nixos-hypervisor/systems/minimalLXCConfig.nix

{
  config,
  pkgs,
  lib,
  inputs,
  modulesPath,
  ...
}: {
  nix = {
    settings.experimental-features = ["nix-command" "flakes"];
    settings.trusted-users = ["root" "@wheel"];
  };

  networking = {
    firewall = {
      enable = true;
      allowedTCPPorts = [22 9002];
    };
  };

  boot.isContainer = true;
  proxmoxLXC = {
    enable = true;
    privileged = false;
    manageNetwork = false;
    manageHostName = false;
  };
  systemd.suppressedSystemUnits = [
    "dev-mqueue.mount"
    "sys-kernel-debug.mount"
    "sys-fs-fuse-connections.mount"
  ];

  time.timeZone = "Europe/Paris";
  console.keyMap = "fr";
  i18n.defaultLocale = "fr_FR.UTF-8";
  environment.sessionVariables = rec {
    TERM = "xterm-256color";
  };

  nix.gc = {
    automatic = true;
    dates = "daily";
    options = "--delete-old";
  };

  security.sudo.wheelNeedsPassword = false;
  users = {
    users.tbarnouin = {
      isNormalUser = true;
      extraGroups = ["wheel"];
      shell = pkgs.zsh;
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICf1B0nxNMvPWSR9pStdtx2x6Iw+JUeCCt1CKWoD8dsr"
      ];
    };
    users.root = {
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
      ];
    };
  };

  programs = {
    zsh = {
      enable = true;
      shellAliases = {
        ll = "ls -l";
        lla = "ls -lah";
      };
      ohMyZsh = {
        enable = true;
        plugins = ["git"];
        theme = "bira";
      };
    };
    tmux = {
      enable = true;
    };
  };

  nixpkgs.config.allowUnfree = true;
  environment = {
    localBinInPath = true;
    systemPackages = with pkgs; [
      vim
      bash
      wget
      curl
      git
      htop
      tree
      dig
      ncdu
      nmap
      iperf3
      netcat-openbsd
    ];
  };

  services = {
    openssh = {
      enable = true;
      settings.PasswordAuthentication = false;
      settings.KbdInteractiveAuthentication = false;
      settings.PermitRootLogin = "prohibit-password";
      hostKeys = [
        {
          path = "/etc/ssh/ssh_host_ed25519_key";
          type = "ed25519";
        }
      ];
    };
    fail2ban = {
      enable = true;
    };
    rsyslogd = {
      enable = true;
      extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";
    };
    prometheus = {
      exporters = {
        node = {
          enable = true;
          enabledCollectors = ["systemd"];
          port = 9002;
        };
      };
    };
  };

  system = {
    stateVersion = "24.11";
    activationScripts.ensure-ssh-key-dir.text = "mkdir -p /etc/ssh";
  };
}