This repository has no description
4.9 kB
156 lines
1{ config, lib, ... }:
2
3{
4 imports = [
5 ../../2configs
6 ../../2configs/ssh-redirect.nix
7 ../../2configs/retiolum.nix
8 ../../2configs/mailserver.nix
9 ../../2configs/snappymail.nix
10 ../../2configs/gsm-wiki.nix
11 ../../2configs/monitoring/telegraf.nix
12 ../../2configs/pair-programming.nix
13 ../../2configs/nginx.nix
14 ../../2configs/rogue-talk.nix
15
16 ../../2configs/services/matrix
17 ../../2configs/services/matrix/proxy.nix
18 ../../2configs/services/matrix/cinny.nix
19 ../../2configs/services/matrix/bridges/mautrix-whatsapp.nix
20 ../../2configs/services/matrix/bridges/mautrix-signal.nix
21 ../../2configs/services/matrix/bridges/heisenbridge.nix
22 ../../2configs/services/matrix/bridges/mautrix-telegram.nix
23 ../../2configs/services/matrix/bridges/mautrix-discord.nix
24 ../../2configs/services/matrix/bridges/matrix-zulip-bridge.nix
25
26 ../../2configs/services/pad
27
28 ../../2configs/hass/proxy.nix
29
30 # sync-containers
31 ../../2configs/consul.nix
32 ../../2configs/services/flix/container-host.nix
33 ../../2configs/services/radio/container-host.nix
34 ../../2configs/orange-host.nix
35 ../../2configs/hotdog-host.nix
36
37 # other containers
38 ../../2configs/riot.nix
39
40 # proxying of services
41 ../../2configs/services/radio/proxy.nix
42 ../../2configs/services/flix/proxy.nix
43 ../../2configs/services/coms/jitsi.nix
44
45 # dns
46 ../../2configs/dns/knot.nix
47
48 # url shortener
49 ../../2configs/go.nix
50
51 # video strreaming
52 ../../2configs/cast.nix
53
54 # c-base ollama tunnel
55 ../../2configs/c-base-ai-tunnel.nix
56
57 # debug stuff
58 ../../2configs/websites/mergebot.lassul.us.nix
59
60 # autoupdates
61 ../../2configs/autoupdate.nix
62
63 # vaultwarden
64 ../../2configs/vaultwarden.nix
65
66 # download user
67 ../../2configs/download-user.nix
68
69 # caldav calendar
70 ../../2configs/radicale.nix
71
72 # lassul.us website
73 ../../2configs/websites/lassulus.nix
74
75 # realwallpaper generator
76 ../../2configs/realwallpaper.nix
77
78 # binaergewitter announce bot
79 # ../../2configs/bgt-bot
80
81 # paste + cyberlocker
82 ../../2configs/paste.nix
83
84 # opencrow matrix bot
85 ../../2configs/opencrow.nix
86
87 # document signing
88 ../../2configs/docuseal.nix
89
90 # kannix (kanban board)
91 ../../2configs/kannix.nix
92
93 # backups
94 ./backup.nix
95
96 # IPFS
97 ../../2configs/services/flix/ipfs.nix
98
99 # n2n supernode (n2n.lassul.us)
100 ../../2configs/n2n-supernode.nix
101
102 # pocket-id SSO IdP (id.lassul.us)
103 ../../2configs/pocket-id.nix
104
105 # covibe co-vibing dashboard (covibe.lassul.us)
106 ../../2configs/covibe.nix
107
108 # radicle public seed (radicle.lassul.us)
109 ../../2configs/radicle.nix
110 ];
111
112 # lassul.us shouldn't be the default vhost here (nginx.nix already sets one)
113 services.nginx.virtualHosts."lassul.us" = {
114 default = lib.mkForce false;
115 locations = {
116 "= /wallpaper-marker.png".extraConfig = ''
117 alias /var/realwallpaper/realwallpaper-marker.png;
118 '';
119 "= /wallpaper.png".extraConfig = ''
120 alias /var/realwallpaper/realwallpaper.png;
121 '';
122 "= /wallpaper-stars-berlin.png".extraConfig = ''
123 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
124 '';
125 };
126 };
127
128 # riot VM (HFOS): fresh libvirt guest on a dedicated bridged public IP.
129 # Bridged onto ext-br with its own Hetzner MAC, so libvirt manages no
130 # iptables for it -> no nat-chain race, no restart-iptables hack (cf. hfos.nix).
131 virtualisation.libvirtd.enable = true;
132 security.polkit.enable = true;
133 users.users.riot = {
134 isNormalUser = true;
135 extraGroups = [ "libvirtd" ];
136 openssh.authorizedKeys.keys = [
137 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwcI8EKqUwYVd4IlnTTaNY3qVMDe2M1sVPMdWaTJ8FnAXixBcZozFHyJ9bvGn6c/vFGBEACZk6QCxC2+sTxbaodCOUIyhAtxqAGO7jINmGrVWjg2NW8qBi+e+ekr2+jlhizxgMPgMcbawuazpMzrozi6sfJfRelJRqe6TxrK/SBO+V5pf8v2ubAfHHF6bJrqAykC247d2NmsHEyM/nGOOb2AlJx2vrK1FbFWr2fBAvnhJww9wqrfDYSM6+oRF/vrYKkT9cU8yjtCkyaJZTqRufF2pzc9a0X3Z4LHEIUykAl2aVmi5Wzh8CZj3qCeVb9Ju0ZGQIa5pvG5CbH5SUJOr9y6zhTx1xbqL+JYGkJqgHPMOCFiNIvWnFaNlnvFf4C9KcTf/VMOEvNdDklpjoWm+ptuQIciAhWKuUHd/6MqaRjmlvUqjl49EkRvYOGn9vasKt66MYrtfvbZ3tcqh5w9EEKhrcygiUXhIJzhu2s1BseAVRLjCsQ24BNbzrYiCO+vuk8/hdeHB1rP6Sas2v7jvYb3zQd647OTq+HrZWN8aCjCs5h8Y0QxrQzsLru0zKDRaNDlbSshNBAw7PzSXQAf9fISH7v6sC4nstf5jk+87ua/7xjWG4NYp5Y9FMFCsuE3XVmUCAbauq18RmN6V4s2TxCEs9bxONO0Vba4zwPnvMlw== cardno:000619250765"
138 ];
139 };
140 # the only forwarding the VM needs: accept traffic to/from its public IP.
141 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
142 {
143 v6 = false;
144 predicate = "--destination 95.217.192.52";
145 target = "ACCEPT";
146 }
147 {
148 v6 = false;
149 predicate = "--source 95.217.192.52";
150 target = "ACCEPT";
151 }
152 ];
153
154 krebs.build.host = config.krebs.hosts.neoprism;
155 system.stateVersion = "24.05";
156}