forked from
lass.pds.lassul.us/superconfig
This repository has no description
2.1 kB
56 lines
1{ config, pkgs, ... }:
2let
3 cbaseUser = "lassulus";
4 cbaseHost = "tunnel.c-base.org";
5 remoteHost = "ai.cbrp3.c-base.org";
6 port = 11434;
7 sshKey = config.clan.core.vars.generators.c-base-ai-tunnel.files."id_ed25519".path;
8 knownHosts = pkgs.writeText "c-base-ai-tunnel-known_hosts" ''
9 tunnel.c-base.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKDknNl4M2WZChp1N/eRIpem2AEOceGIqvjo0ptBuwxUn0w0B8MGTVqoI+pnUVypORJRoNrLPOAkmEVr32BDN3E=
10 tunnel.c-base.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDgTvns7Gh4smL6kyau2TpVz35z5rJgmI7B/nSYKr/nD203ZJIkZkwHe/yHCz1AwTjx0/tg75lxrz5fGZLATAlS/gXsf97T+2m9XkXRShva5t8WJNUxktOySLv8X68VKYqN3GPgdi2p+4A1yAZvIERIHCS7fJ5wvbe41Z+vABxeVQ1aR48Q0YQ4v4q9KlpoRvU5U9QdHjVZxHkIu5GeMcD+uh54eEvbwdk0sYcF5/fO+tsz0yS3uyMnGOq718UMWHRLiubCJCPefz7FlGBRfbAFArIp7QF7BMWox6YZIk1aCDfB+0U/Tk8Mhp0B4twq5xRaTqOSkHl9QuBUvrKjR0S9
11 '';
12in
13{
14 clan.core.vars.generators.c-base-ai-tunnel = {
15 files."id_ed25519" = {
16 owner = "c-base-tunnel";
17 mode = "0400";
18 };
19 files."id_ed25519.pub".secret = false;
20 runtimeInputs = with pkgs; [ openssh ];
21 script = ''
22 ssh-keygen -t ed25519 -N "" -C "neoprism c-base ai tunnel" -f "$out/id_ed25519"
23 '';
24 };
25
26 users.users.c-base-tunnel = {
27 isSystemUser = true;
28 group = "c-base-tunnel";
29 home = "/var/lib/c-base-tunnel";
30 createHome = true;
31 shell = pkgs.bashInteractive;
32 };
33 users.groups.c-base-tunnel = { };
34
35 services.autossh.sessions = [
36 {
37 name = "c-base-ai";
38 user = "c-base-tunnel";
39 monitoringPort = 0;
40 extraArguments = builtins.concatStringsSep " " [
41 "-N"
42 "-o ServerAliveInterval=30"
43 "-o ServerAliveCountMax=3"
44 "-o ExitOnForwardFailure=yes"
45 "-o StrictHostKeyChecking=yes"
46 "-o UserKnownHostsFile=${knownHosts}"
47 "-o IdentitiesOnly=yes"
48 "-i ${sshKey}"
49 "-L *:${toString port}:${remoteHost}:${toString port}"
50 "${cbaseUser}@${cbaseHost}"
51 ];
52 }
53 ];
54
55 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ port ];
56}