summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--kartei/lass/neoprism.nix16
-rw-r--r--kartei/lass/prism.nix1
-rw-r--r--kartei/lass/radio.nix1
-rw-r--r--kartei/lass/yellow.nix2
-rw-r--r--krebs/nixpkgs-unstable.json8
-rw-r--r--krebs/nixpkgs.json8
-rw-r--r--lass/1systems/neoprism/config.nix5
-rw-r--r--lass/1systems/prism/config.nix28
-rw-r--r--lass/1systems/yellow/config.nix37
-rw-r--r--lass/2configs/gg23.nix105
-rw-r--r--lass/2configs/radio/container-host.nix23
-rw-r--r--lass/2configs/radio/default.nix86
-rw-r--r--lass/2configs/radio/weather.nix26
-rw-r--r--lass/2configs/radio/weather_for_ips.py45
-rw-r--r--lass/2configs/riot.nix14
-rw-r--r--lass/2configs/sync/the_playlist.nix2
-rw-r--r--lass/3modules/sync-containers3.nix30
17 files changed, 298 insertions, 139 deletions
diff --git a/kartei/lass/neoprism.nix b/kartei/lass/neoprism.nix
index 74b8aca3c..9538c3003 100644
--- a/kartei/lass/neoprism.nix
+++ b/kartei/lass/neoprism.nix
@@ -1,6 +1,20 @@
{ r6, w6, ... }:
{
- nets = {
+ nets = rec {
+ internet = {
+ ip4 = rec {
+ addr = "95.217.192.59";
+ prefix = "${addr}/32";
+ };
+ ip6 = rec {
+ addr = "2a01:4f9:4a:4f1a::1";
+ prefix = "${addr}/64";
+ };
+ aliases = [
+ "neoprism.i"
+ ];
+ ssh.port = 45621;
+ };
retiolum = {
ip4.addr = "10.243.0.99";
ip6.addr = r6 "99";
diff --git a/kartei/lass/prism.nix b/kartei/lass/prism.nix
index 029216f88..cfc05b636 100644
--- a/kartei/lass/prism.nix
+++ b/kartei/lass/prism.nix
@@ -70,7 +70,6 @@ rec {
"c.r"
"p.r"
"search.r"
- "radio-news.r"
];
tinc = {
pubkey = ''
diff --git a/kartei/lass/radio.nix b/kartei/lass/radio.nix
index bfb177e19..808245312 100644
--- a/kartei/lass/radio.nix
+++ b/kartei/lass/radio.nix
@@ -6,6 +6,7 @@
ip6.addr = r6 "4d10";
aliases = [
"radio.r"
+ "radio-news.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
diff --git a/kartei/lass/yellow.nix b/kartei/lass/yellow.nix
index a62c6167c..bb0b1f09b 100644
--- a/kartei/lass/yellow.nix
+++ b/kartei/lass/yellow.nix
@@ -7,6 +7,8 @@
aliases = [
"yellow.r"
"jelly.r"
+ "radar.r"
+ "sonar.r"
];
tinc = {
pubkey = ''
diff --git a/krebs/nixpkgs-unstable.json b/krebs/nixpkgs-unstable.json
index 644192bbf..6af475a29 100644
--- a/krebs/nixpkgs-unstable.json
+++ b/krebs/nixpkgs-unstable.json
@@ -1,9 +1,9 @@
{
"url": "https://github.com/NixOS/nixpkgs",
- "rev": "64e0bf055f9d25928c31fb12924e59ff8ce71e60",
- "date": "2022-12-11T09:33:23+00:00",
- "path": "/nix/store/lmiwldi32kcc2qgm68swxgb3xzba0ayc-nixpkgs",
- "sha256": "1hmx7hhjr74fqmxhb49yfyrpqhzwayrq48xwjv3a117czpb0gnjx",
+ "rev": "befc83905c965adfd33e5cae49acb0351f6e0404",
+ "date": "2023-01-13T18:32:21+01:00",
+ "path": "/nix/store/bwpp6fchhfw699jn9hsdypyc7ggb72gx-nixpkgs",
+ "sha256": "0m0ik7z06q3rshhhrg2p0vsrkf2jnqcq5gq1q6wb9g291rhyk6h2",
"fetchLFS": false,
"fetchSubmodules": false,
"deepClone": false,
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 17bffe634..fd6aeb114 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,9 +1,9 @@
{
"url": "https://github.com/NixOS/nixpkgs",
- "rev": "9d692a724e74d2a49f7c985132972f991d144254",
- "date": "2022-12-16T13:36:40-05:00",
- "path": "/nix/store/76wc0ymx7rw348hpl0bp0yb77sf40xd6-nixpkgs",
- "sha256": "1byh49p3kwi6adb1izaalj2ab9disfzq1cx526gwgv20ilmphvnr",
+ "rev": "2f9fd351ec37f5d479556cd48be4ca340da59b8f",
+ "date": "2023-01-15T13:38:37-03:00",
+ "path": "/nix/store/mn2dwzki0d159fl09y87jrvyvcjgyy03-nixpkgs",
+ "sha256": "0w3ysrhbqhgr1qnh0r9miyqd7yf7vsd4wcd21dffwjlb99lynla8",
"fetchLFS": false,
"fetchSubmodules": false,
"deepClone": false,
diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix
index f203abc07..8e5a60c36 100644
--- a/lass/1systems/neoprism/config.nix
+++ b/lass/1systems/neoprism/config.nix
@@ -4,8 +4,13 @@
imports = [
<stockholm/lass>
<stockholm/lass/2configs/retiolum.nix>
+
+ # sync-containers
