diff options
author | tv <tv@krebsco.de> | 2018-12-11 19:50:50 +0100 |
---|---|---|
committer | tv <tv@krebsco.de> | 2018-12-11 19:50:50 +0100 |
commit | 172a746c3a4735f1f7875f7169b53e8b3df82269 (patch) | |
tree | ee5e0d2e093f446d0f23d1abe599e85766928c12 /lass | |
parent | 761ce9cefdb2c04132f44c2b41fac6d49a472752 (diff) | |
parent | 30772247c0e629d443fb62bc566f3651be1157c1 (diff) |
Merge remote-tracking branch 'prism/master'
Diffstat (limited to 'lass')
-rw-r--r-- | lass/1systems/morpheus/config.nix | 33 | ||||
-rw-r--r-- | lass/1systems/morpheus/physical.nix | 32 | ||||
-rw-r--r-- | lass/1systems/prism/config.nix | 26 | ||||
-rw-r--r-- | lass/1systems/yellow/config.nix | 9 | ||||
-rw-r--r-- | lass/2configs/baseX.nix | 4 | ||||
-rw-r--r-- | lass/2configs/default.nix | 1 | ||||
-rw-r--r-- | lass/2configs/exim-smarthost.nix | 1 | ||||
-rw-r--r-- | lass/2configs/games.nix | 1 | ||||
-rw-r--r-- | lass/2configs/mouse.nix | 3 | ||||
-rw-r--r-- | lass/2configs/wirelum.nix | 44 |
10 files changed, 131 insertions, 23 deletions
diff --git a/lass/1systems/morpheus/config.nix b/lass/1systems/morpheus/config.nix new file mode 100644 index 000000000..0d82ba611 --- /dev/null +++ b/lass/1systems/morpheus/config.nix @@ -0,0 +1,33 @@ +{ config, pkgs, ... }: +with import <stockholm/lib>; +{ + imports = [ + <stockholm/lass> + + <stockholm/lass/2configs/retiolum.nix> + <stockholm/lass/2configs/power-action.nix> + <stockholm/lass/2configs/baseX.nix> + <stockholm/lass/2configs/games.nix> + <stockholm/lass/2configs/steam.nix> + ]; + + krebs.build.host = config.krebs.hosts.morpheus; + + networking.wireless.enable = false; + networking.networkmanager.enable = true; + + services.logind.extraConfig = '' + HandleLidSwitch=ignore + ''; + + nixpkgs.config.packageOverrides = super: { + steam = super.steam.override { + withPrimus = true; + extraPkgs = p: with p; [ + glxinfo + nettools + bumblebee + ]; + }; + }; +} diff --git a/lass/1systems/morpheus/physical.nix b/lass/1systems/morpheus/physical.nix new file mode 100644 index 000000000..0f08acb2d --- /dev/null +++ b/lass/1systems/morpheus/physical.nix @@ -0,0 +1,32 @@ +{ lib, ... }: +{ + imports = [ + <nixpkgs/nixos/modules/installer/scan/not-detected.nix> + ./config.nix + ]; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostId = "60ce7e88"; + + boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.kernelParams = [ "acpi_osi=!" ''acpi_osi="Windows 2009"'' ]; + + hardware.bumblebee.enable = true; + hardware.bumblebee.group = "video"; + + fileSystems."/" = + { device = "rpool/root"; + fsType = "zfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/DF3B-4528"; + fsType = "vfat"; + }; + + nix.maxJobs = lib.mkDefault 8; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; +} diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index 83cc96771..ec3976519 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -297,37 +297,25 @@ with import <stockholm/lib>; }; } { - krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-p udp --dport 51820"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } + imports = [ + <stockholm/lass/2configs/wirelum.nix> ]; + #krebs.iptables.tables.nat.PREROUTING.rules = [ + # { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } + #]; krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } + { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24 -d 10.243.0.0/16"; target = "ACCEPT"; } { v6 = false; precedence = 1000; predicate = "-s 10.243.0.0/16 -d 10.244.1.0/24"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ { v6 = false; predicate = "-s 10.244.1.0/24 ! -d 10.244.1.0/24"; target = "MASQUERADE"; } ]; - networking.wireguard.interfaces.wg0 = { - ips = [ "10.244.1.1/24" ]; - listenPort = 51820; - privateKeyFile = (toString <secrets>) + "/wireguard.key"; - allowedIPsAsRoutes = true; - peers = [ - { - # lass-android - allowedIPs = [ "10.244.1.2/32" ]; - publicKey = "zVunBVOxsMETlnHkgjfH71HaZjjNUOeYNveAVv5z3jw="; - } - ]; - }; services.dnsmasq = { enable = true; resolveLocalQueries = false; extraConfig= '' + listen-address=10.244.1.1 except-interface=lo interface=wg0 ''; diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ff7b23687..58fa564a1 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -19,7 +19,11 @@ with import <stockholm/lib>; users.groups.download.members = [ "transmission" ]; users.users.transmission.group = mkForce "download"; - systemd.services.transmission.serviceConfig.bindsTo = [ "openvpn-nordvpn.service" ]; + systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; + systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; + systemd.services.transmission.postStart = '' + chmod 775 /var/download/finished + ''; services.transmission = { enable = true; settings = { @@ -52,6 +56,9 @@ with import <stockholm/lib>; autoindex on; ''; }; + locations."