summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--hosts/omega-relay/default.nix23
-rw-r--r--hosts/omega-relay/firewall.nix100
-rw-r--r--hosts/omega-relay/hardware-configuration.nix18
-rw-r--r--services/email.nix64
-rw-r--r--services/freshrss.nix2
-rw-r--r--services/mysql.nix12
-rw-r--r--services/uptimekuma.nix10
-rw-r--r--users/wilkuu-server.nix5
8 files changed, 136 insertions, 98 deletions
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 3c7272c..95e03e4 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -24,14 +24,13 @@
desktop.xfce.enable = lib.mkForce false;
gpg.enable = true;
- virtualisation.guest = true;
+ virtualisation.guest = true;
};
boot.loader.grub = {
enable = true;
efiSupport = false;
};
-
environment.systemPackages = with pkgs; [
lynx
chawan
@@ -77,22 +76,22 @@
};
services.fail2ban = {
- enable = true;
+ enable = true;
maxretry = 5;
ignoreIP = [
- "192.168.80.0/24"
"192.168.80.0/24"
- ];
- bantime = "24h";
+ "192.168.80.0/24"
+ ];
+ bantime = "24h";
bantime-increment = {
enable = true; # Enable increment of bantime after each violation
formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
# multipliers = "1 2 4 8 16 32 64";
maxtime = "168h"; # Do not ban for more than 1 week
overalljails = true; # Calculate the bantime based on all the violations
- };
+ };
};
-
+
# TODO: Make a nginx module
security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) {
acceptTerms = true;
@@ -109,10 +108,10 @@
enableACME = !isVM;
addSSL = !isVM;
root = "/srv/www/wilkuu.xyz/";
- locations."/" = {
- index = "index.html";
- tryFiles = "$uri $uri/ =404";
- };
+ locations."/" = {
+ index = "index.html";
+ tryFiles = "$uri $uri/ =404";
+ };
};
};
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index c90a903..086a86e 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
let
wgHomePort = 16888;
baseTCP = [
@@ -34,59 +34,73 @@ let
];
in
{
- sops.secrets = let
- secrets = [
- "wg/home/privateKey"
- "wg/home/chrono/PSK"
- "wg/home/chrono/PK"
- "wg/home/chrono/endpoint"
- ];
- in lib.genAttrs secrets (name: {
- sopsFile = ../../secrets/${config.networking.hostName}/wireguard.yaml;
- key = lib.removePrefix "wg/" name;
- });
+ sops.secrets =
+ let
+ secrets = [
+ "wg/home/privateKey"
+ "wg/home/chrono/PSK"
+ "wg/home/chrono/PK"
+ "wg/home/chrono/endpoint"
+ ];
+ in
+ lib.genAttrs secrets (name: {
+ sopsFile = ../../secrets/${config.networking.hostName}/wireguard.yaml;
+ key = lib.removePrefix "wg/" name;
+ });
networking.wireguard = {
- enable = true;
- useNetworkd = true;
- interfaces = {
- wg-home = {
- ips = ["192.168.80.100/24"];
- extraOptions = {
- DNS = "192.168.88.1";
- };
- privateKeyFile = config.sops.secrets."wg/home/privateKey".path;
- listenPort = wgHomePort;
- dynamicEndpointRefreshSeconds = 45;
-
- peers = [
- {
- allowedIPs = ["192.168.88.0/24" "192.168.80.0/24"];
- presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
- publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk=";
- # endpoint = "45.138.54.155:16556";
- endpoint = "wilkuu.duckdns.org:16556";
- name = "wg-home-chronosphere";
+ enable = true;
+ useNetworkd = true;
+ interfaces = {
+ wg-home = {
+ ips = [ "192.168.80.100/24" ];
+ extraOptions = {
+ DNS = "192.168.88.1";
+ };
