Compare commits

..

No commits in common. "dad468fec49070be02108958442fcf944adf5be3" and "45fbd6e8a8fadc19f75bce9dd3952a1402727c68" have entirely different histories.

19 changed files with 22 additions and 341 deletions

View File

@ -7,7 +7,6 @@ keys:
- &host_kinda_sus_lol age187hkscvxar33wta3zvgypj6kkc02g6sewwmfwmup26z2fuhwpamsa2d8yh - &host_kinda_sus_lol age187hkscvxar33wta3zvgypj6kkc02g6sewwmfwmup26z2fuhwpamsa2d8yh
- &host_nyx_lewd_wtf age1vnyex6qqzwl5laxgww9xzcqy9ht85s0etgq0esry8gk7ad0eaq8qz9p5ya - &host_nyx_lewd_wtf age1vnyex6qqzwl5laxgww9xzcqy9ht85s0etgq0esry8gk7ad0eaq8qz9p5ya
- &host_phoenix_lewd_wtf age1tf5077gpdp3cp4hedvng5wltzvp9jg0ehpt7czhnczlx6ctvqpjstvrmmh - &host_phoenix_lewd_wtf age1tf5077gpdp3cp4hedvng5wltzvp9jg0ehpt7czhnczlx6ctvqpjstvrmmh
- &host_sphinx_lewd_wtf age1myz28jqex5kpcsjqg2a0la8cyuutzj4cxf53vs3v8ey6fqzvk3ws8z8k3h
creation_rules: creation_rules:
# kinda.sus.lol # kinda.sus.lol
- path_regex: hosts/kinda.sus.lol/secrets/.* - path_regex: hosts/kinda.sus.lol/secrets/.*
@ -27,9 +26,3 @@ creation_rules:
- age: - age:
- *admin_ecchi - *admin_ecchi
- *host_phoenix_lewd_wtf - *host_phoenix_lewd_wtf
# sphinx.lewd.wtf
- path_regex: hosts/sphinx.lewd.wtf/secrets/.*
key_groups:
- age:
- *admin_ecchi
- *host_sphinx_lewd_wtf

View File

@ -146,11 +146,11 @@
}, },
"nixpkgs-stable_2": { "nixpkgs-stable_2": {
"locked": { "locked": {
"lastModified": 1716655032, "lastModified": 1716061101,
"narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=", "narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f", "rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -162,11 +162,11 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1716769173, "lastModified": 1716137900,
"narHash": "sha256-7EXDb5WBw+d004Agt+JHC/Oyh/KTUglOaQ4MNjBbo5w=", "narHash": "sha256-sowPU+tLQv8GlqtVtsXioTKeaQvlMz/pefcdwg8MvfM=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "9ca3f649614213b2aaf5f1e16ec06952fe4c2632", "rev": "6c0b7a92c30122196a761b440ac0d46d3d9954f1",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -193,11 +193,11 @@
"nixpkgs-stable": "nixpkgs-stable_2" "nixpkgs-stable": "nixpkgs-stable_2"
}, },
"locked": { "locked": {
"lastModified": 1716692524, "lastModified": 1716087663,
"narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=", "narHash": "sha256-zuSAGlx8Qk0OILGCC2GUyZ58/SJ5R3GZdeUNQ6IS0fQ=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "962797a8d7f15ed7033031731d0bb77244839960", "rev": "0bf1808e70ce80046b0cff821c019df2b19aabf5",
"type": "github" "type": "github"
}, },
"original": { "original": {

View File

@ -21,16 +21,6 @@
]; ];
}; };
"sphinx.lewd.wtf" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs self; };
modules = [
sops-nix.nixosModules.sops
./default.nix
./hosts/sphinx.lewd.wtf/configuration.nix
];
};
"aztul.elmosco.lewd.wtf" = nixpkgs.lib.nixosSystem { "aztul.elmosco.lewd.wtf" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = { inherit inputs self; }; specialArgs = { inherit inputs self; };
@ -85,18 +75,7 @@
user = "root"; user = "root";
}; };
}; };
"sphinx.lewd.wtf" = {
sshOpts = [ "-p" "222" "-o" "StrictHostKeyChecking=no" ];
hostname = "sphinx.lewd.wtf";
fastConnection = true;
profiles.system = {
sshUser = "root";
path =
deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations."sphinx.lewd.wtf";
user = "root";
};
};
"aztul.elmosco.lewd.wtf" = { "aztul.elmosco.lewd.wtf" = {
sshOpts = [ "-p" "22111" "-o" "StrictHostKeyChecking=no" ]; sshOpts = [ "-p" "22111" "-o" "StrictHostKeyChecking=no" ];
hostname = "aztul.elmosco.lewd.wtf"; hostname = "aztul.elmosco.lewd.wtf";