<stockholm/lass/2configs/consul.nix>
<stockholm/lass/2configs/yellow-host.nix>
+ <stockholm/lass/2configs/radio/container-host.nix>
+
+ # other containers
<stockholm/lass/2configs/riot.nix>
];
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index c2a405759..bcc8c1a08 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -97,9 +97,35 @@ with import <stockholm/lib>;
localAddress = "10.233.2.2";
};
}
+ {
+ services.nginx.virtualHosts."radio.lassul.us" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/" = {
+ # recommendedProxySettings = true;
+ proxyWebsockets = true;
+ proxyPass = "http://radio.r";
+ extraConfig = ''
+ proxy_set_header Host radio.r;
+ # get source ip for weather reports
+ proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
+ '';
+ };
+ };
+ krebs.htgen.radio-redirect = {
+ port = 8000;
+ scriptFile = pkgs.writers.writeDash "redir" ''
+ printf 'HTTP/1.1 301 Moved Permanently\r\n'
+ printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
+ printf '\r\n'
+ '';
+ };
+ krebs.iptables.tables.filter.INPUT.rules = [
+ { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
+ ];
+ }
<stockholm/lass/2configs/exim-smarthost.nix>
<stockholm/lass/2configs/privoxy-retiolum.nix>
- <stockholm/lass/2configs/radio>
<stockholm/lass/2configs/binary-cache/server.nix>
<stockholm/lass/2configs/iodined.nix>
<stockholm/lass/2configs/paste.nix>
diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix
index 552dd7f00..06561e9cf 100644
--- a/lass/1systems/yellow/config.nix
+++ b/lass/1systems/yellow/config.nix
@@ -34,6 +34,12 @@ in {
};
};
+ security.acme.defaults.email = "spam@krebsco.de";
+ security.acme.acceptTerms = true;
+ security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
+ security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
+ security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
+ security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
services.nginx = {
enable = true;
package = pkgs.nginx.override {
@@ -41,8 +47,10 @@ in {
fancyindex
];
};
- virtualHosts.default = {
+ virtualHosts."yellow.r" = {
default = true;
+ enableACME = true;
+ addSSL = true;
locations."/" = {
root = "/var/download";
extraConfig = ''
@@ -137,11 +145,29 @@ in {
'';
};
virtualHosts."jelly.r" = {
+ enableACME = true;
+ addSSL = true;
locations."/".extraConfig = ''
proxy_pass http://localhost:8096/;
proxy_set_header Accept-Encoding "";
'';
};
+ virtualHosts."radar.r" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://localhost:7878";
+ };
+ };
+ virtualHosts."sonar.r" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://localhost:8989";
+ };
+ };
};
services.samba = {
@@ -215,6 +241,7 @@ in {
enable = true;
tables.filter.INPUT.rules = [
{ predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
+ { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
{ predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
{ predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
{ predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
@@ -222,6 +249,7 @@ in {
{ predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
{ predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
{ predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
+ { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
# smbd
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
@@ -367,13 +395,20 @@ in {
services.radarr = {
enable = true;
+ group = "download";
};
services.sonarr = {
enable = true;
+ group = "download";
};
services.prowlarr = {
enable = true;
};
+
+ services.bazarr = {
+ enable = true;
+ group = "download";
+ };
}
diff --git a/lass/2configs/gg23.nix b/lass/2configs/gg23.nix
index 6bcbd7400..1af2fa226 100644
--- a/lass/2configs/gg23.nix
+++ b/lass/2configs/gg23.nix
@@ -2,37 +2,66 @@