/dl".extraConfig = '' + return 301 /; + ''; locations."/" = { root = "/var/download/finished"; extraConfig = '' diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix index d781f8c71..53d90ed7d 100644 --- a/lass/2configs/baseX.nix +++ b/lass/2configs/baseX.nix @@ -97,9 +97,9 @@ in { enable = true; layout = "us"; display = mkForce 0; - xkbModel = "evdev"; xkbVariant = "altgr-intl"; - xkbOptions = "caps:backspace"; + xkbOptions = "caps:escape"; + libinput.enable = true; displayManager.lightdm.enable = true; windowManager.default = "xmonad"; windowManager.session = [{ diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index a43113177..dea32d4d4 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -10,6 +10,7 @@ with import <stockholm/lib>; ./zsh.nix ./htop.nix ./security-workarounds.nix + ./wirelum.nix { users.extraUsers = mapAttrs (_: h: { hashedPassword = h; }) diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix index 1ee45bb41..1acfe5056 100644 --- a/lass/2configs/exim-smarthost.nix +++ b/lass/2configs/exim-smarthost.nix @@ -94,6 +94,7 @@ with import <stockholm/lib>; { from = "osmocom@lassul.us"; to = lass.mail; } { from = "lesswrong@lassul.us"; to = lass.mail; } { from = "nordvpn@lassul.us"; to = lass.mail; } + { from = "csv-direct@lassul.us"; to = lass.mail; } ]; system-aliases = [ { from = "mailer-daemon"; to = "postmaster"; } diff --git a/lass/2configs/games.nix b/lass/2configs/games.nix index 49602898e..62e3f6d52 100644 --- a/lass/2configs/games.nix +++ b/lass/2configs/games.nix @@ -57,6 +57,7 @@ let in { environment.systemPackages = with pkgs; [ + dolphinEmu doom1 doom2 vdoom1 diff --git a/lass/2configs/mouse.nix b/lass/2configs/mouse.nix index 098809d62..f5f9319ed 100644 --- a/lass/2configs/mouse.nix +++ b/lass/2configs/mouse.nix @@ -1,4 +1,4 @@ -{ ... }: +{ lib, ... }: { hardware.trackpoint = { enable = true; @@ -7,6 +7,7 @@ emulateWheel = true; }; + services.xserver.libinput.enable = lib.mkForce false; services.xserver.synaptics = { enable = true; horizEdgeScroll = false; diff --git a/lass/2configs/wirelum.nix b/lass/2configs/wirelum.nix new file mode 100644 index 000000000..cd8a20c6b --- /dev/null +++ b/lass/2configs/wirelum.nix @@ -0,0 +1,44 @@ +with import <stockholm/lib>; +{ config, pkgs, ... }: let + + self = config.krebs.build.host.nets.wirelum; + isRouter = !isNull self.via; + +in mkIf (hasAttr "wirelum" config.krebs.build.host.nets) { + #hack for modprobe inside containers + systemd.services."wireguard-wirelum".path = mkIf config.boot.isContainer (mkBefore [ + (pkgs.writeDashBin "modprobe" ":") + ]); + + boot.kernel.sysctl = mkIf isRouter { + "net.ipv6.conf.all.forwarding" = 1; + }; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; } + ]; + krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [ + { precedence = 1000; predicate = "-i wirelum -o wirelum"; target = "ACCEPT"; } + ]; + + networking.wireguard.interfaces.wirelum = { + ips = + (optional (!isNull self.ip4) self.ip4.addr) ++ + (optional (!isNull self.ip6) self.ip6.addr); + listenPort = 51820; + privateKeyFile = (toString <secrets>) + "/wirelum.key"; + allowedIPsAsRoutes = true; + peers = mapAttrsToList + (_: host: { + allowedIPs = if isRouter then + (optional (!isNull host.nets.wirelum.ip4) host.nets.wirelum.ip4.addr) ++ + (optional (!isNull host.nets.wirelum.ip6) host.nets.wirelum.ip6.addr) + else + host.nets.wirelum.wireguard.subnets + ; + endpoint = mkIf (!isNull host.nets.wirelum.via) (host.nets.wirelum.via.ip4.addr + ":${toString host.nets.wirelum.wireguard.port}"); + persistentKeepalive = mkIf (!isNull host.nets.wirelum.via) 61; + publicKey = host.nets.wirelum.wireguard.pubkey; + }) + (filterAttrs (_: h: hasAttr "wirelum" h.nets) config.krebs.hosts); + }; +} |