View File

@ -17,10 +17,6 @@ in {
device = "/mnt/zbigdata/media"; device = "/mnt/zbigdata/media";
options = [ "bind" ]; options = [ "bind" ];
}; };
"/export/c3moc/games" = lib.mkIf cfg.switchNfs {
device = "/mnt/zbigdata/games";
options = [ "bind" ];
};
"/export/c3moc/dropfolder" = lib.mkIf cfg.switchNfs { "/export/c3moc/dropfolder" = lib.mkIf cfg.switchNfs {
device = "/mnt/zbigdata/c3moc_dropfolder"; device = "/mnt/zbigdata/c3moc_dropfolder";
options = [ "bind" ]; options = [ "bind" ];
@ -31,19 +27,13 @@ in {
autoStart = true; autoStart = true;
privateNetwork = true; privateNetwork = true;
hostAddress = "192.168.69.1"; hostAddress = "192.168.69.1";
hostAddress6 = "aa69::1";
localAddress = "192.168.69.10"; localAddress = "192.168.69.10";
localAddress6 = "aa69::69";
bindMounts = { bindMounts = {
"/home/c3moc/media" = { "/home/c3moc/media" = {
hostPath = "/mnt/zbigdata/media"; hostPath = "/mnt/zbigdata/media";
isReadOnly = true; isReadOnly = true;
}; };
"/home/c3moc/games" = {
hostPath = "/mnt/zbigdata/games";
isReadOnly = true;
};
"/home/c3moc/dropfolder" = { "/home/c3moc/dropfolder" = {
hostPath = "/mnt/zbigdata/c3moc_dropfolder"; hostPath = "/mnt/zbigdata/c3moc_dropfolder";
isReadOnly = false; isReadOnly = false;
@ -135,8 +125,6 @@ in {
services.nfs.server.exports = mkIf cfg.switchNfs '' services.nfs.server.exports = mkIf cfg.switchNfs ''
/export (ro,fsid=0,no_subtree_check) /export (ro,fsid=0,no_subtree_check)
/export/c3moc (ro,nohide,insecure,no_subtree_check) /export/c3moc (ro,nohide,insecure,no_subtree_check)
/export/c3moc/games (ro,nohide,insecure,no_subtree_check)
/export/c3moc/media (ro,nohide,insecure,no_subtree_check)
/export/c3moc/dropfolder (rw,nohide,insecure,no_subtree_check) /export/c3moc/dropfolder (rw,nohide,insecure,no_subtree_check)
''; '';
@ -179,91 +167,8 @@ in {
proto = "tcp"; proto = "tcp";
sourcePort = 445; sourcePort = 445;
} }
# FTP
{
destination = "aa69::69:20";
proto = "tcp";
sourcePort = 20;
}
{
destination = "aa69::69:21";
proto = "tcp";
sourcePort = 21;
}
# SFTP
{
destination = "aa69::69:22";
proto = "tcp";
sourcePort = 22;
}
# SMB
{
destination = "aa69::69:137";
proto = "udp";
sourcePort = 137;
}
{
destination = "aa69::69:138";
proto = "udp";
sourcePort = 138;
}
{
destination = "aa69::69:139";
proto = "tcp";
sourcePort = 139;
}
{
destination = "aa69::69:445";
proto = "tcp";
sourcePort = 445;
}
]; ];
# Monitoring Stuff
services.prometheus.exporters.node = {
enable = true;
port = 9100;
enabledCollectors = [
"logind"
"systemd"
];
disabledCollectors = [
"textfile"
];
};
services.prometheus = {
enable = true;
scrapeConfigs = [
{
job_name = "node";
static_configs = [{
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
}];
}
];
};
services.grafana = {
enable = true;
settings = {
server = {
# Listening Address
http_addr = "127.0.0.1";
# and Port
http_port = 3000;
# Grafana needs to know on which domain and URL it's running
domain = "gpn22.c3moc.lol";
root_url = "https://gpn22.c3moc.lol/stats/"; # Not needed if it is `https://your.domain/`
serve_from_sub_path = true;
};
"auth.anonymous" = {
enabled = true;
org_name = "Public";
};
};
};
# Nginx Stuff # Nginx Stuff
services.nginx = { services.nginx = {
virtualHosts."gpn22.c3moc.lol" = { virtualHosts."gpn22.c3moc.lol" = {
@ -314,11 +219,6 @@ in {
proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Host $http_host;
''; '';
}; };
"/stats/" = {
proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
proxyWebsockets = true;
recommendedProxySettings = true;
};
}; };
}; };
}; };