with import <stockholm/lib>;
{
+ # ipv6 from vodafone is really really flaky
+ boot.kernel.sysctl."net.ipv6.conf.et0.disable_ipv6" = 1;
+ systemd.network.networks."50-et0" = {
+ matchConfig.Name = "et0";
+ DHCP = "ipv4";
+ # dhcpV4Config.UseDNS = false;
+ # dhcpV6Config.UseDNS = false;
+ linkConfig = {
+ RequiredForOnline = "routable";
+ };
+ # networkConfig = {
+ # LinkLocalAddressing = "no";
+ # };
+ # dhcpV6Config = {
+ # PrefixDelegationHint = "::/60";
+ # };
+ # networkConfig = {
+ # IPv6AcceptRA = true;
+ # };
+ # ipv6PrefixDelegationConfig = {
+ # Managed = true;
+ # };
+ };
+ boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+ systemd.network.networks."50-int0" = {
+ name = "int0";
+ address = [
+ "10.42.0.1/24"
+ ];
+ networkConfig = {
+ # IPForward = "yes";
+ # IPMasquerade = "both";
+ ConfigureWithoutCarrier = true;
+ DHCPServer = "yes";
+ # IPv6SendRA = "yes";
+ # DHCPPrefixDelegation = "yes";
+ };
+ };
networking.networkmanager.unmanaged = [ "int0" ];
- networking.interfaces.int0.ipv4.addresses = [{
- address = "10.42.0.1";
- prefixLength = 24;
- }];
+ krebs.iptables.tables.filter.INPUT.rules = [
+ { predicate = "-i int0"; target = "ACCEPT"; }
+ ];
+ krebs.iptables.tables.filter.FORWARD.rules = [
+ { predicate = "-i int0"; target = "ACCEPT"; }
+ { predicate = "-o int0"; target = "ACCEPT"; }
+ { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
+ ];
+ krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
+ { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; }
+ ];
+ krebs.iptables.tables.nat.POSTROUTING.rules = [
+ { v6 = false; predicate = "-s 10.42.0.0/24"; target = "MASQUERADE"; }
+ ];
networking.domain = "gg23";
- services.dhcpd4 = {
- enable = true;
- interfaces = [ "int0" ];
- extraConfig = ''
- option subnet-mask 255.255.255.0;
- option routers 10.42.0.1;
- option domain-name-servers 10.42.0.1;
- subnet 10.42.0.0 netmask 255.255.255.0 {
- range 10.42.0.100 10.42.0.200;
- }
- '';
- machines = [
- { ethernetAddress = "a8:a6:48:65:ce:4c"; hostName = "tv"; ipAddress = "10.42.0.3"; }
- { ethernetAddress = "3c:2a:f4:22:28:37"; hostName = "drucker"; ipAddress = "10.42.0.4"; }
- { ethernetAddress = "80:7d:3a:67:b7:01"; hostName = "s20-tv"; ipAddress = "10.42.0.10"; }
- { ethernetAddress = "80:7d:3a:68:04:f0"; hostName = "s20-drucker"; ipAddress = "10.42.0.11"; }
- { ethernetAddress = "80:7d:3a:68:11:a5"; hostName = "s20-wasch"; ipAddress = "10.42.0.12"; }
- { ethernetAddress = "80:7d:3a:67:bb:69"; hostName = "s20-stereo"; ipAddress = "10.42.0.13"; }
- { ethernetAddress = "ec:b5:fa:07:78:16"; hostName = "hue-bridge"; ipAddress = "10.42.0.21"; }
- { ethernetAddress = "80:8d:b7:c5:80:dc"; hostName = "arubaAP"; ipAddress = "10.42.0.99"; }
- ];
- };
-
+ networking.useHostResolvConf = false;
+ services.resolved.extraConfig = ''
+ DNSStubListener=no
+ '';
services.dnsmasq = {
enable = true;
resolveLocalQueries = false;
@@ -46,21 +75,11 @@ with import <stockholm/lib>;
'';
};
- boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
- krebs.iptables.tables.filter.INPUT.rules = [
- { predicate = "-i int0 -p udp --dport 53"; target = "ACCEPT"; } # dns
- ];
- krebs.iptables.tables.filter.FORWARD.rules = [
- { v6 = false; predicate = "-d 10.42.0.0/24 -o int0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
- { v6 = false; predicate = "-s 10.42.0.0/24 -i int0"; target = "ACCEPT"; }
- { v6 = false; predicate = "-o int0"; target = "REJECT --reject-with icmp-port-unreachable"; }
- { v6 = false; predicate = "-i int0"; target = "REJECT --reject-with icmp-port-unreachable"; }
- ];
- krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
- { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; }
- ];
- krebs.iptables.tables.nat.POSTROUTING.rules = [
- { v6 = false; predicate = "-s 10.42.0.0/24 ! -d 10.42.0.0/24"; target = "MASQUERADE"; }
