This repository has no description
10 kB
277 lines
1{
2 self,
3 config,
4 lib,
5 ...
6}:
7let
8 slib = self.inputs.stockholm.lib;
9in
10{
11
12 system.stateVersion = "23.05";
13 imports = [
14 ../../2configs
15 {
16 # helsinki migration
17 users.users.root.openssh.authorizedKeys.keys = [
18 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIP4MIZG/hZR3Ib7faGDyK67Tk53Q1P7pE5cFIWwEFbrtAAAABHNzaDo="
19 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHBR9+AP/K+CY3S66vAGFyD5CQfNe7mrpD+jpKp5YfFJAAAABHNzaDo= fabian_sk"
20 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILVGDN7LfdnZQ0411u27288g+Nz8Z3qv5F280itDFArAAAAABHNzaDo="
21 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIC9d1Di6VHunJrvzVQqvsCdZzO3dmNe7XpQ4BB1uaclnAAAABHNzaDo="
22 ];
23 }
24 ./backup.nix
25 # ../../2configs/autoupdate.nix
26 ../../2configs/ssh-redirect.nix
27 ../../2configs/retiolum.nix
28 ../../2configs/libvirt.nix
29 ../../2configs/services/git/proxy.nix
30 ../../2configs/monitoring/telegraf.nix
31 ../../2configs/consul.nix
32 {
33 services.nginx.enable = true;
34 imports = [
35 ../../2configs/websites/domsen.nix
36 ];
37
38 krebs.iptables.tables.filter.INPUT.rules = [
39 {
40 predicate = "-p tcp --dport http";
41 target = "ACCEPT";
42 }
43 {
44 predicate = "-p tcp --dport https";
45 target = "ACCEPT";
46 }
47 ];
48 }
49 {
50 # TODO make new hfos.nix out of this vv
51 users.users.riot = {
52 uid = slib.genid_uint31 "riot";
53 isNormalUser = true;
54 extraGroups = [ "libvirtd" ];
55 openssh.authorizedKeys.keys = [
56 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
57 ];
58 };
59 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
60 {
61 v6 = false;
62 predicate = "--destination 95.216.1.130";
63 target = "ACCEPT";
64 }
65 {
66 v6 = false;
67 predicate = "--source 95.216.1.130";
68 target = "ACCEPT";
69 }
70 ];
71 }
72 {
73 users.users.tv = {
74 uid = slib.genid_uint31 "tv";
75 isNormalUser = true;
76 openssh.authorizedKeys.keys = [
77 config.krebs.users.tv.pubkey
78 ];
79 };
80 users.users.makefu = {
81 uid = slib.genid_uint31 "makefu";
82 isNormalUser = true;
83 openssh.authorizedKeys.keys = [
84 config.krebs.users.makefu.pubkey
85 ];
86 };
87 users.extraUsers.dritter = {
88 uid = slib.genid_uint31 "dritter";
89 isNormalUser = true;
90 extraGroups = [
91 "download"
92 ];
93 openssh.authorizedKeys.keys = [
94 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
95 ];
96 };
97 users.extraUsers.juhulian = {
98 uid = 1339;
99 isNormalUser = true;
100 openssh.authorizedKeys.keys = [
101 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
102 ];
103 };
104 users.users.hellrazor = {
105 uid = slib.genid_uint31 "hellrazor";
106 isNormalUser = true;
107 extraGroups = [
108 "download"
109 ];
110 openssh.authorizedKeys.keys = [
111 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ=="
112 ];
113 };
114 }
115 {
116 imports = [
117 ../../2configs/services/matrix/proxy.nix
118 ];
119 services.nginx.virtualHosts."matrix.lassul.us" = {
120 enableACME = lib.mkForce false;
121 forceSSL = lib.mkForce false;
122 };
123 }
124 ../../2configs/privoxy-retiolum.nix
125 ../../2configs/binary-cache/server.nix
126 ../../2configs/binary-cache/proxy.nix
127 ../../2configs/iodined.nix
128 # paste.nix removed - paste/cyberlocker now runs on neoprism, proxied below
129 ../../2configs/syncthing.nix
130 ../../2configs/container-networking.nix
131 {
132 services.tor = {
133 enable = true;
134 };
135 }
136 ../../2configs/minecraft.nix
137 {
138 imports = [
139 ../../2configs/wiregrill.nix
140 ];
141 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
142 {
143 v6 = false;
144 predicate = "-s 10.244.0.0/16";
145 target = "ACCEPT";
146 }
147 {
