This repository has no description
6.5 kB
183 lines
1{
2 lib,
3 ...
4}:
5
6{
7 imports = [
8 ../../configs
9 ../../configs/ssh-redirect.nix
10 ../../configs/retiolum.nix
11 ../../configs/mailserver.nix
12 ../../configs/snappymail.nix
13 ../../configs/gsm-wiki.nix
14 ../../configs/monitoring/telegraf.nix
15 ../../configs/pair-programming.nix
16 ../../configs/nginx.nix
17 ../../configs/services/matrix
18 ../../configs/services/matrix/proxy.nix
19 ../../configs/services/matrix/cinny.nix
20 ../../configs/services/matrix/bridges/mautrix-whatsapp.nix
21 ../../configs/services/matrix/bridges/mautrix-signal.nix
22 ../../configs/services/matrix/bridges/heisenbridge.nix
23 ../../configs/services/matrix/bridges/mautrix-telegram.nix
24 ../../configs/services/matrix/bridges/mautrix-discord.nix
25 ../../configs/services/matrix/bridges/matrix-zulip-bridge.nix
26
27 ../../configs/services/pad
28
29 ../../configs/hass/proxy.nix
30 ../../configs/hermes-proxy.nix
31 ../../configs/crit-proxy.nix
32
33 # sync-containers
34 ../../configs/consul.nix
35 ../../configs/services/flix/container-host.nix
36 ../../configs/services/radio/container-host.nix
37 ../../configs/orange-host.nix
38 ../../configs/hotdog-host.nix
39
40 # other containers
41 ../../configs/riot.nix
42
43 # proxying of services
44 ../../configs/services/radio/proxy.nix
45 ../../configs/services/flix/proxy.nix
46 ../../configs/services/coms/jitsi.nix
47
48 # dns
49 ../../configs/dns/knot.nix
50
51 # video strreaming
52 ../../configs/cast.nix
53
54 # c-base ollama tunnel
55 ../../configs/c-base-ai-tunnel.nix
56
57 # debug stuff
58 ../../configs/websites/mergebot.lassul.us.nix
59
60 # autoupdates
61 ../../configs/autoupdate.nix
62
63 # vaultwarden
64 ../../configs/vaultwarden.nix
65
66 # download user
67 ../../configs/download-user.nix
68
69 # caldav calendar
70 ../../configs/radicale.nix
71
72 # lassul.us website
73 ../../configs/websites/lassulus.nix
74
75 # where.is.lassul.us (location from home-assistant on a map)
76 ../../configs/websites/where.is.lassul.us
77
78 # realwallpaper generator
79 ../../configs/realwallpaper.nix
80
81 # paste + cyberlocker
82 ../../configs/paste
83
84 # document signing
85 ../../configs/docuseal.nix
86
87 # timeful availability polls (when.lassul.us)
88 ../../configs/timeful.nix
89
90 # request-and-approve booking page (book.lassul.us)
91 ../../configs/book.nix
92
93 # backups
94 ./backup.nix
95
96 # IPFS
97 ../../configs/services/flix/ipfs.nix
98
99 # n2n supernode (n2n.lassul.us)
100 ../../configs/n2n-supernode.nix
101
102 # pocket-id SSO IdP (id.lassul.us)
103 ../../configs/pocket-id.nix
104
105 # radicle public seed (radicle.lassul.us)
106 ../../configs/radicle.lassul.us.nix
107 # radicle identity + node for this machine (/var/lib/rad)
108 ../../configs/rad.nix
109
110 # self-hosted iroh relay (relay.lassul.us)
111 ../../configs/iroh-relay
112
113 # signed remote command execution (root executor + fleet dashboard,
114 # sigexec.lassul.us)
115 ../../configs/sigexec/executor.nix
116 ../../configs/sigexec/dashboard.nix
117
118 # parley federated IRC-speaking chat (parley.lassul.us)
119 ../../configs/parley.nix
120
121 # nixpkgs PR triage dashboard (review.lassul.us)
122 ../../configs/nixpkgs-triage.nix
123
124 # build farm (grpc://neoprism.r:50051) + binary cache (cache.lassul.us,
125 # niks3.lassul.us)
126 ../../configs/nix-farm/cache.nix
127 ../../configs/nix-farm/builder.nix
128 ];
129
130 # lassul.us shouldn't be the default vhost here (nginx.nix already sets one)
131 services.nginx.virtualHosts."lassul.us" = {
132 default = lib.mkForce false;
133 locations = {
134 "= /wallpaper-marker.png".extraConfig = ''
135 alias /var/realwallpaper/realwallpaper-marker.png;
136 '';
137 "= /wallpaper.png".extraConfig = ''
138 alias /var/realwallpaper/realwallpaper.png;
139 '';
140 "= /wallpaper-stars-berlin.png".extraConfig = ''
141 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
142 '';
143 };
144 };
145
146 # riot VM (HFOS): fresh libvirt guest on a dedicated bridged public IP.