+ environment.systemPackages = [
+ (pkgs.writers.writeDashBin "restart_router" ''
+ ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m OFF
+ sleep 2
+ ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m ON
+ '')
];
}
-
diff --git a/lass/2configs/radio/container-host.nix b/lass/2configs/radio/container-host.nix
new file mode 100644
index 000000000..e32095ffa
--- /dev/null
+++ b/lass/2configs/radio/container-host.nix
@@ -0,0 +1,23 @@
+{ config, pkgs, ... }:
+{
+ lass.sync-containers3.containers.radio = {
+ sshKey = "${toString <secrets>}/radio.sync.key";
+ };
+ containers.radio = {
+ bindMounts."/var/music" = {
+ hostPath = "/var/music";
+ isReadOnly = false;
+ };
+ };
+ krebs.iptables.tables.filter.INPUT.rules = [
+ { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
+ ];
+ krebs.htgen.radio-redirect = {
+ port = 8000;
+ scriptFile = pkgs.writers.writeDash "redir" ''
+ printf 'HTTP/1.1 301 Moved Permanently\r\n'
+ printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
+ printf '\r\n'
+ '';
+ };
+}
diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix
index 46540969b..a511196fd 100644
--- a/lass/2configs/radio/default.nix
+++ b/lass/2configs/radio/default.nix
@@ -113,7 +113,7 @@ in {
LIMIT=1000 #how many tracks to keep in the history
HISTORY_FILE=/var/lib/radio/recent
- listeners=$(${pkgs.curl}/bin/curl -fSs lassul.us:8000/status-json.xsl |
+ listeners=$(${pkgs.curl}/bin/curl -fSs http://localhost:8000/status-json.xsl |
${pkgs.jq}/bin/jq '[.icestats.source[].listeners] | add' || echo 0)
echo "$(${pkgs.coreutils}/bin/date -Is)" "$filename" | ${pkgs.coreutils}/bin/tee -a "$HISTORY_FILE"
echo "$(${pkgs.coreutils}/bin/tail -$LIMIT "$HISTORY_FILE")" > "$HISTORY_FILE"
@@ -128,14 +128,33 @@ in {
serviceConfig.User = lib.mkForce "radio";
};
+ nixpkgs.config.packageOverrides = opkgs: {
+ icecast = opkgs.icecast.overrideAttrs (old: rec {
+ version = "2.5-beta3";
+
+ src = pkgs.fetchurl {
+ url = "http://downloads.xiph.org/releases/icecast/icecast-${version}.tar.gz";
+ sha256 = "sha256-4FDokoA9zBDYj8RAO/kuTHaZ6jZYBLSJZiX/IYFaCW8=";
+ };
+
+ buildInputs = old.buildInputs ++ [ pkgs.pkg-config ];
+ });
+ };
services.icecast = {
enable = true;
hostname = "radio.lassul.us";
admin.password = "hackme";
extraConf = ''
<authentication>
- <source-password>hackme</source-password>
+ <source-password>hackme</source-password>
+ <admin-user>admin</admin-user>
+ <admin-password>hackme</admin-password>
</authentication>
+ <logging>
+ <accesslog>-</accesslog>
+ <errorlog>-</errorlog>
+ <loglevel>3</loglevel>
+ </logging>
'';
};
@@ -234,18 +253,38 @@ in {
'';
};
+ networking.firewall.allowedTCPPorts = [ 80 ];
services.nginx = {
enable = true;
- virtualHosts."radio.lassul.us" = {
- forceSSL = true;
- enableACME = true;
+ virtualHosts."radio.r" = {
locations."/".extraConfig = ''
- proxy_set_header Host $host;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header X-Forwarded-Host $host;
- proxy_set_header X-Forwarded-Server $host;
- proxy_set_header X-Real-IP $remote_addr;
+ # https://github.com/aswild/icecast-notes#core-nginx-config
proxy_pass http://localhost:8000;
+ # Disable request size limit, very important for uploading large files
+ client_max_body_size 0;
+
+ # Enable support `Transfer-Encoding: chunked`
+ chunked_transfer_encoding on;
+
+ # Disable request and response buffering, minimize latency to/from Icecast
+ proxy_buffering off;
+ proxy_request_buffering off;
+
+ # Icecast needs HTTP/1.1, not 1.0 or 2
+ proxy_http_version 1.1;
+
+ # Forward all original request headers
+ proxy_pass_request_headers on;
+
+ # Set some standard reverse proxy headers. Icecast server currently ignores these,
+ # but may support them in a future version so that access logs are more useful.
