lass.pds.lassul.us / superconfig
This repository has no description
0
Fork 1

Configure Feed

Select the types of activity you want to include in your feed.

configs: remove dead modules

author
lassulus date (Oct 2, 2026, 9:45 PM CEST) commit 510e3436 parent e01333fe
-1895
-35
configs/bitcoin.nix
··· 1 - { config, pkgs, ... }: 2 - 3 - let 4 - mainUser = config.users.extraUsers.mainUser; 5 - in 6 - { 7 - 8 - users.extraUsers = { 9 - bitcoin = { 10 - name = "bitcoin"; 11 - description = "user for bitcoin stuff"; 12 - home = "/home/bitcoin"; 13 - useDefaultShell = true; 14 - createHome = true; 15 - packages = [ pkgs.electrum ]; 16 - isNormalUser = true; 17 - }; 18 - monero = { 19 - name = "monero"; 20 - description = "user for monero stuff"; 21 - home = "/home/monero"; 22 - useDefaultShell = true; 23 - createHome = true; 24 - packages = [ 25 - pkgs.monero-cli 26 - pkgs.monero-gui 27 - ]; 28 - isNormalUser = true; 29 - }; 30 - }; 31 - security.sudo.extraConfig = '' 32 - ${mainUser.name} ALL=(bitcoin) ALL 33 - ${mainUser.name} ALL=(monero) ALL 34 - ''; 35 - }
-128
configs/c-base.nix
··· 1 - { config, pkgs, ... }: 2 - 3 - { 4 - 5 - environment.systemPackages = [ 6 - pkgs.cifs-utils 7 - ]; 8 - 9 - clan.core.vars.generators.c-base = { 10 - files."c-base.txt" = { }; 11 - prompts.user.description = "c-base nickname"; 12 - prompts.pass.description = "c-base password"; 13 - script = '' 14 - cat "$prompts"/user > "$out/c-base.txt" 15 - cat "$prompts"/pass >> "$out/c-base.txt" 16 - ''; 17 - }; 18 - 19 - systemd.network.networks.c-base = { 20 - matchConfig.Name = "c-base"; 21 - networkConfig = { 22 - IgnoreCarrierLoss = "3s"; 23 - KeepConfiguration = "static"; 24 - DNS = "10.0.1.254"; 25 - Domains = "cbrp3.c-base.org"; 26 - }; 27 - routes = [ 28 - { 29 - routeConfig = { 30 - Destination = "10.0.0.0/23"; 31 - Gateway = "172.31.77.1"; 32 - }; 33 - } 34 - { 35 - routeConfig = { 36 - Destination = "91.102.9.99/32"; # vorstand.c-base.org 37 - Gateway = "172.31.77.1"; 38 - }; 39 - } 40 - ]; 41 - }; 42 - services.openvpn.servers.c-base = { 43 - config = '' 44 - remote vpn.ext.c-base.org 1194 45 - verify-x509-name vpn.ext.c-base.org name 46 - client 47 - proto udp 48 - dev-type tun 49 - dev c-base 50 - resolv-retry infinite 51 - nobind 52 - # user openvpn 53 - # group openvpn 54 - persist-key 55 - persist-tun 56 - comp-lzo 57 - # register-dns 58 - # block-outside-dns 59 - script-security 2 60 - auth-user-pass ${config.clan.core.vars.generators.c-base.files."c-base.txt".path} 61 - #auth-user-pass 62 - key-direction 1 63 - <tls-auth> 64 - # 65 - # 2048 bit OpenVPN static key 66 - # 67 - -----BEGIN OpenVPN Static key V1----- 68 - 54a66ed1048bed7508703347e89d68d6 69 - 5586e6a5d1218cf8675941031d540be6 70 - 993e07200a16ad3b770b659932ee71e5 71 - f8080b5c9fa2acb3893abd40fad2552c 72 - fdaf17565e617ae450efcccf5652dca5 73 - a16419509024b075941098731eb25ac0 74 - a64f963ece3dca1d2a64a9c5e17839d7 75 - 5b5080165a9b2dc90ef111879d7d3173 76 - 2d1027ae42d869394aca08da4472a9d0 77 - 6b724b4ed43a957feef7d6dfc86da241 78 - 74828fa0e1240941586f0d937cac32fc 79 - 13cc81e7bed58817353d6afaff7e6a26 80 - 4f9cc086af79c1cdca660d86e18cff96 81 - 69dd3d392caf09a468894a8504f4cc7c 82 - 7ae0072e6d9ad90b166ad13a39c57b3c 83 - 3a869e27a1d89deb161c255227551713 84 - -----END OpenVPN Static key V1----- 85 - </tls-auth> 86 - <ca> 87 - -----BEGIN CERTIFICATE----- 88 - MIIGsDCCBJigAwIBAgIJAPkM1l2zA306MA0GCSqGSIb3DQEBCwUAMIGWMQswCQYD 89 - VQQGEwJERTEPMA0GA1UEBxMGQmVybGluMRswGQYDVQQLExJ2cG4uZXh0LmMtYmFz 90 - ZS5vcmcxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEbMBkGA1UEKRMSdnBu 91 - LmV4dC5jLWJhc2Uub3JnMR8wHQYJKoZIhvcNAQkBFhBhZG1heEBjLWJhc2Uub3Jn 92 - MB4XDTE2MDcwOTE4MjkyMFoXDTI2MDcxMDE4MjkyMFowgZYxCzAJBgNVBAYTAkRF 93 - MQ8wDQYDVQQHEwZCZXJsaW4xGzAZBgNVBAsTEnZwbi5leHQuYy1iYXNlLm9yZzEb 94 - MBkGA1UEAxMSdnBuLmV4dC5jLWJhc2Uub3JnMRswGQYDVQQpExJ2cG4uZXh0LmMt 95 - YmFzZS5vcmcxHzAdBgkqhkiG9w0BCQEWEGFkbWF4QGMtYmFzZS5vcmcwggIiMA0G 96 - CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXEs+uWCXLNmm+lgP9x7u3FqWa4pPI 97 - h64c6EWIULMATrhEw+Ej4fpCXwU9otFaO04fAeJmZGkDcnAYdBDiCeI0luOSdj44 98 - Bg9KecSei/TskqjhDVnEBp65hiz0rZE6c1baPdLYmD5xrXWb3i0zrlBYFawuL6C2 99 - lwVCEm3cadvkDJ2DleMuu3NblV8ViIDN0HZqzJNP72g1I0MgohkpetACXlf7MzQV 100 - PFHfzvb04Rj2lJ8BDhceQ0WmjtVV/Ag6nka5oi954OeHMujRuH+rZYiQZDZpJLHK 101 - Kh1KWTVlWPRy+AvCi9lweDWSmLccq7Ug4xMtDF4I5qW3tjCd0xqpZ21Xmo2JyKtY 102 - 4h8wEDPqiJvgwvkXsH17GLn5ZxiMcQuRJQYZqJephkzR9uccJeWSS76kwm/vLqG3 103 - +eORlYnyjiNXtiMIhmAEFjpWUrGH8v4CijpUNP6E63ynGrRVXK684YQXkqL+xPAt 104 - t6dsMBUwf94a2S1o2kgvuRCim1wlHvf1QsHrO/Hwgpzc8no/daWL+Z9Rq9okTHNK 105 - nc1G5dv8TkmxIDYnLm07QMzzBoOT36BcGtkEBA+0xhQlX5PyQdM5/jnZVhdSBmoP 106 - MbZXPoU/gJAIuuBuwdTlgCzYf44/9/YU/AnW8eLrbhm9KtMtoMpatrWorKqk/GPv 107 - /lGNRQuNffrbiQIDAQABo4H+MIH7MB0GA1UdDgQWBBTf5cYbK+KCF9u9aobFlLbu 108 - ilwX4jCBywYDVR0jBIHDMIHAgBTf5cYbK+KCF9u9aobFlLbuilwX4qGBnKSBmTCB 109 - ljELMAkGA1UEBhMCREUxDzANBgNVBAcTBkJlcmxpbjEbMBkGA1UECxMSdnBuLmV4 110 - dC5jLWJhc2Uub3JnMRswGQYDVQQDExJ2cG4uZXh0LmMtYmFzZS5vcmcxGzAZBgNV 111 - BCkTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhAYy1i 112 - YXNlLm9yZ4IJAPkM1l2zA306MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQAD 113 - ggIBAMs1moiS7UZ4neOivQjqwKrBbm1j3tgmPLhDfNMmXYarGhnBGAlLxLAQWtG+ 114 - Fnbx8KcsJnrsWcGfZcst1z45S4a5oBdVNKOfgkMOG0glZorIDO8Odrb51rpyzU0v 115 - 0wcNumMNWhkFuo2OTBHPnnJIWEAFwwCCSCL0I0hQxxoaV36kphjuIwzrMJhd+XAT 116 - 24En58cNp6sPRDd+FzOH08uFINevyzKWYxkMgVj+e3fbuiyOB8RqvndKvtfBBcpB 117 - cCO86lGnj/ETMDciTczUShxaMn9wV1zr1KH1xvT3ohUeOcQZGbGTcjG4mxlns8ZO 118 - U5J3Yrcd1eMfJq9Bwd3zPsTLnT8LwIS8vfYRav9b34XdqcBG73dhrjsicMK0Qy0z 119 - Qz7vKJzcvrEnKuaMyB3mCxz/UvbNc2Bupwm4FmzN5eFjDs+7paYFdfOzqMjoRP+8 120 - bcXSqDN5P2eUd7cdsZXaFNcsf1FkWlE3GudVBOmNJqz9zBab/T5J+l4Z90Pd6OUX 121 - GNozEvLhcJkvPKA526TegHTGC8hMquxKc9tpOzNRqZJMFa+UG1mgMrMepRmM/B3s 122 - QrKI1C11iCVYfb9J0tQUkfENHMx4J7mG2DZAhnKWQDU2awM41qU4A7aBYaJvDPnQ 123 - RRcbaT0D794lKUQwH/mZuyKzF22oZNk1o1TV2SaFXqgX5tDt 124 - -----END CERTIFICATE----- 125 - </ca> 126 - ''; 127 - }; 128 - }
-58
configs/container-networking.nix
··· 1 - { lib, ... }: 2 - 3 - { 4 - krebs.iptables.tables.filter.FORWARD.rules = [ 5 - # { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } 6 - # { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; } 7 - { 8 - v6 = false; 9 - predicate = "-o ctr+ -m conntrack --ctstate RELATED,ESTABLISHED"; 10 - target = "ACCEPT"; 11 - } 12 - { 13 - v6 = false; 14 - predicate = "-i ctr+"; 15 - target = "ACCEPT"; 16 - } 17 - { 18 - v6 = false; 19 - predicate = "-o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; 20 - target = "ACCEPT"; 21 - } 22 - { 23 - v6 = false; 24 - predicate = "-i ve-+"; 25 - target = "ACCEPT"; 26 - } 27 - # { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; } 28 - # { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; } 29 - # { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; } 30 - ]; 31 - krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [ 32 - { 33 - v6 = false; 34 - predicate = "-i ctr+"; 35 - target = "ACCEPT"; 36 - } 37 - { 38 - v6 = false; 39 - predicate = "-i ve-+"; 40 - target = "ACCEPT"; 41 - } 42 - ]; 43 - krebs.iptables.tables.nat.POSTROUTING.rules = [ 44 - # { v6 = false; predicate = "-o et0"; target = "MASQUERADE"; } 45 - 46 - { 47 - v6 = false; 48 - predicate = "-s 10.233.0.0/16 ! -d 10.233.0.0/16"; 49 - target = "MASQUERADE"; 50 - } 51 - # { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; } 52 - # { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; } 53 - # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; } 54 - # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; } 55 - # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; } 56 - ]; 57 - boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1; 58 - }
