summaryrefslogtreecommitdiffstats
path: root/lass/1systems
diff options
context:
space:
mode:
Diffstat (limited to 'lass/1systems')
-rw-r--r--lass/1systems/coaxmetal/config.nix2
-rw-r--r--lass/1systems/green/config.nix2
-rw-r--r--lass/1systems/mors/config.nix1
-rw-r--r--lass/1systems/neoprism/config.nix18
-rw-r--r--lass/1systems/neoprism/disk.nix116
-rw-r--r--lass/1systems/neoprism/physical.nix42
-rw-r--r--lass/1systems/prism/config.nix48
-rw-r--r--lass/1systems/radio/config.nix24
-rw-r--r--lass/1systems/radio/physical.nix7
-rw-r--r--lass/1systems/shodan/config.nix2
-rw-r--r--lass/1systems/yellow/config.nix154
11 files changed, 385 insertions, 31 deletions
diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix
index dd8308bb..2c88b68c 100644
--- a/lass/1systems/coaxmetal/config.nix
+++ b/lass/1systems/coaxmetal/config.nix
@@ -16,7 +16,7 @@
<stockholm/lass/2configs/steam.nix>
<stockholm/lass/2configs/wine.nix>
<stockholm/lass/2configs/fetchWallpaper.nix>
- <stockholm/lass/2configs/prism-mounts/samba.nix>
+ <stockholm/lass/2configs/yellow-mounts/samba.nix>
<stockholm/lass/2configs/pass.nix>
<stockholm/lass/2configs/mail.nix>
<stockholm/lass/2configs/bitcoin.nix>
diff --git a/lass/1systems/green/config.nix b/lass/1systems/green/config.nix
index 4c98091f..cd38c358 100644
--- a/lass/1systems/green/config.nix
+++ b/lass/1systems/green/config.nix
@@ -57,7 +57,7 @@ with import <stockholm/lib>;
];
krebs.iptables.tables.nat.PREROUTING.rules = [
- { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
+ { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
];
# workaround for ssh access from yubikey via android
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index dd479f26..6d0d177e 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -41,6 +41,7 @@ with import <stockholm/lib>;
<stockholm/lass/2configs/ppp/umts-stick.nix>
# <stockholm/lass/2configs/remote-builder/morpheus.nix>
# <stockholm/lass/2configs/remote-builder/prism.nix>
+ <stockholm/lass/2configs/autotether.nix>
{
krebs.iptables.tables.filter.INPUT.rules = [
#risk of rain
diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix
new file mode 100644
index 00000000..8e5a60c3
--- /dev/null
+++ b/lass/1systems/neoprism/config.nix
@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+
+{
+ imports = [
+ <stockholm/lass>
+ <stockholm/lass/2configs/retiolum.nix>
+
+ # sync-containers
+ <stockholm/lass/2configs/consul.nix>
+ <stockholm/lass/2configs/yellow-host.nix>
+ <stockholm/lass/2configs/radio/container-host.nix>
+
+ # other containers
+ <stockholm/lass/2configs/riot.nix>
+ ];
+
+ krebs.build.host = config.krebs.hosts.neoprism;
+}
diff --git a/lass/1systems/neoprism/disk.nix b/lass/1systems/neoprism/disk.nix
new file mode 100644
index 00000000..cf9a8cef
--- /dev/null
+++ b/lass/1systems/neoprism/disk.nix
@@ -0,0 +1,116 @@
+{ lib, ... }:
+{
+ disk = (lib.genAttrs [ "/dev/nvme0n1" "/dev/nvme1n1" ] (disk: {
+ type = "disk";
+ device = disk;
+ content = {
+ type = "table";
+ format = "gpt";
+ partitions = [
+ {
+ name = "boot";
+ type = "partition";
+ start = "0";
+ end = "1M";
+ part-type = "primary";
+ flags = ["bios_grub"];
+ }
+ {
+ type = "partition";
+ name = "ESP";
+ start = "1M";
+ end = "1GiB";
+ fs-type = "fat32";
+ bootable = true;
+ content = {
+ type = "mdraid";
+ name = "boot";
+ };
+ }
+ {
+ type = "partition";
+ name = "zfs";
+ start = "1GiB";
+ end = "100%";
+ content = {
+ type = "zfs";
+ pool = "zroot";
+ };
+ }
+ ];
+ };
+ })) // {
+ hdd1 = {
+ type = "disk";
+ device = "/dev/sda";
+ content = {
+ type = "zfs";
+ pool = "tank";
+ };
+ };
+ };
+ mdadm = {
+ boot = {
+ type = "mdadm";
+ level = 1;
+ metadata = "1.0";
+ content = {
+ type = "filesystem";
+ format = "vfat";
+ mountpoint = "/boot";
+ };
+ };
+ };
+ zpool = {
+ zroot = {
+ type = "zpool";
+ mode = "mirror";
+ mountpoint = "/";
+ rootFsOptions = {
+ };
+ datasets.reserved = {
+ zfs_type = "filesystem";
