summaryrefslogtreecommitdiff
path: root/os/kay
diff options
context:
space:
mode:
Diffstat (limited to 'os/kay')
-rw-r--r--os/kay/modules/acme.nix9
-rw-r--r--os/kay/modules/alina.nix20
-rw-r--r--os/kay/modules/dns/default.nix69
-rw-r--r--os/kay/modules/home-assistant.nix27
-rw-r--r--os/kay/modules/hurricane.nix47
-rw-r--r--os/kay/modules/mail.nix46
-rw-r--r--os/kay/modules/matrix/default.nix8
-rw-r--r--os/kay/modules/matrix/dendrite.nix50
-rw-r--r--os/kay/modules/matrix/matrix-sliding-sync.nix33
-rw-r--r--os/kay/modules/network.nix11
-rw-r--r--os/kay/modules/observability/prometheus.nix62
-rw-r--r--os/kay/modules/postgresql.nix22
-rw-r--r--os/kay/modules/router.nix29
-rw-r--r--os/kay/modules/sftp.nix4
-rw-r--r--os/kay/modules/sshfwd.nix15
-rw-r--r--os/kay/modules/wireguard.nix33
-rw-r--r--os/kay/modules/www.nix372
-rw-r--r--os/kay/pkgs/matrix-sliding-sync.nix7
18 files changed, 498 insertions, 366 deletions
diff --git a/os/kay/modules/acme.nix b/os/kay/modules/acme.nix
index 00819e7..60e40a8 100644
--- a/os/kay/modules/acme.nix
+++ b/os/kay/modules/acme.nix
@@ -1,10 +1,11 @@
-{ config, pkgs, ... }: let
+{ config, pkgs, ... }:
+let
email = config.global.userdata.email;
domain = config.global.userdata.domain;
- environmentFile =
- pkgs.writeText "acme-dns" "RFC2136_NAMESERVER='[2001:470:ee65::1]:53'";
-in {
+ environmentFile = pkgs.writeText "acme-dns" "RFC2136_NAMESERVER='[2001:470:ee65::1]:53'";
+in
+{
security.acme = {
acceptTerms = true;
defaults.email = email;
diff --git a/os/kay/modules/alina.nix b/os/kay/modules/alina.nix
index ef6331b..6f8fac4 100644
--- a/os/kay/modules/alina.nix
+++ b/os/kay/modules/alina.nix
@@ -1,14 +1,18 @@
-{ config, pkgs, ... }: let
+{ config, pkgs, ... }:
+let
domain = "alinafs.com";
-in {
- sops.secrets."misc/alina" = {};
+in
+{
+ sops.secrets."misc/alina" = { };
services.postgresql = {
ensureDatabases = [ "alina" ];
- ensureUsers = [{
- name = "alina";
- ensureDBOwnership = true;
- }];
+ ensureUsers = [
+ {
+ name = "alina";
+ ensureDBOwnership = true;
+ }
+ ];
};
services.alina = {
@@ -17,7 +21,7 @@ in {
environmentFile = config.sops.secrets."misc/alina".path;
settings.server = {
data = "/hdd/alina";
- file_size_limit = 1024 * 1024 * 1024; /* 1GB */
+ file_size_limit = 1024 * 1024 * 1024; # 1GB
public_url = "https://${domain}";
};
};
diff --git a/os/kay/modules/dns/default.nix b/os/kay/modules/dns/default.nix
index 357cddd..6179527 100644
--- a/os/kay/modules/dns/default.nix
+++ b/os/kay/modules/dns/default.nix
@@ -1,5 +1,6 @@
-{ config, pkgs, ... }: let
- listen_addr = [
+{ config, pkgs, ... }:
+let
+ listen_addr = [
"137.59.84.126"
"2001:470:ee65::1"
];
@@ -16,7 +17,8 @@
IN NS ns1.sinanmohd.com.
