nixos-config/modules/server/default.nix

#
#  Server module — import this instead of configuration_server.nix + manual virtualisation imports.
#
#  Usage in hosts/<hostname>/default.nix:
#
#    imports = [
#      ./hardware-configuration.nix
#      ../../modules/server
#    ];
#
#    myServer.virtualisation.enable = true;
#    myServer.virtualisation.cpu    = "amd";   # amd | intel | none (default)
#
#    myServer.sshPort               = 2220;    # default
#    myServer.fail2ban.enable       = true;
#
#    myServer.extraSystemPackages   = with pkgs; [ some-tool ];
#
{
  config,
  lib,
  pkgs,
  user,
  ...
}: let
  cfg = config.myServer;
in {
  # ── Options ──────────────────────────────────────────────────────────────

  options.myServer = with lib; {
    uid = mkOption {
      type = types.int;
      default = 3000;
      description = "UID for the server user.";
    };

    sshPort = mkOption {
      type = types.port;
      default = 2220;
      description = "Port openssh listens on.";
    };

    sudoRequiresPassword = mkOption {
      type = types.bool;
      default = true;
      description = "Whether wheel users must enter a password for sudo.";
    };

    autoUpgrade.enable = mkOption {
      type = types.bool;
      default = true;
      description = "Enable automatic NixOS upgrades (inherits flake URL from configuration_common.nix).";
    };

    virtualisation = {
      enable = mkEnableOption "container/VM stack (podman with docker-compat, KVM tuning)";
      cpu = mkOption {
        type = types.enum ["amd" "intel" "none"];
        default = "none";
        description = "CPU type — selects KVM kernel parameters when virtualisation is enabled.";
      };
    };

    extraGroups = mkOption {
      type = types.listOf types.str;
      default = [];
      description = "Additional groups for the server user beyond the defaults.";
    };

    extraSystemPackages = mkOption {
      type = types.listOf types.package;
      default = [];
      description = "Additional system packages specific to this host.";
    };

    fail2ban = {
      enable = mkEnableOption "fail2ban intrusion prevention";
    };
  };

  # ── Configuration ────────────────────────────────────────────────────────

  config = lib.mkMerge [
    # ── Base server config ────────────────────────────────────────────────
    {
      users.users.${user} = {
        isNormalUser = true;
        uid = cfg.uid;
        extraGroups = ["wheel" "networkmanager" "kvm" "libvirtd"] ++ cfg.extraGroups;
      };

      security.sudo.wheelNeedsPassword = cfg.sudoRequiresPassword;

      environment.systemPackages = with pkgs;
        [
          ffmpeg
          smartmontools
          htop
        ]
        ++ cfg.extraSystemPackages;

      services.openssh = {
        ports = [cfg.sshPort];
        openFirewall = true;
      };

      nix.extraOptions = ''
        keep-outputs          = true
        keep-derivations      = true
      '';

      system.autoUpgrade.enable = cfg.autoUpgrade.enable;
    }

    # ── Virtualisation (podman/docker-compat) ─────────────────────────────
    (lib.mkIf cfg.virtualisation.enable {
      virtualisation.podman = {
        enable = true;
        autoPrune.enable = true;
        dockerCompat = true;
      };

      users.groups.docker.members = [user];
    })

    # ── KVM – AMD ─────────────────────────────────────────────────────────
    (lib.mkIf (cfg.virtualisation.enable && cfg.virtualisation.cpu == "amd") {
      boot.extraModprobeConfig = ''
        options kvm_amd nested=0 avic=1 npt=1
      '';
    })

    # ── KVM – Intel ───────────────────────────────────────────────────────
    (lib.mkIf (cfg.virtualisation.enable && cfg.virtualisation.cpu == "intel") {
      boot.extraModprobeConfig = ''
        options kvm_intel nested=1
        options kvm_intel emulate_invalid_guest_state=0
        options kvm ignore_nsrs=1
      '';
    })

    # ── Fail2ban ──────────────────────────────────────────────────────────
    (lib.mkIf cfg.fail2ban.enable {
      services.fail2ban = {
        enable = true;
        maxretry = 5;
        jails.DEFAULT.settings.findtime = "15m";
      };
    })
  ];
}