-1
configs/default.nix
··· 24 24 25 25 # Import individual configurations 26 26 ./security-workarounds.nix 27 - # ./binary-cache/client.nix 28 27 ./gc.nix 29 28 ./mc.nix 30 29 ./zsh.nix
-83
configs/hfos.nix
··· 1 - { pkgs, ... }: 2 - { 3 - users.users.riot = { 4 - uid = genid "riot"; 5 - isNormalUser = true; 6 - extraGroups = [ "libvirtd" ]; 7 - openssh.authorizedKeys.keys = [ 8 - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMkyCwdwBrsbs3qrNQcy/SqQpex4aaQoAMuT+NDefFc8KVHOMfmkDccEyAggDTgQhUrEVIvo/fFUmGBd9sm1vN1IthO2Qh5nX+qiK/A2R7sxci0Ry6piU03R27JfpZqi6g8TSPNi1C9rC8eBqOfO3OB8oQOkFmM48Q9cmS8AV3ERLR0LaHoEqUbs86JELbtHrMdKk4Hzo8zTM/isP3GO8iDHRt4dBS/03Ve7+WVxgNwWU2HW3a3jJd3tWHrqGmS/ZfCEC/47eIj4WSW+JiH9Q0BarNEbkkMV1Mvm32MX52stGPd5FaIIUtFqD4745iVSiw8esUGFUxJ1RjWgUHr99h riot@vortex" 9 - ]; 10 - }; 11 - 12 - networking.interfaces."eth0:0".ip4 = [ 13 - { 14 - address = "213.239.205.246"; 15 - prefixLength = 24; 16 - } 17 - ]; 18 - 19 - krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ 20 - { 21 - v6 = false; 22 - predicate = "-d 213.239.205.246 -p tcp --dport 22"; 23 - target = "DNAT --to-destination 192.168.122.208:22"; 24 - } 25 - { 26 - v6 = false; 27 - predicate = "-d 213.239.205.246 -p tcp --dport 25"; 28 - target = "DNAT --to-destination 192.168.122.208:25"; 29 - } 30 - { 31 - v6 = false; 32 - predicate = "-d 213.239.205.246 -p tcp --dport 80"; 33 - target = "DNAT --to-destination 192.168.122.208:1080"; 34 - } 35 - { 36 - v6 = false; 37 - predicate = "-d 213.239.205.246 -p tcp --dport 443"; 38 - target = "DNAT --to-destination 192.168.122.208:1443"; 39 - } 40 - ]; 41 - 42 - krebs.iptables.tables.filter.FORWARD.rules = mkBefore [ 43 - { 44 - v6 = false; 45 - predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; 46 - target = "ACCEPT"; 47 - } 48 - { 49 - v6 = false; 50 - predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; 51 - target = "ACCEPT"; 52 - } 53 - { 54 - v6 = false; 55 - predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; 56 - target = "ACCEPT"; 57 - } 58 - { 59 - v6 = false; 60 - predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; 61 - target = "ACCEPT"; 62 - } 63 - ]; 64 - 65 - krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [ 66 - { 67 - v6 = false; 68 - predicate = "-d 213.239.205.246 -p tcp --dport 443"; 69 - target = "DNAT --to-destination 192.168.122.208:1443"; 70 - } 71 - ]; 72 - 73 - # TODO use bridge interfaces instead of this crap 74 - systemd.services.libvirtd.serviceConfig.ExecStartPost = 75 - let 76 - restart-iptables = pkgs.writeDash "restart-iptables" '' 77 - #soo hacky 78 - ${pkgs.coreutils}/bin/sleep 5s 79 - ${pkgs.systemd}/bin/systemctl restart krebs-iptables.service 80 - ''; 81 - in 82 - restart-iptables; 83 - }
-31
configs/home-manager.nix
··· 1 - { 2 - lib, 3 - pkgs, 4 - ... 5 - }: 6 - let 7 - vim_nix = import ./vim.nix { 8 - inherit lib pkgs; 9 - config = { }; 10 - }; 11 - in 12 - { 13 - programs.git = { 14 - enable = true; 15 - userName = "lassulus"; 16 - userEmail = "lassulus@lassul.us"; 17 - extraConfig = { 18 - rebase.autostash = true; 19 - }; 20 - }; 21 - 22 - home.packages = [ 23 - (pkgs.writers.writeDashBin "vim" '' 24 - ${vim_nix.environment.etc.vim.source}/bin/vim -u ${vim_nix.environment.etc.vimrc.source} "$@" 25 - '') 26 - pkgs.mosh 27 - pkgs.direnv 28 - ]; 29 - 30 - programs.home-manager.enable = true; 31 - }
-105
configs/home-media.nix
··· 1 - { self, pkgs, ... }: 2 - { 3 - imports = [ 4 - ]; 5 - users.users.media = { 6 - isNormalUser = true; 7 - uid = self.inputs.stockholm.lib.genid_uint31 "media"; 8 - extraGroups = [ 9 - "video" 10 - "audio" 11 - "pipewire" 12 - ]; 13 - packages = [ 14 - (pkgs.writers.writeDashBin "mpv" '' 15 - if test -e "$1"; then 16 - mpv-ipc-cli loadfile "$(realpath "$1")" 17 - else 18 - mpv-ipc-cli loadfile "$1" 19 - fi 20 - '') 21 - ]; 22 - }; 23 - 24 - users.users.mainUser.packages = [ 25 - (pkgs.writers.writeDashBin "mpv" '' 26 - if test -e "$1"; then 27 - mpv-ipc-cli loadfile "$(realpath "$1")" 28 - else 29 - mpv-ipc-cli loadfile "$1" 30 - fi 31 - '') 32 - ]; 33 - 34 - services.xserver.displayManager.autoLogin = { 35 - enable = true; 36 - user = "media"; 37 - }; 38 - 39 - hardware.pulseaudio.configFile = pkgs.writeText "pulse.pa" '' 40 - .include ${pkgs.pulseaudioFull}/etc/pulse/default.pa 41 - load-module module-native-protocol-tcp auth-ip-acl=127.0.0.1;10.42.0.0/24 auth-anonymous=1 42 - ''; 43 - 44 - environment.systemPackages = [ 45 - (pkgs.writers.writeDashBin "mpv-ipc-cli" '' 46 - set -efux 47 - ${pkgs.jq}/bin/jq -nc '{ "command": $ARGS.positional }' --args "$@" | ${pkgs.socat}/bin/socat - /tmp/mpv.ipc 48 - '') 49 - (pkgs.writers.writeDashBin "ipc-mpv" '' 50 - /run/current-system/sw/bin/mpv \ 51 - --audio-display=no --audio-channels=stereo \ 52 - --audio-samplerate=48000 --audio-format=s16 \ 53 - --ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \ 54 - --audio-delay=-1 \ 55 - "$@" 56 - '') 57 - pkgs.mpvc 58 - (pkgs.writers.writeDashBin "iptv" '' 59 - curl -Ssf 'https://iptv-org.github.io/iptv/index.nsfw.m3u' | 60 - sed 's/.*,//' | 61 - sed -z 's/\nhttp/,http/g' | 62 - fzf --bind='enter:execute(echo {} | cut -d ',' -f 2 | xargs -0 mpv-ipc-cli loadfile)' 63 - '') 64 - ]; 65 - 66 - environment.variables.SOCKET = "/tmp/mpv.ipc"; 67 - systemd.services.mpvd = { 68 - wantedBy = [ "multi-user.target" ]; 69 - environment.DISPLAY = ":0"; 70 - serviceConfig = { 71 - User = "media"; 72 - RemainAfterExit = true; 73 - Nice = "-10"; 74 - ExecStart = '' 75 - ${pkgs.tmux}/bin/tmux -2 new-session -d -s mpvd -- /run/current-system/sw/bin/ipc-mpv \ 76 - --audio-display=no --audio-channels=stereo \ 77 - --audio-samplerate=48000 --audio-format=s16 \ 78 - --ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \ 79 - --audio-delay=-1 \ 80 - --network-timeout=3 \ 81 - --untimed --cache-pause=no \ 82 - --idle=yes --force-window=yes \ 83 - --loop-playlist=inf \ 84 - --input-ipc-server=/tmp/mpv.ipc 85 - ''; 86 - ExecStop = "${pkgs.tmux}/bin/tmux kill-session -t mpvd"; 87 - ExecStartPre = [ 88 - "+${pkgs.writers.writeDash "remove_socket" '' 89 - set -efux 90 - rm -f /tmp/mpv.ipc 91 - ''}" 92 - ]; 93 - ExecStartPost = [ 94 - "+${pkgs.writers.writeDash "fix_permissions" '' 95 - set -efux 96 - until test -e /tmp/mpv.ipc; do 97 - sleep 1 98 - done 99 - # sleep 2 100 - chmod 666 /tmp/mpv.ipc || : 101 - ''}" 102 - ]; 103 - }; 104 - }; 105 - }
-18
configs/iodined.nix
··· 1 - { config, ... }: 2 - 3 - let 4 - # TODO: make this a parameter 5 - domain = "io.lassul.us"; 6 - in 7 - { 8 - 9 - services.iodine.server = { 10 - enable = true; 11 - domain = domain; 12 - ip = "172.16.10.1/24"; 13 - extraConfig = "-c -l ${config.krebs.build.host.nets.internet.ip4.addr}"; 14 - }; 15 - 16 - networking.firewall.allowedUDPPorts = [ 53 ]; 17 - 18 - }
-97
configs/libvirt.nix
