diff options
| -rw-r--r-- | description | 2 | ||||
| -rw-r--r-- | flake.lock | 30 | ||||
| -rw-r--r-- | hosts/omega-relay/default.nix | 46 | ||||
| -rw-r--r-- | inventory.nix | 2 | ||||
| -rw-r--r-- | services/cgit.nix | 62 |
5 files changed, 93 insertions, 49 deletions
diff --git a/description b/description deleted file mode 100644 index 8de9d74..0000000 --- a/description +++ /dev/null @@ -1,2 +0,0 @@ -nix-config -Nix confuration for my systems @@ -28,11 +28,11 @@ ] }, "locked": { - "lastModified": 1785496534, - "narHash": "sha256-EASdusMYLuPhOCrE3LmsAGOvGhX3vnKBLxFvj9lI8tU=", + "lastModified": 1786356609, + "narHash": "sha256-ou8fYz5w9yhXC8YbvvExybFIa19MyW5G/8dEPqa90hM=", "owner": "nix-community", "repo": "home-manager", - "rev": "e8827fbbb12015a8dd9f66285aec79d655bcb9f6", + "rev": "c30c7955cec30d664a9baced6bc0112e263d4647", "type": "github" }, "original": { @@ -43,11 +43,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1785454630, - "narHash": "sha256-LQy14TZp77TwbQf40gg1V3jo8FwJG0jGDkAH+zRHqg8=", + "lastModified": 1786106723, + "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746", + "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238", "type": "github" }, "original": { @@ -59,11 +59,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1785386831, - "narHash": "sha256-sPS3CaXH8RAT3FZRuy4VcV47iuYIWMMfa0GbyJKC3o4=", + "lastModified": 1786313170, + "narHash": "sha256-9BG7OgUWdu0ONDO5X2q6+K4bsuBITkX/3W4nNJu1Ito=", "owner": "nixos", "repo": "nixpkgs", - "rev": "21ea275a7c46aef9d4d6ddc962e6d562e9d94183", + "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d", "type": "github" }, "original": { @@ -107,11 +107,11 @@ ] }, "locked": { - "lastModified": 1783174389, - "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", + "lastModified": 1786375908, + "narHash": "sha256-G7qDAT98nywA4EFmJCwIRO5wKvDlBBN3BWpsOnjAto8=", "owner": "Mic92", "repo": "sops-nix", - "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", + "rev": "d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4", "type": "github" }, "original": { @@ -164,11 +164,11 @@ ] }, "locked": { - "lastModified": 1785360170, - "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", + "lastModified": 1785945821, + "narHash": "sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", + "rev": "ae7910970dddc408fe6ab1c8e4b277bb21d72dc0", "type": "github" }, "original": { diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 542b843..4d89763 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -54,7 +54,7 @@ { prometheus.enableExporters = true; cgit = { - enable = true; + enable = true; domain = "git.wilkuu.nl"; }; desecDyn = { @@ -153,6 +153,21 @@ maxtime = "168h"; # Do not ban for more than 1 week overalljails = true; # Calculate the bantime based on all the violations }; + jails = { + nginx-http-auth = '' + enabled = true + filter = nginx-http-auth + logpath = /var/log/nginx/error.log + maxretry = 5 + ''; + + nginx-badbots = '' + enabled = true + filter = nginx-badbots + logpath = /var/log/nginx/access.log + maxretry = 2 + ''; + }; }; virtualisation = { @@ -170,6 +185,7 @@ domain = if isVM then "omega-relay.local" else "wilkuu.xyz"; in { + statusPage = true; enable = true; virtualHosts."${domain}" = { enableACME = !isVM; @@ -265,9 +281,31 @@ }; }; - services.prometheus.exporters.unbound = { - enable = true; - + services.prometheus.exporters = { + unbound = { + enable = true; + group = "unbound"; + unbound = { + host = "unix:///run/unbound/unbound.ctl"; + key = "/var/lib/unbound/unbound_control.key"; + certificate = "/var/lib/unbound/unbound_control.pem"; + ca = "/var/lib/unbound/unbound_server.pem"; + }; + }; + nginxlog = { + enable = true; + group = "nginx"; + settings.namespaces = [ + { + name = "default"; + format = "$remote_addr - $remote_user [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\""; + source.files = [ + "/var/log/nginx/access.log" + "/var/log/nginx/error.log" + ]; + } + ]; + }; }; services.resolved = { diff --git a/inventory.nix b/inventory.nix index 3e89531..e555f25 100644 --- a/inventory.nix +++ b/inventory.nix @@ -14,6 +14,8 @@ "node" "systemd" "unbound" + "nginx" + "nginxlog" ]; }; interfaces = { diff --git a/services/cgit.nix b/services/cgit.nix index 07d4024..acadcc1 100644 --- a/services/cgit.nix +++ b/services/cgit.nix @@ -1,38 +1,44 @@ -{pkgs, lib, config, ...}: let - inherit (lib) mkIf mkOption mkEnableOption types; - cfg = config.wilkuu.services.cgit; - cgit_dark = pkgs.fetchFromGitHub { - owner = "jb3"; - repo = "cgit-dark"; - rev = "f82cde4b29834d31465a5dafa00de527ef6853b0"; - hash = "sha256-fSOelKDf1lHHRuyg/F81l8rAFrc6u7mAEFBX1Ua3V10="; - }; -in { +{ + pkgs, + lib, + config, + ... +}: +let + inherit (lib) + mkIf + mkOption + mkEnableOption + types + ; + cfg = config.wilkuu.services.cgit; +in +{ options.wilkuu.services.cgit = { - enable = mkEnableOption "remote git and cgit"; + enable = mkEnableOption "remote git and cgit"; domain = mkOption { - description = "Domain to run cgit on"; - example = "git.wilkuu.xyz"; + description = "Domain to run cgit on"; + example = "git.wilkuu.xyz"; default = "git.${config.networking.hostName}.local"; type = types.str; - }; + }; }; config = mkIf cfg.enable { - users.groups.git = {}; + users.groups.git = { }; users.users.git = { - group = "git"; + group = "git"; enable = true; - isSystemUser = true; + isSystemUser = true; home = "/srv/git/"; - createHome = true; - shell = "${pkgs.git}/bin/git-shell"; + createHome = true; + shell = "${pkgs.git}/bin/git-shell"; openssh.authorizedKeys.keyFiles = [ ../secrets/${config.networking.hostName}/git_authorized_keys ]; - }; + }; services.openssh = { - enable = true; + enable = true; extraConfig = '' Match user git AllowTcpForwarding no @@ -42,13 +48,13 @@ in { PermitTTY no X11Forwarding no ''; - + }; - services.openssh.settings.AllowUsers = ["git"]; + services.openssh.settings.AllowUsers = [ "git" ]; services.cgit."${cfg.domain}" = { - enable = true; + enable = true; group = "git"; - user = "git"; + user = "git"; scanPath = "/srv/git"; settings = { enable-follow-links = true; @@ -57,13 +63,13 @@ in { # css = "https://raw.githubusercontent.com/jb3/cgit-dark/f82cde4b29834d31465a5dafa00de527ef6853b0/cgit-themed.css"; }; gitHttpBackend = { - enable = true; + enable = true; checkExportOkFiles = false; # TODO: Reconsider later }; }; services.nginx.virtualHosts.${cfg.domain} = { - forceSSL = true; - enableACME = true; + forceSSL = true; + enableACME = true; }; }; |