+ options.refreservation = "1G";
+ };
+ };
+ tank = {
+ type = "zpool";
+ datasets = {
+ reserved = {
+ zfs_type = "filesystem";
+ options.refreservation = "1G";
+ };
+ containers = {
+ zfs_type = "filesystem";
+ mountpoint = "/var/lib/containers";
+ };
+ home = {
+ zfs_type = "filesystem";
+ mountpoint = "/home";
+ };
+ srv = {
+ zfs_type = "filesystem";
+ mountpoint = "/srv";
+ };
+ libvirt = {
+ zfs_type = "filesystem";
+ mountpoint = "/var/lib/libvirt";
+ };
+ # encrypted = {
+ # zfs_type = "filesystem";
+ # options = {
+ # mountpoint = "none";
+ # encryption = "aes-256-gcm";
+ # keyformat = "passphrase";
+ # keylocation = "prompt";
+ # };
+ # };
+
+ # "encrypted/download" = {
+ # zfs_type = "filesystem";
+ # mountpoint = "/var/download";
+ # };
+ };
+ };
+ };
+}
diff --git a/lass/1systems/neoprism/physical.nix b/lass/1systems/neoprism/physical.nix
new file mode 100644
index 00000000..4ffb749f
--- /dev/null
+++ b/lass/1systems/neoprism/physical.nix
@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+ imports = [
+ ./config.nix
+ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
+ ];
+
+ disko.devices = import ./disk.nix;
+ boot.loader.grub.enable = true;
+ boot.loader.grub.version = 2;
+ boot.loader.grub.efiSupport = true;
+ boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ];
+ boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ];
+ boot.kernelModules = [ "kvm-amd" ];
+ hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+ # networking config
+ boot.kernelParams = [ "net.ifnames=0" ];
+ networking.bridges."ext-br".interfaces = [ "eth0" ];
+ networking = {
+ hostId = "2283aaae";
+ defaultGateway = "95.217.192.1";
+ defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; };
+ # Use google's public DNS server
+ nameservers = [ "8.8.8.8" ];
+ interfaces.ext-br.ipv4.addresses = [
+ {
+ address = "95.217.192.59";
+ prefixLength = 26;
+ }
+ ];
+ interfaces.ext-br.ipv6.addresses = [
+ {
+ address = "2a01:4f9:4a:4f1a::1";
+ prefixLength = 64;
+ }
+ ];
+ };
+
+}
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 594a21c0..bcc8c1a0 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -33,9 +33,9 @@ with import <stockholm/lib>;
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
];
};
- krebs.iptables.tables.filter.FORWARD.rules = [
- { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
- { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
+ krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
+ { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
+ { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
];
}
{
@@ -97,9 +97,35 @@ with import <stockholm/lib>;
localAddress = "10.233.2.2";
};
}
+ {
+ services.nginx.virtualHosts."radio.lassul.us" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/" = {
+ # recommendedProxySettings = true;
+ proxyWebsockets = true;
+ proxyPass = "http://radio.r";
+ extraConfig = ''
+ proxy_set_header Host radio.r;
+ # get source ip for weather reports
+ proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
+ '';
+ };
+ };
+ krebs.htgen.radio-redirect = {
+ port = 8000;
+ scriptFile = pkgs.writers.writeDash "redir" ''
+ printf 'HTTP/1.1 301 Moved Permanently\r\n'
+ printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
+ printf '\r\n'
+ '';
+ };
+ krebs.iptables.tables.filter.INPUT.rules = [
+ { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
+ ];
+ }
<stockholm/lass/2configs/exim-smarthost.nix>
<stockholm/lass/2configs/privoxy-retiolum.nix>
- <stockholm/lass/2configs/radio>
<stockholm/lass/2configs/binary-cache/server.nix>
<stockholm/lass/2configs/iodined.nix>
<stockholm/lass/2configs/paste.nix>
@@ -227,13 +253,13 @@ with import <stockholm/lib>;
imports = [
<stockholm/lass/2configs/wiregrill.nix>
];
- krebs.iptables.tables.nat.PREROUTING.rules = [
- { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
- { v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
