This repository has no description
11 kB
297 lines
1{
2 self,
3 config,
4 lib,
5 ...
6}:
7let
8 slib = self.inputs.stockholm.lib;
9in
10{
11
12 system.stateVersion = "23.05";
13 imports = [
14 ../../2configs
15 {
16 # helsinki migration
17 users.users.root.openssh.authorizedKeys.keys = [
18 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIP4MIZG/hZR3Ib7faGDyK67Tk53Q1P7pE5cFIWwEFbrtAAAABHNzaDo="
19 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHBR9+AP/K+CY3S66vAGFyD5CQfNe7mrpD+jpKp5YfFJAAAABHNzaDo= fabian_sk"
20 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILVGDN7LfdnZQ0411u27288g+Nz8Z3qv5F280itDFArAAAAABHNzaDo="
21 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIC9d1Di6VHunJrvzVQqvsCdZzO3dmNe7XpQ4BB1uaclnAAAABHNzaDo="
22 ];
23 }
24 ./backup.nix
25 # ../../2configs/autoupdate.nix
26 ../../2configs/ssh-redirect.nix
27 ../../2configs/retiolum.nix
28 ../../2configs/libvirt.nix
29 ../../2configs/websites/lassulus.nix
30 ../../2configs/services/git/proxy.nix
31 ../../2configs/monitoring/telegraf.nix
32 ../../2configs/consul.nix
33 {
34 services.nginx.enable = true;
35 imports = [
36 ../../2configs/websites/domsen.nix
37 ];
38
39 krebs.iptables.tables.filter.INPUT.rules = [
40 {
41 predicate = "-p tcp --dport http";
42 target = "ACCEPT";
43 }
44 {
45 predicate = "-p tcp --dport https";
46 target = "ACCEPT";
47 }
48 ];
49 }
50 {
51 # TODO make new hfos.nix out of this vv
52 users.users.riot = {
53 uid = slib.genid_uint31 "riot";
54 isNormalUser = true;
55 extraGroups = [ "libvirtd" ];
56 openssh.authorizedKeys.keys = [
57 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
58 ];
59 };
60 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
61 {
62 v6 = false;
63 predicate = "--destination 95.216.1.130";
64 target = "ACCEPT";
65 }
66 {
67 v6 = false;
68 predicate = "--source 95.216.1.130";
69 target = "ACCEPT";
70 }
71 ];
72 }
73 {
74 users.users.tv = {
75 uid = slib.genid_uint31 "tv";
76 isNormalUser = true;
77 openssh.authorizedKeys.keys = [
78 config.krebs.users.tv.pubkey
79 ];
80 };
81 users.users.makefu = {
82 uid = slib.genid_uint31 "makefu";
83 isNormalUser = true;
84 openssh.authorizedKeys.keys = [
85 config.krebs.users.makefu.pubkey
86 ];
87 };
88 users.extraUsers.dritter = {
89 uid = slib.genid_uint31 "dritter";
90 isNormalUser = true;
91 extraGroups = [
92 "download"
93 ];
94 openssh.authorizedKeys.keys = [
95 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
96 ];
97 };
98 users.extraUsers.juhulian = {
99 uid = 1339;
100 isNormalUser = true;
101 openssh.authorizedKeys.keys = [
102 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
103 ];
104 };
105 users.users.hellrazor = {
106 uid = slib.genid_uint31 "hellrazor";
107 isNormalUser = true;
108 extraGroups = [
109 "download"
110 ];
111 openssh.authorizedKeys.keys = [
112 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ=="
113 ];
114 };
115 }
116 {
117 imports = [
118 ../../2configs/services/matrix/proxy.nix
119 ];
120 services.nginx.virtualHosts."matrix.lassul.us" = {
121 enableACME = lib.mkForce false;
122 forceSSL = lib.mkForce false;
123 };
124 }
125 ../../2configs/privoxy-retiolum.nix
126 ../../2configs/binary-cache/server.nix
127 ../../2configs/binary-cache/proxy.nix
128 ../../2configs/iodined.nix
129 # paste.nix removed - paste/cyberlocker now runs on neoprism, proxied below
130 ../../2configs/syncthing.nix
131 ../../2configs/container-networking.nix
132 ../../2configs/bgt-bot
133 (self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
134 {
135 services.tor = {
136 enable = true;
137 };
138 }
139 {
140 imports = [
141 ../../2configs/realwallpaper.nix
142 ];
143 services.nginx.virtualHosts."lassul.us".locations = {
144 "= /wallpaper-marker.png".extraConfig = ''
145 alias /var/realwallpaper/realwallpaper-marker.png;
146 '';
147 "= /wallpaper.png".extraConfig = ''
148 alias /var/realwallpaper/realwallpaper.png;
149 '';
150 "= /wallpaper-stars-berlin.png".extraConfig = ''
151 alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
152 '';