View File

@ -14,8 +14,8 @@ let
in { in {
inherit imports; inherit imports;
c3moc.enable = false; c3moc.enable = true;
c3moc.switchNfs = false; c3moc.switchNfs = true;
boot.loader.systemd-boot.enable = false; boot.loader.systemd-boot.enable = false;
boot.loader.grub = { boot.loader.grub = {

View File

@ -35,11 +35,6 @@
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/mnt/zbigdata/games" = {
device = "zbigdata/games";
fsType = "zfs";
};
fileSystems."/var/lib/attic/storage" = { fileSystems."/var/lib/attic/storage" = {
device = "zbigdata/attic"; device = "zbigdata/attic";
fsType = "zfs"; fsType = "zfs";

View File

@ -5,9 +5,8 @@
"br0" = { "br0" = {
interfaces = [ interfaces = [
"eno2" "eno2"
"enp2s0" "enp23s0"
"enp101s0" "enp23s0d1"
"enp101s0d1"
]; ];
}; };
}; };
@ -20,13 +19,18 @@
}; };
networking.interfaces.br0.ipv4.addresses = [ networking.interfaces.br0.ipv4.addresses = [
{
address = "10.0.69.69";
prefixLength = 16;
}
{ {
address = "192.168.0.42"; address = "192.168.0.42";
prefixLength = 22; prefixLength = 22;
} }
]; ];
# networking.defaultGateway = "10.0.0.1";
networking.defaultGateway = "192.168.0.1"; networking.defaultGateway = "10.0.0.1";
# networking.defaultGateway = "192.168.0.1";
networking.nameservers = [ "1.1.1.1" ]; networking.nameservers = [ "1.1.1.1" ];
networking.firewall.enable = false; networking.firewall.enable = false;

View File

@ -3,12 +3,10 @@ let
utils = import ../../../util/include.nix { lib = lib; }; utils = import ../../../util/include.nix { lib = lib; };
imports = imports =
(utils.includeDir ./services) ++ (utils.includeDir ./services) ++
(utils.includeDir ./storage_users) ++
[ [
./hardware-configuration.nix ./hardware-configuration.nix
./networking.nix ./networking.nix
./users.nix ./users.nix
./sftp_jail.nix
]; ];
in in
{ {

View File

@ -14,12 +14,5 @@
fsType = "ext4"; fsType = "ext4";
}; };
# Shared stuff
fileSystems."/sftp_jail/melic" = {
device = "/home/rene/shared";
options = [ "bind,ro" ];
};
services.qemuGuest.enable = true; services.qemuGuest.enable = true;
} }

View File

@ -1,10 +0,0 @@
{
services.openssh.extraConfig = ''
Match Group sftponly
ChrootDirectory /sftp_jail
ForceCommand internal-sftp
AllowTcpForwarding no
'';
users.groups.sftponly = {};
}

