Configuration des services courants

{
  services.openssh.enable = true;
  services.openssh.settings = {
    PermitRootLogin = "no";
    PasswordAuthentication = false;
  };
}

{
  users.users.admin.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAA... user@machine"
  ];
}

{
  services.nginx.enable = true;

  services.nginx.virtualHosts."monsite.com" = {
    root = "/var/www/monsite";
  };
}

{
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "admin@monsite.com";

  services.nginx.enable = true;
  services.nginx.virtualHosts."monsite.com" = {
    enableACME = true;
    forceSSL = true;
    root = "/var/www/monsite";
  };
}

{
  services.nginx.virtualHosts."app.monsite.com" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:3000";
      proxyWebsockets = true;
    };
  };
}

{
  virtualisation.docker.enable = true;

  # Ajouter l'utilisateur au groupe docker
  users.users.admin.extraGroups = [ "docker" ];
}

{
  environment.systemPackages = with pkgs; [
    docker-compose
  ];
}

{
  virtualisation.podman.enable = true;
  virtualisation.podman.dockerCompat = true;  # alias docker -> podman
}

{
  services.postgresql.enable = true;
  services.postgresql.package = pkgs.postgresql_15;

  services.postgresql.ensureDatabases = [ "myapp" ];
  services.postgresql.ensureUsers = [
    {
      name = "myapp";
      ensureDBOwnership = true;
    }
  ];
}

{
  services.mysql.enable = true;
  services.mysql.package = pkgs.mariadb;

  services.mysql.ensureDatabases = [ "wordpress" ];
  services.mysql.ensureUsers = [
    {
      name = "wordpress";
      ensurePermissions = {
        "wordpress.*" = "ALL PRIVILEGES";
      };
    }
  ];
}

{
  services.fail2ban.enable = true;
  services.fail2ban.maxretry = 5;
  services.fail2ban.bantime = "10m";

  services.fail2ban.jails = {
    sshd.settings = {
      enabled = true;
      maxretry = 3;
    };
  };
}

{
  systemd.timers."backup-daily" = {
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };

  systemd.services."backup-daily" = {
    script = ''
      ${pkgs.rsync}/bin/rsync -av /data /backup/
    '';
    serviceConfig.Type = "oneshot";
  };
}

{
  services.grafana.enable = true;
  services.grafana.settings.server = {
    http_addr = "127.0.0.1";
    http_port = 3000;
  };
}

{
  services.prometheus.enable = true;
  services.prometheus.scrapeConfigs = [
    {
      job_name = "node";
      static_configs = [{
        targets = [ "localhost:9100" ];
      }];
    }
  ];

  services.prometheus.exporters.node.enable = true;
}

systemctl status nginx
systemctl status docker
journalctl -u nginx -f