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ # get source ip for weather reports
+ proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
'';
locations."= /recent".extraConfig = ''
default_type "text/plain";
@@ -266,7 +305,7 @@ in {
while sleep 1; do
mpv \
--cache-secs=0 --demuxer-readahead-secs=0 --untimed --cache-pause=no \
- 'http://lassul.us:8000/radio.ogg'
+ 'http://radio.lassul.us/radio.ogg'
done
'';
locations."= /controls".extraConfig = ''
@@ -278,33 +317,10 @@ in {
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
'';
};
- virtualHosts."lassul.us".locations."= /the_playlist".extraConfig = let
- html = pkgs.writeText "index.html" ''
- <!DOCTYPE html>
- <html lang="en">
- <head>
- <meta charset="utf-8">
- <title>lassulus playlist</title>
- </head>
- <body>
- <div style="display:inline-block;margin:0px;padding:0px;overflow:hidden">
- <iframe src="https://kiwiirc.com/client/irc.hackint.org/?nick=kiwi_test|?&theme=cli#the_playlist" frameborder="0" style="overflow:hidden;overflow-x:hidden;overflow-y:hidden;height:95%;width:100%;position:absolute;top:0px;left:0px;right:0px;bottom:0px" height="95%" width="100%"></iframe>
- </div>
- <div style="position:absolute;bottom:1px;display:inline-block;background-color:red;">
- <audio controls autoplay="autoplay"><source src="http://lassul.us:8000/radio.ogg" type="audio/ogg">Your browser does not support the audio element.</audio>
- </div>
- <!-- page content -->
- </body>
- </html>
- '';
- in ''
- default_type "text/html";
- alias ${html};
- '';
};
services.syncthing.declarative.folders."the_playlist" = {
path = "/var/music/the_playlist";
- devices = [ "mors" "phone" "prism" "omo" ];
+ devices = [ "mors" "phone" "prism" "omo" "radio" ];
};
krebs.acl."/var/music/the_playlist"."u:syncthing:X".parents = true;
krebs.acl."/var/music/the_playlist"."u:syncthing:rwX" = {};
diff --git a/lass/2configs/radio/weather.nix b/lass/2configs/radio/weather.nix
index ad96d8ec0..dca8a7843 100644
--- a/lass/2configs/radio/weather.nix
+++ b/lass/2configs/radio/weather.nix
@@ -10,23 +10,25 @@ let
export PATH="${lib.makeBinPath [
pkgs.coreutils
pkgs.curl
- pkgs.iproute2
- pkgs.jc
pkgs.jq
]}"
curl -fSsz /tmp/GeoLite2-City.mmdb -o /tmp/GeoLite2-City.mmdb http://c.r/GeoLite2-City.mmdb
MAXMIND_GEOIP_DB="/tmp/GeoLite2-City.mmdb"; export MAXMIND_GEOIP_DB
OPENWEATHER_API_KEY=$(cat "$CREDENTIALS_DIRECTORY/openweather_api"); export OPENWEATHER_API_KEY
- ss -no 'sport = :8000' |
- jc --ss | jq -r '
- [
- .[] |
- select(
- .local_address != "[::ffff:127.0.0.1]"
- and .local_address != "[::1]"
- ) | .peer_address | gsub("[\\[\\]]"; "")
- ] | unique[]
- ' |
+ (
+ curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.ogg'
+ curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.mp3'
+ curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.opus'
+ ) | jq -rs '
+ [
+ .[][].source|values|to_entries[].value |
+ (.listener//[]) [] |
+ (.useragent | capture("client-ip=(?<ip>[a-f0-9.:]+)")).ip // .ip
+ ] |
+ unique[] |
+ select(. != "127.0.0.1") |
+ select(. != "::1")
+ ' |
${weather_for_ips}/bin/weather_for_ips
'';
in {
diff --git a/lass/2configs/radio/weather_for_ips.py b/lass/2configs/radio/weather_for_ips.py
index 447c6389b..62206a985 100644
--- a/lass/2configs/radio/weather_for_ips.py
+++ b/lass/2configs/radio/weather_for_ips.py
@@ -20,26 +20,29 @@ for ip in fileinput.input():
f'The probability of reincarnation is {random.randrange(0, 100)} percent.'
