This repository has no description
6.9 kB
204 lines
1{
2 self,
3 config,
4 lib,
5 ...
6}:
7
8{
9 imports = [
10 ../../2configs
11 ../../2configs/ssh-redirect.nix
12 ../../2configs/retiolum.nix
13 ../../2configs/mailserver.nix
14 ../../2configs/snappymail.nix
15 ../../2configs/gsm-wiki.nix
16 ../../2configs/monitoring/telegraf.nix
17 ../../2configs/pair-programming.nix
18 ../../2configs/nginx.nix
19 ../../2configs/rogue-talk.nix
20
21 ../../2configs/services/matrix
22 ../../2configs/services/matrix/proxy.nix
23 ../../2configs/services/matrix/cinny.nix
24 ../../2configs/services/matrix/bridges/mautrix-whatsapp.nix
25 ../../2configs/services/matrix/bridges/mautrix-signal.nix
26 ../../2configs/services/matrix/bridges/heisenbridge.nix
27 ../../2configs/services/matrix/bridges/mautrix-telegram.nix
28 ../../2configs/services/matrix/bridges/mautrix-discord.nix
29 ../../2configs/services/matrix/bridges/matrix-zulip-bridge.nix
30
31 ../../2configs/services/pad
32
33 ../../2configs/hass/proxy.nix
34 ../../2configs/hermes-proxy.nix
35
36 # sync-containers
37 ../../2configs/consul.nix
38 ../../2configs/services/flix/container-host.nix
39 ../../2configs/services/radio/container-host.nix
40 ../../2configs/orange-host.nix
41 ../../2configs/hotdog-host.nix
42
43 # other containers
44 ../../2configs/riot.nix
45
46 # proxying of services
47 ../../2configs/services/radio/proxy.nix
48 ../../2configs/services/flix/proxy.nix
49 ../../2configs/services/coms/jitsi.nix
50 # mastodon (social.krebsco.de) -> hotdog container, migrated from prism
51 (self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
52
53 # dns
54 ../../2configs/dns/knot.nix
55
56 # url shortener
57 ../../2configs/go.nix
58
59 # video strreaming
60 ../../2configs/cast.nix
61
62 # c-base ollama tunnel
63 ../../2configs/c-base-ai-tunnel.nix
64
65 # debug stuff
66 ../../2configs/websites/mergebot.lassul.us.nix
67
68 # autoupdates
69 ../../2configs/autoupdate.nix
70
71 # vaultwarden
72 ../../2configs/vaultwarden.nix
73
74 # download user
75 ../../2configs/download-user.nix
76
77 # caldav calendar
78 ../../2configs/radicale.nix
79
80 # lassul.us website
81 ../../2configs/websites/lassulus.nix
82
83 # where.is.lassul.us (location from home-assistant on a map)
84 ../../2configs/websites/where.is.lassul.us
85
86 # realwallpaper generator
87 ../../2configs/realwallpaper.nix
88
89 # binaergewitter announce bot
90 # ../../2configs/bgt-bot
91
92 # paste + cyberlocker
93 ../../2configs/paste.nix
94
95 # opencrow matrix bot
96 ../../2configs/opencrow.nix
97
98 # document signing
99 ../../2configs/docuseal.nix
100
101 # kannix (kanban board)
102 ../../2configs/kannix.nix
103
104 # backups
105 ./backup.nix
106
107 # IPFS
108 ../../2configs/services/flix/ipfs.nix
109
110 # n2n supernode (n2n.lassul.us)
111 ../../2configs/n2n-supernode.nix
112
113 # pocket-id SSO IdP (id.lassul.us)
114 ../../2configs/pocket-id.nix
115
116 # covibe co-vibing dashboard (covibe.lassul.us)
117 ../../2configs/covibe.nix
118
119 # omnigent agent meta-harness (omni.lassul.us)
120 ../../2configs/omnigent.nix
121
122 # browser maze game with spectator camera (maze.lassul.us)
123 ../../2configs/mazegame.nix
124
125 # radicle public seed (radicle.lassul.us)
126 ../../2configs/radicle.lassul.us.nix
127 # radicle identity + node for this machine (/var/lib/rad)
128 ../../2configs/rad.nix
129
130 # herdr agent multiplexer
131 ../../2configs/herdr.nix
132
133 # self-hosted iroh relay (relay.lassul.us)
134 ../../2configs/iroh-relay
135
136 # signed remote command execution (root executor + fleet dashboard,
137 # sigexec.lassul.us)
138 ../../2configs/sigexec/executor.nix
139 ../../2configs/sigexec/dashboard.nix
140 ];
141
142 # lassul.us shouldn't be the default vhost here (nginx.nix already sets one)
143 services.nginx.virtualHosts."lassul.us" = {
144 default = lib.mkForce false;
145 locations = {
146 "= /wallpaper-marker.png".extraConfig = ''
147 alias /var/realwallpaper/realwallpaper-marker.png;
148 '';
149 "= /wallpaper.png".extraConfig = ''
150 alias /var/realwallpaper/realwallpaper.png;
151 '';
152 "= /wallpaper-stars-berlin.png".extraConfig = ''
153 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
154 '';
155 };
156 };
157
158 # riot VM (HFOS): fresh libvirt guest on a dedicated bridged public IP.
