diff options
Diffstat (limited to '')
| -rw-r--r-- | hosts/omega-relay/default.nix | 41 | ||||
| -rw-r--r-- | hosts/omega-relay/firewall.nix | 56 |
2 files changed, 80 insertions, 17 deletions
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 2235a04..3c7272c 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -24,12 +24,14 @@ desktop.xfce.enable = lib.mkForce false; gpg.enable = true; + virtualisation.guest = true; }; boot.loader.grub = { enable = true; efiSupport = false; }; + environment.systemPackages = with pkgs; [ lynx chawan @@ -41,29 +43,29 @@ in { stalwart = { - enable = false; + enable = true; domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz"; doACME = !isVM; }; vaultwarden = { - enable = false; + enable = true; signupWhitelist = [ "wilkuu.xyz" "omega-relay.local" ]; backupDir = "/srv/data/vaultwarden"; - domain = if isVM then "vaultwarden.omega-relay.local" else "vaultwarden.wilkuu.xyz"; + domain = if isVM then "bitwarden.omega-relay.local" else "bitwarden.wilkuu.xyz"; doACME = !isVM; }; uptimekuma = { - enable = false; + enable = true; domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz"; dataDir = "/srv/data/uptimekuma"; doACME = !isVM; }; freshrss = { - enable = false; + enable = true; domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz"; doACME = !isVM; }; @@ -74,10 +76,27 @@ }; }; + services.fail2ban = { + enable = true; + maxretry = 5; + ignoreIP = [ + "192.168.80.0/24" + "192.168.80.0/24" + ]; + bantime = "24h"; + bantime-increment = { + enable = true; # Enable increment of bantime after each violation + formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)"; + # multipliers = "1 2 4 8 16 32 64"; + maxtime = "168h"; # Do not ban for more than 1 week + overalljails = true; # Calculate the bantime based on all the violations + }; + }; + # TODO: Make a nginx module security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) { acceptTerms = true; - defaults.email = "jakub@wilkuu.xyz"; + defaults.email = "jstachurski9991@gmail.com"; }; services.nginx = let @@ -89,11 +108,11 @@ virtualHosts."${domain}" = { enableACME = !isVM; addSSL = !isVM; - locations."/" = { - root = "/srv/www/wilkuu.xyz/"; - index = "index.html"; - tryFiles = "$uri $uri/ =404"; - }; + root = "/srv/www/wilkuu.xyz/"; + locations."/" = { + index = "index.html"; + tryFiles = "$uri $uri/ =404"; + }; }; }; diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix index 15a96b6..c90a903 100644 --- a/hosts/omega-relay/firewall.nix +++ b/hosts/omega-relay/firewall.nix @@ -1,5 +1,6 @@ -{ ... }: +{ config, lib, pkgs, ... }: let + wgHomePort = 16888; baseTCP = [ 20 22 @@ -11,7 +12,7 @@ let 465 ]; baseUDP = [ - 16555 # Wireguard + wgHomePort # Wireguard ]; baseTCPRanges = [ ]; @@ -33,17 +34,60 @@ let ]; in { + sops.secrets = let + secrets = [ + "wg/home/privateKey" + "wg/home/chrono/PSK" + "wg/home/chrono/PK" + "wg/home/chrono/endpoint" + ]; + in lib.genAttrs secrets (name: { + sopsFile = ../../secrets/${config.networking.hostName}/wireguard.yaml; + key = lib.removePrefix "wg/" name; + }); + + networking.wireguard = { + enable = true; + useNetworkd = true; + interfaces = { + wg-home = { + ips = ["192.168.80.100/24"]; + extraOptions = { + DNS = "192.168.88.1"; + }; + privateKeyFile = config.sops.secrets."wg/home/privateKey".path; + listenPort = wgHomePort; + dynamicEndpointRefreshSeconds = 45; + + peers = [ + { + allowedIPs = ["192.168.88.0/24" "192.168.80.0/24"]; + presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path; + publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk="; + # endpoint = "45.138.54.155:16556"; + endpoint = "wilkuu.duckdns.org:16556"; + name = "wg-home-chronosphere"; + + } + ]; + }; + }; + }; + systemd.network.networks."40-wg-home".dns = ["192.168.88.1"]; systemd.network.enable = true; systemd.network.networks."10-uplink" = { - matchConfig.Name = "eth*"; - networkConfig.DHCP = "ipv4"; - linkConfig.RequiredForOnline="routable"; + matchConfig.Name = "ens18"; + # TODO: Cloudinit + address = ["45.136.141.133/26" "2a12:bec0:650:128::133/64"]; + gateway = ["45.136.141.129" "2a12:bec0:650:128::"]; + dns = ["1.1.1.1" "2606:4700:4700:0000:0000:0000:0000:1002"]; + linkConfig.RequiredForOnline="yes"; }; systemd.network.networks."99-fallback" = { matchConfig.Type = "ether"; networkConfig.DHCP = "ipv4"; linkConfig.RequiredForOnline="routable"; - } + }; networking.useDHCP = false; networking.useNetworkd = true; |