)
else:
- location = geoip.city(ip.strip())
- if location.city.geoname_id not in seen:
- seen[location.city.geoname_id] = True
- weather_api_key = os.environ['OPENWEATHER_API_KEY']
- url = (
- f'https://api.openweathermap.org/data/2.5/onecall'
- f'?lat={location.location.latitude}'
- f'&lon={location.location.longitude}'
- f'&appid={weather_api_key}'
- f'&units=metric'
- )
- resp = requests.get(url)
- weather = json.loads(resp.text)
- output.append(
- f'Weather report for {location.city.name}, {location.country.name}. '
- f'It is {weather["current"]["weather"][0]["description"]} outside '
- f'with a temperature of {weather["current"]["temp"]:.1f} degrees, '
- f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second '
- f'and a humidity of {weather["current"]["humidity"]} percent. '
- f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. '
- )
+ try:
+ location = geoip.city(ip.strip())
+ if location.city.geoname_id not in seen:
+ seen[location.city.geoname_id] = True
+ weather_api_key = os.environ['OPENWEATHER_API_KEY']
+ url = (
+ f'https://api.openweathermap.org/data/2.5/onecall'
+ f'?lat={location.location.latitude}'
+ f'&lon={location.location.longitude}'
+ f'&appid={weather_api_key}'
+ f'&units=metric'
+ )
+ resp = requests.get(url)
+ weather = json.loads(resp.text)
+ output.append(
+ f'Weather report for {location.city.name}, {location.country.name}. '
+ f'It is {weather["current"]["weather"][0]["description"]} outside '
+ f'with a temperature of {weather["current"]["temp"]:.1f} degrees, '
+ f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second '
+ f'and a humidity of {weather["current"]["humidity"]} percent. '
+ f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. '
+ )
+ except: # noqa E722
+ pass
print('\n'.join(output))
diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix
index 559e7b20d..6aacec5b6 100644
--- a/lass/2configs/riot.nix
+++ b/lass/2configs/riot.nix
@@ -31,27 +31,31 @@
privateNetwork = true;
hostAddress = "10.233.1.1";
localAddress = "10.233.1.2";
- forwardPorts = [
- { hostPort = 45622; containerPort = 22; }
- ];
};
systemd.network.networks."50-ve-riot" = {
matchConfig.Name = "ve-riot";
networkConfig = {
- IPForward = "yes";
# weirdly we have to use POSTROUTING MASQUERADE here
+ # and set ip_forward manually
+ # IPForward = "yes";
# IPMasquerade = "both";
LinkLocalAddressing = "no";
KeepConfiguration = "static";
};
};
- # networking.nat can be used instead of this
+ boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
{ v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; }
];
+
+ # networking.nat can be used instead of this
+ krebs.iptables.tables.nat.PREROUTING.rules = [
+ { predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; }
+ ];
krebs.iptables.tables.filter.FORWARD.rules = [
{ predicate = "-i ve-riot"; target = "ACCEPT"; }
{ predicate = "-o ve-riot"; target = "ACCEPT"; }
diff --git a/lass/2configs/sync/the_playlist.nix b/lass/2configs/sync/the_playlist.nix
index c01a11cc3..233ca8fb7 100644
--- a/lass/2configs/sync/the_playlist.nix
+++ b/lass/2configs/sync/the_playlist.nix
@@ -1,7 +1,7 @@
{
services.syncthing.folders.the_playlist = {
path = "/home/lass/tmp/the_playlist";
- devices = [ "mors" "phone" "prism" "omo" ];
+ devices = [ "mors" "phone" "prism" "omo" "radio" ];
