This repository has no description
9.2 kB
261 lines
1{
2 self,
3 config,
4 lib,
5 ...
6}:
7let
8 slib = self.inputs.stockholm.lib;
9in
10{
11
12 system.stateVersion = "23.05";
13 imports = [
14 ../../2configs
15 {
16 # helsinki migration
17 users.users.root.openssh.authorizedKeys.keys = [
18 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIP4MIZG/hZR3Ib7faGDyK67Tk53Q1P7pE5cFIWwEFbrtAAAABHNzaDo="
19 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHBR9+AP/K+CY3S66vAGFyD5CQfNe7mrpD+jpKp5YfFJAAAABHNzaDo= fabian_sk"
20 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILVGDN7LfdnZQ0411u27288g+Nz8Z3qv5F280itDFArAAAAABHNzaDo="
21 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIC9d1Di6VHunJrvzVQqvsCdZzO3dmNe7XpQ4BB1uaclnAAAABHNzaDo="
22 ];
23 }
24 ./backup.nix
25 # ../../2configs/autoupdate.nix
26 ../../2configs/ssh-redirect.nix
27 ../../2configs/retiolum.nix
28 ../../2configs/libvirt.nix
29 ../../2configs/websites/lassulus.nix
30 ../../2configs/services/git/proxy.nix
31 ../../2configs/monitoring/telegraf.nix
32 ../../2configs/consul.nix
33 {
34 services.nginx.enable = true;
35 imports = [
36 ../../2configs/websites/domsen.nix
37 ];
38 # needed by domsen.nix ^^
39 lass.usershadow = {
40 enable = true;
41 };
42
43 krebs.iptables.tables.filter.INPUT.rules = [
44 {
45 predicate = "-p tcp --dport http";
46 target = "ACCEPT";
47 }
48 {
49 predicate = "-p tcp --dport https";
50 target = "ACCEPT";
51 }
52 ];
53 }
54 {
55 # TODO make new hfos.nix out of this vv
56 users.users.riot = {
57 uid = slib.genid_uint31 "riot";
58 isNormalUser = true;
59 extraGroups = [ "libvirtd" ];
60 openssh.authorizedKeys.keys = [
61 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
62 ];
63 };
64 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
65 {
66 v6 = false;
67 predicate = "--destination 95.216.1.130";
68 target = "ACCEPT";
69 }
70 {
71 v6 = false;
72 predicate = "--source 95.216.1.130";
73 target = "ACCEPT";
74 }
75 ];
76 }
77 {
78 users.users.tv = {
79 uid = slib.genid_uint31 "tv";
80 isNormalUser = true;
81 openssh.authorizedKeys.keys = [
82 config.krebs.users.tv.pubkey
83 ];
84 };
85 users.users.makefu = {
86 uid = slib.genid_uint31 "makefu";
87 isNormalUser = true;
88 openssh.authorizedKeys.keys = [
89 config.krebs.users.makefu.pubkey
90 ];
91 };
92 users.extraUsers.dritter = {
93 uid = slib.genid_uint31 "dritter";
94 isNormalUser = true;
95 extraGroups = [
96 "download"
97 ];
98 openssh.authorizedKeys.keys = [
99 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
100 ];
101 };
102 users.extraUsers.juhulian = {
103 uid = 1339;
104 isNormalUser = true;
105 openssh.authorizedKeys.keys = [
106 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
107 ];
108 };
109 users.users.hellrazor = {
110 uid = slib.genid_uint31 "hellrazor";
111 isNormalUser = true;
112 extraGroups = [
113 "download"
114 ];
115 openssh.authorizedKeys.keys = [
116 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ=="
117 ];
118 };
119 }
120 {
121 imports = [
122 ../../2configs/services/matrix/proxy.nix
123 ];
124 services.nginx.virtualHosts."matrix.lassul.us" = {
125 enableACME = lib.mkForce false;
126 forceSSL = lib.mkForce false;
127 };
128 }
129 ../../2configs/exim-smarthost.nix
130 ../../2configs/privoxy-retiolum.nix
131 ../../2configs/binary-cache/server.nix
132 ../../2configs/binary-cache/proxy.nix
133 ../../2configs/iodined.nix
134 ../../2configs/paste.nix
135 ../../2configs/syncthing.nix
136 ../../2configs/container-networking.nix
137 ../../2configs/bgt-bot
138 (self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
139 {
140 services.tor = {
141 enable = true;
142 };
143 }
144 {
145 imports = [
146 ../../2configs/realwallpaper.nix
147 ];
148 services.nginx.virtualHosts."lassul.us".locations = {
149 "= /wallpaper-marker.png".extraConfig = ''
150 alias /var/realwallpaper/realwallpaper-marker.png;
151 '';
152 "= /wallpaper.png".extraConfig = ''
153 alias /var/realwallpaper/realwallpaper.png;
154 '';
155 "= /wallpaper-stars-berlin.png".extraConfig = ''
156 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
157 '';
158 };
159 }
160 ../../2configs/minecraft.nix
161 {
162 lass.nichtparasoup.enable = true;
163 services.nginx = {
164 enable = true;
165 virtualHosts."lol.lassul.us" = {
166 forceSSL = true;
167 enableACME = true;
168 locations."/".extraConfig = ''
169 proxy_pass http://localhost:5001;
170 '';
171 };
172 };
173 }
174 {
175 imports = [
176 ../../2configs/wiregrill.nix
177 ];
178 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
179 {
180 v6 = false;
181 predicate = "-s 10.244.0.0/16";
182 target = "ACCEPT";
183 }
184 {
185 v4 = false;
186 predicate = "-s 42:1::/32";
187 target = "ACCEPT";
188 }
189 ];
190 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
191 {
192 predicate = "-i wiregrill -o retiolum";
193 target = "ACCEPT";
194 }
195 {
196 predicate = "-i retiolum -o wiregrill";
197 target = "ACCEPT";
198 }
199 ];
200 krebs.iptables.tables.nat.POSTROUTING.rules = [
201 {
202 v4 = false;
203 predicate = "-s 42:1::/32 ! -d 42:1::/48";
204 target = "MASQUERADE";
205 }
206 {
207 v6 = false;
208 predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16";
209 target = "MASQUERADE";
210 }
211 ];
212 services.dnsmasq = {
213 enable = true;
214 resolveLocalQueries = false;
215
216 settings = {
217 bind-interfaces = true;
218 interface = [
219 "wiregrill"
220 "retiolum "
221 ];
222 };
223 };
224 }
225 {
226 krebs.iptables.tables.filter.INPUT.rules = [
227 {
228 predicate = "-p udp --dport 60000:61000";
229 target = "ACCEPT";
230 }
231 ];
232 }
233 ../../2configs/services/coms/murmur.nix
234 {
235 # acme fallback for neoprism migration
236 services.nginx.virtualHosts."lassul.us".acmeFallbackHost = "orange.r";
237 services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
238 services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
239 services.nginx.virtualHosts."jitsi.lassul.us".acmeFallbackHost = "neoprism.r";
240 services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
241 services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
242 services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
243 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
244 enableACME = true;
245 forceSSL = true;
246 acmeFallbackHost = "ubik.r";
247 locations."/" = {
248 recommendedProxySettings = true;
249 proxyWebsockets = true;
250 proxyPass = "https://ubik.r";
251 };
252 };
253 }
254 ];
255
256 krebs.build.host = config.krebs.hosts.prism;
257 services.earlyoom = {
258 enable = true;
259 freeMemThreshold = 5;
260 };
261}