··· 1 - { lib, ... }: 2 - 3 - { 4 - virtualisation.libvirtd.enable = true; 5 - security.polkit.enable = true; 6 - 7 - krebs.iptables.tables.filter.INPUT.rules = [ 8 - { 9 - v6 = false; 10 - predicate = "-i virbr0 -p udp -m udp --dport 53"; 11 - target = "ACCEPT"; 12 - } 13 - { 14 - v6 = false; 15 - predicate = "-i virbr0 -p tcp -m tcp --dport 53"; 16 - target = "ACCEPT"; 17 - } 18 - { 19 - v6 = false; 20 - predicate = "-i virbr0 -p udp -m udp --dport 67"; 21 - target = "ACCEPT"; 22 - } 23 - { 24 - v6 = false; 25 - predicate = "-i virbr0 -p tcp -m tcp --dport 67"; 26 - target = "ACCEPT"; 27 - } 28 - ]; 29 - krebs.iptables.tables.filter.FORWARD.rules = [ 30 - { 31 - v6 = false; 32 - predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED"; 33 - target = "ACCEPT"; 34 - } 35 - { 36 - v6 = false; 37 - predicate = "-s 192.168.122.0/24 -i virbr0"; 38 - target = "ACCEPT"; 39 - } 40 - { 41 - v6 = false; 42 - predicate = "-i virbr0 -o virbr0"; 43 - target = "ACCEPT"; 44 - } 45 - { 46 - v6 = false; 47 - predicate = "-o virbr0"; 48 - target = "REJECT --reject-with icmp-port-unreachable"; 49 - } 50 - { 51 - v6 = false; 52 - predicate = "-i virbr0"; 53 - target = "REJECT --reject-with icmp-port-unreachable"; 54 - } 55 - ]; 56 - krebs.iptables.tables.filter.OUTPUT.rules = [ 57 - { 58 - v6 = false; 59 - predicate = "-o virbr0 -p udp -m udp --dport 68"; 60 - target = "ACCEPT"; 61 - } 62 - ]; 63 - krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [ 64 - { 65 - v6 = false; 66 - predicate = "-s 192.168.122.0/24"; 67 - target = "ACCEPT"; 68 - } 69 - ]; 70 - krebs.iptables.tables.nat.POSTROUTING.rules = [ 71 - { 72 - v6 = false; 73 - predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; 74 - target = "RETURN"; 75 - } 76 - { 77 - v6 = false; 78 - predicate = "-s 192.168.122.0/24 -d 255.255.255.255"; 79 - target = "RETURN"; 80 - } 81 - { 82 - v6 = false; 83 - predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24"; 84 - target = "MASQUERADE"; 85 - } 86 - { 87 - v6 = false; 88 - predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp"; 89 - target = "MASQUERADE --to-ports 1024-65535"; 90 - } 91 - { 92 - v6 = false; 93 - predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp"; 94 - target = "MASQUERADE --to-ports 1024-65535"; 95 - } 96 - ]; 97 - }
-9
configs/minecraft.nix
··· 1 - { ... }: 2 - { 3 - services.minecraft-server = { 4 - enable = true; 5 - eula = true; 6 - }; 7 - networking.firewall.allowedTCPPorts = [ 25565 ]; 8 - networking.firewall.allowedUDPPorts = [ 25565 ]; 9 - }
-43
configs/murmur.nix
··· 1 - { lib, ... }: 2 - { 3 - services.murmur = { 4 - enable = true; 5 - allowHtml = false; 6 - bandwidth = 10000000; 7 - registerName = "lassul.us"; 8 - autobanTime = 30; 9 - }; 10 - krebs.iptables.tables.filter.INPUT.rules = [ 11 - { 12 - predicate = "-p tcp --dport 64738"; 13 - target = "ACCEPT"; 14 - } 15 - { 16 - predicate = "-p udp --dport 64738"; 17 - target = "ACCEPT"; 18 - } 19 - ]; 20 - 21 - systemd.services.docker-mumble-web.serviceConfig = { 22 - StandardOutput = lib.mkForce "journal"; 23 - StandardError = lib.mkForce "journal"; 24 - }; 25 - virtualisation.oci-containers.containers.mumble-web = { 26 - image = "rankenstein/mumble-web:0.5"; 27 - environment = { 28 - MUMBLE_SERVER = "lassul.us:64738"; 29 - }; 30 - ports = [ 31 - "64739:8080" 32 - ]; 33 - }; 34 - 35 - services.nginx.virtualHosts."mumble.lassul.us" = { 36 - enableACME = true; 37 - forceSSL = true; 38 - locations."/" = { 39 - proxyPass = "http://localhost:64739"; 40 - proxyWebsockets = true; 41 - }; 42 - }; 43 - }
-11
configs/news-host.nix
··· 1 - { config, pkgs, ... }: 2 - { 3 - krebs.sync-containers3.containers.news = { 4 - sshKey = "${config.krebs.secret.directory}/news.sync.key"; 5 - startCommand = '' 6 - export PATH=$PATH:${pkgs.git}/bin 7 - until ${pkgs.dig.host}/bin/host github.com; do sleep 1; done 8 - ${pkgs.nixos-rebuild}/bin/nixos-rebuild --refresh --flake git+https://cgit.lassul.us/stockholm#news switch 9 - ''; 10 - }; 11 - }
-39
configs/nextcloud.nix
··· 1 - { config, pkgs, ... }: 2 - { 3 - services.nextcloud = { 4 - enable = true; 5 - hostName = "c.lassul.us"; 6 - package = pkgs.nextcloud31; 7 - database.createLocally = true; 8 - config.dbtype = "pgsql"; 9 - config.adminpassFile = "/var/lib/nextcloud/admin.pass"; 10 - https = true; 11 - }; 12 - 13 - services.nginx.virtualHosts.${config.services.nextcloud.hostName} = { 14 - forceSSL = true; 15 - enableACME = true; 16 - }; 17 - 18 - systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [ 19 - "+${pkgs.writers.writeDash "install_admin_pw" '' 20 - mkdir -p /var/lib/nextcloud 21 - chown nextcloud:nextcloud /var/lib/nextcloud 22 - install -o nextcloud -g nextcloud -Dm0600 \ 23 - ${config.clan.core.vars.generators.nextcloud.files."nextcloud_adminpass".path} \ 24 - /var/lib/nextcloud/admin.pass 25 - ''}" 26 - ]; 27 - 28 - clan.core.vars.generators.nextcloud = { 29 - files."nextcloud_adminpass" = { }; 30 - prompts.password = { 31 - description = "please enter the admin password for nextcloud"; 32 - type = "hidden"; 33 - }; 34 - runtimeInputs = with pkgs; [ coreutils ]; 35 - script = '' 36 - echo "$prompts/password" > "$out"/nextcloud_adminpass 37 - ''; 38 - }; 39 - }
-27
configs/privoxy-retiolum.nix
··· 1 - { config, ... }: 2 - 3 - let 4 - r_ip = config.krebs.build.host.nets.retiolum.ip4.addr; 5 - in 6 - { 7 - imports = [ 8 - ./privoxy.nix 9 - ]; 10 - 11 - services.privoxy.settings.listen-address = "${r_ip}:8118"; 12 - 13 - krebs.iptables = { 14 - tables = { 15 - filter.INPUT.rules = [ 16 - { 17 - predicate = "-i retiolum -p tcp --dport 8118"; 18 - target = "ACCEPT"; 19 - } 20 - { 21 - predicate = "-i dns0 -p tcp --dport 8118"; 22 - target = "ACCEPT"; 23 - } 24 - ]; 25 - }; 26 - }; 27 - }
-7
configs/privoxy.nix
··· 1 - { ... }: 2 - 3 - { 4 - services.privoxy = { 5 - enable = true; 6 - }; 7 - }
-21
configs/shadowsocks.nix
··· 1 - { config, pkgs, ... }: 2 - { 3 - services.shadowsocks = { 4 - enable = true; 5 - passwordFile = config.clan.core.vars.generators.shadowsocks.files.shadowsocks_password.path; 6 - }; 7 - networking.firewall.allowedTCPPorts = [ 8388 ]; 8 - clan.core.vars.generators.shadowsocks = { 9 - files."shadowsocks_password" = { }; 10 - prompts.password = { 11 - description = "please enter your shadowsocks password"; 12 - type = "hidden"; 13 - }; 14 - runtimeInputs = with pkgs; [ 15 - coreutils 16 - ]; 17 - script = '' 18 - cp "$prompts"/password "$out"/shadowsocks_password 19 - ''; 20 - }; 21 - }
-113
configs/wiregrill.nix