'';
-in {
+in
+{
imports = [ ./ddns.nix ];
networking.firewall = {
@@ -39,39 +41,55 @@ in {
remote = [
{
id = "ns1.he.net";
- address = [ "2001:470:100::2" "216.218.130.2" ];
+ address = [
+ "2001:470:100::2"
+ "216.218.130.2"
+ ];
via = "2001:470:ee65::1";
}
{
id = "m.gtld-servers.net";
- address = [ "2001:501:b1f9::30" "192.55.83.30" ];
+ address = [
+ "2001:501:b1f9::30"
+ "192.55.83.30"
+ ];
}
];
- submission = [{
- id = "gtld-servers.net";
- parent = "m.gtld-servers.net";
- }];
+ submission = [
+ {
+ id = "gtld-servers.net";
+ parent = "m.gtld-servers.net";
+ }
+ ];
- policy = [{
- id = "gtld-servers.net";
- algorithm = "ecdsap384sha384";
- ksk-lifetime = "365d";
- ksk-submission = "gtld-servers.net";
- }];
+ policy = [
+ {
+ id = "gtld-servers.net";
+ algorithm = "ecdsap384sha384";
+ ksk-lifetime = "365d";
+ ksk-submission = "gtld-servers.net";
+ }
+ ];
# generate TSIG key with keymgr -t name
acl = [
{
id = "ns1.he.net";
key = "ns1.he.net";
- address = [ "2001:470:600::2" "216.218.133.2" ];
+ address = [
+ "2001:470:600::2"
+ "216.218.133.2"
+ ];
action = "transfer";
}
{
id = "ddns";
address = listen_addr;
- update-type = [ "A" "AAAA" ];
+ update-type = [
+ "A"
+ "AAAA"
+ ];
action = "update";
}
{
@@ -82,11 +100,13 @@ in {
}
];
- mod-rrl = [{
- id = "default";
- rate-limit = 200;
- slip = 2;
- }];
+ mod-rrl = [
+ {
+ id = "default";
+ rate-limit = 200;
+ slip = 2;
+ }
+ ];
template = [
{
@@ -102,7 +122,10 @@ in {
dnssec-policy = "gtld-servers.net";
notify = [ "ns1.he.net" ];
- acl = [ "ns1.he.net" "ddns" ];
+ acl = [
+ "ns1.he.net"
+ "ddns"
+ ];
zonefile-sync = "-1";
zonefile-load = "difference";
diff --git a/os/kay/modules/home-assistant.nix b/os/kay/modules/home-assistant.nix
index 2376997..65807f7 100644
--- a/os/kay/modules/home-assistant.nix
+++ b/os/kay/modules/home-assistant.nix
@@ -1,21 +1,26 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
services.postgresql = {
enable = true;
ensureDatabases = [ "hass" ];
- ensureUsers = [{
- name = "hass";
- ensureDBOwnership = true;
- }];
+ ensureUsers = [
+ {
+ name = "hass";
+ ensureDBOwnership = true;
+ }
+ ];
};
services.home-assistant = {
enable = true;
- package = (pkgs.home-assistant.override {
- extraPackages = py: with py; [ psycopg2 ];
- }).overrideAttrs (oldAttrs: {
- doInstallCheck = false;
- });
+ package =
+ (pkgs.home-assistant.override {
+ extraPackages = py: with py; [ psycopg2 ];
+ }).overrideAttrs
+ (oldAttrs: {
+ doInstallCheck = false;
+ });
extraComponents = [
"analytics"
@@ -29,7 +34,7 @@
];
config = {
- default_config = {};
+ default_config = { };
recorder.db_url = "postgresql://@/hass";
http = {
diff --git a/os/kay/modules/hurricane.nix b/os/kay/modules/hurricane.nix
index 511b213..e815136 100644
--- a/os/kay/modules/hurricane.nix
+++ b/os/kay/modules/hurricane.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}:
let
iface = "hurricane";
@@ -10,12 +15,15 @@ let
prefix64 = "2001:470:36:72a::/64";
prefix48 = "2001:470:ee65::/48";
