ciapa
/
infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: ciapa:dad468fec49070be02108958442fcf944adf5be3
Branches Tags
ciapa:master
ciapa:update_flake_lock_action
ciapa:test
..
compare: ciapa:45fbd6e8a8fadc19f75bce9dd3952a1402727c68
Branches Tags
ciapa:master
ciapa:update_flake_lock_action
ciapa:test

No commits in common. "dad468fec49070be02108958442fcf944adf5be3" and "45fbd6e8a8fadc19f75bce9dd3952a1402727c68" have entirely different histories.
dad468fec4 ... 45fbd6e8a8

19 changed files with 22 additions and 341 deletions
Show Stats Expand all files Collapse all files

7
.sops.yaml
View File

@ -7,7 +7,6 @@ keys:
- &host_kinda_sus_lol age187hkscvxar33wta3zvgypj6kkc02g6sewwmfwmup26z2fuhwpamsa2d8yh
- &host_nyx_lewd_wtf age1vnyex6qqzwl5laxgww9xzcqy9ht85s0etgq0esry8gk7ad0eaq8qz9p5ya
- &host_phoenix_lewd_wtf age1tf5077gpdp3cp4hedvng5wltzvp9jg0ehpt7czhnczlx6ctvqpjstvrmmh
- &host_sphinx_lewd_wtf age1myz28jqex5kpcsjqg2a0la8cyuutzj4cxf53vs3v8ey6fqzvk3ws8z8k3h
creation_rules:
# kinda.sus.lol
- path_regex: hosts/kinda.sus.lol/secrets/.*
@ -27,9 +26,3 @@ creation_rules:
- age:
- *admin_ecchi
- *host_phoenix_lewd_wtf
# sphinx.lewd.wtf
- path_regex: hosts/sphinx.lewd.wtf/secrets/.*
key_groups:
- age:
- *admin_ecchi
- *host_sphinx_lewd_wtf

18
flake.lock
View File

@ -146,11 +146,11 @@
},
"nixpkgs-stable_2": {
"locked": {
"lastModified": 1716655032,
"narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=",
"lastModified": 1716061101,
"narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f",
"rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
"type": "github"
},
"original": {
@ -162,11 +162,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1716769173,
"narHash": "sha256-7EXDb5WBw+d004Agt+JHC/Oyh/KTUglOaQ4MNjBbo5w=",
"lastModified": 1716137900,
"narHash": "sha256-sowPU+tLQv8GlqtVtsXioTKeaQvlMz/pefcdwg8MvfM=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "9ca3f649614213b2aaf5f1e16ec06952fe4c2632",
"rev": "6c0b7a92c30122196a761b440ac0d46d3d9954f1",
"type": "github"
},
"original": {
@ -193,11 +193,11 @@
"nixpkgs-stable": "nixpkgs-stable_2"
},
"locked": {
"lastModified": 1716692524,
"narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=",
"lastModified": 1716087663,
"narHash": "sha256-zuSAGlx8Qk0OILGCC2GUyZ58/SJ5R3GZdeUNQ6IS0fQ=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "962797a8d7f15ed7033031731d0bb77244839960",
"rev": "0bf1808e70ce80046b0cff821c019df2b19aabf5",
"type": "github"
},
"original": {

23
flake.nix
View File

@ -21,16 +21,6 @@
];
};
"sphinx.lewd.wtf" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs self; };
modules = [
sops-nix.nixosModules.sops
./default.nix
./hosts/sphinx.lewd.wtf/configuration.nix
];
};
"aztul.elmosco.lewd.wtf" = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs self; };
@ -85,18 +75,7 @@
user = "root";
};
};
"sphinx.lewd.wtf" = {
sshOpts = [ "-p" "222" "-o" "StrictHostKeyChecking=no" ];
hostname = "sphinx.lewd.wtf";
fastConnection = true;
profiles.system = {
sshUser = "root";
path =
deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations."sphinx.lewd.wtf";
user = "root";
};
};
"aztul.elmosco.lewd.wtf" = {
sshOpts = [ "-p" "22111" "-o" "StrictHostKeyChecking=no" ];
hostname = "aztul.elmosco.lewd.wtf";

