os/hosts/droppie/droppie.nix

{
  config,
  pkgs,
  lib,
  self,
  ...
}:
with lib; let
  psCfg = config.pub-solar;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
  imports = [
    ./configuration.nix
    ./nextcloud-web-tunnel.nix
    ./restic-backup.nix
  ];

  config = {
    hardware.cpu.intel.updateMicrocode = true;

    pub-solar.core.disk-encryption-active = false;
    pub-solar.core.lite = true;

    security.sudo.extraRules = [
      {
        users = ["${psCfg.user.name}"];
        commands = [
          {
            command = "ALL";
            options = ["NOPASSWD"];
          }
        ];
      }
    ];

    services.ddclient = {
      enable = false;
      ipv6 = true;
      domains = ["backup.b12f.io"];
      server = "ddns.hosting.de";
      username = "b12f";
      use = "web, web=https://ipcheck-ds.wieistmeineip.de/callback/, web-skip='ip\":\"'";
      passwordFile = "/run/agenix/dyndns-droppie.key";
    };

    age.secrets."dyndns-droppie.key" = {
      file = "${self}/secrets/dyndns-droppie.key";
      mode = "400";
      owner = "root";
    };

    # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQSephFJU0NMbVbhwvVJ2/m6jcPYo1IsWCsoarqKin root@droppie
    age.secrets."droppie-ssh-root.key" = {
      file = "${self}/secrets/droppie-ssh-root.key";
      path = "/home/${psCfg.user.name}/.ssh/id_ed25519";
      mode = "400";
      owner = psCfg.user.name;
    };
  };
}