- makeAddr = prefix: host: let
- split = lib.strings.splitString "/" prefix;
- in {
- address = "${lib.head split}${host}";
- prefixLength = lib.toInt (lib.last split);
- };
+ makeAddr =
+ prefix: host:
+ let
+ split = lib.strings.splitString "/" prefix;
+ in
+ {
+ address = "${lib.head split}${host}";
+ prefixLength = lib.toInt (lib.last split);
+ };
in
{
networking = {
@@ -43,17 +51,15 @@ in
};
firewall = {
- extraCommands =
- "iptables -A INPUT --proto 41 --source ${remote} --jump ACCEPT";
- extraStopCommands =
- "iptables -D INPUT --proto 41 --source ${remote} --jump ACCEPT";
+ extraCommands = "iptables -A INPUT --proto 41 --source ${remote} --jump ACCEPT";
+ extraStopCommands = "iptables -D INPUT --proto 41 --source ${remote} --jump ACCEPT";
};
};
sops.secrets = {
- "hurricane/username" = {};
- "hurricane/update_key" = {};
- "hurricane/tunnel_id" = {};
+ "hurricane/username" = { };
+ "hurricane/update_key" = { };
+ "hurricane/tunnel_id" = { };
};
systemd.services."network-route-${iface}" = {
@@ -64,7 +70,10 @@ in
];
before = [ "network-setup.service" ];
bindsTo = [ "network-addresses-hurricane.service" ];
- after = [ "network-pre.target" "network-addresses-hurricane.service" ];
+ after = [
+ "network-pre.target"
+ "network-addresses-hurricane.service"
+ ];
# restart rather than stop+start this unit to prevent the
# network from dying during switch-to-configuration.
stopIfChanged = false;
@@ -95,9 +104,13 @@ in
'';
};
-
services.pppd.script."01-${iface}" = {
- runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ];
+ runtimeInputs = with pkgs; [
+ curl
+ coreutils
+ iproute2
+ iputils
+ ];
text = ''
wan_ip="$4"
username="$(cat ${config.sops.secrets."hurricane/username".path})"
diff --git a/os/kay/modules/mail.nix b/os/kay/modules/mail.nix
index a418a86..57912ac 100644
--- a/os/kay/modules/mail.nix
+++ b/os/kay/modules/mail.nix
@@ -1,4 +1,5 @@
-{ config, pkgs, ... }: let
+{ config, pkgs, ... }:
+let
ipv6 = "2001:470:ee65::1337";
domain = config.global.userdata.domain;
username = config.global.userdata.name;
@@ -15,12 +16,13 @@
];
credentials_directory = "/run/credentials/stalwart-mail.service";
-in {
+in
+{
security.acme.certs.${domain}.postRun = "systemctl restart stalwart-mail.service";
sops.secrets = {
- "mail.${domain}/dkim_rsa" = {};
- "mail.${domain}/dkim_ed25519" = {};
- "mail.${domain}/password" = {};
+ "mail.${domain}/dkim_rsa" = { };
+ "mail.${domain}/dkim_ed25519" = { };
+ "mail.${domain}/password" = { };
};
systemd.services.stalwart-mail.serviceConfig.LoadCredential = [
@@ -35,10 +37,12 @@ in {
services.postgresql = {
ensureDatabases = [ "stalwart" ];
- ensureUsers = [{
- name = "stalwart";
- ensureDBOwnership = true;
- }];
+ ensureUsers = [
+ {
+ name = "stalwart";
+ ensureDBOwnership = true;
+ }
+ ];
};
services.stalwart-mail = {
@@ -70,7 +74,10 @@ in {
server.listener = {
smtp = {
- bind = [ "[${ipv6}]:25" "0.0.0.0:25" ];
+ bind = [
+ "[${ipv6}]:25"
+ "0.0.0.0:25"
+ ];
protocol = "smtp";
};
submission = {