100
hosts/phoenix.lewd.wtf/c3moc.nix
View File

@ -17,10 +17,6 @@ in {
device = "/mnt/zbigdata/media";
options = [ "bind" ];
};
"/export/c3moc/games" = lib.mkIf cfg.switchNfs {
device = "/mnt/zbigdata/games";
options = [ "bind" ];
};
"/export/c3moc/dropfolder" = lib.mkIf cfg.switchNfs {
device = "/mnt/zbigdata/c3moc_dropfolder";
options = [ "bind" ];
@ -31,19 +27,13 @@ in {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.69.1";
hostAddress6 = "aa69::1";
localAddress = "192.168.69.10";
localAddress6 = "aa69::69";
bindMounts = {
"/home/c3moc/media" = {
hostPath = "/mnt/zbigdata/media";
isReadOnly = true;
};
"/home/c3moc/games" = {
hostPath = "/mnt/zbigdata/games";
isReadOnly = true;
};
"/home/c3moc/dropfolder" = {
hostPath = "/mnt/zbigdata/c3moc_dropfolder";
isReadOnly = false;
@ -135,8 +125,6 @@ in {
services.nfs.server.exports = mkIf cfg.switchNfs ''
/export (ro,fsid=0,no_subtree_check)
/export/c3moc (ro,nohide,insecure,no_subtree_check)
/export/c3moc/games (ro,nohide,insecure,no_subtree_check)
/export/c3moc/media (ro,nohide,insecure,no_subtree_check)
/export/c3moc/dropfolder (rw,nohide,insecure,no_subtree_check)
'';
@ -179,91 +167,8 @@ in {
proto = "tcp";
sourcePort = 445;
}
# FTP
{
destination = "aa69::69:20";
proto = "tcp";
sourcePort = 20;
}
{
destination = "aa69::69:21";
proto = "tcp";
sourcePort = 21;
}
# SFTP
{
destination = "aa69::69:22";
proto = "tcp";
sourcePort = 22;
}
# SMB
{
destination = "aa69::69:137";
proto = "udp";
sourcePort = 137;
}
{
destination = "aa69::69:138";
proto = "udp";
sourcePort = 138;
}
{
destination = "aa69::69:139";
proto = "tcp";
sourcePort = 139;
}
{
destination = "aa69::69:445";
proto = "tcp";
sourcePort = 445;
}
];
# Monitoring Stuff
services.prometheus.exporters.node = {
enable = true;
port = 9100;
enabledCollectors = [
"logind"
"systemd"
];
disabledCollectors = [
"textfile"
];
};
services.prometheus = {
enable = true;
scrapeConfigs = [
{
job_name = "node";
static_configs = [{
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
}];
}
];
};
services.grafana = {
enable = true;
settings = {
server = {
# Listening Address
http_addr = "127.0.0.1";
# and Port
http_port = 3000;
# Grafana needs to know on which domain and URL it's running
domain = "gpn22.c3moc.lol";
root_url = "https://gpn22.c3moc.lol/stats/"; # Not needed if it is `https://your.domain/`
serve_from_sub_path = true;
};
"auth.anonymous" = {
enabled = true;
org_name = "Public";
};
};
};
# Nginx Stuff
services.nginx = {
virtualHosts."gpn22.c3moc.lol" = {
@ -314,11 +219,6 @@ in {
proxy_set_header X-Forwarded-Host $http_host;
'';
};
"/stats/" = {
proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
proxyWebsockets = true;
recommendedProxySettings = true;
};
};
};
};

4
hosts/phoenix.lewd.wtf/configuration.nix
View File

@ -14,8 +14,8 @@ let
in {
inherit imports;
c3moc.enable = false;
c3moc.switchNfs = false;
c3moc.enable = true;
c3moc.switchNfs = true;
boot.loader.systemd-boot.enable = false;
boot.loader.grub = {