··· 1 - { 2 - config, 3 - lib, 4 - pkgs, 5 - ... 6 - }: 7 - with lib; 8 - let 9 - 10 - self = config.krebs.build.host.nets.wiregrill; 11 - isRouter = !isNull self.via; 12 - 13 - in 14 - mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { 15 - #hack for modprobe inside containers 16 - systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [ 17 - (pkgs.writeDashBin "modprobe" ":") 18 - ]); 19 - 20 - boot.kernel.sysctl = mkIf isRouter { 21 - "net.ipv6.conf.all.forwarding" = 1; 22 - }; 23 - krebs.iptables.tables.filter.INPUT.rules = [ 24 - { 25 - predicate = "-p udp --dport ${toString self.wireguard.port}"; 26 - target = "ACCEPT"; 27 - } 28 - ]; 29 - krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [ 30 - { 31 - predicate = "-i wiregrill -o wiregrill"; 32 - target = "ACCEPT"; 33 - } 34 - { 35 - predicate = "-i wiregrill -o retiolum"; 36 - target = "ACCEPT"; 37 - } 38 - { 39 - predicate = "-i retiolum -o wiregrill"; 40 - target = "ACCEPT"; 41 - } 42 - { 43 - predicate = "-i wiregrill -o eth0"; 44 - target = "ACCEPT"; 45 - } 46 - { 47 - predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; 48 - target = "ACCEPT"; 49 - } 50 - ]); 51 - 52 - clan.core.vars.generators.wiregrill = { 53 - files."wiregrill.key" = { }; 54 - files."wiregrill.pub" = { }; 55 - runtimeInputs = with pkgs; [ 56 - coreutils 57 - wireguard-tools 58 - ]; 59 - script = '' 60 - wg genkey > "$out"/wiregrill.key 61 - cat "$out"/wiregrill.key | wg pubkey > "$out"/wiregrill.pub 62 - ''; 63 - }; 64 - 65 - systemd.network.networks.wiregrill = { 66 - matchConfig.Name = "wiregrill"; 67 - address = 68 - (optional (!isNull self.ip4) "${self.ip4.addr}/16") 69 - ++ (optional (!isNull self.ip6) "${self.ip6.addr}/48"); 70 - networkConfig = { 71 - IgnoreCarrierLoss = "10s"; 72 - }; 73 - }; 74 - 75 - networking.wireguard.interfaces.wiregrill = { 76 - ips = 77 - (optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr) 78 - ++ (optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr); 79 - listenPort = 51820; 80 - privateKeyFile = config.clan.core.vars.generators.wiregrill.files."wiregrill.key".path; 81 - allowedIPsAsRoutes = true; 82 - peers = 83 - mapAttrsToList 84 - (_name: host: { 85 - # inherit name; 86 - allowedIPs = 87 - if isRouter then 88 - (optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) 89 - ++ (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr) 90 - else 91 - host.nets.wiregrill.wireguard.subnets; 92 - endpoint = mkIf (!isNull host.nets.wiregrill.via) ( 93 - host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}" 94 - ); 95 - persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61; 96 - publicKey = (replaceStrings [ "\n" ] [ "" ] host.nets.wiregrill.wireguard.pubkey); 97 - }) 98 - ( 99 - filterAttrs ( 100 - _: h: 101 - hasAttr "wiregrill" h.nets 102 - && hasAttr "wireguard" h.nets.wiregrill 103 - && !isNull h.nets.wiregrill.wireguard 104 - && ( 105 - let 106 - pk = builtins.tryEval h.nets.wiregrill.wireguard.pubkey; 107 - in 108 - pk.success && !isNull pk.value 109 - ) 110 - ) config.krebs.hosts 111 - ); 112 - }; 113 - }
-44
configs/antimicrox/default.nix
··· 1 - { 2 - config, 3 - lib, 4 - pkgs, 5 - ... 6 - }: 7 - { 8 - systemd.services.antimicrox = { 9 - after = [ "display-manager.service" ]; 10 - wantedBy = [ "multi-user.target" ]; 11 - environment = { 12 - DISPLAY = ":0"; 13 - }; 14 - serviceConfig = { 15 - User = config.users.users.mainUser.name; 16 - ExecStartPre = lib.singleton (pkgs.writeDash "init_state" "echo 0 > /tmp/gamepad.state"); 17 - ExecStart = "${pkgs.antimicrox}/bin/antimicrox --hidden --profile ${./mouse.gamecontroller.amgp}"; 18 - }; 19 - }; 20 - 21 - services.udev.extraRules = '' 22 - KERNEL=="uinput", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput" 23 - ''; 24 - 25 - environment.systemPackages = [ 26 - pkgs.antimicrox 27 - (pkgs.writers.writeDashBin "gamepad_mouse_disable" '' 28 - echo 1 > /tmp/gamepad.state 29 - ${pkgs.antimicrox}/bin/antimicrox --profile ${./empty.gamecontroller.amgp} 30 - '') 31 - (pkgs.writers.writeDashBin "gamepad_mouse_enable" '' 32 - echo 0 > /tmp/gamepad.state 33 - ${pkgs.antimicrox}/bin/antimicrox --profile ${./mouse.gamecontroller.amgp} 34 - '') 35 - (pkgs.writers.writeDashBin "gamepad_mouse_toggle" '' 36 - state=$(${pkgs.coreutils}/bin/cat /tmp/gamepad.state) 37 - if [ "$state" = 1 ]; then 38 - /run/current-system/sw/bin/gamepad_mouse_enable 39 - else 40 - /run/current-system/sw/bin/gamepad_mouse_disable 41 - fi 42 - '') 43 - ]; 44 - }
-20
configs/antimicrox/empty.gamecontroller.amgp
··· 1 - <?xml version="1.0" encoding="UTF-8"?> 2 - <gamecontroller configversion="19" appversion="3.3.2"> 3 - <!--The SDL name for a joystick is included for informational purposes only.--> 4 - <sdlname>XInput Controller</sdlname> 5 - <!--The Unique ID for a joystick is included for informational purposes only.--> 6 - <uniqueID>030000005e0400008e020000010100001118654</uniqueID> 7 - <stickAxisAssociation index="2" xAxis="3" yAxis="4"/> 8 - <stickAxisAssociation index="1" xAxis="1" yAxis="2"/> 9 - <vdpadButtonAssociations index="1"> 10 - <vdpadButtonAssociation axis="0" button="12" direction="1"/> 11 - <vdpadButtonAssociation axis="0" button="13" direction="4"/> 12 - <vdpadButtonAssociation axis="0" button="14" direction="8"/> 13 - <vdpadButtonAssociation axis="0" button="15" direction="2"/> 14 - </vdpadButtonAssociations> 15 - <names> 16 - <controlstickname index="2">R Stick</controlstickname> 17 - <controlstickname index="1">L Stick</controlstickname> 18 - </names> 19 - <sets/> 20 - </gamecontroller>
-281
configs/antimicrox/mouse.gamecontroller.amgp
··· 1 - <?xml version="1.0" encoding="UTF-8"?> 2 - <gamecontroller configversion="19" appversion="3.3.2"> 3 - <!--The SDL name for a joystick is included for informational purposes only.--> 4 - <sdlname>XInput Controller</sdlname> 5 - <!--The Unique ID for a joystick is included for informational purposes only.--> 6 - <uniqueID>030000005e0400008e020000010100001118654</uniqueID> 7 - <stickAxisAssociation index="2" xAxis="3" yAxis="4"/> 8 - <stickAxisAssociation index="1" xAxis="1" yAxis="2"/> 9 - <vdpadButtonAssociations index="1"> 10 - <vdpadButtonAssociation axis="0" button="12" direction="1"/> 11 - <vdpadButtonAssociation axis="0" button="13" direction="4"/> 12 - <vdpadButtonAssociation axis="0" button="14" direction="8"/> 13 - <vdpadButtonAssociation axis="0" button="15" direction="2"/> 14 - </vdpadButtonAssociations> 15 - <names> 16 - <controlstickname index="2">Stick 2</controlstickname> 17 - <controlstickname index="1">Stick 1</controlstickname> 18 - </names> 19 - <sets> 20 - <set index="1"> 21 - <stick index="2"> 22 - <deadZone>1</deadZone> 23 - <maxZone>29501</maxZone> 24 - <modifierZone>1412</modifierZone> 25 - <diagonalRange>90</diagonalRange> 26 - <squareStick>100</squareStick> 27 - <stickbutton index="1"> 28 - <mousespeedx>74</mousespeedx> 29 - <mousespeedy>74</mousespeedy> 30 - <accelerationmultiplier>4</accelerationmultiplier> 31 - <startaccelmultiplier>20</startaccelmultiplier> 32 - <minaccelthreshold>3</minaccelthreshold> 33 - <extraaccelerationcurve>easeoutquad</extraaccelerationcurve> 34 - <slots> 35 - <slot> 36 - <code>1</code> 37 - <mode>mousemovement</mode> 38 - </slot> 39 - </slots> 40 - </stickbutton> 41 - <stickbutton index="3"> 42 - <mousespeedx>74</mousespeedx> 43 - <mousespeedy>74</mousespeedy> 44 - <accelerationmultiplier>4</accelerationmultiplier> 45 - <startaccelmultiplier>20</startaccelmultiplier> 46 - <minaccelthreshold>3</minaccelthreshold> 47 - <extraaccelerationcurve>easeoutquad</extraaccelerationcurve> 48 - <slots> 49 - <slot> 50 - <code>4</code> 51 - <mode>mousemovement</mode> 52 - </slot> 53 - </slots> 54 - </stickbutton> 55 - <stickbutton index="2"> 56 - <mousespeedx>74</mousespeedx> 57 - <mousespeedy>74</mousespeedy> 58 - </stickbutton> 59 - <stickbutton index="5"> 60 - <mousespeedx>74</mousespeedx> 61 - <mousespeedy>74</mousespeedy> 62 - <accelerationmultiplier>4</accelerationmultiplier> 63 - <startaccelmultiplier>20</startaccelmultiplier> 64 - <minaccelthreshold>3</minaccelthreshold> 65 - <extraaccelerationcurve>easeoutquad</extraaccelerationcurve> 66 - <slots> 67 - <slot> 68 - <code>2</code> 69 - <mode>mousemovement</mode> 70 - </slot> 71 - </slots> 72 - </stickbutton> 73 - <stickbutton index="4"> 74 - <mousespeedx>74</mousespeedx> 75 - <mousespeedy>74</mousespeedy> 76 - </stickbutton> 77 - <stickbutton index="7"> 78 - <mousespeedx>74</mousespeedx> 79 - <mousespeedy>74</mousespeedy> 80 - <accelerationmultiplier>4</accelerationmultiplier> 81 - <startaccelmultiplier>20</startaccelmultiplier> 82 - <minaccelthreshold>3</minaccelthreshold> 83 - <extraaccelerationcurve>easeoutquad</extraaccelerationcurve> 84 - <slots> 85 - <slot> 86 - <code>3</code> 87 - <mode>mousemovement</mode> 88 - </slot> 89 - </slots> 90 - </stickbutton> 91 - <stickbutton index="6"> 92 - <mousespeedx>74</mousespeedx> 93 - <mousespeedy>74</mousespeedy> 94 - </stickbutton> 95 - <stickbutton index="8"> 96 - <mousespeedx>74</mousespeedx> 97 - <mousespeedy>74</mousespeedy> 98 - </stickbutton> 99 - </stick> 100 - <stick index="1"> 101 - <deadZone>2578</deadZone> 102 - <maxZone>30799</maxZone> 103 - <stickbutton index="1"> 104 - <mouseacceleration>linear</mouseacceleration> 105 - <slots> 106 - <slot> 107 - <code>4</code> 108 - <mode>mousebutton</mode> 109 - </slot> 110 - </slots> 111 - </stickbutton> 112 - <stickbutton index="3"> 113 - <mouseacceleration>linear</mouseacceleration> 114 - <slots> 115 - <slot> 116 - <code>7</code> 117 - <mode>mousebutton</mode> 118 - </slot> 119 - </slots> 120 - </stickbutton> 121 - <stickbutton index="2"> 122 - <mouseacceleration>linear</mouseacceleration> 123 - </stickbutton> 124 - <stickbutton index="5"> 125 - <mouseacceleration>linear</mouseacceleration> 126 - <slots> 127 - <slot> 128 - <code>5</code> 129 - <mode>mousebutton</mode> 130 - </slot> 131 - </slots> 132 - </stickbutton> 133 - <stickbutton index="4"> 134 - <mouseacceleration>linear</mouseacceleration> 135 - </stickbutton> 136 - <stickbutton index="7"> 137 - <mouseacceleration>linear</mouseacceleration> 138 - <slots> 139 - <slot> 140 - <code>6</code> 141 - <mode>mousebutton</mode> 142 - </slot> 143 - </slots> 144 - </stickbutton> 145 - <stickbutton index="6"> 146 - <mouseacceleration>linear</mouseacceleration> 147 - </stickbutton> 148 - <stickbutton index="8"> 149 - <mouseacceleration>linear</mouseacceleration> 150 - </stickbutton> 151 - </stick> 152 - <dpad index="1"> 153 - <dpadbutton index="12"> 154 - <wheelspeedx>2</wheelspeedx> 155 - <wheelspeedy>10</wheelspeedy> 156 - </dpadbutton> 157 - <dpadbutton index="1"> 158 - <wheelspeedx>10</wheelspeedx> 159 - <wheelspeedy>10</wheelspeedy> 160 - <slots> 161 - <slot> 162 - <code>0x1000013</code> 163 - <mode>keyboard</mode> 164 - </slot> 165 - </slots> 166 - </dpadbutton> 167 - <dpadbutton index="3"> 168 - <wheelspeedx>2</wheelspeedx> 169 - <wheelspeedy>10</wheelspeedy> 170 - </dpadbutton> 171 - <dpadbutton index="2"> 172 - <wheelspeedx>2</wheelspeedx> 173 - <wheelspeedy>10</wheelspeedy> 174 - <slots> 175 - <slot> 176 - <code>0x1000014</code> 177 - <mode>keyboard</mode> 178 - </slot> 179 - </slots> 180 - </dpadbutton> 181 - <dpadbutton index="4"> 182 - <wheelspeedx>2</wheelspeedx> 183 - <wheelspeedy>10</wheelspeedy> 184 - <slots> 185 - <slot> 186 - <code>0x1000015</code> 187 - <mode>keyboard</mode> 188 - </slot> 189 - </slots> 190 - </dpadbutton> 191 - <dpadbutton index="6"> 192 - <wheelspeedx>2</wheelspeedx> 193 - <wheelspeedy>10</wheelspeedy> 194 - </dpadbutton> 195 - <dpadbutton index="9"> 196 - <wheelspeedx>2</wheelspeedx> 197 - <wheelspeedy>10</wheelspeedy> 198 - </dpadbutton> 199 - <dpadbutton index="8"> 200 - <wheelspeedx>2</wheelspeedx> 201 - <wheelspeedy>10</wheelspeedy> 202 - <slots> 203 - <slot> 204 - <code>0x1000012</code> 205 - <mode>keyboard</mode> 206 - </slot> 207 - </slots> 208 - </dpadbutton> 209 - </dpad> 210 - <trigger index="6"> 211 - <deadZone>2000</deadZone> 212 - <throttle>positivehalf</throttle> 213 - <triggerbutton index="1"> 214 - <mousespeedx>100</mousespeedx> 215 - <mousespeedy>100</mousespeedy> 216 - </triggerbutton> 217 - <triggerbutton index="2"> 218 - <mousespeedx>100</mousespeedx> 219 - <mousespeedy>100</mousespeedy> 220 - <slots> 221 - <slot> 222 - <code>250</code> 223 - <mode>mousespeedmod</mode> 224 - </slot> 225 - </slots> 226 - </triggerbutton> 227 - </trigger> 228 - <trigger index="5"> 229 - <throttle>positivehalf</throttle> 230 - </trigger> 231 - <button index="11"> 232 - <slots> 233 - <slot> 234 - <code>1</code> 235 - <mode>mousebutton</mode> 236 - </slot> 237 - </slots> 238 - </button> 239 - <button index="2"> 240 - <slots> 241 - <slot> 242 - <code>3</code> 243 - <mode>mousebutton</mode> 244 - </slot> 245 - </slots> 246 - </button> 247 - <button index="1"> 248 - <slots> 249 - <slot> 250 - <code>1</code> 251 - <mode>mousebutton</mode> 252 - </slot> 253 - </slots> 254 - </button> 255 - <button index="4"> 256 - <slots> 257 - <slot> 258 - <code>0x1000004</code> 259 - <mode>keyboard</mode> 260 - </slot> 261 - </slots> 262 - </button> 263 - <button index="3"> 264 - <slots> 265 - <slot> 266 - <code>2</code> 267 - <mode>mousebutton</mode> 268 - </slot> 269 - </slots> 270 - </button> 271 - <button index="5"> 272 - <slots> 273 - <slot> 274 - <code>1</code> 275 - <mode>mousebutton</mode> 276 - </slot> 277 - </slots> 278 - </button> 279 - </set> 280 - </sets> 281 - </gamecontroller>
-57
configs/bgt-bot/bgt-check.sh
··· 1 - #!/bin/sh 2 - # needs in path: 3 - # curl gnugrep jq 4 - # creates and manages $PWD/state 5 - set -xeuf 6 - 7 - send_reaktor(){ 8 - # usage: send_reaktor "text" 9 - echo "send_reaktor: $1" 10 - curl -fsS "http://localhost:$REAKTOR_PORT" \ 11 - -H content-type:application/json \ 12 - -d "$(jq -n \ 13 - --arg text "$1" \ 14 - --arg channel "$IRC_CHANNEL" \ 15 - '{ 16 - command:"PRIVMSG", 17 - params:[$channel,$text] 18 - }' 19 - )" 20 - } 21 - 22 - live=$(shuf -n1 <<EOF 23 - Binärgewitter Liveshow hat begonnen! http://stream.radiotux.de:8000/binaergewitter.mp3 24 - EOF 25 - ) 26 - 27 - offline=$(shuf -n1 <<EOF 28 - Live stream vorbei 29 - EOF 30 - ) 31 - error=$(shuf -n1 <<EOF 32 - something went wrong 33 - EOF 34 - ) 35 - 36 - if curl -Ss http://stream.radiotux.de:8000 | grep -q 'Mount Point /binaergewitter'; then 37 - state='live' 38 - else 39 - state='offline' 40 - fi 41 - prevstate=$(cat state ||:) 42 - 43 - if test "$state" = "$(cat state)";then 44 - #echo "current and last state is the same ($state), doing nothing" 45 - : 46 - else 47 - echo "API state and last state differ ( '$state' != '$prevstate')" 48 - if test "$state" = 'live';then 49 - send_reaktor "$live" 50 - elif test "$state" = 'offline';then 51 - send_reaktor "$offline" 52 - else 53 - send_reaktor "$error" 54 - fi 55 - echo 'updating state' 56 - printf "%s" "$state" > state 57 - fi
-46
configs/bgt-bot/default.nix
··· 1 - { self, pkgs, ... }: 2 - let 3 - 4 - bot_port = "7654"; 5 - irc_channel = "#binaergewitter"; 6 - in 7 - { 8 - imports = [ 9 - self.inputs.stockholm.nixosModules.reaktor2 10 - ]; 11 - krebs.reaktor2.bgt-announce = { 12 - hostname = "irc.libera.chat"; 13 - port = "6697"; 14 - nick = "bgt-announce"; 15 - API.listen = "inet://127.0.0.1:${bot_port}"; 16 - plugins = [ 17 - { 18 - plugin = "register"; 19 - config = { 20 - channels = [ 21 - irc_channel 22 - ]; 23 - }; 24 - } 25 - ]; 26 - }; 27 - systemd.services.check_bgt_show = { 28 - startAt = "*:0/5"; 29 - environment = { 30 - IRC_CHANNEL = irc_channel; 31 - REAKTOR_PORT = bot_port; 32 - }; 33 - path = with pkgs; [ 34 - curl 35 - gnugrep 36 - jq 37 - ]; 38 - script = builtins.readFile ./bgt-check.sh; 39 - serviceConfig = { 40 - DynamicUser = true; 41 - StateDirectory = "bgt-announce"; 42 - WorkingDirectory = "/var/lib/bgt-announce"; 43 - PrivateTmp = true; 44 - }; 45 - }; 46 - }