159 # Bridged onto ext-br with its own Hetzner MAC, so libvirt manages no
160 # iptables for it -> no nat-chain race, no restart-iptables hack (cf. hfos.nix).
161 virtualisation.libvirtd.enable = true;
162 security.polkit.enable = true;
163 users.users.riot = {
164 isNormalUser = true;
165 extraGroups = [ "libvirtd" ];
166 openssh.authorizedKeys.keys = [
167 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwcI8EKqUwYVd4IlnTTaNY3qVMDe2M1sVPMdWaTJ8FnAXixBcZozFHyJ9bvGn6c/vFGBEACZk6QCxC2+sTxbaodCOUIyhAtxqAGO7jINmGrVWjg2NW8qBi+e+ekr2+jlhizxgMPgMcbawuazpMzrozi6sfJfRelJRqe6TxrK/SBO+V5pf8v2ubAfHHF6bJrqAykC247d2NmsHEyM/nGOOb2AlJx2vrK1FbFWr2fBAvnhJww9wqrfDYSM6+oRF/vrYKkT9cU8yjtCkyaJZTqRufF2pzc9a0X3Z4LHEIUykAl2aVmi5Wzh8CZj3qCeVb9Ju0ZGQIa5pvG5CbH5SUJOr9y6zhTx1xbqL+JYGkJqgHPMOCFiNIvWnFaNlnvFf4C9KcTf/VMOEvNdDklpjoWm+ptuQIciAhWKuUHd/6MqaRjmlvUqjl49EkRvYOGn9vasKt66MYrtfvbZ3tcqh5w9EEKhrcygiUXhIJzhu2s1BseAVRLjCsQ24BNbzrYiCO+vuk8/hdeHB1rP6Sas2v7jvYb3zQd647OTq+HrZWN8aCjCs5h8Y0QxrQzsLru0zKDRaNDlbSshNBAw7PzSXQAf9fISH7v6sC4nstf5jk+87ua/7xjWG4NYp5Y9FMFCsuE3XVmUCAbauq18RmN6V4s2TxCEs9bxONO0Vba4zwPnvMlw== cardno:000619250765"
168 ];
169 };
170 # the only forwarding the VM needs: accept traffic to/from its public IP.
171 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
172 {
173 v6 = false;
174 predicate = "--destination 95.217.192.52";
175 target = "ACCEPT";
176 }
177 {
178 v6 = false;
179 predicate = "--source 95.217.192.52";
180 target = "ACCEPT";
181 }
182 ];
183
184 # tank/radicle (radicle seed storage) is created by disko at install; on an
185 # already-provisioned host it must be created before deploying:
186 # zfs create -o mountpoint=/var/lib/radicle -o quota=80G tank/radicle
187 # nofail keeps a missing dataset from failing local-fs.target -> emergency
188 # mode (which has no network and bricks the box).
189 fileSystems."/var/lib/radicle".options = [ "nofail" ];
190
191 # Fleet-wide safety net: this box is headless (Hetzner, console only via
192 # KVM), so a failed critical target must never strand us at the emergency
193 # shell. With emergency mode disabled systemd keeps booting instead of
194 # dropping to a console -> network + sshd still come up, so a bad deploy
195 # (e.g. a missing dataset, as happened once) leaves the box reachable to
196 # fix and redeploy rather than bricked. Mirrors nixpkgs' headless profile.
197 # Note: we intentionally do NOT auto-roll-back to the previous generation;
198 # our config is pulled from git by system.autoUpgrade, so a rollback would
199 # just re-pull the same broken config on the next run (a rollback loop).
200 systemd.enableEmergencyMode = false;
201
202 krebs.build.host = config.krebs.hosts.neoprism;
203 system.stateVersion = "24.05";
204}