5
hosts/phoenix.lewd.wtf/hardware-configuration.nix
View File

@ -35,11 +35,6 @@
fsType = "zfs";
};
fileSystems."/mnt/zbigdata/games" = {
device = "zbigdata/games";
fsType = "zfs";
};
fileSystems."/var/lib/attic/storage" = {
device = "zbigdata/attic";
fsType = "zfs";

14
hosts/phoenix.lewd.wtf/networking.nix
View File

@ -5,9 +5,8 @@
"br0" = {
interfaces = [
"eno2"
"enp2s0"
"enp101s0"
"enp101s0d1"
"enp23s0"
"enp23s0d1"
];
};
};
@ -20,13 +19,18 @@
};
networking.interfaces.br0.ipv4.addresses = [
{
address = "10.0.69.69";
prefixLength = 16;
}
{
address = "192.168.0.42";
prefixLength = 22;
}
];
# networking.defaultGateway = "10.0.0.1";
networking.defaultGateway = "192.168.0.1";
networking.defaultGateway = "10.0.0.1";
# networking.defaultGateway = "192.168.0.1";
networking.nameservers = [ "1.1.1.1" ];
networking.firewall.enable = false;

2
hosts/seedbox/rene/configuration.nix
View File

@ -3,12 +3,10 @@ let
utils = import ../../../util/include.nix { lib = lib; };
imports =
(utils.includeDir ./services) ++
(utils.includeDir ./storage_users) ++
[
./hardware-configuration.nix
./networking.nix
./users.nix
./sftp_jail.nix
];
in
{

7
hosts/seedbox/rene/hardware-configuration.nix
View File

@ -14,12 +14,5 @@
fsType = "ext4";
};
# Shared stuff
fileSystems."/sftp_jail/melic" = {
device = "/home/rene/shared";
options = [ "bind,ro" ];
};
services.qemuGuest.enable = true;
}

10
hosts/seedbox/rene/sftp_jail.nix
View File

@ -1,10 +0,0 @@
{
services.openssh.extraConfig = ''
Match Group sftponly
ChrootDirectory /sftp_jail
ForceCommand internal-sftp
AllowTcpForwarding no
'';
users.groups.sftponly = {};
}

12
hosts/seedbox/rene/storage_users/melic.nix
View File

@ -1,12 +0,0 @@
{
users.users.melic = {
group = "sftponly";
isNormalUser = true;
home = "/sftp_jail/melic";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIERtfY26/h5xl+bzZm2htR4+Wd879DvZRPHsosFaEqIW gaming@DESKTOP-4ACM3JU"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcJKdwwvygRMH/91brR++Fk7sP47wuB8zuTtx+1OZBL+ZyeSmyiwZFXU5WfhwEZndOG4XlLTvJwvgYTMEyvZqh9DuasLv7AqbMfTVkQx1RJOUuLBDLFcjVI5RvGJz1aFRY8Uu0lWll+Nd7Onl8qSDnfSe+mRXw7O90cJI+nELDITxrG5wZ1Onm/ApsaX3S8iPLT5o74hWzE6tKBQqbEcRJJs5snLhxeIXNpaHFN40tJr2MEaLjpdu+9EiKUoVhV8JyUWKHeJFinyAwCC7g7IWte8t43IwQrSfIA19r7+HAMi6bJk5++LBm8p4APSV+rw+tFOzSV+jkAvizTKTUGC/CHMBnq2R1FF+ilSmWSecu2XI4KmKeAD64o5YndXrb0VWCIcVZjphqp52lzk4YNA97xsA6l1VVdfbhKu95Z+HV8kLXW8Nf4d36RUrxgtFnO1MkIh+yO6+xeVak4Fizbu42g49QZe6i3pcCUvB73kHFFfprnSgKouK3/TN4YCIyDsk= melic@Erika"
];
};
}

