diff options
author | lassulus <lass@aidsballs.de> | 2016-02-01 15:19:04 +0100 |
---|---|---|
committer | lassulus <lass@aidsballs.de> | 2016-02-01 15:19:04 +0100 |
commit | b7e2a64c3205a36b850dd1990146e0aeab5dbf5e (patch) | |
tree | 1434c93427bee20fb515168c6a2705eb04aa2970 /makefu/1systems/omo.nix | |
parent | 72dc2dd7fa54c77e08052efed21f68758fa533a2 (diff) | |
parent | b38a821c31de84af6567073bd65ac76c5fc02b5d (diff) |
Merge remote-tracking branch 'gum/master'
Diffstat (limited to 'makefu/1systems/omo.nix')
-rw-r--r-- | makefu/1systems/omo.nix | 44 |
1 files changed, 38 insertions, 6 deletions
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 552af4e4..19183fea 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -31,10 +31,45 @@ in { ../2configs/nginx/omo-share.nix ../3modules ]; + networking.firewall.trustedInterfaces = [ "enp3s0" ]; + # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net + # tcp:80 - nginx for sharing files + # tcp:655 udp:655 - tinc + # tcp:8080 - sabnzbd + networking.firewall.allowedUDPPorts = [ 655 ]; + networking.firewall.allowedTCPPorts = [ 80 655 8080 ]; + # services.openssh.allowSFTP = false; - krebs.build.host = config.krebs.hosts.omo; krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce"; + # samba share /media/crypt1/share + users.users.smbguest = { + name = "smbguest"; + uid = config.ids.uids.smbguest; + description = "smb guest user"; + home = "/var/empty"; + }; + services.samba = { + enable = true; + shares = { + winshare = { + path = "/media/crypt1/share"; + "read only" = "no"; + browseable = "yes"; + "guest ok" = "yes"; + }; + }; + extraConfig = '' + guest account = smbguest + map to guest = bad user + # disable printing + load printers = no + printing = bsd + printcap name = /dev/null + disable spoolss = yes + ''; + }; + # copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/ services.sabnzbd.enable = true; systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; @@ -67,6 +102,7 @@ in { ${pkgs.hdparm}/sbin/hdparm -y ${disk} '') allDisks); + # crypto unlocking boot = { initrd.luks = { devices = let @@ -97,15 +133,11 @@ in { extraModulePackages = [ ]; }; - networking.firewall.allowedUDPPorts = [ 655 ]; - # 8080: sabnzbd - networking.firewall.allowedTCPPorts = [ 80 655 8080 ]; - hardware.enableAllFirmware = true; hardware.cpu.amd.updateMicrocode = true; zramSwap.enable = true; zramSwap.numDevices = 2; - + krebs.build.host = config.krebs.hosts.omo; } |