+ privateKeyFile = config.sops.secrets."wg/home/privateKey".path;
+ listenPort = wgHomePort;
+ dynamicEndpointRefreshSeconds = 45;
+
+ peers = [
+ {
+ allowedIPs = [
+ "192.168.88.0/24"
+ "192.168.80.0/24"
+ ];
+ presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
+ publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk=";
+ # endpoint = "45.138.54.155:16556";
+ endpoint = "wilkuu.duckdns.org:16556";
+ name = "wg-home-chronosphere";
- }
- ];
- };
- };
- };
- systemd.network.networks."40-wg-home".dns = ["192.168.88.1"];
+ }
+ ];
+ };
+ };
+ };
+ systemd.network.networks."40-wg-home".dns = [ "192.168.88.1" ];
systemd.network.enable = true;
systemd.network.networks."10-uplink" = {
matchConfig.Name = "ens18";
# TODO: Cloudinit
- address = ["45.136.141.133/26" "2a12:bec0:650:128::133/64"];
- gateway = ["45.136.141.129" "2a12:bec0:650:128::"];
- dns = ["1.1.1.1" "2606:4700:4700:0000:0000:0000:0000:1002"];
- linkConfig.RequiredForOnline="yes";
+ address = [
+ "45.136.141.133/26"
+ "2a12:bec0:650:128::133/64"
+ ];
+ gateway = [
+ "45.136.141.129"
+ "2a12:bec0:650:128::"
+ ];
+ dns = [
+ "1.1.1.1"
+ "2606:4700:4700:0000:0000:0000:0000:1002"
+ ];
+ linkConfig.RequiredForOnline = "yes";
};
systemd.network.networks."99-fallback" = {
matchConfig.Type = "ether";
networkConfig.DHCP = "ipv4";
- linkConfig.RequiredForOnline="routable";
+ linkConfig.RequiredForOnline = "routable";
};
networking.useDHCP = false;
diff --git a/hosts/omega-relay/hardware-configuration.nix b/hosts/omega-relay/hardware-configuration.nix
index aaf9d00..cb7c84c 100644
--- a/hosts/omega-relay/hardware-configuration.nix
+++ b/hosts/omega-relay/hardware-configuration.nix
@@ -1,14 +1,22 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:
{
- imports =
- [ (modulesPath + "/profiles/qemu-guest.nix")
- ];
+ imports = [
+ (modulesPath + "/profiles/qemu-guest.nix")
+ ];
- boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+ boot.initrd.availableKernelModules = [
+ "uhci_hcd"
+ "ehci_pci"
+ "ahci"
+ "virtio_pci"
+ "virtio_scsi"
+ "sd_mod"
+ "sr_mod"
+ ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
diff --git a/services/email.nix b/services/email.nix
index 906b44d..3f7cb9f 100644
--- a/services/email.nix
+++ b/services/email.nix
@@ -93,28 +93,40 @@ in
uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME
));
})
- )) //
- { ${cfg.domain} = {
- addSSL = cfg.doACME;
- enableACME = cfg.doACME;
- serverName = "${cfg.domain}";
- locations."/" = {
- proxyPass = "http://localhost:3080";
- recommendedProxySettings = true;
- };
- };};
+ ))
+ // {
+ ${cfg.domain} = {
+ addSSL = cfg.doACME;
+ enableACME = cfg.doACME;
+ serverName = "${cfg.domain}";
+ locations."/" = {
+ proxyPass = "http://localhost:3080";
+ recommendedProxySettings = true;
+ };
+ };
+ };
services.stalwart = {
enable = true;
dataDir = cfg.dataDir;
openFirewall = false;
- credentials = (lib.genAttrs secrets toCredfilePath) // (let
- acme_dir = config.security.acme.certs.${cfg.domain}.directory;
- cert_path = file: "${acme_dir}/${file}";
- in (if cfg.doACME then {
- "tls_cert.pem" = cert_path "cert.pem";
- "tls_key.pem" = cert_path "key.pem";
- } else {}));
+ credentials =
+ (lib.genAttrs secrets toCredfilePath)
+ // (
+ let
+ acme_dir = config.security.acme.certs.${cfg.domain}.directory;
