This repository has no description
7.0 kB
208 lines
1{
2 self,
3 lib,
4 ...
5}:
6
7{
8 imports = [
9 ../../configs
10 ../../configs/ssh-redirect.nix
11 ../../configs/retiolum.nix
12 ../../configs/mailserver.nix
13 ../../configs/snappymail.nix
14 ../../configs/gsm-wiki.nix
15 ../../configs/monitoring/telegraf.nix
16 ../../configs/pair-programming.nix
17 ../../configs/nginx.nix
18 ../../configs/rogue-talk.nix
19
20 ../../configs/services/matrix
21 ../../configs/services/matrix/proxy.nix
22 ../../configs/services/matrix/cinny.nix
23 ../../configs/services/matrix/bridges/mautrix-whatsapp.nix
24 ../../configs/services/matrix/bridges/mautrix-signal.nix
25 ../../configs/services/matrix/bridges/heisenbridge.nix
26 ../../configs/services/matrix/bridges/mautrix-telegram.nix
27 ../../configs/services/matrix/bridges/mautrix-discord.nix
28 ../../configs/services/matrix/bridges/matrix-zulip-bridge.nix
29
30 ../../configs/services/pad
31
32 ../../configs/hass/proxy.nix
33 ../../configs/hermes-proxy.nix
34
35 # sync-containers
36 ../../configs/consul.nix
37 ../../configs/services/flix/container-host.nix
38 ../../configs/services/radio/container-host.nix
39 ../../configs/orange-host.nix
40 ../../configs/hotdog-host.nix
41
42 # other containers
43 ../../configs/riot.nix
44
45 # proxying of services
46 ../../configs/services/radio/proxy.nix
47 ../../configs/services/flix/proxy.nix
48 ../../configs/services/coms/jitsi.nix
49 # mastodon (social.krebsco.de) -> hotdog container, migrated from prism
50 (self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
51
52 # dns
53 ../../configs/dns/knot.nix
54
55 # url shortener
56 ../../configs/go.nix
57
58 # video strreaming
59 ../../configs/cast.nix
60
61 # c-base ollama tunnel
62 ../../configs/c-base-ai-tunnel.nix
63
64 # debug stuff
65 ../../configs/websites/mergebot.lassul.us.nix
66
67 # autoupdates
68 ../../configs/autoupdate.nix
69
70 # vaultwarden
71 ../../configs/vaultwarden.nix
72
73 # download user
74 ../../configs/download-user.nix
75
76 # caldav calendar
77 ../../configs/radicale.nix
78
79 # lassul.us website
80 ../../configs/websites/lassulus.nix
81
82 # where.is.lassul.us (location from home-assistant on a map)
83 ../../configs/websites/where.is.lassul.us
84
85 # realwallpaper generator
86 ../../configs/realwallpaper.nix
87
88 # paste + cyberlocker
89 ../../configs/paste.nix
90
91 # opencrow matrix bot
92 ../../configs/opencrow.nix
93
94 # document signing
95 ../../configs/docuseal.nix
96
97 # kannix (kanban board)
98 ../../configs/kannix.nix
99
100 # timeful availability polls (when.lassul.us)
101 ../../configs/timeful.nix
102
103 # request-and-approve booking page (book.lassul.us)
104 ../../configs/book.nix
105
106 # backups
107 ./backup.nix
108
109 # IPFS
110 ../../configs/services/flix/ipfs.nix
111
112 # n2n supernode (n2n.lassul.us)
113 ../../configs/n2n-supernode.nix
114
115 # pocket-id SSO IdP (id.lassul.us)
116 ../../configs/pocket-id.nix
117
118 # covibe co-vibing dashboard (covibe.lassul.us)
119 ../../configs/covibe.nix
120
121 # omnigent agent meta-harness (omni.lassul.us)
122 ../../configs/omnigent.nix
123
124 # radicle public seed (radicle.lassul.us)
125 ../../configs/radicle.lassul.us.nix
126 # radicle identity + node for this machine (/var/lib/rad)
127 ../../configs/rad.nix
128
129 # herdr agent multiplexer
130 ../../configs/herdr.nix
131
132 # self-hosted iroh relay (relay.lassul.us)
133 ../../configs/iroh-relay
134
135 # signed remote command execution (root executor + fleet dashboard,
136 # sigexec.lassul.us)
137 ../../configs/sigexec/executor.nix
138 ../../configs/sigexec/dashboard.nix
139
140 # parley federated IRC-speaking chat (parley.lassul.us)
141 ../../configs/parley.nix
142
143 # nixpkgs PR triage dashboard (review.lassul.us)
144 ../../configs/nixpkgs-triage.nix
145 ];
146
147 # lassul.us shouldn't be the default vhost here (nginx.nix already sets one)
148 services.nginx.virtualHosts."lassul.us" = {
149 default = lib.mkForce false;
150 locations = {
151 "= /wallpaper-marker.png".extraConfig = ''
152 alias /var/realwallpaper/realwallpaper-marker.png;
153 '';
154 "= /wallpaper.png".extraConfig = ''
155 alias /var/realwallpaper/realwallpaper.png;
156 '';
157 "= /wallpaper-stars-berlin.png".extraConfig = ''
158 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
159 '';
160 };
161 };
162
163 # riot VM (HFOS): fresh libvirt guest on a dedicated bridged public IP.
