superconfig/machines/neoprism/ at 037fe68771a38cb6efed1335be3bb16a57292764 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at 037fe68771a38cb6efed1335be3bb16a57292764

lassulus configs: replace krebs.iptables with the nftables firewall 15d ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

neoprism: host timeful on when.lassul.us Availability polls (formerly schej), patched to drop ads/tracking/paywall and to sign in via GitHub OAuth.

2 weeks ago

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

2 weeks ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

machines.neoprism: add facter.json

2 years ago

neoprism: drop ollama, stage riot VM on bridged dedicated IP ollama is no longer used here; removing it frees ~4G. Prepare a fresh libvirt guest for riot on a dedicated public IP (95.217.192.52, separate MAC) bridged directly onto ext-br. Because the bridge is unmanaged, libvirt installs no iptables rules for it, avoiding the nat-chain race that forced the old restart-iptables hack in hfos.nix. - physical.nix: enable the ext-br bridge, enslave enp35s0, host IP on bridge - config.nix: enable libvirtd, add riot login user, FORWARD accept for the VM IP Bridge cutover applies at the next reboot window; the VM is created imperatively afterwards. Assisted-by: Claude Code (claude-opus-4-8[1m])

4 months ago