This repository has no description
8.5 kB
234 lines
1{
2 self,
3 config,
4 lib,
5 ...
6}:
7let
8 slib = self.inputs.stockholm.lib;
9in
10{
11
12 system.stateVersion = "23.05";
13 imports = [
14 ../../2configs
15 {
16 # helsinki migration
17 users.users.root.openssh.authorizedKeys.keys = [
18 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIP4MIZG/hZR3Ib7faGDyK67Tk53Q1P7pE5cFIWwEFbrtAAAABHNzaDo="
19 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHBR9+AP/K+CY3S66vAGFyD5CQfNe7mrpD+jpKp5YfFJAAAABHNzaDo= fabian_sk"
20 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILVGDN7LfdnZQ0411u27288g+Nz8Z3qv5F280itDFArAAAAABHNzaDo="
21 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIC9d1Di6VHunJrvzVQqvsCdZzO3dmNe7XpQ4BB1uaclnAAAABHNzaDo="
22 ];
23 }
24 ./backup.nix
25 # ../../2configs/autoupdate.nix
26 ../../2configs/ssh-redirect.nix
27 ../../2configs/retiolum.nix
28 ../../2configs/libvirt.nix
29 ../../2configs/websites/lassulus.nix
30 ../../2configs/services/git/proxy.nix
31 ../../2configs/monitoring/telegraf.nix
32 ../../2configs/consul.nix
33 {
34 services.nginx.enable = true;
35 imports = [
36 ../../2configs/websites/domsen.nix
37 ];
38
39 krebs.iptables.tables.filter.INPUT.rules = [
40 {
41 predicate = "-p tcp --dport http";
42 target = "ACCEPT";
43 }
44 {
45 predicate = "-p tcp --dport https";
46 target = "ACCEPT";
47 }
48 ];
49 }
50 {
51 # TODO make new hfos.nix out of this vv
52 users.users.riot = {
53 uid = slib.genid_uint31 "riot";
54 isNormalUser = true;
55 extraGroups = [ "libvirtd" ];
56 openssh.authorizedKeys.keys = [
57 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
58 ];
59 };
60 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
61 {
62 v6 = false;
63 predicate = "--destination 95.216.1.130";
64 target = "ACCEPT";
65 }
66 {
67 v6 = false;
68 predicate = "--source 95.216.1.130";
69 target = "ACCEPT";
70 }
71 ];
72 }
73 {
74 users.users.tv = {
75 uid = slib.genid_uint31 "tv";
76 isNormalUser = true;
77 openssh.authorizedKeys.keys = [
78 config.krebs.users.tv.pubkey
79 ];
80 };
81 users.users.makefu = {
82 uid = slib.genid_uint31 "makefu";
83 isNormalUser = true;
84 openssh.authorizedKeys.keys = [
85 config.krebs.users.makefu.pubkey
86 ];
87 };
88 users.extraUsers.dritter = {
89 uid = slib.genid_uint31 "dritter";
90 isNormalUser = true;
91 extraGroups = [
92 "download"
93 ];
94 openssh.authorizedKeys.keys = [
95 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
96 ];
97 };
98 users.extraUsers.juhulian = {
99 uid = 1339;
100 isNormalUser = true;
101 openssh.authorizedKeys.keys = [
102 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
103 ];
104 };
105 users.users.hellrazor = {
106 uid = slib.genid_uint31 "hellrazor";
107 isNormalUser = true;
108 extraGroups = [
109 "download"
110 ];
111 openssh.authorizedKeys.keys = [
112 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ=="
113 ];
114 };
115 }
116 {
117 imports = [
118 ../../2configs/services/matrix/proxy.nix
119 ];
120 services.nginx.virtualHosts."matrix.lassul.us" = {
121 enableACME = lib.mkForce false;
122 forceSSL = lib.mkForce false;
123 };
124 }
125 ../../2configs/exim-smarthost.nix
126 ../../2configs/privoxy-retiolum.nix
127 ../../2configs/binary-cache/server.nix
128 ../../2configs/binary-cache/proxy.nix
129 ../../2configs/iodined.nix
130 ../../2configs/paste.nix
131 ../../2configs/syncthing.nix
132 ../../2configs/container-networking.nix
133 ../../2configs/bgt-bot
134 (self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
135 {
136 services.tor = {
137 enable = true;
138 };
139 }
140 {
141 imports = [
142 ../../2configs/realwallpaper.nix
143 ];
144 services.nginx.virtualHosts."lassul.us".locations = {
145 "= /wallpaper-marker.png".extraConfig = ''
146 alias /var/realwallpaper/realwallpaper-marker.png;
147 '';
148 "= /wallpaper.png".extraConfig = ''
149 alias /var/realwallpaper/realwallpaper.png;
150 '';
151 "= /wallpaper-stars-berlin.png".extraConfig = ''
152 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
153 '';
154 };
155 }
156 ../../2configs/minecraft.nix
157 {
158 imports = [
159 ../../2configs/wiregrill.nix
160 ];
161 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
162 {
163 v6 = false;
164 predicate = "-s 10.244.0.0/16";
165 target = "ACCEPT";
166 }
167 {
168 v4 = false;
169 predicate = "-s 42:1::/32";
170 target = "ACCEPT";
171 }
172 ];
173 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
174 {
175 predicate = "-i wiregrill -o retiolum";
176 target = "ACCEPT";
177 }
178 {
179 predicate = "-i retiolum -o wiregrill";
180 target = "ACCEPT";
181 }
182 ];
183 krebs.iptables.tables.nat.POSTROUTING.rules = [
184 {
185 v4 = false;
186 predicate = "-s 42:1::/32 ! -d 42:1::/48";
187 target = "MASQUERADE";
188 }
189 {
190 v6 = false;
191 predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16";
192 target = "MASQUERADE";
193 }
194 ];
195 services.dnsmasq = {
196 enable = true;
197 resolveLocalQueries = false;
198
199 settings = {
200 bind-interfaces = true;
201 interface = [
202 "wiregrill"
203 "retiolum "
204 ];
205 };
206 };
207 }
208 {
209 krebs.iptables.tables.filter.INPUT.rules = [
210 {
211 predicate = "-p udp --dport 60000:61000";
212 target = "ACCEPT";
213 }
214 ];
215 }
216 ../../2configs/services/coms/murmur.nix
217 {
218 # acme fallback for neoprism migration
219 services.nginx.virtualHosts."lassul.us".acmeFallbackHost = "orange.r";
220 services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
221 services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
222 services.nginx.virtualHosts."jitsi.lassul.us".acmeFallbackHost = "neoprism.r";
223 services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
224 services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
225 services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
226 }
227 ];
228
229 krebs.build.host = config.krebs.hosts.prism;
230 services.earlyoom = {
231 enable = true;
232 freeMemThreshold = 5;
233 };
234}