-12
configs/binary-cache/client.nix
··· 1 - { 2 - nix.settings = { 3 - substituters = [ 4 - "http://cache.neoprism.r" 5 - "https://cache.nixos.org/" 6 - ]; 7 - trusted-public-keys = [ 8 - "cache.prism-2:YwmCm3/s/D+SxrPKN/ETjlpw/219pNUbpnluatp6FKI=" 9 - "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" 10 - ]; 11 - }; 12 - }
-13
configs/binary-cache/proxy.nix
··· 1 - { ... }: 2 - { 3 - services.nginx = { 4 - enable = true; 5 - virtualHosts."cache.krebsco.de" = { 6 - enableACME = true; 7 - forceSSL = true; 8 - locations."/".extraConfig = '' 9 - proxy_pass http://cache.neoprism.r/; 10 - ''; 11 - }; 12 - }; 13 - }
-41
configs/binary-cache/server.nix
··· 1 - { config, pkgs, ... }: 2 - { 3 - # nixpkgs.config.packageOverrides = p: { 4 - # nix-serve = p.haskellPackages.nix-serve-ng; 5 - # }; 6 - # generate private key with: 7 - # nix-store --generate-binary-cache-key my-secret-key my-public-key 8 - clan.core.vars.generators.nix-serve = { 9 - files."nix-serve.key" = { }; 10 - files."nix-serve.pub" = { }; 11 - runtimeInputs = with pkgs; [ 12 - coreutils 13 - nix 14 - ]; 15 - script = '' 16 - nix-store --generate-binary-cache-key "$out"/nix-serve.key "$out"/nix-serve.pub 17 - ''; 18 - }; 19 - services.nix-serve = { 20 - enable = true; 21 - secretKeyFile = config.clan.core.vars.generators.nix-serve.files."nix-serve.key".path; 22 - port = 5005; 23 - }; 24 - 25 - services.nginx = { 26 - enable = true; 27 - virtualHosts.nix-serve = { 28 - serverAliases = [ "cache.${config.networking.hostName}.r" ]; 29 - locations."/".extraConfig = '' 30 - proxy_pass http://localhost:${toString config.services.nix-serve.port}; 31 - ''; 32 - locations."= /nix-cache-info".extraConfig = '' 33 - alias ${pkgs.writeText "cache-info" '' 34 - StoreDir: /nix/store 35 - WantMassQuery: 1 36 - Priority: 42 37 - ''}; 38 - ''; 39 - }; 40 - }; 41 - }
-125
configs/hw/brcmfmac4356-pcie.txt
··· 1 - # Sample variables file for BCM94356Z NGFF 22x30mm iPA, iLNA board with PCIe for production package 2 - NVRAMRev=$Rev: 492104 $ 3 - #4356 chip = 4354 A2 chip 4 - sromrev=11 5 - boardrev=0x1102 6 - boardtype=0x073e 7 - boardflags=0x02400201 8 - #0x2000 enable 2G spur WAR 9 - boardflags2=0x00802000 10 - boardflags3=0x0000000a 11 - #boardflags3 0x00000100 /* to read swctrlmap from nvram*/ 12 - #define BFL3_5G_SPUR_WAR 0x00080000 /* enable spur WAR in 5G band */ 13 - #define BFL3_AvVim 0x40000000 /* load AvVim from nvram */ 14 - macaddr=00:90:4c:1a:10:01 15 - ccode=0x5854 16 - regrev=205 17 - antswitch=0 18 - pdgain5g=4 19 - pdgain2g=4 20 - tworangetssi2g=0 21 - tworangetssi5g=0 22 - paprdis=0 23 - femctrl=10 24 - vendid=0x14e4 25 - devid=0x43ec 26 - manfid=0x2d0 27 - #prodid=0x052e 28 - nocrc=1 29 - otpimagesize=502 30 - xtalfreq=37400 31 - rxgains2gelnagaina0=0 32 - rxgains2gtrisoa0=7 33 - rxgains2gtrelnabypa0=0 34 - rxgains5gelnagaina0=0 35 - rxgains5gtrisoa0=11 36 - rxgains5gtrelnabypa0=0 37 - rxgains5gmelnagaina0=0 38 - rxgains5gmtrisoa0=13 39 - rxgains5gmtrelnabypa0=0 40 - rxgains5ghelnagaina0=0 41 - rxgains5ghtrisoa0=12 42 - rxgains5ghtrelnabypa0=0 43 - rxgains2gelnagaina1=0 44 - rxgains2gtrisoa1=7 45 - rxgains2gtrelnabypa1=0 46 - rxgains5gelnagaina1=0 47 - rxgains5gtrisoa1=10 48 - rxgains5gtrelnabypa1=0 49 - rxgains5gmelnagaina1=0 50 - rxgains5gmtrisoa1=11 51 - rxgains5gmtrelnabypa1=0 52 - rxgains5ghelnagaina1=0 53 - rxgains5ghtrisoa1=11 54 - rxgains5ghtrelnabypa1=0 55 - rxchain=3 56 - txchain=3 57 - aa2g=3 58 - aa5g=3 59 - agbg0=2 60 - agbg1=2 61 - aga0=2 62 - aga1=2 63 - tssipos2g=1 64 - extpagain2g=2 65 - tssipos5g=1 66 - extpagain5g=2 67 - tempthresh=255 68 - tempoffset=255 69 - rawtempsense=0x1ff 70 - pa2ga0=-147,6192,-705 71 - pa2ga1=-161,6041,-701 72 - pa5ga0=-194,6069,-739,-188,6137,-743,-185,5931,-725,-171,5898,-715 73 - pa5ga1=-190,6248,-757,-190,6275,-759,-190,6225,-757,-184,6131,-746 74 - subband5gver=0x4 75 - pdoffsetcckma0=0x4 76 - pdoffsetcckma1=0x4 77 - pdoffset40ma0=0x0000 78 - pdoffset80ma0=0x0000 79 - pdoffset40ma1=0x0000 80 - pdoffset80ma1=0x0000 81 - maxp2ga0=76 82 - maxp5ga0=74,74,74,74 83 - maxp2ga1=76 84 - maxp5ga1=74,74,74,74 85 - cckbw202gpo=0x0000 86 - cckbw20ul2gpo=0x0000 87 - mcsbw202gpo=0x99644422 88 - mcsbw402gpo=0x99644422 89 - dot11agofdmhrbw202gpo=0x6666 90 - ofdmlrbw202gpo=0x0022 91 - mcsbw205glpo=0x88766663 92 - mcsbw405glpo=0x88666663 93 - mcsbw805glpo=0xbb666665 94 - mcsbw205gmpo=0xd8666663 95 - mcsbw405gmpo=0x88666663 96 - mcsbw805gmpo=0xcc666665 97 - mcsbw205ghpo=0xdc666663 98 - mcsbw405ghpo=0xaa666663 99 - mcsbw805ghpo=0xdd666665 100 - mcslr5glpo=0x0000 101 - mcslr5gmpo=0x0000 102 - mcslr5ghpo=0x0000 103 - sb20in40hrpo=0x0 104 - sb20in80and160hr5glpo=0x0 105 - sb40and80hr5glpo=0x0 106 - sb20in80and160hr5gmpo=0x0 107 - sb40and80hr5gmpo=0x0 108 - sb20in80and160hr5ghpo=0x0 109 - sb40and80hr5ghpo=0x0 110 - sb20in40lrpo=0x0 111 - sb20in80and160lr5glpo=0x0 112 - sb40and80lr5glpo=0x0 113 - sb20in80and160lr5gmpo=0x0 114 - sb40and80lr5gmpo=0x0 115 - sb20in80and160lr5ghpo=0x0 116 - sb40and80lr5ghpo=0x0 117 - dot11agduphrpo=0x0 118 - dot11agduplrpo=0x0 119 - phycal_tempdelta=255 120 - temps_period=15 121 - temps_hysteresis=15 122 - rssicorrnorm_c0=4,4 123 - rssicorrnorm_c1=4,4 124 - rssicorrnorm5g_c0=1,2,3,1,2,3,6,6,8,6,6,8 125 - rssicorrnorm5g_c1=1,2,3,2,2,2,7,7,8,7,7,8
-208
configs/monitoring/alert-rules.nix
··· 1 - # inspiration from https://github.com/Mic92/dotfiles/blob/master/nixos/eva/modules/prometheus/alert-rules.nix 2 - { lib }: 3 - 4 - lib.mapAttrsToList 5 - (name: opts: { 6 - alert = name; 7 - expr = opts.condition; 8 - for = opts.time or "2m"; 9 - labels = { }; 10 - annotations.description = opts.description; 11 - }) 12 - ({ 13 - prometheus_too_many_restarts = { 14 - condition = ''changes(process_start_time_seconds{job=~"prometheus|pushgateway|alertmanager|telegraf"}[15m]) > 2''; 15 - description = "Prometheus has restarted more than twice in the last 15 minutes. It might be crashlooping."; 16 - }; 17 - 18 - alert_manager_config_not_synced = { 19 - condition = ''count(count_values("config_hash", alertmanager_config_hash)) > 1''; 20 - description = "Configurations of AlertManager cluster instances are out of sync."; 21 - }; 22 - 23 - prometheus_not_connected_to_alertmanager = { 24 - condition = "prometheus_notifications_alertmanagers_discovered < 1"; 25 - description = "Prometheus cannot connect the alertmanager\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"; 26 - }; 27 - 28 - prometheus_rule_evaluation_failures = { 29 - condition = "increase(prometheus_rule_evaluation_failures_total[3m]) > 0"; 30 - description = "Prometheus encountered {{ $value }} rule evaluation failures, leading to potentially ignored alerts.