@@ -98,7 +105,13 @@ in {
private-key = "%{file:${credentials_directory}/dkim_rsa}%";
inherit domain;
selector = "rsa";
- headers = ["From" "To" "Date" "Subject" "Message-ID"];
+ headers = [
+ "From"
+ "To"
+ "Date"
+ "Subject"
+ "Message-ID"
+ ];
algorithm = "rsa-sha-256";
canonicalization = "simple/simple";
@@ -110,7 +123,13 @@ in {
private-key = "%{file:${credentials_directory}/dkim_ed25519}%";
inherit domain;
selector = "ed25519";
- headers = ["From" "To" "Date" "Subject" "Message-ID"];
+ headers = [
+ "From"
+ "To"
+ "Date"
+ "Subject"
+ "Message-ID"
+ ];
algorithm = "ed25519-sha256";
canonicalization = "simple/simple";
@@ -152,7 +171,8 @@ in {
secret = "%{file:${credentials_directory}/password}%";
inherit email;
}
- { # for mta-sts & dmarc reports
+ {
+ # for mta-sts & dmarc reports
class = "individual";
name = "reports";
secret = "%{file:${credentials_directory}/password}%";
diff --git a/os/kay/modules/matrix/default.nix b/os/kay/modules/matrix/default.nix
index f81d0d9..1b9564d 100644
--- a/os/kay/modules/matrix/default.nix
+++ b/os/kay/modules/matrix/default.nix
@@ -1,12 +1,14 @@
-{ config, ... }: let
+{ config, ... }:
+let
domain = config.global.userdata.domain;
-in {
+in
+{
imports = [
./dendrite.nix
./matrix-sliding-sync.nix
];
- sops.secrets."matrix-${domain}/sliding_sync" = {};
+ sops.secrets."matrix-${domain}/sliding_sync" = { };
services.matrix-sliding-sync-dirty = {
enable = true;
diff --git a/os/kay/modules/matrix/dendrite.nix b/os/kay/modules/matrix/dendrite.nix
index 3f4a879..e66c5a5 100644
--- a/os/kay/modules/matrix/dendrite.nix
+++ b/os/kay/modules/matrix/dendrite.nix
@@ -10,16 +10,18 @@ let
};
in
{
- sops.secrets."matrix-${domain}/key" = {};
+ sops.secrets."matrix-${domain}/key" = { };
systemd.services.dendrite.after = [ "postgresql.service" ];
services = {
postgresql = {
ensureDatabases = [ "dendrite" ];
- ensureUsers = [{
- name = "dendrite";
- ensureDBOwnership = true;
- }];
+ ensureUsers = [
+ {
+ name = "dendrite";
+ ensureDBOwnership = true;
+ }
+ ];
};
dendrite = {
@@ -43,10 +45,12 @@ in
];
inherit database;
};
- logging = [{
- type = "std";
- level = "warn";
- }];
+ logging = [
+ {
+ type = "std";
+ level = "warn";
+ }
+ ];
mscs = {
inherit database;
mscs = [ "msc2836" ];
@@ -63,19 +67,21 @@ in
federation_api = {
inherit database;
send_max_retries = 8;
- key_perspectives = [{
- server_name = "matrix.org";
- keys = [
- {
- key_id = "ed25519:auto";
- public_key = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
- }
- {
- key_id = "ed25519:a_RXGa";
- public_key = "l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ";
- }
- ];
- }];
+ key_perspectives = [
+ {
+ server_name = "matrix.org";
+ keys = [
+ {
+ key_id = "ed25519:auto";
+ public_key = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
+ }
+ {
+ key_id = "ed25519:a_RXGa";
+ public_key = "l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ";
+ }
+ ];
+ }
+ ];
};
app_service_api = {