147 # Bridged onto ext-br with its own Hetzner MAC, so libvirt manages no
148 # firewall rules for it -> no nat-chain race, no restart-iptables hack (cf. hfos.nix).
149 virtualisation.libvirtd.enable = true;
150 security.polkit.enable = true;
151 users.users.riot = {
152 isNormalUser = true;
153 extraGroups = [ "libvirtd" ];
154 openssh.authorizedKeys.keys = [
155 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwcI8EKqUwYVd4IlnTTaNY3qVMDe2M1sVPMdWaTJ8FnAXixBcZozFHyJ9bvGn6c/vFGBEACZk6QCxC2+sTxbaodCOUIyhAtxqAGO7jINmGrVWjg2NW8qBi+e+ekr2+jlhizxgMPgMcbawuazpMzrozi6sfJfRelJRqe6TxrK/SBO+V5pf8v2ubAfHHF6bJrqAykC247d2NmsHEyM/nGOOb2AlJx2vrK1FbFWr2fBAvnhJww9wqrfDYSM6+oRF/vrYKkT9cU8yjtCkyaJZTqRufF2pzc9a0X3Z4LHEIUykAl2aVmi5Wzh8CZj3qCeVb9Ju0ZGQIa5pvG5CbH5SUJOr9y6zhTx1xbqL+JYGkJqgHPMOCFiNIvWnFaNlnvFf4C9KcTf/VMOEvNdDklpjoWm+ptuQIciAhWKuUHd/6MqaRjmlvUqjl49EkRvYOGn9vasKt66MYrtfvbZ3tcqh5w9EEKhrcygiUXhIJzhu2s1BseAVRLjCsQ24BNbzrYiCO+vuk8/hdeHB1rP6Sas2v7jvYb3zQd647OTq+HrZWN8aCjCs5h8Y0QxrQzsLru0zKDRaNDlbSshNBAw7PzSXQAf9fISH7v6sC4nstf5jk+87ua/7xjWG4NYp5Y9FMFCsuE3XVmUCAbauq18RmN6V4s2TxCEs9bxONO0Vba4zwPnvMlw== cardno:000619250765"
156 ];
157 };
158 # the only forwarding the VM needs: accept traffic to/from its public IP.
159 networking.firewall.extraForwardRules = ''
160 ip daddr 95.217.192.52 accept
161 ip saddr 95.217.192.52 accept
162 '';
163
164 # tank/radicle (radicle seed storage) is created by disko at install; on an
165 # already-provisioned host it must be created before deploying:
166 # zfs create -o mountpoint=/var/lib/radicle -o quota=80G tank/radicle
167 # nofail keeps a missing dataset from failing local-fs.target -> emergency
168 # mode (which has no network and bricks the box).
169 fileSystems."/var/lib/radicle".options = [ "nofail" ];
170
171 # Fleet-wide safety net: this box is headless (Hetzner, console only via
172 # KVM), so a failed critical target must never strand us at the emergency
173 # shell. With emergency mode disabled systemd keeps booting instead of
174 # dropping to a console -> network + sshd still come up, so a bad deploy
175 # (e.g. a missing dataset, as happened once) leaves the box reachable to
176 # fix and redeploy rather than bricked. Mirrors nixpkgs' headless profile.
177 # Note: we intentionally do NOT auto-roll-back to the previous generation;
178 # our config is pulled from git by system.autoUpgrade, so a rollback would
179 # just re-pull the same broken config on the next run (a rollback loop).
180 systemd.enableEmergencyMode = false;
181
182 system.stateVersion = "24.05";
183}