Omega-Relay host replacement for Ubuntu VM on Feox

* Add omega-relay prototype host

* Add omega-relay prototype host

* Inital commit for working omega-relay host.

This commit includes:
- Mysql module from umbriel
- Disko configuration for the Ferox VM
- Freshrss module
- Stalwart module
- Vaultwarden module
- Wakapi module
- Uptime Kuma module
- Support for using mysql socket
- Server user that does not depend on full home-manager preset.
- ACME for wilkuu.xyz domains, including all the services.

* Nix fmt

* Fixes in secrets and services.

Mostly fixes connection to mysql and the unix-socket auth for it.

* Little fixes and update

* Format and do fixes

* Update secrets and keys for omega-relay

* Apply changes from messing around and making things work

5 files changed, 396 insertions, 0 deletions

diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
new file mode 100644
index 0000000..3c7272c
--- /dev/null
+++ b/hosts/omega-relay/default.nix
@@ -0,0 +1,139 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  imports = [
+    ./firewall.nix
+    ./disko.nix
+    ./vm.nix
+    ./hardware-configuration.nix
+    ../../services/mysql.nix
+    ../../services/email.nix
+    ../../services/vaultwarden.nix
+    ../../services/uptimekuma.nix
+    ../../services/freshrss.nix
+    ../../services/wakapi.nix
+  ];
+
+  addons = {
+    desktop.hyprland.enable = lib.mkForce false;
+    # desktop.cosmic.enable = lib.mkForce false;
+    desktop.xfce.enable = lib.mkForce false;
+
+    gpg.enable = true;
+    virtualisation.guest = true; 
+  };
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+  };
+
+
+  environment.systemPackages = with pkgs; [
+    lynx
+    chawan
+  ];
+
+  wilkuu.services =
+    let
+      isVM = config.addons.virtualisation.isTestVM;
+    in
+    {
+      stalwart = {
+        enable = true;
+        domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
+        doACME = !isVM;
+      };
+
+      vaultwarden = {
+        enable = true;
+        signupWhitelist = [
+          "wilkuu.xyz"
+          "omega-relay.local"
+        ];
+        backupDir = "/srv/data/vaultwarden";
+        domain = if isVM then "bitwarden.omega-relay.local" else "bitwarden.wilkuu.xyz";
+        doACME = !isVM;
+      };
+      uptimekuma = {
+        enable = true;
+        domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz";
+        dataDir = "/srv/data/uptimekuma";
+        doACME = !isVM;
+      };
+      freshrss = {
+        enable = true;
+        domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz";
+        doACME = !isVM;
+      };
+      wakapi = {
+        enable = false;
+        domain = if isVM then "wakapi.omega-relay.local" else "wakapi.wilkuu.xyz";
+        doACME = !isVM;
+      };
+    };
+
+  services.fail2ban = {
+    enable = true; 
+    maxretry = 5;
+    ignoreIP = [
+      "192.168.80.0/24" 
+      "192.168.80.0/24"
+    ]; 
+    bantime = "24h"; 
+    bantime-increment = {
+      enable = true; # Enable increment of bantime after each violation
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+      # multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h"; # Do not ban for more than 1 week
+      overalljails = true; # Calculate the bantime based on all the violations
+    }; 
+  };
+	
+  # TODO: Make a nginx module
+  security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) {
+    acceptTerms = true;
+    defaults.email = "jstachurski9991@gmail.com";
+  };
+  services.nginx =
+    let
+      isVM = config.addons.virtualisation.isTestVM;
+      domain = if isVM then "omega-relay.local" else "wilkuu.xyz";
+    in
+    {
+      enable = true;
+      virtualHosts."${domain}" = {
+        enableACME = !isVM;
+        addSSL = !isVM;
+        root = "/srv/www/wilkuu.xyz/";
+	locations."/" = {
+		index = "index.html";
+		tryFiles = "$uri $uri/ =404";
+	};
+      };
+    };
+
+  networking.hostName = "omega-relay";
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+  };
+
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    openFirewall = true;
+    allowSFTP = true;
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = [ "wilkuu" ];
+      X11Forwarding = false;
+      PermitRootLogin = "no";
+      PrintMotd = true;
+    };
+  };
+
+}
diff --git a/hosts/omega-relay/disko.nix b/hosts/omega-relay/disko.nix
new file mode 100644
index 0000000..2de6943
--- /dev/null
+++ b/hosts/omega-relay/disko.nix
@@ -0,0 +1,70 @@
+{ config, lib, ... }:
+let
+  cfg = config.hosts.omega-relay;
+in
+{
+  options.hosts.omega-relay = with lib; {
+    root_device = mkOption {
+      type = types.path;
+      default = "/dev/sda";
+      example = "/dev/sda";
+      description = "Root device for disko and grub";
+    };
+
+    do_disko = mkOption {
+      type = types.bool;
+      default = !config.addons.virtualisation.isTestVM;
+      description = "Whenever to do disko or not.";
+    };
+  };
+  config = lib.mkIf (cfg.do_disko) ({
+    services.btrfs.autoScrub = {
+      enable = true;
+      interval = "weekly";
+    };
+
+    boot.loader.grub.device = cfg.root_device;
+    # Workaround
+    boot.loader.grub.devices = lib.mkForce [ cfg.root_device ];