View File

@ -1,12 +0,0 @@
{
users.users.melic = {
group = "sftponly";
isNormalUser = true;
home = "/sftp_jail/melic";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIERtfY26/h5xl+bzZm2htR4+Wd879DvZRPHsosFaEqIW gaming@DESKTOP-4ACM3JU"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcJKdwwvygRMH/91brR++Fk7sP47wuB8zuTtx+1OZBL+ZyeSmyiwZFXU5WfhwEZndOG4XlLTvJwvgYTMEyvZqh9DuasLv7AqbMfTVkQx1RJOUuLBDLFcjVI5RvGJz1aFRY8Uu0lWll+Nd7Onl8qSDnfSe+mRXw7O90cJI+nELDITxrG5wZ1Onm/ApsaX3S8iPLT5o74hWzE6tKBQqbEcRJJs5snLhxeIXNpaHFN40tJr2MEaLjpdu+9EiKUoVhV8JyUWKHeJFinyAwCC7g7IWte8t43IwQrSfIA19r7+HAMi6bJk5++LBm8p4APSV+rw+tFOzSV+jkAvizTKTUGC/CHMBnq2R1FF+ilSmWSecu2XI4KmKeAD64o5YndXrb0VWCIcVZjphqp52lzk4YNA97xsA6l1VVdfbhKu95Z+HV8kLXW8Nf4d36RUrxgtFnO1MkIh+yO6+xeVak4Fizbu42g49QZe6i3pcCUvB73kHFFfprnSgKouK3/TN4YCIyDsk= melic@Erika"
];
};
}

View File

@ -1,25 +0,0 @@
{ self, config, pkgs, lib, ... }:
let
utils = import ../../util/include.nix { lib = lib; };
imports =
(utils.includeDir ./services) ++
[
./hardware-configuration.nix
./networking.nix
./secrets.nix
];
in
{
inherit imports;
networking.hostName = "sphinx";
networking.domain = "lewd.wtf";
boot.loader.grub = {
enable = true;
efiSupport = false;
devices = [ "/dev/sda" ];
};
system.stateVersion = "24.05";
}

View File

@ -1,11 +0,0 @@
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.kernelModules = [ "nvme" ];
fileSystems."/" = {
device = "/dev/sda1";
fsType = "ext4";
};
}

View File

@ -1,32 +0,0 @@
{ lib, ... }: {
# This file was populated at runtime with the networking
# details gathered from the active system.
networking = {
nameservers = [ "8.8.8.8" ];
defaultGateway = "172.31.1.1";
defaultGateway6 = {
address = "fe80::1";
interface = "eth0";
};
dhcpcd.enable = false;
usePredictableInterfaceNames = lib.mkForce false;
interfaces = {
eth0 = {
ipv4.addresses = [
{ address="116.203.182.240"; prefixLength=32; }
];
ipv6.addresses = [
{ address="2a01:4f8:1c1b:7a9b::1"; prefixLength=64; }
{ address="fe80::9400:3ff:fe62:dffe"; prefixLength=64; }
];
ipv4.routes = [ { address = "172.31.1.1"; prefixLength = 32; } ];
ipv6.routes = [ { address = "fe80::1"; prefixLength = 128; } ];
};
};
};
services.udev.extraRules = ''
ATTR{address}=="96:00:03:62:df:fe", NAME="eth0"
'';
}

View File

@ -1,13 +0,0 @@
{ config, ... }:
{
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# Vaultwarden
sops.secrets."services/vaultwarden/.env" = {
mode = "0400";
owner = config.users.users.vaultwarden.name;
group = config.users.users.vaultwarden.group;
sopsFile = ./secrets/vaultwarden.env;
format = "dotenv";
};
}

