flake/groups/server/default.nix

{lib, ...}: {
  networking = {
    networkmanager.enable = true;

    # Use CloudFlare's WARP+ 1.1.1.1 DNS service
    nameservers = [
      "1.1.1.1"
      "1.0.0.1"
    ];

    firewall = {
      enable = lib.mkDefault true;
      allowedTCPPorts = [
        22
      ];
    };
  };

  security = {
    # accept Lets Encrypt's security policy
    acme = {
      acceptTerms = true;
      defaults.email = "them@dobutterfliescry.net";
    };

    sudo = {
      enable = true;
      wheelNeedsPassword = true;
    };
    # allow SSH keys for passwordless auth
    pam = {
      enableSSHAgentAuth = true;
      services.sudo.sshAgentAuth = true; # pam_ssh_agent_auth module
    };
  };

  services = {
    openssh = {
      enable = true;
      ports = [22];
      settings = {
        PasswordAuthentication = false;
        PermitRootLogin = "no";
        # AllowUsers = ["cry"]; # DO NOT ALLOW ALL
        UseDns = true;
        X11Forwarding = false;
      };
    };
  };

  users = {
    users = {
      # primary user
      cry = {
        isNormalUser = true;
        home = "/home/cry";
        extraGroups = ["wheel"];
        openssh.authorizedKeys.keys = lib.mkOverride 900 [
          (throw ''
            Hosts in the `server` group must set `users.users.cry.openssh.authorizedKeys.keys = [ ... ]`.
          '')
        ];
      };
    };
  };
}