+    boot.loader.efi.canTouchEfiVariables = false;
+
+    # TODO: Mount points
+
+    # Disko for formatting
+    disko.devices = {
+      disk = {
+        main-disk = {
+          device = cfg.root_device;
+          type = "disk";
+          content = {
+            type = "gpt";
+            partitions = {
+              BOOT = {
+                type = "EF02";
+                size = "1M";
+              };
+              ESP = {
+                type = "EF00";
+                size = "128M";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                  mountOptions = [ "umask=0077" ];
+                };
+              };
+              root = {
+                size = "100%";
+                content = {
+                  type = "filesystem";
+                  format = "btrfs";
+                  mountpoint = "/";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  });
+}
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
new file mode 100644
index 0000000..c90a903
--- /dev/null
+++ b/hosts/omega-relay/firewall.nix
@@ -0,0 +1,120 @@
+{ config, lib, pkgs, ... }:
+let
+  wgHomePort = 16888;
+  baseTCP = [
+    20
+    22
+    25
+    80
+    143
+    443
+    993
+    465
+  ];
+  baseUDP = [
+    wgHomePort # Wireguard
+  ];
+  baseTCPRanges = [
+  ];
+
+  baseUDPRanges = [
+  ];
+
+  secureTCP = [
+    # config.wilkuu.services.mysql.port
+  ];
+
+  secureUDP = [
+  ];
+
+  secureTCPRanges = [
+  ];
+
+  secureUDPRanges = [
+  ];
+in
+{
+  sops.secrets = let 
+	secrets = [
+	  "wg/home/privateKey" 
+	  "wg/home/chrono/PSK" 
+	  "wg/home/chrono/PK" 
+	  "wg/home/chrono/endpoint" 
+	];  
+  in lib.genAttrs secrets (name: {
+	sopsFile = ../../secrets/${config.networking.hostName}/wireguard.yaml;
+	key = lib.removePrefix "wg/" name; 
+  });
+
+  networking.wireguard = {
+	enable = true; 
+	useNetworkd = true; 
+	interfaces = {
+	  wg-home = {
+	    ips = ["192.168.80.100/24"]; 
+	    extraOptions = {
+		DNS = "192.168.88.1"; 
+	    };
+	    privateKeyFile = config.sops.secrets."wg/home/privateKey".path; 
+	    listenPort = wgHomePort;
+	    dynamicEndpointRefreshSeconds = 45;
+	    
+	    peers = [
+	      {
+	        allowedIPs = ["192.168.88.0/24" "192.168.80.0/24"]; 
+		presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
+		publicKey  = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk="; 
+	    	# endpoint       = "45.138.54.155:16556";
+	    	endpoint       = "wilkuu.duckdns.org:16556";
+		name = "wg-home-chronosphere"; 
+
+	      } 
+	    ]; 
+	  }; 
+	};
+  }; 
+  systemd.network.networks."40-wg-home".dns = ["192.168.88.1"];
+  systemd.network.enable = true;
+  systemd.network.networks."10-uplink" = {
+    matchConfig.Name = "ens18";
+    # TODO: Cloudinit
+    address = ["45.136.141.133/26" "2a12:bec0:650:128::133/64"];   
+    gateway = ["45.136.141.129"    "2a12:bec0:650:128::"];
+    dns     = ["1.1.1.1"           "2606:4700:4700:0000:0000:0000:0000:1002"];
+    linkConfig.RequiredForOnline="yes";
+  };
+  systemd.network.networks."99-fallback" = {
+    matchConfig.Type = "ether";
+    networkConfig.DHCP = "ipv4";
+    linkConfig.RequiredForOnline="routable";
+  };
+
+  networking.useDHCP = false;
+  networking.useNetworkd = true;
+  networking.nftables.enable = true;
+  networking.firewall = {
+    enable = true;
+    checkReversePath = false;
+    allowedTCPPorts = baseTCP;
+    allowedUDPPorts = baseUDP;
+    allowedUDPPortRanges = baseUDPRanges;
+    allowedTCPPortRanges = baseTCPRanges;
+    interfaces = {
+      "wg-home" = {
+        allowedTCPPorts = secureTCP;
+        allowedUDPPorts = secureUDP;
+        allowedUDPPortRanges = secureUDPRanges;
+        allowedTCPPortRanges = secureTCPRanges;
+      };
+    };
+    trustedInterfaces = [
+      "docker0"
+      "br-*"
+      "veth*"
+      "vnet*"
+      "virbr*"
+      "lo"
+    ];
+
+  };
+}
diff --git a/hosts/omega-relay/hardware-configuration.nix b/hosts/omega-relay/hardware-configuration.nix
new file mode 100644
index 0000000..aaf9d00
--- /dev/null
+++ b/hosts/omega-relay/hardware-configuration.nix
@@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/hosts/omega-relay/vm.nix b/hosts/omega-relay/vm.nix
new file mode 100644
index 0000000..6672949
--- /dev/null
+++ b/hosts/omega-relay/vm.nix
@@ -0,0 +1,43 @@
+{ ... }:
+let
+  forward = proto: gport: hport: {
+    from = "host";
+    proto = proto;
+    host = {
+      port = hport;
+      # address = "10.0.69.1";
+    };
+    guest = {
+      port = gport;
+      # address = "10.0.69.2";
+    };
+  };
+in
+{
+  # TODO: Make this into a more global module.
+  virtualisation.vmVariant = {
+    addons.virtualisation.isTestVM = true;
+    addons.virtualisation.guest = true;
+    fileSystems."/" = {
+      device = "none";
+      fsType = "tmpfs";
+      options = [
+        "defaults"
+        "size=2G"
+        "mode=755"
+      ];
+    };
+    virtualisation = {
+      forwardPorts = [
+        (forward "tcp" 80 9080)
+        (forward "tcp" 443 9443)
+        (forward "tcp" 143 9143)
+        (forward "tcp" 25 9025)
+        (forward "tcp" 22 9022)
+      ];
+      memorySize = 2048; # Use 2048MiB memory.
+      cores = 3;
+      graphics = false;
+    };
+  };
+}