This repository has no description
10 kB
278 lines
1{
2 self,
3 config,
4 lib,
5 ...
6}:
7let
8 slib = self.inputs.stockholm.lib;
9in
10{
11
12 system.stateVersion = "23.05";
13 imports = [
14 ../../2configs
15 {
16 # helsinki migration
17 users.users.root.openssh.authorizedKeys.keys = [
18 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIP4MIZG/hZR3Ib7faGDyK67Tk53Q1P7pE5cFIWwEFbrtAAAABHNzaDo="
19 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHBR9+AP/K+CY3S66vAGFyD5CQfNe7mrpD+jpKp5YfFJAAAABHNzaDo= fabian_sk"
20 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILVGDN7LfdnZQ0411u27288g+Nz8Z3qv5F280itDFArAAAAABHNzaDo="
21 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIC9d1Di6VHunJrvzVQqvsCdZzO3dmNe7XpQ4BB1uaclnAAAABHNzaDo="
22 ];
23 }
24 ./backup.nix
25 # ../../2configs/autoupdate.nix
26 ../../2configs/ssh-redirect.nix
27 ../../2configs/retiolum.nix
28 ../../2configs/libvirt.nix
29 ../../2configs/services/git/proxy.nix
30 ../../2configs/monitoring/telegraf.nix
31 ../../2configs/consul.nix
32 {
33 services.nginx.enable = true;
34 imports = [
35 ../../2configs/websites/domsen.nix
36 ];
37
38 krebs.iptables.tables.filter.INPUT.rules = [
39 {
40 predicate = "-p tcp --dport http";
41 target = "ACCEPT";
42 }
43 {
44 predicate = "-p tcp --dport https";
45 target = "ACCEPT";
46 }
47 ];
48 }
49 {
50 # TODO make new hfos.nix out of this vv
51 users.users.riot = {
52 uid = slib.genid_uint31 "riot";
53 isNormalUser = true;
54 extraGroups = [ "libvirtd" ];
55 openssh.authorizedKeys.keys = [
56 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
57 ];
58 };
59 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
60 {
61 v6 = false;
62 predicate = "--destination 95.216.1.130";
63 target = "ACCEPT";
64 }
65 {
66 v6 = false;
67 predicate = "--source 95.216.1.130";
68 target = "ACCEPT";
69 }
70 ];
71 }
72 {
73 users.users.tv = {
74 uid = slib.genid_uint31 "tv";
75 isNormalUser = true;
76 openssh.authorizedKeys.keys = [
77 config.krebs.users.tv.pubkey
78 ];
79 };
80 users.users.makefu = {
81 uid = slib.genid_uint31 "makefu";
82 isNormalUser = true;
83 openssh.authorizedKeys.keys = [
84 config.krebs.users.makefu.pubkey
85 ];
86 };
87 users.extraUsers.dritter = {
88 uid = slib.genid_uint31 "dritter";
89 isNormalUser = true;
90 extraGroups = [
91 "download"
92 ];
93 openssh.authorizedKeys.keys = [
94 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
95 ];
96 };
97 users.extraUsers.juhulian = {
98 uid = 1339;
99 isNormalUser = true;
100 openssh.authorizedKeys.keys = [
101 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
102 ];
103 };
104 users.users.hellrazor = {
105 uid = slib.genid_uint31 "hellrazor";
106 isNormalUser = true;
107 extraGroups = [
108 "download"
109 ];
110 openssh.authorizedKeys.keys = [
111 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ=="
112 ];
113 };
114 }
115 {
116 imports = [
117 ../../2configs/services/matrix/proxy.nix
118 ];
119 services.nginx.virtualHosts."matrix.lassul.us" = {
120 enableACME = lib.mkForce false;
121 forceSSL = lib.mkForce false;
122 };
123 }
124 ../../2configs/privoxy-retiolum.nix
125 ../../2configs/binary-cache/server.nix
126 ../../2configs/binary-cache/proxy.nix
127 ../../2configs/iodined.nix
128 # paste.nix removed - paste/cyberlocker now runs on neoprism, proxied below
129 ../../2configs/syncthing.nix
130 ../../2configs/container-networking.nix
131 (self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
132 {
133 services.tor = {
134 enable = true;
135 };
136 }
137 ../../2configs/minecraft.nix
138 {
139 imports = [
140 ../../2configs/wiregrill.nix
141 ];
142 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
143 {
144 v6 = false;
145 predicate = "-s 10.244.0.0/16";