25
hosts/sphinx.lewd.wtf/configuration.nix
View File

@ -1,25 +0,0 @@
{ self, config, pkgs, lib, ... }:
let
utils = import ../../util/include.nix { lib = lib; };
imports =
(utils.includeDir ./services) ++
[
./hardware-configuration.nix
./networking.nix
./secrets.nix
];
in
{
inherit imports;
networking.hostName = "sphinx";
networking.domain = "lewd.wtf";
boot.loader.grub = {
enable = true;
efiSupport = false;
devices = [ "/dev/sda" ];
};
system.stateVersion = "24.05";
}

11
hosts/sphinx.lewd.wtf/hardware-configuration.nix
View File

@ -1,11 +0,0 @@
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.kernelModules = [ "nvme" ];
fileSystems."/" = {
device = "/dev/sda1";
fsType = "ext4";
};
}

32
hosts/sphinx.lewd.wtf/networking.nix
View File

@ -1,32 +0,0 @@
{ lib, ... }: {
# This file was populated at runtime with the networking
# details gathered from the active system.
networking = {
nameservers = [ "8.8.8.8" ];
defaultGateway = "172.31.1.1";
defaultGateway6 = {
address = "fe80::1";
interface = "eth0";
};
dhcpcd.enable = false;
usePredictableInterfaceNames = lib.mkForce false;
interfaces = {
eth0 = {
ipv4.addresses = [
{ address="116.203.182.240"; prefixLength=32; }
];
ipv6.addresses = [
{ address="2a01:4f8:1c1b:7a9b::1"; prefixLength=64; }
{ address="fe80::9400:3ff:fe62:dffe"; prefixLength=64; }
];
ipv4.routes = [ { address = "172.31.1.1"; prefixLength = 32; } ];
ipv6.routes = [ { address = "fe80::1"; prefixLength = 128; } ];
};
};
};
services.udev.extraRules = ''
ATTR{address}=="96:00:03:62:df:fe", NAME="eth0"
'';
}

13
hosts/sphinx.lewd.wtf/secrets.nix
View File

@ -1,13 +0,0 @@
{ config, ... }:
{
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# Vaultwarden
sops.secrets."services/vaultwarden/.env" = {
mode = "0400";
owner = config.users.users.vaultwarden.name;
group = config.users.users.vaultwarden.group;
sopsFile = ./secrets/vaultwarden.env;
format = "dotenv";
};
}