diff --git a/os/kay/modules/matrix/matrix-sliding-sync.nix b/os/kay/modules/matrix/matrix-sliding-sync.nix
index f4c1426..63d95ad 100644
--- a/os/kay/modules/matrix/matrix-sliding-sync.nix
+++ b/os/kay/modules/matrix/matrix-sliding-sync.nix
@@ -1,12 +1,20 @@
-{ config, lib, pkgs, ... }:
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}:
let
cfg = config.services.matrix-sliding-sync-dirty;
- matrix-sliding-sync = pkgs.callPackage ../../pkgs/matrix-sliding-sync.nix {};
+ matrix-sliding-sync = pkgs.callPackage ../../pkgs/matrix-sliding-sync.nix { };
in
{
imports = [
- (lib.mkRenamedOptionModule [ "services" "matrix-synapse" "sliding-sync" ] [ "services" "matrix-sliding-sync" ])
+ (lib.mkRenamedOptionModule
+ [ "services" "matrix-synapse" "sliding-sync" ]
+ [ "services" "matrix-sliding-sync" ]
+ )
];
options.services.matrix-sliding-sync-dirty = {
@@ -40,7 +48,14 @@ in
};
SYNCV3_LOG_LEVEL = lib.mkOption {
- type = lib.types.enum [ "trace" "debug" "info" "warn" "error" "fatal" ];
+ type = lib.types.enum [
+ "trace"
+ "debug"
+ "info"
+ "warn"
+ "error"
+ "fatal"
+ ];
default = "info";
description = "The level of verbosity for messages logged.";
};
@@ -77,10 +92,12 @@ in
services.postgresql = lib.optionalAttrs cfg.createDatabase {
enable = true;
ensureDatabases = [ "matrix-sliding-sync" ];
- ensureUsers = [ {
- name = "matrix-sliding-sync";
- ensureDBOwnership = true;
- } ];
+ ensureUsers = [
+ {
+ name = "matrix-sliding-sync";
+ ensureDBOwnership = true;
+ }
+ ];
};
systemd.services.matrix-sliding-sync = rec {
diff --git a/os/kay/modules/network.nix b/os/kay/modules/network.nix
index 22d132b..1315289 100644
--- a/os/kay/modules/network.nix
+++ b/os/kay/modules/network.nix
@@ -3,7 +3,10 @@
let
inetVlan = 1003;
wanInterface = "enp3s0";
- nameServer = [ "1.0.0.1" "1.1.1.1" ];
+ nameServer = [
+ "1.0.0.1"
+ "1.1.1.1"
+ ];
in
{
imports = [
@@ -12,9 +15,9 @@ in
];
sops.secrets = {
- "ppp/chap-secrets" = {};
- "ppp/pap-secrets" = {};
- "ppp/username" = {};
+ "ppp/chap-secrets" = { };
+ "ppp/pap-secrets" = { };
+ "ppp/username" = { };
};
networking = {
diff --git a/os/kay/modules/observability/prometheus.nix b/os/kay/modules/observability/prometheus.nix
index d9b6071..1810f9e 100644
--- a/os/kay/modules/observability/prometheus.nix
+++ b/os/kay/modules/observability/prometheus.nix
@@ -4,36 +4,38 @@
enable = true;
port = 9001;
- scrapeConfigs = [{
- job_name = "kay";
- scrape_interval = "1s";
- static_configs = [
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.wireguard.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginxlog.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.postgres.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.snmp.port}" ];
- }
- {
- targets = [ "127.0.0.1:${toString config.services.dendrite.httpPort}" ];
- }
- ];
- }];
+ scrapeConfigs = [
+ {
+ job_name = "kay";
+ scrape_interval = "1s";
+ static_configs = [