164 # Bridged onto ext-br with its own Hetzner MAC, so libvirt manages no
165 # iptables for it -> no nat-chain race, no restart-iptables hack (cf. hfos.nix).
166 virtualisation.libvirtd.enable = true;
167 security.polkit.enable = true;
168 users.users.riot = {
169 isNormalUser = true;
170 extraGroups = [ "libvirtd" ];
171 openssh.authorizedKeys.keys = [
172 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwcI8EKqUwYVd4IlnTTaNY3qVMDe2M1sVPMdWaTJ8FnAXixBcZozFHyJ9bvGn6c/vFGBEACZk6QCxC2+sTxbaodCOUIyhAtxqAGO7jINmGrVWjg2NW8qBi+e+ekr2+jlhizxgMPgMcbawuazpMzrozi6sfJfRelJRqe6TxrK/SBO+V5pf8v2ubAfHHF6bJrqAykC247d2NmsHEyM/nGOOb2AlJx2vrK1FbFWr2fBAvnhJww9wqrfDYSM6+oRF/vrYKkT9cU8yjtCkyaJZTqRufF2pzc9a0X3Z4LHEIUykAl2aVmi5Wzh8CZj3qCeVb9Ju0ZGQIa5pvG5CbH5SUJOr9y6zhTx1xbqL+JYGkJqgHPMOCFiNIvWnFaNlnvFf4C9KcTf/VMOEvNdDklpjoWm+ptuQIciAhWKuUHd/6MqaRjmlvUqjl49EkRvYOGn9vasKt66MYrtfvbZ3tcqh5w9EEKhrcygiUXhIJzhu2s1BseAVRLjCsQ24BNbzrYiCO+vuk8/hdeHB1rP6Sas2v7jvYb3zQd647OTq+HrZWN8aCjCs5h8Y0QxrQzsLru0zKDRaNDlbSshNBAw7PzSXQAf9fISH7v6sC4nstf5jk+87ua/7xjWG4NYp5Y9FMFCsuE3XVmUCAbauq18RmN6V4s2TxCEs9bxONO0Vba4zwPnvMlw== cardno:000619250765"
173 ];
174 };
175 # the only forwarding the VM needs: accept traffic to/from its public IP.
176 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
177 {
178 v6 = false;
179 predicate = "--destination 95.217.192.52";
180 target = "ACCEPT";
181 }
182 {
183 v6 = false;
184 predicate = "--source 95.217.192.52";
185 target = "ACCEPT";
186 }
187 ];
188
189 # tank/radicle (radicle seed storage) is created by disko at install; on an
190 # already-provisioned host it must be created before deploying:
191 # zfs create -o mountpoint=/var/lib/radicle -o quota=80G tank/radicle
192 # nofail keeps a missing dataset from failing local-fs.target -> emergency
193 # mode (which has no network and bricks the box).
194 fileSystems."/var/lib/radicle".options = [ "nofail" ];
195
196 # Fleet-wide safety net: this box is headless (Hetzner, console only via
197 # KVM), so a failed critical target must never strand us at the emergency
198 # shell. With emergency mode disabled systemd keeps booting instead of
199 # dropping to a console -> network + sshd still come up, so a bad deploy
200 # (e.g. a missing dataset, as happened once) leaves the box reachable to
201 # fix and redeploy rather than bricked. Mirrors nixpkgs' headless profile.
202 # Note: we intentionally do NOT auto-roll-back to the previous generation;
203 # our config is pulled from git by system.autoUpgrade, so a rollback would
204 # just re-pull the same broken config on the next run (a rollback loop).
205 systemd.enableEmergencyMode = false;
206
207 system.stateVersion = "24.05";
208}