11
hosts/sphinx.lewd.wtf/secrets/vaultwarden.env
View File

@ -1,11 +0,0 @@
ADMIN_TOKEN=ENC[AES256_GCM,data:xAMhqj/wAqmDPUEo+IUMsaY9+/dTOmdwm5NKu7LC9PGgyORRVjowI5Fu/3j47u9JKLXPyGvQM33s+S3VqNhspQ==,iv:yCdNQbQx86CZU7GvShcL9YxOlzGr/bTfTp5DDMudTDs=,tag:QRsgnB9K1DcEcHlGrUA2EQ==,type:str]
SMTP_PASSWORD=ENC[AES256_GCM,data:JvSxXTTPQmox2O7n28018A==,iv:uA3WytiA9o/3qohl/eaMD7gVbORo4YZg2gzT/qZZHbA=,tag:v3Rkhp4HpjZE8Z45N3jcxQ==,type:str]
YUBICO_SECRET_KEY=ENC[AES256_GCM,data:oUXZDR5F1eXNKFYYiK9BQfeuves36PdqfKE1Yb7Z,iv:XDmIl7dqV8R7bykwtQz3EQIf1qJHh3wPbL9RAu6ZWEk=,tag:F5kb5XqY0JPeBGYOFrQC8g==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcWZxL3Q4dElaV0hjWm9J\nN1ViOEZkS3Z1RlAvRHFKZjdhU2drNWFZT3dBClY3Rm1lK1FaR1hmSTZ5dUJSNktK\ndGhneVdXS2R3MXB4N01yaTBlaGxjSEUKLS0tIHY3ejBnUzNlRWs3L0c3bkpBRFk5\ndHJNdG9ESHZ3ZzlPMExwNmpZSHpYZVUK9d6xS6ji8N3rZS1OmXJU7VZd6jZNETPK\nZTozNHhcvQiXTdlc23cSUZOHeJyugV+IjRpkDUBjh/0f/YzBNH7gsA==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age17wdazshqnfe63cy7mmsmwld75e5wedgn8gngvmvlqdktlr86c4us87tjxv
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTEdOT3RaQWNzQkhzd0ds\ncS9tVWZJbDNMUmNCcWpRSDJwbDV4cUpHZ0ZJCkdBUGRxOUp2QnpYSnRpdzFxK2Fj\nSW9lRUIxbFBoWDFYVEhDK3FvOGk0VzgKLS0tIENBVkpTa0ZpTFFpVG4yR1p2c1lT\nZExSWmdUTXR5SS8yZzQ1VExGdkk0alkKIebJqoBgEv9KK8Nmtyo4xYAd8UA7czBC\noRHZv9cduFhA55iDvEQIdfrDJGMTCAbnuXEGlh0hee0KFFrsar7FEg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_1__map_recipient=age1myz28jqex5kpcsjqg2a0la8cyuutzj4cxf53vs3v8ey6fqzvk3ws8z8k3h
sops_lastmodified=2024-06-06T10:12:52Z
sops_mac=ENC[AES256_GCM,data:KRi4A7W8/SWaSdX6kz1r00u0s0e+H9T1DlNlWXjbL5ZqUiACBGvmnlU0Ylqter7JBnP6hM3y34wuTH3XzqpAmcPLSCg6bhLqV24AIzTxb/xJJUj0G2uTle//LUipVVem19ECVS0refj36nDd4Lzuyy6fe6uowQMkt2vzLlmr6t8=,iv:1DTq4KQLJwyByoFP6inLp4DmrFra+ca1EEAGgUJ5NMs=,tag:oovcb4hGB1dyOzR5GV5wog==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.7.3

7
hosts/sphinx.lewd.wtf/services/nginx.nix
View File

@ -1,7 +0,0 @@
{
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx = {
enable = true;
};
}

60
hosts/sphinx.lewd.wtf/services/vaultwarden.nix
View File

@ -1,60 +0,0 @@
{ config, ... }:
{
users.users.vaultwarden.extraGroups = [ config.users.groups.keys.name ];
services.vaultwarden = {
enable = true;
environmentFile = "/run/secrets/services/vaultwarden/.env";
config = {
DOMAIN = "https://vault.lewd.wtf";
SIGNUPS_ALLOWED = false;
SIGNUPS_VERIFY = true;
INVITATIONS_ALLOWED = false;
WEBSOCKET_ENABLED = true;
WEBSOCKET_PORT = 3012;
ROCKET_PORT = 8222;
SMTP_HOST = "mail.your-server.de";
SMTP_FROM = "vaultwarden@lewd.wtf";
SMTP_FROM_NAME = "Vaultwarden";
SMTP_USERNAME = "vaultwarden@lewd.wtf";
YUBICO_CLIENT_ID = 88022;
};
};
services.nginx.clientMaxBodySize = "128M";
services.nginx.virtualHosts."vault.lewd.wtf" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8222";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig =
"proxy_set_header Host $host;" +
"proxy_set_header X-Real-IP $remote_addr;" +
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" +
"proxy_set_header X-Forwarded-Proto $scheme;"
;
};
locations."/notifications/hub/negotiate" = {
proxyPass = "http://127.0.0.1:8222";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig =
"proxy_set_header Host $host;" +
"proxy_set_header X-Real-IP $remote_addr;" +
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" +
"proxy_set_header X-Forwarded-Proto $scheme;"
;
};
locations."/notifications/hub" = {
proxyPass = "http://127.0.0.1:3012";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig =
"proxy_set_header Host $host;" +
"proxy_set_header X-Real-IP $remote_addr;" +
"proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" +
"proxy_set_header X-Forwarded-Proto $scheme;"
;
};
};
}

2
modules/base/nix.nix
View File

@ -5,7 +5,7 @@
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 15d";
options = "--delete-older-than 15";
};
};
}