feat(core): initialize NaxOS declarative NixOS distribution, modules, and ISO installer

2026-09-03 23:53:18 +02:00
parent 88a638955b
commit 5da58ae6d7
28 changed files with 2247 additions and 2 deletions
@@ -0,0 +1,96 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.naxos.core;
+in {
+  options.services.naxos.core = {
+    enable = mkEnableOption "NaxOS Core Appliance Base";
+
+    hostName = mkOption {
+      type = types.str;
+      default = "naxos";
+      description = "Appliance hostname.";
+    };
+
+    hostId = mkOption {
+      type = types.str;
+      default = "8425f3a1";
+      description = "32-bit Host ID required for OpenZFS safety locking.";
+    };
+
+    timeZone = mkOption {
+      type = types.str;
+      default = "Europe/Berlin";
+      description = "System timezone.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.hostName = cfg.hostName;
+    networking.hostId = cfg.hostId;
+    time.timeZone = cfg.timeZone;
+
+    # Flakes and Nix CLI enablement
+    nix.settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+    };
+
+    # High-Performance Storage & Network Kernel Tuning
+    boot.kernel.sysctl = {
+      # BBR Congestion Control
+      "net.core.default_qdisc" = "fq";
+      "net.ipv4.tcp_congestion_control" = "bbr";
+
+      # High-bandwidth 10G/25G network buffer tuning
+      "net.core.rmem_max" = 67108864;
+      "net.core.wmem_max" = 67108864;
+      "net.ipv4.tcp_rmem" = "4096 87380 33554432";
+      "net.ipv4.tcp_wmem" = "4096 65536 33554432";
+      "net.core.netdev_max_backlog" = 10000;
+
+      # Storage & VM writeback tuning for ZFS
+      "vm.swappiness" = 10;
+      "vm.dirty_background_ratio" = 5;
+      "vm.dirty_ratio" = 10;
+
+      # File handles limit
+      "fs.file-max" = 2097152;
+    };
+
+    # Core system tools
+    environment.systemPackages = with pkgs; [
+      curl
+      wget
+      git
+      htop
+      btop
+      tmux
+      jq
+      pciutils
+      usbutils
+      ethtool
+      iperf3
+      rsync
+    ];
+
+    # Security & Firewall defaults
+    networking.firewall = {
+      enable = true;
+      allowPing = true;
+      allowedTCPPorts = [ 22 80 443 ];
+    };
+
+    # SSH Server with modern secure defaults
+    services.openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "prohibit-password";
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+  };
+}