+    # For now, placeholder: you’ll set adminpassFile via sops secret.
+    config = {
+      adminuser = "admin";
+      adminpassFile = "/var/lib/sops-nix/nextcloud-adminpass";
+      dbtype = "pgsql";
+      dbpassFile = "/var/lib/sops-nix/nextcloud-dbpass";
+    };
+  };
+
+  services.nginx.virtualHosts.${config.services.flowback.nextcloudHost} = {
+    forceSSL = true;
+    enableACME = true;
+  };
+}

modules/sops.nix

@@ -0,0 +1,15 @@
+{ config, lib, ... }:
+
+{
+  # sops-nix reads secrets from YAML files in ./secrets
+  # You will create these later.
+  sops.defaultSopsFile = ../secrets/secrets.yaml;
+
+  # Where the age key lives on target machines
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+
+  # Good to have a dedicated secrets mount/dir
+  systemd.tmpfiles.rules = [
+    "d /var/lib/sops-nix 0700 root root - -"
+  ];
+}