+ krebs.iptables.tables.nat.PREROUTING.rules = mkOrder 999 [
+ { v6 = false; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
+ { v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
];
- krebs.iptables.tables.filter.FORWARD.rules = [
- { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
- { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
+ krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
+ { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
];
krebs.iptables.tables.nat.POSTROUTING.rules = [
{ v4 = false; predicate = "-s 42:1::/32 ! -d 42:1::/48"; target = "MASQUERADE"; }
@@ -252,7 +278,7 @@ with import <stockholm/lib>;
}
{
krebs.iptables.tables.filter.INPUT.rules = [
- { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";}
+ { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; }
];
}
<stockholm/lass/2configs/murmur.nix>
diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix
new file mode 100644
index 00000000..2fd23a44
--- /dev/null
+++ b/lass/1systems/radio/config.nix
@@ -0,0 +1,24 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+{
+ imports = [
+ <stockholm/lass>
+ <stockholm/lass/2configs>
+ <stockholm/lass/2configs/retiolum.nix>
+
+ <stockholm/lass/2configs/syncthing.nix>
+ <stockholm/lass/2configs/radio>
+ ];
+
+ krebs.build.host = config.krebs.hosts.radio;
+
+ security.acme = {
+ acceptTerms = true;
+ defaults.email = "acme@lassul.us";
+ };
+
+ lass.sync-containers3.inContainer = {
+ enable = true;
+ pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt";
+ };
+}
diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix
new file mode 100644
index 00000000..8577daf3
--- /dev/null
+++ b/lass/1systems/radio/physical.nix
@@ -0,0 +1,7 @@
+{
+ imports = [
+ ./config.nix
+ ];
+ boot.isContainer = true;
+ networking.useDHCP = true;
+}
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index ef538f33..5e48c216 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -16,7 +16,7 @@
<stockholm/lass/2configs/blue-host.nix>
<stockholm/lass/2configs/green-host.nix>
<stockholm/krebs/2configs/news-host.nix>
- <stockholm/lass/2configs/prism-mounts/samba.nix>
+ <stockholm/lass/2configs/yellow-mounts/samba.nix>
<stockholm/lass/2configs/fetchWallpaper.nix>
<stockholm/lass/2configs/consul.nix>
<stockholm/lass/2configs/red-host.nix>
diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix
index c8077e5e..06561e9c 100644
--- a/lass/1systems/yellow/config.nix
+++ b/lass/1systems/yellow/config.nix
@@ -9,20 +9,23 @@ in {
krebs.build.host = config.krebs.hosts.yellow;
+ lass.sync-containers3.inContainer = {
+ enable = true;
+ pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL";
+ };
+
users.groups.download.members = [ "transmission" ];
networking.useHostResolvConf = false;
networking.useNetworkd = true;
- systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ];
- systemd.services.transmission.after = [ "openvpn-nordvpn.service" ];
services.transmission = {
enable = true;
+ home = "/var/state/transmission";
group = "download";
downloadDirPermissions = "775";
settings = {
- download-dir = "/var/download/finished";
- incomplete-dir = "/var/download/incoming";
- incomplete-dir-enable = true;
+ download-dir = "/var/download/transmission";
+ incomplete-dir-enabled = false;
rpc-bind-address = "::";
message-level = 1;
umask = 18;
@@ -31,6 +34,12 @@ in {
};
};
+ security.acme.defaults.email = "spam@krebsco.de";
+ security.acme.acceptTerms = true;
+ security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
+ security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
+ security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
+ security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
services.nginx = {
enable = true;
package = pkgs.nginx.override {
@@ -38,13 +47,12 @@ in {
fancyindex
];
};
- virtualHosts.default = {
+ virtualHosts."yellow.r" = {
default = true;
- locations."/dl".extraConfig = ''
- return 301 /;
- '';
+ enableACME = true;
