superconfig/machines/neoprism/ at 38937c4fef397a054b273515624e988dd7994138 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at 38937c4fef397a054b273515624e988dd7994138

lassulus configs.kartei: drop krebs.users 13d ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

neoprism: host timeful on when.lassul.us Availability polls (formerly schej), patched to drop ads/tracking/paywall and to sign in via GitHub OAuth.

2 weeks ago

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

1 week ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

machines.neoprism: add facter.json

2 years ago

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

1 week ago