153 };
154 }
155 ../../2configs/minecraft.nix
156 {
157 imports = [
158 ../../2configs/wiregrill.nix
159 ];
160 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
161 {
162 v6 = false;
163 predicate = "-s 10.244.0.0/16";
164 target = "ACCEPT";
165 }
166 {
167 v4 = false;
168 predicate = "-s 42:1::/32";
169 target = "ACCEPT";
170 }
171 ];
172 krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
173 {
174 predicate = "-i wiregrill -o retiolum";
175 target = "ACCEPT";
176 }
177 {
178 predicate = "-i retiolum -o wiregrill";
179 target = "ACCEPT";
180 }
181 ];
182 krebs.iptables.tables.nat.POSTROUTING.rules = [
183 {
184 v4 = false;
185 predicate = "-s 42:1::/32 ! -d 42:1::/48";
186 target = "MASQUERADE";
187 }
188 {
189 v6 = false;
190 predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16";
191 target = "MASQUERADE";
192 }
193 ];
194 services.dnsmasq = {
195 enable = true;
196 resolveLocalQueries = false;
197
198 settings = {
199 bind-interfaces = true;
200 interface = [
201 "wiregrill"
202 "retiolum "
203 ];
204 };
205 };
206 }
207 {
208 krebs.iptables.tables.filter.INPUT.rules = [
209 {
210 predicate = "-p udp --dport 60000:61000";
211 target = "ACCEPT";
212 }
213 ];
214 }
215 ../../2configs/services/coms/murmur.nix
216 {
217 # acme fallback for neoprism migration
218 services.nginx.virtualHosts."lassul.us".acmeFallbackHost = "orange.r";
219 services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
220 services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
221 services.nginx.virtualHosts."jitsi.lassul.us".acmeFallbackHost = "neoprism.r";
222 services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
223 services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
224 services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
225
226 # proxy paste/cyberlocker to neoprism
227 services.nginx.virtualHosts."p.krebsco.de" = {
228 enableACME = true;
229 addSSL = true;
230 serverAliases = [ "p.krebsco.de" ];
231 locations."/".extraConfig = ''
232 client_max_body_size 4G;
233 proxy_set_header Host $host;
234 proxy_set_header X-Forwarded-Proto $scheme;
235 proxy_pass https://neoprism.lassul.us;
236 '';
237 locations."/form".extraConfig = ''
238 client_max_body_size 4G;
239 proxy_set_header Host $host;
240 proxy_pass https://neoprism.lassul.us;
241 '';
242 locations."/image".extraConfig = ''
243 proxy_set_header Host $host;
244 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
245 proxy_set_header X-Forwarded-Proto $scheme;
246 proxy_pass https://neoprism.lassul.us;
247 '';
248 extraConfig = ''
249 add_header Access-Control-Allow-Headers Authorization always;
250 add_header Access-Control-Allow-Origin * always;
251 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
252 '';
253 };
254 services.nginx.virtualHosts."c.krebsco.de" = {
255 enableACME = true;
256 addSSL = true;
257 serverAliases = [ "c.krebsco.de" ];
258 locations."/".extraConfig = ''
259 proxy_set_header Host $host;
260 proxy_pass https://neoprism.lassul.us;
261 '';
262 extraConfig = ''
263 add_header Access-Control-Allow-Origin * always;
264 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
265 '';
266 };
267 services.nginx.virtualHosts.paste = {
268 serverAliases = [ "p.r" ];
269 locations."/".extraConfig = ''
270 client_max_body_size 4G;
271 proxy_set_header Host $host;
272 proxy_set_header X-Forwarded-Proto $scheme;
273 proxy_pass https://neoprism.lassul.us;
274 '';
275 locations."/image".extraConfig = ''
276 proxy_set_header Host $host;
277 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
278 proxy_set_header X-Forwarded-Proto $scheme;
279 proxy_pass https://neoprism.lassul.us;
280 '';
281 };
282 services.nginx.virtualHosts.cyberlocker = {
283 serverAliases = [ "c.r" ];
284 locations."/".extraConfig = ''
285 proxy_set_header Host $host;
286 proxy_pass https://neoprism.lassul.us;
287 '';
288 };
289 }
290 ];
291
292 krebs.build.host = config.krebs.hosts.prism;
293 services.earlyoom = {
294 enable = true;
295 freeMemThreshold = 5;
296 };
297}