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"; 31 - }; 32 - 33 - prometheus_template_expansion_failures = { 34 - condition = "increase(prometheus_template_text_expansion_failures_total[3m]) > 0"; 35 - time = "0m"; 36 - description = "Prometheus encountered {{ $value }} template text expansion failures\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"; 37 - }; 38 - 39 - promtail_request_errors = { 40 - condition = ''100 * sum(rate(promtail_request_duration_seconds_count{status_code=~"5..|failed"}[1m])) by (namespace, job, route, instance) / sum(rate(promtail_request_duration_seconds_count[1m])) by (namespace, job, route, instance) > 10''; 41 - time = "15m"; 42 - description = ''{{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}% errors.''; 43 - }; 44 - 45 - promtail_file_lagging = { 46 - condition = "abs(promtail_file_bytes_total - promtail_read_bytes_total) > 1e6"; 47 - time = "15m"; 48 - description = "{{ $labels.instance }} {{ $labels.job }} {{ $labels.path }} has been lagging by more than 1MB for more than 15m."; 49 - }; 50 - 51 - filesystem_full_80percent = { 52 - condition = ''disk_used_percent{mode!="ro"} >= 95''; 53 - time = "10m"; 54 - description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 20% space left on its filesystem."; 55 - }; 56 - 57 - filesystem_full_krebs = { 58 - condition = ''disk_used_percent{mode!="ro", org="krebs"} >= 95''; 59 - time = "10m"; 60 - description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 5% space left on its filesystem."; 61 - }; 62 - 63 - filesystem_inodes_full = { 64 - condition = "disk_inodes_free / disk_inodes_total < 0.10"; 65 - time = "10m"; 66 - description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 10% inodes left on its filesystem."; 67 - }; 68 - 69 - daily_task_not_run = { 70 - # give 6 hours grace period 71 - condition = ''time() - task_last_run{state="ok",frequency="daily"} > (24 + 6) * 60 * 60''; 72 - description = "{{$labels.host}}: {{$labels.name}} was not run in the last 24h"; 73 - }; 74 - 75 - daily_task_failed = { 76 - condition = ''task_last_run{state="fail"}''; 77 - description = "{{$labels.host}}: {{$labels.name}} failed to run"; 78 - }; 79 - 80 - swap_using_30percent = { 81 - condition = "mem_swap_total - (mem_swap_cached + mem_swap_free) > mem_swap_total * 0.3"; 82 - time = "30m"; 83 - description = "{{$labels.host}} is using 30% of its swap space for at least 30 minutes."; 84 - }; 85 - 86 - systemd_service_failed = { 87 - condition = ''systemd_units_active_code{name!~"nixpkgs-update-.*.service"} == 3''; 88 - description = "{{$labels.host}} failed to (re)start service {{$labels.name}}."; 89 - }; 90 - 91 - service_not_running = { 92 - condition = ''systemd_units_active_code{name=~"teamspeak3-server.service|tt-rss.service", sub!="running"}''; 93 - description = "{{$labels.host}} should have a running {{$labels.name}}."; 94 - }; 95 - 96 - nfs_export_not_present = { 97 - condition = "nfs_export_present == 0"; 98 - time = "1h"; 99 - description = "{{$labels.host}} cannot reach nfs export [{{$labels.server}}]:{{$labels.path}}"; 100 - }; 101 - 102 - ram_using_90percent = { 103 - condition = "mem_buffered + mem_free + mem_cached < mem_total * 0.1"; 104 - time = "1h"; 105 - description = "{{$labels.host}} is using at least 90% of its RAM for at least 1 hour."; 106 - }; 107 - load15 = { 108 - condition = ''system_load15 / system_n_cpus{org!="nix-community"} >= 2.0''; 109 - time = "10m"; 110 - description = "{{$labels.host}} is running with load15 > 1 for at least 5 minutes: {{$value}}"; 111 - }; 112 - reboot = { 113 - condition = "system_uptime < 300"; 114 - description = "{{$labels.host}} just rebooted."; 115 - }; 116 - uptime = { 117 - # too scared to upgrade matchbox 118 - condition = ''system_uptime {host!~"^(matchbox|grandalf)$"} > 2592000''; 119 - description = "Uptime monster: {{$labels.host}} has been up for more than 30 days."; 120 - }; 121 - telegraf_down = { 122 - condition = ''min(up{job=~"telegraf",type!='mobile'}) by (source, job, instance, org) == 0''; 123 - time = "3m"; 124 - description = "{{$labels.instance}}: {{$labels.job}} telegraf exporter from {{$labels.source}} is down."; 125 - }; 126 - ping = { 127 - condition = "ping_result_code{type!='mobile'} != 0"; 128 - description = "{{$labels.url}}: ping from {{$labels.instance}} has failed!"; 129 - }; 130 - ping_high_latency = { 131 - condition = "ping_average_response_ms{type!='mobile'} > 5000"; 132 - description = "{{$labels.instance}}: ping probe from {{$labels.source}} is encountering high latency!"; 133 - }; 134 - http = { 135 - condition = "http_response_result_code != 0"; 136 - description = "{{$labels.server}} : http request failed from {{$labels.instance}}: {{$labels.result}}!"; 137 - }; 138 - http_match_failed = { 139 - condition = "http_response_response_string_match == 0"; 140 - description = "{{$labels.server}} : http body not as expected; status code: {{$labels.status_code}}!"; 141 - }; 142 - dns_query = { 143 - condition = "dns_query_result_code != 0"; 144 - description = "{{$labels.domain}} : could retrieve A record {{$labels.instance}} from server {{$labels.server}}: {{$labels.result}}!"; 145 - }; 146 - secure_dns_query = { 147 - condition = "secure_dns_state != 0"; 148 - description = "{{$labels.domain}} : could retrieve A record {{$labels.instance}} from server {{$labels.server}}: {{$labels.result}} for protocol {{$labels.protocol}}!"; 149 - }; 150 - connection_failed = { 151 - condition = "net_response_result_code != 0"; 152 - description = "{{$labels.server}}: connection to {{$labels.port}}({{$labels.protocol}}) failed from {{$labels.instance}}"; 153 - }; 154 - healthchecks = { 155 - condition = "hc_check_up == 0"; 156 - description = "{{$labels.instance}}: healtcheck {{$labels.job}} fails!"; 157 - }; 158 - cert_expiry = { 159 - condition = "x509_cert_expiry < 7*24*3600"; 160 - description = "{{$labels.instance}}: The TLS certificate from {{$labels.source}} will expire in less than 7 days: {{$value}}s"; 161 - }; 162 - 163 - postfix_queue_length = { 164 - condition = "avg_over_time(postfix_queue_length[1h]) > 10"; 165 - description = "{{$labels.instance}}: postfix mail queue has undelivered {{$value}} items"; 166 - }; 167 - 168 - zfs_errors = { 169 - condition = "zfs_arcstats_l2_io_error + zfs_dmu_tx_error + zfs_arcstats_l2_writes_error > 0"; 170 - description = "{{$labels.instance}} reports: {{$value}} ZFS IO errors."; 171 - }; 172 - 173 - # ignore devices that disabled S.M.A.R.T (example if attached via USB) 174 - smart_errors = { 175 - condition = ''smart_device_health_ok{enabled!="Disabled"} != 1''; 176 - description = "{{$labels.instance}}: S.M.A.R.T reports: {{$labels.device}} ({{$labels.model}}) has errors."; 177 - }; 178 - 179 - oom_kills = { 180 - condition = "increase(kernel_vmstat_oom_kill[5m]) > 0"; 181 - description = "{{$labels.instance}}: OOM kill detected"; 182 - }; 183 - 184 - unusual_disk_read_latency = { 185 - condition = "rate(diskio_read_time[1m]) / rate(diskio_reads[1m]) > 0.1 and rate(diskio_reads[1m]) > 0"; 186 - description = "{{$labels.instance}}: Disk latency is growing (read operations > 100ms)\n"; 187 - }; 188 - 189 - unusual_disk_write_latency = { 190 - condition = "rate(diskio_write_time[1m]) / rate(diskio_write[1m]) > 0.1 and rate(diskio_write[1m]) > 0"; 191 - description = "{{$labels.instance}}: Disk latency is growing (write operations > 100ms)\n"; 192 - }; 193 - 194 - host_memory_under_memory_pressure = { 195 - condition = "rate(node_vmstat_pgmajfault[1m]) > 1000"; 196 - description = "{{$labels.instance}}: The node is under heavy memory pressure. High rate of major page faults: {{$value}}"; 197 - }; 198 - 199 - ext4_errors = { 200 - condition = "ext4_errors_value > 0"; 201 - description = "{{$labels.instance}}: ext4 has reported {{$value}} I/O errors: check /sys/fs/ext4/*/errors_count"; 202 - }; 203 - 204 - alerts_silences_changed = { 205 - condition = ''abs(delta(alertmanager_silences{state="active"}[1h])) >= 1''; 206 - description = "alertmanager: number of active silences has changed: {{$value}}"; 207 - }; 208 - })
