Refactor nginx.nix using generative functions; Remove bind container service; Enable CoreDNS; Open 53UDP on system firewall; rename service files; containers listen on localhost only; added SDA-EXT data volume

system/build-services.nix

@@ -1,11 +1,9 @@
 { config, ... }: {
   services = {
-    openssh = { enable = true; };
-
     hydra = {
       enable = true;
       hydraURL = "https://hydra.matri.cx";
-      listenHost = "192.168.0.130";
+      listenHost = "127.0.0.1";
       port = 3034;
 
       extraConfig = ''

system/dns.nix

@@ -0,0 +1,17 @@
+{ config, ... }: {
+  services = {
+    coredns.enable = true;
+    coredns.config = ''
+      		  . {
+      		    forward . 9.9.9.9 149.112.112.112 84.200.69.80 84.200.70.40
+      		    cache
+      		  }
+      		
+      		  matri.cx {
+      		    template IN A  {
+      		        answer "{{ .Name }} 0 IN A 192.168.0.130"
+      		    }
+      		  }
+      		'';
+  };
+}

system/hardware.nix

@@ -1,37 +1,38 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules =
-    [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/NIXROOT";
-    fsType = "ext4";
+  boot = {
+    initrd = {
+      availableKernelModules =
+        [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
   };
 
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/NIXBOOT";
-    fsType = "vfat";
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-label/NIXROOT";
+      fsType = "ext4";
+    };
+
+    "/mnt/data" = {
+      device = "/dev/disk/by-label/SDA-EXT";
+      fsType = "ext4";
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+    };
   };
 
   swapDevices = [ ];
 
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
   hardware.cpu.intel.updateMicrocode =

system/security.nix

@@ -1,4 +1,7 @@
 { ... }: {
+  services.openssh = {
+    enable = true;
+  };
   security = {
     sudo.wheelNeedsPassword = false;
     acme = {

system/system.nix

@@ -10,7 +10,7 @@
     hostName = "eve-psr-nix0";
     firewall = {
       allowedTCPPorts = [ 22 80 443 ];
-      allowedUDPPorts = [ 22 80 443 ];
+      allowedUDPPorts = [ 22 80 443 53 ];
     };
   };