Apply changes from messing around and making things work

2 files changed, 80 insertions, 17 deletions

diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 2235a04..3c7272c 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -24,12 +24,14 @@
     desktop.xfce.enable = lib.mkForce false;
 
     gpg.enable = true;
+    virtualisation.guest = true; 
   };
   boot.loader.grub = {
     enable = true;
     efiSupport = false;
   };
 
+
   environment.systemPackages = with pkgs; [
     lynx
     chawan
@@ -41,29 +43,29 @@
     in
     {
       stalwart = {
-        enable = false;
+        enable = true;
         domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
         doACME = !isVM;
       };
 
       vaultwarden = {
-        enable = false;
+        enable = true;
         signupWhitelist = [
           "wilkuu.xyz"
           "omega-relay.local"
         ];
         backupDir = "/srv/data/vaultwarden";
-        domain = if isVM then "vaultwarden.omega-relay.local" else "vaultwarden.wilkuu.xyz";
+        domain = if isVM then "bitwarden.omega-relay.local" else "bitwarden.wilkuu.xyz";
         doACME = !isVM;
       };
       uptimekuma = {
-        enable = false;
+        enable = true;
         domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz";
         dataDir = "/srv/data/uptimekuma";
         doACME = !isVM;
       };
       freshrss = {
-        enable = false;
+        enable = true;
         domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz";
         doACME = !isVM;
       };
@@ -74,10 +76,27 @@
       };
     };
 
+  services.fail2ban = {
+    enable = true; 
+    maxretry = 5;
+    ignoreIP = [
+      "192.168.80.0/24" 
+      "192.168.80.0/24"
+    ]; 
+    bantime = "24h"; 
+    bantime-increment = {
+      enable = true; # Enable increment of bantime after each violation
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+      # multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h"; # Do not ban for more than 1 week
+      overalljails = true; # Calculate the bantime based on all the violations
+    }; 
+  };
+	
   # TODO: Make a nginx module
   security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) {
     acceptTerms = true;
-    defaults.email = "jakub@wilkuu.xyz";
+    defaults.email = "jstachurski9991@gmail.com";
   };
   services.nginx =
     let
@@ -89,11 +108,11 @@
       virtualHosts."${domain}" = {
         enableACME = !isVM;
         addSSL = !isVM;
-        locations."/" = {
-          root = "/srv/www/wilkuu.xyz/";
-          index = "index.html";
-          tryFiles = "$uri $uri/ =404";
-        };
+        root = "/srv/www/wilkuu.xyz/";
+	locations."/" = {
+		index = "index.html";
+		tryFiles = "$uri $uri/ =404";
+	};
       };
     };
 
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index 15a96b6..c90a903 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,5 +1,6 @@
-{ ... }:
+{ config, lib, pkgs, ... }:
 let
+  wgHomePort = 16888;
   baseTCP = [
     20
     22
@@ -11,7 +12,7 @@ let
     465
   ];
   baseUDP = [
-    16555 # Wireguard
+    wgHomePort # Wireguard
   ];
   baseTCPRanges = [
   ];
@@ -33,17 +34,60 @@ let
   ];
 in
 {
+  sops.secrets = let 
+	secrets = [
+	  "wg/home/privateKey" 
+	  "wg/home/chrono/PSK" 
+	  "wg/home/chrono/PK" 
+	  "wg/home/chrono/endpoint" 
+	];  
+  in lib.genAttrs secrets (name: {
+	sopsFile = ../../secrets/${config.networking.hostName}/wireguard.yaml;
+	key = lib.removePrefix "wg/" name; 
+  });
+
+  networking.wireguard = {
+	enable = true; 
+	useNetworkd = true; 
+	interfaces = {
+	  wg-home = {
+	    ips = ["192.168.80.100/24"]; 
+	    extraOptions = {
+		DNS = "192.168.88.1"; 
+	    };
+	    privateKeyFile = config.sops.secrets."wg/home/privateKey".path; 
+	    listenPort = wgHomePort;
+	    dynamicEndpointRefreshSeconds = 45;
+	    
+	    peers = [
+	      {
+	        allowedIPs = ["192.168.88.0/24" "192.168.80.0/24"]; 
+		presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
+		publicKey  = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk="; 
+	    	# endpoint       = "45.138.54.155:16556";
+	    	endpoint       = "wilkuu.duckdns.org:16556";
+		name = "wg-home-chronosphere"; 
+
+	      } 
+	    ]; 
+	  }; 
+	};
+  }; 
+  systemd.network.networks."40-wg-home".dns = ["192.168.88.1"];
   systemd.network.enable = true;
   systemd.network.networks."10-uplink" = {
-    matchConfig.Name = "eth*";
-    networkConfig.DHCP = "ipv4";
-    linkConfig.RequiredForOnline="routable";
+    matchConfig.Name = "ens18";
+    # TODO: Cloudinit
+    address = ["45.136.141.133/26" "2a12:bec0:650:128::133/64"];   
+    gateway = ["45.136.141.129"    "2a12:bec0:650:128::"];
+    dns     = ["1.1.1.1"           "2606:4700:4700:0000:0000:0000:0000:1002"];
+    linkConfig.RequiredForOnline="yes";
   };
   systemd.network.networks."99-fallback" = {
     matchConfig.Type = "ether";
     networkConfig.DHCP = "ipv4";
     linkConfig.RequiredForOnline="routable";
-  }
+  };
 
   networking.useDHCP = false;
   networking.useNetworkd = true;