From 1820b1753011eb42bb9be30011e6fbd11993b201 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 23:18:05 +0200
Subject: l: add red.r

---
 lass/1systems/prism/config.nix      | 28 ++++++++++++++++++++++++++++
 lass/1systems/red/config.nix        | 30 ++++++++++++++++++++++++++++++
 lass/1systems/red/source.nix        |  4 ++++
 lass/2configs/websites/lassulus.nix |  1 -
 4 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 lass/1systems/red/config.nix
 create mode 100644 lass/1systems/red/source.nix

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 7b581d905..d1faf77bd 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -304,6 +304,34 @@ in {
       ];
     }
     <stockholm/lass/2configs/go.nix>
+    {
+      environment.systemPackages = [ pkgs.cryptsetup ];
+      systemd.services."container@red".reloadIfChanged = mkForce false;
+      containers.red = {
+        config = { ... }: {
+          environment.systemPackages = [ pkgs.git ];
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = [
+            config.krebs.users.lass.pubkey
+          ];
+        };
+        autoStart = false;
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.3";
+        localAddress = "10.233.2.4";
+      };
+      services.nginx.virtualHosts."rote-allez-fraktion.de" = {
+        enableACME = true;
+        addSSL = true;
+        locations."/" = {
+          extraConfig = ''
+            proxy_set_header Host rote-allez-fraktion.de;
+            proxy_pass http://10.233.2.4;
+          '';
+        };
+      };
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
diff --git a/lass/1systems/red/config.nix b/lass/1systems/red/config.nix
new file mode 100644
index 000000000..8c60aed62
--- /dev/null
+++ b/lass/1systems/red/config.nix
@@ -0,0 +1,30 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+let
+  inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
+    servephpBB
+  ;
+in
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/websites>
+    <stockholm/lass/2configs/websites/sqlBackup.nix>
+    (servephpBB [ "rote-allez-fraktion.de" ])
+  ];
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport 80"; target = "ACCEPT"; }
+  ];
+
+  krebs.build.host = config.krebs.hosts.red;
+  boot.isContainer = true;
+  networking.useDHCP = false;
+
+  services.nginx.enable = true;
+  environment.systemPackages = [
+    pkgs.mk_sql_pair
+  ];
+}
diff --git a/lass/1systems/red/source.nix b/lass/1systems/red/source.nix
new file mode 100644
index 000000000..f2bad743c
--- /dev/null
+++ b/lass/1systems/red/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/lass/source.nix> {
+  name = "red";
+  secure = true;
+}
diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index b9811221c..53f1eea5c 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -10,7 +10,6 @@ in {
   imports = [
     ./default.nix
     ../git.nix
-    (servephpBB [ "rote-allez-fraktion.de" ])
   ];
 
   security.acme = {
-- 
cgit v1.2.3