+ addSSL = true;
locations."/" = {
- root = "/var/download/finished";
+ root = "/var/download";
extraConfig = ''
fancyindex on;
fancyindex_footer "/fancy.html";
@@ -136,9 +144,87 @@ in {
''};
'';
};
+ virtualHosts."jelly.r" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/".extraConfig = ''
+ proxy_pass http://localhost:8096/;
+ proxy_set_header Accept-Encoding "";
+ '';
+ };
+ virtualHosts."radar.r" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://localhost:7878";
+ };
+ };
+ virtualHosts."sonar.r" = {
+ enableACME = true;
+ addSSL = true;
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://localhost:8989";
+ };
+ };
};
- systemd.services.bruellwuerfel = {
+ services.samba = {
+ enable = true;
+ enableNmbd = false;
+ extraConfig = ''
+ workgroup = WORKGROUP
+ server string = ${config.networking.hostName}
+ # only allow retiolum addresses
+ hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
+
+ # Use sendfile() for performance gain
+ use sendfile = true
+
+ # No NetBIOS is needed
+ disable netbios = true
+
+ # Only mangle non-valid NTFS names, don't care about DOS support
+ mangled names = illegal
+
+ # Performance optimizations
+ socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
+
+ # Disable all printing
+ load printers = false
+ disable spoolss = true
+ printcap name = /dev/null
+
+ map to guest = Bad User
+ max log size = 50
+ dns proxy = no
+ security = user
+
+ [global]
+ syslog only = yes
+ '';
+ shares.public = {
+ comment = "Warez";
+ path = "/var/download";
+ public = "yes";
+ "only guest" = "yes";
+ "create mask" = "0644";
+ "directory mask" = "2777";
+ writable = "no";
+ printable = "no";
+ };
+ };
+
+ systemd.services.bruellwuerfel =
+ let
+ bruellwuerfelSrc = pkgs.fetchFromGitHub {
+ owner = "krebs";
+ repo = "bruellwuerfel";
+ rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
+ sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
+ };
+ in {
wantedBy = [ "multi-user.target" ];
environment = {
IRC_CHANNEL = "#flix";
@@ -147,7 +233,7 @@ in {
IRC_HISTORY_FILE = "/tmp/bruelli.history";
};
serviceConfig = {
- ExecStart = "${pkgs.bruellwuerfel}/bin/bruellwuerfel";
+ ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
};
};
@@ -155,15 +241,36 @@ in {
enable = true;
tables.filter.INPUT.rules = [
{ predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
+ { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
{ predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
- { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface
{ predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
{ predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
{ predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
+ { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
+ { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
+ { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
+ { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
+
+ # smbd
+ { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
];
tables.filter.OUTPUT = {
policy = "DROP";
rules = [
+ { predicate = "-o lo"; target = "ACCEPT"; }
{ v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; }
{ predicate = "-o tun0"; target = "ACCEPT"; }
{ predicate = "-o retiolum"; target = "ACCEPT"; }
@@ -271,7 +378,7 @@ in {
ExecStart = pkgs.writers.writeDash "flix-index" ''
set -efu
- DIR=/var/download/finished
+ DIR=/var/download
cd "$DIR"
while inotifywait -rq -e create -e move -e delete "$DIR"; do
find . -type f > "$DIR"/index.tmp
@@ -286,9 +393,22 @@ in {
group = "download";
};
- services.magnetico = {
+ services.radarr = {
+ enable = true;
+ group = "download";
+ };
+
+ services.sonarr = {
+ enable = true;
+ group = "download";
+ };
+
+ services.prowlarr = {
enable = true;
- web.address = "0.0.0.0";
- web.port = 9092;
+ };
+
+ services.bazarr = {
+ enable = true;
+ group = "download";
};
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 15:18:53 +0000