Added hetzner server configs

servers/hetzner/hosts/hetzner/default.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    ./networking.nix
+    ./users.nix
+    ./hardware.nix
+    ./disko-config.nix
+    ../../modules/system/env.nix
+    ../../modules/security/acme.nix
+    ../../modules/services/caddy.nix
+    ../../modules/services/coredns.nix
+    ../../modules/services/gitea.nix
+    ../../modules/services/wireguard.nix
+    ../../modules/services/fail2ban.nix
+    ../../modules/services/vaultwarden.nix
+    ../../modules/services/mailserver.nix
+    ../../modules/services/snappymail.nix
+    ../../modules/services/rustdesk.nix
+    ../../modules/services/wrxproxy.nix
+    ../../modules/services/watchtower.nix
+    ../../modules/services/tlsa-updater.nix
+    ../../modules/services/shkeeper.nix
+    ../../modules/services/backup.nix
+  ];
+
+  system.stateVersion = "24.05";
+}

servers/hetzner/hosts/hetzner/disko-config.nix

@@ -0,0 +1,37 @@
+{lib, ...}: {
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "256M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot/efi";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}

servers/hetzner/hosts/hetzner/dns-zone.nix

@@ -0,0 +1,20 @@
+# Zone file for severijnse.eu
+# This is the authoritative DNS zone served by CoreDNS
+# Update serial number on changes
+{
+  serial = "2026071003";
+  adminEmail = "abuse.severijnse.eu";
+  nameservers = ["ns1.severijnse.eu" "ns2.severijnse.eu"];
+  ipv4 = "49.13.92.205";
+  ipv6 = "2a01:4f8:c014:2585::1";
+  mailIpv4 = "49.13.92.205";
+  mailIpv6 = "2a01:4f8:c014:2585::1";
+  dkimRecord = ''
+    v=DKIM1; k=rsa;
+    p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAskpG7m4kninxRE4JF5KzpnBhLbOlGJL2RO/iDfzdz6sHEvxe78q9c5UnZ0OQddOSuQo4q48dJkXR/XzqY7Ak109lhoAx+Kr1neYsi8/
+    JaoTC8OURk365+/aBSmWXUCCBphCx43QWfC9h8GMQ6PUIqawkz5CcGPT7X7hPdwHQcd5Vn3CqmABptxdwshdkBjZs
+    oi79BOo9ZrQSTY7iiLcOP7hVVC9Ad+ydlZ4MWGfy5BxgyTGrrtuSuLcM219oqdovIvr2EtXs8AMx5fyXplKE3R/
+    YlwF2Jcy50Gmb5y/E9pOaFjVv8HXUmKsvuhA2b8K+rt0WVHNc3dvbgZUl8bGAQIDAQAB
+  '';
+  dnssecKeyTag = "20930";
+}

servers/hetzner/hosts/hetzner/hardware-configuration.nix

@@ -0,0 +1,21 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

servers/hetzner/hosts/hetzner/hardware.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  boot = {
+    loader = {
+      grub = {
+        enable = true;
+        device = "/dev/sda";
+        efiSupport = true;
+        efiInstallAsRemovable = true;
+      };
+      efi = {
+        efiSysMountPoint = "/boot/efi";
+      };
+    };
+    initrd.availableKernelModules = ["ata_piix" "virtio_pci" "virtio_scsi" "virtio_blk"];
+  };
+
+  swapDevices = [
+    {
+      device = "/swap";
+      size = 2048;
+    }
+  ];
+
+  # Enable Podman OCI container support
+  virtualisation = {
+    podman = {
+      enable = true;
+      dockerCompat = true;
+      defaultNetwork.settings = {
+        dns_enabled = true;
+        ipv6_enabled = true;
+        subnets = [
+          {
+            subnet = "10.88.0.0/16";
+            gateway = "10.88.0.1";
+          }
+          {
+            subnet = "fd00:dead:beef::/48";
+            gateway = "fd00:dead:beef::1";
+          }
+        ];
+      };
+    };
+    oci-containers.backend = "podman";
+  };
+}

servers/hetzner/hosts/hetzner/networking.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  networking = {
+    hostName = "debian-4gb-fsn1-1";
+    domain = "severijnse.eu";
+    useDHCP = true;
+    dhcpcd.enable = true;
+    nameservers = [
+      "2a01:4ff:ff00::add:2"
+      "2a01:4ff:ff00::add:1"
+      "185.12.64.2"
+    ];
+    search = ["severijnse.eu"];
+    interfaces."enp1s0" = {
+      ipv6.addresses = [
+        {
+          address = "2a01:4f8:c014:2585::1";
+          prefixLength = 64;
+        }
+      ];
+      ipv6.routes = [
+        {
+          address = "::";
+          prefixLength = 0;
+          via = "fe80::1";
+        }
+      ];
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22 # SSH
+        53 # DNS (CoreDNS)
+        80 # HTTP (Caddy)
+        443 # HTTPS (Caddy)
+        465 # SMTP over TLS
+        587 # SMTP (STARTTLS)
+        993 # IMAP over TLS
+        143 # IMAP
+        25 # SMTP
+        222 # Gitea SSH
+        51821 # WG-Easy web UI
+      ];
+      allowedUDPPorts = [
+        53 # DNS
+        51820 # WireGuard
+      ];
+    };
+    nat = {
+      enable = true;
+      externalInterface = "enp1s0";
+      internalInterfaces = ["wg0"];
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv4.conf.all.src_valid_mark" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+}

servers/hetzner/hosts/hetzner/users.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  users.users = {
+    root = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYboWHsP50CXzMpz4FogC3ecFchjZARCdY4wSTc/Et0 someone@archlinux"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKAlpdPnqihMxE6XPBUQ9Kb6MrvWUWw/BYx6kf2kTPD6 admin@severijnse.eu"
+      ];
+    };
+
+    admin = {
+      isNormalUser = true;
+      uid = 1000;
+      description = "Jory";
+      extraGroups = ["wheel" "docker" "podman"];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYboWHsP50CXzMpz4FogC3ecFchjZARCdY4wSTc/Et0 someone@archlinux"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKAlpdPnqihMxE6XPBUQ9Kb6MrvWUWw/BYx6kf2kTPD6 admin@severijnse.eu"
+      ];
+      shell = pkgs.fish;
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+      PubkeyAuthentication = true;
+    };
+    hostKeys = [
+      {
+        path = "/etc/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }
+    ];
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+}