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.wireguard.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginxlog.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.postgres.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.snmp.port}" ];
+ }
+ {
+ targets = [ "127.0.0.1:${toString config.services.dendrite.httpPort}" ];
+ }
+ ];
+ }
+ ];
exporters = {
node = {
diff --git a/os/kay/modules/postgresql.nix b/os/kay/modules/postgresql.nix
index 79d0b12..6ba5398 100644
--- a/os/kay/modules/postgresql.nix
+++ b/os/kay/modules/postgresql.nix
@@ -1,15 +1,21 @@
-{ config, lib, pkgs, ... }: {
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}:
+{
services.postgresql = {
enable = true;
package = with pkgs; postgresql_15;
authentication = lib.mkForce ''
- #type database DBuser origin-address auth-method
- # unix socket
- local all all trust
- # ipv4
- host all all 127.0.0.1/32 trust
- # ipv6
- host all all ::1/128 trust
+ #type database DBuser origin-address auth-method
+ # unix socket
+ local all all trust
+ # ipv4
+ host all all 127.0.0.1/32 trust
+ # ipv6
+ host all all ::1/128 trust
'';
settings.log_timezone = config.time.timeZone;
diff --git a/os/kay/modules/router.nix b/os/kay/modules/router.nix
index bb8cd3b..7280401 100644
--- a/os/kay/modules/router.nix
+++ b/os/kay/modules/router.nix
@@ -1,4 +1,5 @@
-{ ... }: let
+{ ... }:
+let
wanInterface = "ppp0";
gponInterface = "enp3s0";
@@ -15,7 +16,8 @@
wapMac = "40:86:cb:d7:40:49";
wapIp = "192.168.43.2";
-in {
+in
+{
imports = [
./wireguard.nix
./iperf3.nix
@@ -30,17 +32,24 @@ in {
internalInterfaces = [ bridgeInterface ];
};
interfaces = {
- ${bridgeInterface}.ipv4.addresses = [{
+ ${bridgeInterface}.ipv4.addresses = [
+ {
address = host;
- prefixLength = prefix;
- }];
- ${gponInterface}.ipv4.addresses = [{
+ prefixLength = prefix;
+ }
+ ];
+ ${gponInterface}.ipv4.addresses = [
+ {
address = gponHost;
- prefixLength = gponPrefix;
- }];
+ prefixLength = gponPrefix;
+ }
+ ];
};
firewall = {
- allowedUDPPorts = [ 53 67 ];
+ allowedUDPPorts = [
+ 53
+ 67
+ ];
allowedTCPPorts = [ 53 ];
extraCommands = ''
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
@@ -57,7 +66,7 @@ in {
services.dnsmasq.settings = {
dhcp-range = [ "${leaseRangeStart},${leaseRangeEnd}" ];
- dhcp-host= "${wapMac},${wapIp}";
+ dhcp-host = "${wapMac},${wapIp}";
interface = [ bridgeInterface ];
};
diff --git a/os/kay/modules/sftp.nix b/os/kay/modules/sftp.nix
index 45ed151..b740fd6 100644
--- a/os/kay/modules/sftp.nix
+++ b/os/kay/modules/sftp.nix
@@ -7,7 +7,7 @@ let
in
{
users = {
- groups."sftp".members = [];
+ groups."sftp".members = [ ];
users."sftp" = {
group = "sftp";
@@ -42,7 +42,7 @@ in
};
# sandboxing
- extraConfig = ''
+ extraConfig = ''
Match Group sftp
# chroot dir should be owned by root
# and sub dirs by %u
diff --git a/os/kay/modules/sshfwd.nix b/os/kay/modules/sshfwd.nix
index d70b893..fcafd17 100644
--- a/os/kay/modules/sshfwd.nix
+++ b/os/kay/modules/sshfwd.nix
@@ -1,21 +1,24 @@
-{ ... }: let
+{ ... }:
+let
group = "sshfwd";
-in {
+in
+{
networking.firewall.allowedTCPPorts = [ 2222 ];