+ cert_path = file: "${acme_dir}/${file}";
+ in
+ (
+ if cfg.doACME then
+ {
+ "tls_cert.pem" = cert_path "cert.pem";
+ "tls_key.pem" = cert_path "key.pem";
+ }
+ else
+ { }
+ )
+ );
settings = {
server.listener = {
@@ -156,17 +168,17 @@ in
url = "protocol + \"://${cfg.domain}\"";
};
- session.connect = {
- hostname = "config_get('server.hostname')";
- };
+ session.connect = {
+ hostname = "config_get('server.hostname')";
+ };
- server.hostname = "${cfg.domain}";
+ server.hostname = "${cfg.domain}";
- certificate."nix_${cfg.domain}" = lib.mkIf cfg.doACME {
- cert = toStalwartCred "tls_cert.pem";
- private-key = toStalwartCred "tls_key.pem";
- default = true;
- };
+ certificate."nix_${cfg.domain}" = lib.mkIf cfg.doACME {
+ cert = toStalwartCred "tls_cert.pem";
+ private-key = toStalwartCred "tls_key.pem";
+ default = true;
+ };
};
};
}
diff --git a/services/freshrss.nix b/services/freshrss.nix
index 26a1853..fb20ce8 100644
--- a/services/freshrss.nix
+++ b/services/freshrss.nix
@@ -59,7 +59,7 @@ in
enable = true;
users."freshrss" = {
sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
- host = "localhost";
+ host = "localhost";
};
databases."freshrss" = {
enable = true;
diff --git a/services/mysql.nix b/services/mysql.nix
index 06edfcb..1c0a785 100644
--- a/services/mysql.nix
+++ b/services/mysql.nix
@@ -26,7 +26,9 @@ let
ALTER USER IF EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}';
CREATE USER IF NOT EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}';
''
- + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'${ucfg.host}'") (create_users_ensure name))
+ + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'${ucfg.host}'") (
+ create_users_ensure name
+ ))
)
else
" -- Ommitted user ${name}";
@@ -84,10 +86,10 @@ in
allowedRanges = mkOption {
type = types.listOf types.str;
};
- host = mkOption {
- type = types.str;
- default = "%";
- };
+ host = mkOption {
+ type = types.str;
+ default = "%";
+ };
};
}
);
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
index 720040d..f35b469 100644
--- a/services/uptimekuma.nix
+++ b/services/uptimekuma.nix
@@ -67,12 +67,12 @@ in
services.uptime-kuma = {
enable = true;
settings = {
- UPTIME_KUMA_PORT = "3111";
- UPTIME_KUMA_HOST = "127.0.0.1";
- UPTIME_KUMA_DB_TYPE = "sqlite";
+ UPTIME_KUMA_PORT = "3111";
+ UPTIME_KUMA_HOST = "127.0.0.1";
+ UPTIME_KUMA_DB_TYPE = "sqlite";
#UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
- #UPTIME_KUMA_DB_USERNAME = config.systemd.services.uptime-kuma.serviceConfig.User;
- #UPTIME_KUMA_DB_NAME = "uptimekuma";
+ #UPTIME_KUMA_DB_USERNAME = config.systemd.services.uptime-kuma.serviceConfig.User;
+ #UPTIME_KUMA_DB_NAME = "uptimekuma";
};
};
});
diff --git a/users/wilkuu-server.nix b/users/wilkuu-server.nix
index b982ddf..c1bbc92 100644
--- a/users/wilkuu-server.nix
+++ b/users/wilkuu-server.nix
@@ -8,7 +8,10 @@
programs.zsh.enable = true;
users.users.wilkuu = {
shell = pkgs.zsh;
- openssh.authorizedKeys.keyFiles = [ ../certs/wilkuu_rsa.pub ../certs/pi_ed25519.pub];
+ openssh.authorizedKeys.keyFiles = [
+ ../certs/wilkuu_rsa.pub
+ ../certs/pi_ed25519.pub
+ ];
isNormalUser = true;
initialPassword = "PleazeChangeThis123";
extraGroups = [
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-10 23:20:50 +0000