diff options
| author | makefu <github@syntax-fehler.de> | 2022-12-12 19:44:00 +0100 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2022-12-12 19:44:00 +0100 |
| commit | 6eb5e44b7e5bdc8b1b3b5ffe40c146841f7afd10 (patch) | |
| tree | f706bf7c3c7a289f680ac329caa2b578e5145a56 /krebs/1systems | |
| parent | 96e934dc8a353cff91ef824f6a125ed49996d058 (diff) | |
| parent | 3884243448869bdf09f6434b385e532c7c26ae88 (diff) | |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'krebs/1systems')
| -rw-r--r-- | krebs/1systems/hotdog/config.nix | 4 | ||||
| -rw-r--r-- | krebs/1systems/ponte/config.nix | 26 |
2 files changed, 30 insertions, 0 deletions
diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix index cf07d3b4d..9849937d5 100644 --- a/krebs/1systems/hotdog/config.nix +++ b/krebs/1systems/hotdog/config.nix @@ -13,12 +13,16 @@ <stockholm/krebs/2configs/acme.nix> <stockholm/krebs/2configs/mud.nix> + <stockholm/krebs/2configs/cal.nix> + <stockholm/krebs/2configs/mastodon.nix> + ## shackie irc bot <stockholm/krebs/2configs/shack/reaktor.nix> ]; krebs.build.host = config.krebs.hosts.hotdog; krebs.github-hosts-sync.enable = true; + krebs.pages.enable = true; boot.isContainer = true; networking.useDHCP = false; diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix index 8250ebad9..2f55995cf 100644 --- a/krebs/1systems/ponte/config.nix +++ b/krebs/1systems/ponte/config.nix @@ -7,5 +7,31 @@ <stockholm/krebs/2configs/matterbridge.nix> ]; + networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.logRefusedConnections = false; + networking.firewall.logRefusedUnicastsOnly = false; + + # Move Internet-facing SSH port to reduce logspam. + networking.firewall.extraCommands = let + host = config.krebs.build.host; + in /* sh */ '' + iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22 + iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22 + iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT + iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0 + + ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22 + ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22 + ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT + ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0 + ''; + krebs.build.host = config.krebs.hosts.ponte; + + krebs.pages.enable = true; + krebs.pages.nginx.addSSL = true; + krebs.pages.nginx.enableACME = true; + + security.acme.acceptTerms = true; + security.acme.certs.${config.krebs.pages.domain}.email = "spam@krebsco.de"; } |