148 v4 = false;
149 predicate = "-s 42:1::/32";
150 target = "ACCEPT";
151 }
152 ];
153 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
154 {
155 predicate = "-i wiregrill -o retiolum";
156 target = "ACCEPT";
157 }
158 {
159 predicate = "-i retiolum -o wiregrill";
160 target = "ACCEPT";
161 }
162 ];
163 krebs.iptables.tables.nat.POSTROUTING.rules = [
164 {
165 v4 = false;
166 predicate = "-s 42:1::/32 ! -d 42:1::/48";
167 target = "MASQUERADE";
168 }
169 {
170 v6 = false;
171 predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16";
172 target = "MASQUERADE";
173 }
174 ];
175 services.dnsmasq = {
176 enable = true;
177 resolveLocalQueries = false;
178
179 settings = {
180 bind-interfaces = true;
181 interface = [
182 "wiregrill"
183 "retiolum "
184 ];
185 };
186 };
187 }
188 {
189 krebs.iptables.tables.filter.INPUT.rules = [
190 {
191 predicate = "-p udp --dport 60000:61000";
192 target = "ACCEPT";
193 }
194 ];
195 }
196 ../../2configs/services/coms/murmur.nix
197 {
198 # acme fallback for neoprism migration
199 services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
200 services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
201 services.nginx.virtualHosts."jitsi.lassul.us".acmeFallbackHost = "neoprism.r";
202 services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
203 services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
204 services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
205
206 # proxy paste/cyberlocker to neoprism
207 services.nginx.virtualHosts."p.krebsco.de" = {
208 enableACME = true;
209 addSSL = true;
210 serverAliases = [ "p.krebsco.de" ];
211 locations."/".extraConfig = ''
212 client_max_body_size 4G;
213 proxy_set_header Host $host;
214 proxy_set_header X-Forwarded-Proto $scheme;
215 proxy_pass https://neoprism.lassul.us;
216 '';
217 locations."/form".extraConfig = ''
218 client_max_body_size 4G;
219 proxy_set_header Host $host;
220 proxy_pass https://neoprism.lassul.us;
221 '';
222 locations."/image".extraConfig = ''
223 proxy_set_header Host $host;
224 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
225 proxy_set_header X-Forwarded-Proto $scheme;
226 proxy_pass https://neoprism.lassul.us;
227 '';
228 extraConfig = ''
229 add_header Access-Control-Allow-Headers Authorization always;
230 add_header Access-Control-Allow-Origin * always;
231 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
232 '';
233 };
234 services.nginx.virtualHosts."c.krebsco.de" = {
235 enableACME = true;
236 addSSL = true;
237 serverAliases = [ "c.krebsco.de" ];
238 locations."/".extraConfig = ''
239 proxy_set_header Host $host;
240 proxy_pass https://neoprism.lassul.us;
241 '';
242 extraConfig = ''
243 add_header Access-Control-Allow-Origin * always;
244 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
245 '';
246 };
247 services.nginx.virtualHosts.paste = {
248 serverAliases = [ "p.r" ];
249 locations."/".extraConfig = ''
250 client_max_body_size 4G;
251 proxy_set_header Host $host;
252 proxy_set_header X-Forwarded-Proto $scheme;
253 proxy_pass https://neoprism.lassul.us;
254 '';
255 locations."/image".extraConfig = ''
256 proxy_set_header Host $host;
257 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
258 proxy_set_header X-Forwarded-Proto $scheme;
259 proxy_pass https://neoprism.lassul.us;
260 '';
261 };
262 services.nginx.virtualHosts.cyberlocker = {
263 serverAliases = [ "c.r" ];
264 locations."/".extraConfig = ''
265 proxy_set_header Host $host;
266 proxy_pass https://neoprism.lassul.us;
267 '';
268 };
269 }
270 ];
271
272 krebs.build.host = config.krebs.hosts.prism;
273 services.earlyoom = {
274 enable = true;
275 freeMemThreshold = 5;
276 };
277}