-119
configs/monitoring/prometheus.nix
··· 1 - { lib, pkgs, ... }: 2 - { 3 - #prometheus 4 - krebs.iptables = { 5 - enable = true; 6 - tables.filter.INPUT.rules = [ 7 - { 8 - predicate = "-i retiolum -p tcp --dport 80"; 9 - target = "ACCEPT"; 10 - } # nginx 11 - # { predicate = "-i retiolum -p tcp --dport 3012"; target = "ACCEPT"; } # grafana 12 - # { predicate = "-i retiolum -p tcp --dport 9093"; target = "ACCEPT"; } # alertmanager 13 - # { predicate = "-i retiolum -p tcp --dport 9223"; target = "ACCEPT"; } # alertmanager 14 - ]; 15 - }; 16 - 17 - services.nginx = { 18 - enable = true; 19 - virtualHosts = { 20 - "prometheus.lass.r" = { 21 - locations."/".proxyPass = "http://localhost:9090"; 22 - }; 23 - "alert.lass.r" = { 24 - locations."/".proxyPass = "http://localhost:9093"; 25 - }; 26 - "grafana.lass.r" = { 27 - locations."/".proxyPass = "http://localhost:3012"; 28 - }; 29 - }; 30 - }; 31 - 32 - services.grafana = { 33 - enable = true; 34 - addr = "0.0.0.0"; 35 - port = 3012; 36 - auth.anonymous = { 37 - enable = true; 38 - org_role = "Admin"; 39 - }; 40 - }; 41 - services.prometheus = { 42 - enable = true; 43 - ruleFiles = [ 44 - (pkgs.writeText "prometheus-rules.yml" ( 45 - builtins.toJSON { 46 - groups = [ 47 - { 48 - name = "alerting-rules"; 49 - rules = import ./alert-rules.nix { inherit lib; }; 50 - } 51 - ]; 52 - } 53 - )) 54 - ]; 55 - scrapeConfigs = [ 56 - { 57 - job_name = "telegraf"; 58 - scrape_interval = "60s"; 59 - metrics_path = "/metrics"; 60 - static_configs = [ 61 - { 62 - targets = [ 63 - "neoprism.r:9273" 64 - "yellow.r:9273" 65 - ]; 66 - } 67 - ]; 68 - } 69 - ]; 70 - alertmanagers = [ 71 - { 72 - scheme = "http"; 73 - path_prefix = "/"; 74 - static_configs = [ { targets = [ "localhost:9093" ]; } ]; 75 - } 76 - ]; 77 - alertmanager = { 78 - enable = true; 79 - webExternalUrl = "https://alert.lass.r"; 80 - listenAddress = "[::1]"; 81 - configuration = { 82 - global = { 83 - # The smarthost and SMTP sender used for mail notifications. 84 - smtp_smarthost = "localhost:587"; 85 - smtp_from = "alertmanager@alert.lass.r"; 86 - # smtp_auth_username = "alertmanager@thalheim.io"; 87 - # smtp_auth_password = "$SMTP_PASSWORD"; 88 - }; 89 - route = { 90 - receiver = "default"; 91 - routes = [ 92 - { 93 - group_by = [ "host" ]; 94 - group_wait = "30s"; 95 - group_interval = "2m"; 96 - repeat_interval = "2h"; 97 - receiver = "all"; 98 - } 99 - ]; 100 - }; 101 - receivers = [ 102 - { 103 - name = "all"; 104 - webhook_configs = [ 105 - { 106 - url = "http://127.0.0.1:9223/"; 107 - max_alerts = 5; 108 - } 109 - ]; 110 - } 111 - { 112 - name = "default"; 113 - } 114 - ]; 115 - }; 116 - }; 117 - }; 118 - 119 - }
-20
configs/websites/domsen.nix
··· 1 - { 2 - lib, 3 - pkgs, 4 - ... 5 - }: 6 - 7 - let 8 - inherit (import ./util.nix { inherit lib pkgs; }) 9 - servePage 10 - ; 11 - in 12 - { 13 - imports = [ 14 - ./default.nix 15 - (servePage [ 16 - "illustra.de" 17 - "www.illustra.de" 18 - ]) 19 - ]; 20 - }
-12
configs/websites/flix.lassul.us.nix
··· 1 - { ... }: 2 - { 3 - services.nginx.virtualHosts."flix.lassul.us" = { 4 - forceSSL = true; 5 - enableACME = true; 6 - locations."/" = { 7 - proxyPass = "http://yellow.r:8096"; 8 - proxyWebsockets = true; 9 - recommendedProxySettings = true; 10 - }; 11 - }; 12 - }
-21
configs/websites/util.nix
··· 1 - { lib, ... }: 2 - 3 - with lib; 4 - 5 - { 6 - servePage = 7 - domains: 8 - let 9 - domain = head domains; 10 - in 11 - { 12 - services.nginx.virtualHosts.${domain} = { 13 - enableACME = true; 14 - addSSL = true; 15 - serverAliases = domains; 16 - locations."/".extraConfig = '' 17 - root /srv/http/${domain}; 18 - ''; 19 - }; 20 - }; 21 - }
-20
configs/weron/client.nix
··· 1 - { pkgs, ... }: 2 - { 3 - systemd.services.weron = { 4 - wantedBy = [ "multi-user.target" ]; 5 - environment = { 6 - WERON_RADDR = "ws://lassul.us:23420/"; 7 - }; 8 - serviceConfig = { 9 - ExecStart = pkgs.writers.writeDash "weron" '' 10 - ${pkgs.weron}/bin/weron vpn ip \ 11 - --community krebs \ 12 - --password aidsballs \ 13 - --key aidsballs \ 14 - --ips 10.249.1.0/24 \ 15 - --verbose 7 \ 16 - --dev weron 17 - ''; 18 - }; 19 - }; 20 - }
-2
machines/aergia/config.nix
··· 10 10 ../../configs/yellow-mounts/samba.nix 11 11 ../../configs/pass.nix 12 12 ../../configs/mail.nix 13 - # ../../configs/bitcoin.nix 14 13 # ../../configs/review.nix 15 14 # ../../configs/dunst.nix 16 15 ../../configs/br.nix 17 - # ../../configs/c-base.nix 18 16 ]; 19 17 20 18 system.stateVersion = "22.11";
-1
machines/aergia/physical.nix
··· 3 3 imports = [ 4 4 ./config.nix 5 5 (modulesPath + "/installer/scan/not-detected.nix") 6 - # ../../configs/antimicrox 7 6 ./disk.nix 8 7 ]; 9 8
-2
machines/ignavia/config.nix
··· 30 30 ../../configs/mail.nix 31 31 ../../configs/printing 32 32 ../../configs/auto-timezone.nix 33 - # ../../configs/bitcoin.nix 34 33 ../../configs/review.nix 35 34 ../../configs/dunst.nix 36 35 ../../configs/yggdrasil.nix ··· 39 38 ../../configs/herdr.nix 40 39 ../../configs/tablet-screen.nix 41 40 # ../../configs/br.nix 42 - # ../../configs/c-base.nix 43 41 ]; 44 42 45 43 system.stateVersion = "23.11";
-3
machines/neoprism/config.nix
··· 86 86 # realwallpaper generator 87 87 ../../configs/realwallpaper.nix 88 88 89 - # binaergewitter announce bot 90 - # ../../configs/bgt-bot 91 - 92 89 # paste + cyberlocker 93 90 ../../configs/paste.nix 94 91
configs/tests/dummy-secrets/cbase.txt
-1
configs/tests/dummy-secrets/icecast-admin-pw
··· 1 - "blabla"
-1
configs/tests/dummy-secrets/icecast-source-pw
··· 1 - "blabla"
-3
configs/tests/dummy-secrets/lassul.us.dkim.priv
··· 1 - -----BEGIN RSA PRIVATE KEY----- 2 - this is a private key 3 - -----END RSA PRIVATE KEY-----
-1
configs/tests/dummy-secrets/mysql_rootPassword
··· 1 - blabla123
-1
configs/tests/dummy-secrets/nix-serve.key
··· 1 - key-name:blabla123
configs/tests/dummy-secrets/nordvpn.txt
-4
configs/tests/dummy-secrets/retiolum.rsa_key.priv
··· 1 - 2 - -----BEGIN RSA PRIVATE KEY----- 3 - this is a private key 4 - -----END RSA PRIVATE KEY-----
-1
configs/tests/dummy-secrets/searx.key
··· 1 - yolo
configs/tests/dummy-secrets/ssh-tor.priv
-3
configs/tests/dummy-secrets/ssh.id_ed25519
··· 1 - -----BEGIN OPENSSH PRIVATE KEY----- 2 - private key bla 3 - -----END OPENSSH PRIVATE KEY-----
-3
configs/tests/dummy-secrets/ssh.id_rsa
··· 1 - -----BEGIN RSA PRIVATE KEY----- 2 - private key bla 3 - -----END RSA PRIVATE KEY-----
configs/tests/dummy-secrets/syncthing.cert
configs/tests/dummy-secrets/syncthing.key
-3
configs/tests/dummy-secrets/torrent-auth
··· 1 - { 2 - x = "xxx"; 3 - }
-1
configs/tests/dummy-secrets/transmission-pw
··· 1 - "krebskrebs123"
configs/tests/dummy-secrets/initrd/ssh.ed25519_key