View File

@ -1,11 +0,0 @@
ADMIN_TOKEN=ENC[AES256_GCM,data:xAMhqj/wAqmDPUEo+IUMsaY9+/dTOmdwm5NKu7LC9PGgyORRVjowI5Fu/3j47u9JKLXPyGvQM33s+S3VqNhspQ==,iv:yCdNQbQx86CZU7GvShcL9YxOlzGr/bTfTp5DDMudTDs=,tag:QRsgnB9K1DcEcHlGrUA2EQ==,type:str]
SMTP_PASSWORD=ENC[AES256_GCM,data:JvSxXTTPQmox2O7n28018A==,iv:uA3WytiA9o/3qohl/eaMD7gVbORo4YZg2gzT/qZZHbA=,tag:v3Rkhp4HpjZE8Z45N3jcxQ==,type:str]
YUBICO_SECRET_KEY=ENC[AES256_GCM,data:oUXZDR5F1eXNKFYYiK9BQfeuves36PdqfKE1Yb7Z,iv:XDmIl7dqV8R7bykwtQz3EQIf1qJHh3wPbL9RAu6ZWEk=,tag:F5kb5XqY0JPeBGYOFrQC8g==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcWZxL3Q4dElaV0hjWm9J\nN1ViOEZkS3Z1RlAvRHFKZjdhU2drNWFZT3dBClY3Rm1lK1FaR1hmSTZ5dUJSNktK\ndGhneVdXS2R3MXB4N01yaTBlaGxjSEUKLS0tIHY3ejBnUzNlRWs3L0c3bkpBRFk5\ndHJNdG9ESHZ3ZzlPMExwNmpZSHpYZVUK9d6xS6ji8N3rZS1OmXJU7VZd6jZNETPK\nZTozNHhcvQiXTdlc23cSUZOHeJyugV+IjRpkDUBjh/0f/YzBNH7gsA==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age17wdazshqnfe63cy7mmsmwld75e5wedgn8gngvmvlqdktlr86c4us87tjxv
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTEdOT3RaQWNzQkhzd0ds\ncS9tVWZJbDNMUmNCcWpRSDJwbDV4cUpHZ0ZJCkdBUGRxOUp2QnpYSnRpdzFxK2Fj\nSW9lRUIxbFBoWDFYVEhDK3FvOGk0VzgKLS0tIENBVkpTa0ZpTFFpVG4yR1p2c1lT\nZExSWmdUTXR5SS8yZzQ1VExGdkk0alkKIebJqoBgEv9KK8Nmtyo4xYAd8UA7czBC\noRHZv9cduFhA55iDvEQIdfrDJGMTCAbnuXEGlh0hee0KFFrsar7FEg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1myz28jqex5kpcsjqg2a0la8cyuutzj4cxf53vs3v8ey6fqzvk3ws8z8k3h
sops_lastmodified=2024-06-06T10:12:52Z
sops_mac=ENC[AES256_GCM,data:KRi4A7W8/SWaSdX6kz1r00u0s0e+H9T1DlNlWXjbL5ZqUiACBGvmnlU0Ylqter7JBnP6hM3y34wuTH3XzqpAmcPLSCg6bhLqV24AIzTxb/xJJUj0G2uTle//LUipVVem19ECVS0refj36nDd4Lzuyy6fe6uowQMkt2vzLlmr6t8=,iv:1DTq4KQLJwyByoFP6inLp4DmrFra+ca1EEAGgUJ5NMs=,tag:oovcb4hGB1dyOzR5GV5wog==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.7.3

View File

@ -1,7 +0,0 @@
{
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx = {
enable = true;
};
}

View File

@ -1,60 +0,0 @@
{ config, ... }:
{
users.users.vaultwarden.extraGroups = [ config.users.groups.keys.name ];
services.vaultwarden = {
enable = true;
environmentFile = "/run/secrets/services/vaultwarden/.env";
config = {
DOMAIN = "https://vault.lewd.wtf";
SIGNUPS_ALLOWED = false;
SIGNUPS_VERIFY = true;
INVITATIONS_ALLOWED = false;
WEBSOCKET_ENABLED = true;
WEBSOCKET_PORT = 3012;
ROCKET_PORT = 8222;
SMTP_HOST = "mail.your-server.de";
SMTP_FROM = "vaultwarden@lewd.wtf";
SMTP_FROM_NAME = "Vaultwarden";
SMTP_USERNAME = "vaultwarden@lewd.wtf";
YUBICO_CLIENT_ID = 88022;
};
};
services.nginx.clientMaxBodySize = "128M";
services.nginx.virtualHosts."vault.lewd.wtf" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8222";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig =
"proxy_set_header Host $host;" +
"proxy_set_header X-Real-IP $remote_addr;" +
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" +
"proxy_set_header X-Forwarded-Proto $scheme;"
;
};
locations."/notifications/hub/negotiate" = {
proxyPass = "http://127.0.0.1:8222";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig =
"proxy_set_header Host $host;" +
"proxy_set_header X-Real-IP $remote_addr;" +
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" +
"proxy_set_header X-Forwarded-Proto $scheme;"
;
};
locations."/notifications/hub" = {
proxyPass = "http://127.0.0.1:3012";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig =
"proxy_set_header Host $host;" +
"proxy_set_header X-Real-IP $remote_addr;" +
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" +
"proxy_set_header X-Forwarded-Proto $scheme;"
;
};
};
}

View File

@ -5,7 +5,7 @@
gc = { gc = {
automatic = true; automatic = true;
dates = "weekly"; dates = "weekly";
options = "--delete-older-than 15d"; options = "--delete-older-than 15";
}; };
}; };
} }