};
krebs.acl."/home/lass/tmp/the_playlist"."u:syncthing:X".parents = true;
krebs.acl."/home/lass/tmp/the_playlist"."u:syncthing:rwX" = {};
diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix
index 86aa40f03..5188f270d 100644
--- a/lass/3modules/sync-containers3.nix
+++ b/lass/3modules/sync-containers3.nix
@@ -104,9 +104,8 @@ in {
consul lock sync_${ctr.name} ${pkgs.writers.writeDash "${ctr.name}-sync" ''
set -efux
if /run/wrappers/bin/ping -c 1 ${ctr.name}.r; then
- touch "$HOME"/incomplete
- rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --timeout=30 --inplace container_sync@${ctr.name}.r:disk "$HOME"/disk
- rm "$HOME"/incomplete
+ nice --adjustment=30 rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --timeout=30 container_sync@${ctr.name}.r:disk "$HOME"/disk
+ rm -f "$HOME"/incomplete
fi
''}
'';
@@ -218,10 +217,6 @@ in {
exit 0
;;
esac
- if test -e /var/lib/sync-containers3/${ctr.name}/incomplete; then
- echo 'data is inconistent, start aborted'
- exit 1
- fi
consul kv put containers/${ctr.name} "$(jq -cn '{host: "${config.networking.hostName}", time: now}')" >/dev/null
consul lock -verbose -monitor-retry=100 -timeout 30s -name container_${ctr.name} container_${ctr.name} ${pkgs.writers.writeBash "${ctr.name}-start" ''
set -efu
@@ -230,8 +225,8 @@ in {
mountpoint /var/lib/sync-containers3/${ctr.name}/state || mount /dev/mapper/${ctr.name} /var/lib/sync-containers3/${ctr.name}/state
/run/current-system/sw/bin/nixos-container start ${ctr.name}
# wait for system to become reachable for the first time
- retry -t 10 -d 10 -- /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null
systemctl start ${ctr.name}_watcher.service
+ retry -t 10 -d 10 -- /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null
while systemctl is-active container@${ctr.name}.service >/devnull && /run/wrappers/bin/ping -q -c 3 ${ctr.name}.r >/dev/null; do
consul kv put containers/${ctr.name} "$(jq -cn '{host: "${config.networking.hostName}", time: now}')" >/dev/null
sleep 10
@@ -240,6 +235,13 @@ in {
'';
};
}; }
+ { "container@${ctr.name}" = lib.mkIf ctr.runContainer {
+ serviceConfig = {
+ ExecStop = pkgs.writers.writeDash "remove_interface" ''
+ ${pkgs.iproute2}/bin/ip link del vb-${ctr.name}
+ '';
+ };
+ }; }
]) (lib.attrValues cfg.containers)));
systemd.timers = lib.mapAttrs' (n: ctr: lib.nameValuePair "${ctr.name}_syncer" {
@@ -280,14 +282,19 @@ in {
})
(lib.mkIf (cfg.containers != {}) {
# networking
+
+ # needed because otherwise we lose local dns
+ environment.etc."resolv.conf".source = lib.mkForce "/run/systemd/resolve/resolv.conf";
+
+ boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkForce 1;
systemd.network.networks.ctr0 = {
name = "ctr0";
address = [
"10.233.0.1/24"
];
networkConfig = {
- IPForward = "yes";
- IPMasquerade = "both";
+ # IPForward = "yes";
+ # IPMasquerade = "both";
ConfigureWithoutCarrier = true;
DHCPServer = "yes";
};
@@ -304,6 +311,9 @@ in {
{ predicate = "-i ctr0"; target = "ACCEPT"; }
{ predicate = "-o ctr0"; target = "ACCEPT"; }
];
+ krebs.iptables.tables.nat.POSTROUTING.rules = [
+ { v6 = false; predicate = "-s 10.233.0.0/24"; target = "MASQUERADE"; }
+ ];
})
(lib.mkIf cfg.inContainer.enable {
users.groups.container_sync = {};
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-21 23:23:36 +0000