forked from
lass.pds.lassul.us/superconfig
This repository has no description
machines prism: remove legacy flix config
author
lassulus
date
(Mar 17, 2024, 3:23 PM CET)
commit
d38ec924
d38ec92443f68eefb44909d90e62442af7e8943f
parent
41b4b7ae
41b4b7aee05bf7242b81466a16e6586f3979187d
-150
-150
machines/prism/config.nix
-150
machines/prism/config.nix
···
165
165
];
166
166
}
167
167
../../2configs/services/coms/murmur.nix
168
-
{
169
-
170
-
services.nginx.virtualHosts."flix.lassul.us" = {
171
-
forceSSL = true;
172
-
enableACME = true;
173
-
locations."/" = {
174
-
proxyPass = "http://yellow.r:8096";
175
-
proxyWebsockets = true;
176
-
recommendedProxySettings = true;
177
-
};
178
-
};
179
-
services.nginx.virtualHosts."lassul.us" = {
180
-
locations."^~ /flix/".extraConfig = ''
181
-
if ($scheme != "https") {
182
-
rewrite ^ https://$host$request_uri permanent;
183
-
}
184
-
auth_basic "Restricted Content";
185
-
auth_basic_user_file ${pkgs.writeText "flix-user-pass" ''
186
-
krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
187
-
''};
188
-
proxy_pass http://yellow.r:80/;
189
-
proxy_set_header Accept-Encoding "";
190
-
sub_filter "https://lassul.us/" "https://lassul.us/flix/";
191
-
sub_filter_once off;
192
-
'';
193
-
locations."^~ /chatty/".extraConfig = ''
194
-
rewrite ^ https://$host/flix/$request_uri permanent;
195
-
'';
196
-
#locations."^~ /transmission".return = "301 https://$host/transmission/web/";
197
-
locations."^~ /transmission/".extraConfig = ''
198
-
if ($scheme != "https") {
199
-
rewrite ^ https://$host$request_uri permanent;
200
-
}
201
-
auth_basic "Restricted Content";
202
-
auth_basic_user_file ${pkgs.writeText "transmission-user-pass" ''
203
-
krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
204
-
''};
205
-
proxy_pass_header X-Transmission-Session-Id;
206
-
proxy_pass http://10.233.2.14:9091;
207
-
'';
208
-
};
209
-
210
-
users.groups.download = {};
211
-
users.users = {
212
-
download = {
213
-
createHome = false;
214
-
group = "download";
215
-
name = "download";
216
-
home = "/var/download";
217
-
useDefaultShell = true;
218
-
uid = slib.genid "download";
219
-
isSystemUser = true;
220
-
openssh.authorizedKeys.keys = with config.krebs.users; [
221
-
lass.pubkey
222
-
makefu.pubkey
223
-
palo.pubkey
224
-
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB0d0JA20Vqn7I4lCte6Ne2EOmLZyMJyS9yIKJYXNLjbLwkQ4AYoQKantPBkTxR75M09E7d3j5heuWnCjWH45TrfQfe1EOSSC3ppCI6C6aIVlaNs+KhAYZS0m2Y8WkKn+TT5JLEa8yybYVN/RlZPOilpj/1QgjU6CQK+eJ1k/kK+QFXcwN82GDVh5kbTVcKUNp2tiyxFA+z9LY0xFDg/JHif2ROpjJVLQBJ+YPuOXZN5LDnVcuyLWKThjxy5srQ8iDjoxBg7dwLHjby5Mv41K4W61Gq6xM53gDEgfXk4cQhJnmx7jA/pUnsn2ZQDeww3hcc7vRf8soogXXz2KC9maiq0M/svaATsa9Ul4hrKnqPZP9Q8ScSEAUX+VI+x54iWrnW0p/yqBiRAzwsczdPzaQroUFTBxrq8R/n5TFdSHRMX7fYNOeVMjhfNca/gtfw9dYBVquCvuqUuFiRc0I7yK44rrMjjVQRcAbw6F8O7+04qWCmaJ8MPlmApwu2c05VMv9hiJo5p6PnzterRSLCqF6rIdhSnuOwrUIt1s/V+EEZXHCwSaNLaQJnYL0H9YjaIuGz4c8kVzxw4c0B6nl+hqW5y5/B2cuHiumnlRIDKOIzlv8ufhh21iN7QpIsPizahPezGoT1XqvzeXfH4qryo8O4yTN/PWoA+f7o9POU7L6hQ== lhebendanz@nixos"
225
-
"AAAAB3NzaC1yc2EAAAADAQABAAABgQC4ECL9NSCWqs4KVe+FF+2BPtl5Bv5aQPHqnXllCyiESZykwRKLx6/AbF5SbUAUMVZtp9oDSdp28m3BvVeWJ/q7hAbIxUtfd/jp+JBRZ8Kj6K5GzUO7Bhgl/o0A7xEjAeOKHiYuLjdPMcFUyl6Ah4ey/mcQYf6AdU0+hYUDeUlKe/YxxYD6202W0GJq2xGdIqs/TbopT9iaX+sv0wdXDVfFY72nFqOUwJW3u6O2viKKRugrz/eo50Eo3ts7pYz/FpDXExrUvV9Vu/bQ34pa8nKgF3/AKQHgmzljNQSVZKyAV8OY0UFonjBMXCBg2tXtwfnlzdx2SyuQVv55x+0AuRKsi85G2xLpXu1A3921pseBTW6Q6kbYK9eqxAay2c/kNbwNqFnO+nCvQ6Ier/hvGddOtItMu96IuU2E7mPN6WgvM8/3fjJRFWnZxFxqu/k7iH+yYT8qwRgdiSqZc76qvkYEuabdk2itstTRY0A3SpI3hFMZDw/7bxgMZtqpfyoRk5s= philip@shiki11:15 <Profpatsch> AAAAB3NzaC1yc2EAAAADAQABAAABgQC4ECL9NSCWqs4KVe+FF+2BPtl5Bv5aQPHqnXllCyiESZykwRKLx6/AbF5SbUAUMVZtp9oDSdp28m3BvVeWJ/q7hAbIxUtfd/jp+JBRZ8Kj6K5GzUO7Bhgl/o0A7xEjAeOKHiYuLjdPMcFUyl6Ah4ey/mcQYf6AdU0+hYUDeUlKe/YxxYD6202W0GJq2xGdIqs/TbopT9iaX+sv0wdXDVfFY72nFqOUwJW3u6O2viKKRugrz/eo50Eo3ts7pYz/FpDXExrUvV9Vu/bQ34pa8nKgF3/AKQHgmzljNQSVZKyAV8OY0UFonjBMXCBg2tXtwfnlzdx2SyuQVv55x+0AuRKsi85G2xLpXu1A3921pseBTW6Q6kbYK9eqxAay2c/kNbwNqFnO+nCvQ6Ier/hvGddOtItMu96IuU2E7mPN6WgvM8/3fjJRFWnZxFxqu/k7iH+yYT8qwRgdiSqZc76qvkYEuabdk2itstTRY0A3SpI3hFMZDw/7bxgMZtqpfyoRk5s= philip@shiki"
226
-
mic92.pubkey
227
-
qubasa.pubkey
228
-
];
229
-
};
230
-
};
231
-
232
-
system.activationScripts.downloadFolder = ''
233
-
mkdir -p /var/download
234
-
chmod 775 /var/download
235
-
ln -fnsT /var/lib/containers/yellow/var/download/finished /var/download/finished || :
236
-
chown download: /var/download/finished
237
-
'';
238
-
239
-
fileSystems."/export/download" = {
240
-
device = "/var/lib/containers/yellow/var/download/finished";
241
-
options = [ "bind" ];
242
-
};
243
-
services.nfs.server = {
244
-
enable = true;
245
-
exports = ''
246
-
/export 42::/16(insecure,ro,crossmnt)
247
-
'';
248
-
lockdPort = 4001;
249
-
mountdPort = 4002;
250
-
statdPort = 4000;
251
-
};
252
-
253
-
services.samba = {
254
-
enable = true;
255
-
enableNmbd = false;
256
-
extraConfig = ''
257
-
workgroup = WORKGROUP
258
-
netbios name = PRISM
259
-
server string = ${config.networking.hostName}
260
-
# only allow retiolum addresses
261
-
hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
262
-
263
-
# Use sendfile() for performance gain
264
-
use sendfile = true
265
-
266
-
# No NetBIOS is needed
267
-
disable netbios = true
268
-
269
-
# Only mangle non-valid NTFS names, don't care about DOS support
270
-
mangled names = illegal
271
-
272
-
# Performance optimizations
273
-
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
274
-
275
-
# Disable all printing
276
-
load printers = false
277
-
disable spoolss = true
278
-
printcap name = /dev/null
279
-
280
-
map to guest = Bad User
281
-
max log size = 50
282
-
dns proxy = no
283
-
security = user
284
-
285
-
[global]
286
-
syslog only = yes
287
-
'';
288
-
shares.public = {
289
-
comment = "Warez";
290
-
path = "/export";
291
-
public = "yes";
292
-
"only guest" = "yes";
293
-
"create mask" = "0644";
294
-
"directory mask" = "2777";
295
-
writable = "no";
296
-
printable = "no";
297
-
};
298
-
};
299
-
300
-
krebs.iptables.tables.filter.INPUT.rules = [
301
-
# smbd
302
-
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
303
-
{ predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
304
-
{ predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
305
-
{ predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
306
-
{ predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
307
-
{ predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
308
-
{ predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
309
-
{ predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
310
-
{ predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
311
-
{ predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
312
-
{ predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
313
-
{ predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
314
-
{ predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
315
-
{ predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
316
-
];
317
-
}
318
168
{ # acme fallback for neoprism migration
319
169
services.nginx.virtualHosts."lassul.us".acmeFallbackHost = "orange.r";
320
170
services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";