146 target = "ACCEPT";
147 }
148 {
149 v4 = false;
150 predicate = "-s 42:1::/32";
151 target = "ACCEPT";
152 }
153 ];
154 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
155 {
156 predicate = "-i wiregrill -o retiolum";
157 target = "ACCEPT";
158 }
159 {
160 predicate = "-i retiolum -o wiregrill";
161 target = "ACCEPT";
162 }
163 ];
164 krebs.iptables.tables.nat.POSTROUTING.rules = [
165 {
166 v4 = false;
167 predicate = "-s 42:1::/32 ! -d 42:1::/48";
168 target = "MASQUERADE";
169 }
170 {
171 v6 = false;
172 predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16";
173 target = "MASQUERADE";
174 }
175 ];
176 services.dnsmasq = {
177 enable = true;
178 resolveLocalQueries = false;
179
180 settings = {
181 bind-interfaces = true;
182 interface = [
183 "wiregrill"
184 "retiolum "
185 ];
186 };
187 };
188 }
189 {
190 krebs.iptables.tables.filter.INPUT.rules = [
191 {
192 predicate = "-p udp --dport 60000:61000";
193 target = "ACCEPT";
194 }
195 ];
196 }
197 ../../2configs/services/coms/murmur.nix
198 {
199 # acme fallback for neoprism migration
200 services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
201 services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
202 services.nginx.virtualHosts."jitsi.lassul.us".acmeFallbackHost = "neoprism.r";
203 services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
204 services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
205 services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
206
207 # proxy paste/cyberlocker to neoprism
208 services.nginx.virtualHosts."p.krebsco.de" = {
209 enableACME = true;
210 addSSL = true;
211 serverAliases = [ "p.krebsco.de" ];
212 locations."/".extraConfig = ''
213 client_max_body_size 4G;
214 proxy_set_header Host $host;
215 proxy_set_header X-Forwarded-Proto $scheme;
216 proxy_pass https://neoprism.lassul.us;
217 '';
218 locations."/form".extraConfig = ''
219 client_max_body_size 4G;
220 proxy_set_header Host $host;
221 proxy_pass https://neoprism.lassul.us;
222 '';
223 locations."/image".extraConfig = ''
224 proxy_set_header Host $host;
225 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
226 proxy_set_header X-Forwarded-Proto $scheme;
227 proxy_pass https://neoprism.lassul.us;
228 '';
229 extraConfig = ''
230 add_header Access-Control-Allow-Headers Authorization always;
231 add_header Access-Control-Allow-Origin * always;
232 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
233 '';
234 };
235 services.nginx.virtualHosts."c.krebsco.de" = {
236 enableACME = true;
237 addSSL = true;
238 serverAliases = [ "c.krebsco.de" ];
239 locations."/".extraConfig = ''
240 proxy_set_header Host $host;
241 proxy_pass https://neoprism.lassul.us;
242 '';
243 extraConfig = ''
244 add_header Access-Control-Allow-Origin * always;
245 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
246 '';
247 };
248 services.nginx.virtualHosts.paste = {
249 serverAliases = [ "p.r" ];
250 locations."/".extraConfig = ''
251 client_max_body_size 4G;
252 proxy_set_header Host $host;
253 proxy_set_header X-Forwarded-Proto $scheme;
254 proxy_pass https://neoprism.lassul.us;
255 '';
256 locations."/image".extraConfig = ''
257 proxy_set_header Host $host;
258 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
259 proxy_set_header X-Forwarded-Proto $scheme;
260 proxy_pass https://neoprism.lassul.us;
261 '';
262 };
263 services.nginx.virtualHosts.cyberlocker = {
264 serverAliases = [ "c.r" ];
265 locations."/".extraConfig = ''
266 proxy_set_header Host $host;
267 proxy_pass https://neoprism.lassul.us;
268 '';
269 };
270 }
271 ];
272
273 krebs.build.host = config.krebs.hosts.prism;
274 services.earlyoom = {
275 enable = true;
276 freeMemThreshold = 5;
277 };
278}