users = {
- groups.${group}.members = [];
+ groups.${group}.members = [ ];
users."lia" = {
inherit group;
isSystemUser = true;
- openssh.authorizedKeys.keys
- = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe7fJlh9L+9JSq0+hK7jNZjszmZqNXwzqcZ+zx0yJyU lia" ];
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe7fJlh9L+9JSq0+hK7jNZjszmZqNXwzqcZ+zx0yJyU lia"
+ ];
};
};
- services.openssh.extraConfig = ''
+ services.openssh.extraConfig = ''
Match Group ${group}
ForceCommand echo 'this account is only usable for remote forwarding'
PermitTunnel no
diff --git a/os/kay/modules/wireguard.nix b/os/kay/modules/wireguard.nix
index 21cec06..ae42930 100644
--- a/os/kay/modules/wireguard.nix
+++ b/os/kay/modules/wireguard.nix
@@ -1,4 +1,10 @@
-{ config, pkgs, lib, ... }: let
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}:
+let
wgInterface = "wg";
wanInterface = "ppp0";
subnet = "10.0.1.0";
@@ -10,13 +16,17 @@
Address = 10.0.1.1/24
MTU = 1412
ListenPort = 51820
- PostUp = ${lib.getExe (pkgs.writeShellApplication {
- name = "wg_set_key";
- runtimeInputs = with pkgs; [ wireguard-tools ];
- text = ''
- wg set ${wgInterface} private-key <(cat ${config.sops.secrets."misc/wireguard".path})
- '';
- })}
+ PostUp = ${
+ lib.getExe (
+ pkgs.writeShellApplication {
+ name = "wg_set_key";
+ runtimeInputs = with pkgs; [ wireguard-tools ];
+ text = ''
+ wg set ${wgInterface} private-key <(cat ${config.sops.secrets."misc/wireguard".path})
+ '';
+ }
+ )
+ }
[Peer]
# friendly_name = cez
@@ -43,8 +53,9 @@
PublicKey = U6+PzFuM6lKVx0TnDWuWJMsP6Tj8o1a9zjRcD7gV53o=
AllowedIPs = 10.0.1.6/32
'';
-in {
- sops.secrets."misc/wireguard" = {};
+in
+{
+ sops.secrets."misc/wireguard" = { };
networking = {
nat = {
@@ -59,7 +70,7 @@ in {
services.dnsmasq.settings = {
no-dhcp-interface = wgInterface;
- interface = [ wgInterface ];
+ interface = [ wgInterface ];
};
services.prometheus.exporters.wireguard = {
diff --git a/os/kay/modules/www.nix b/os/kay/modules/www.nix
index 54ff8d2..4f894c5 100644
--- a/os/kay/modules/www.nix
+++ b/os/kay/modules/www.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}:
let
domain = config.global.userdata.domain;
@@ -12,7 +17,10 @@ in
security.acme.certs.${domain}.postRun = "systemctl reload nginx.service";
networking.firewall = {
- allowedTCPPorts = [ 80 443 ];
+ allowedTCPPorts = [
+ 80
+ 443
+ ];
allowedUDPPorts = [ 443 ];
};
@@ -27,7 +35,7 @@ in
};
};
- services.nginx = {
+ services.nginx = {
enable = true;
statusPage = true;
package = pkgs.nginxQuic;
@@ -48,218 +56,216 @@ in
add_header Alt-Svc 'h3=":443"; ma=2592000; persist=1';
'';
- virtualHosts = let
- defaultOpts = {
- # reuseport = true;
- quic = true;
- http3 = true;
- forceSSL = true;
- useACMEHost = domain;
- };
- in {
- "${domain}" = defaultOpts // {
- default = true;
- globalRedirect = "www.${domain}";
+ virtualHosts =
+ let
+ defaultOpts = {
+ # reuseport = true;
+ quic = true;
+ http3 = true;
+ forceSSL = true;
+ useACMEHost = domain;
+ };
+ in
+ {
+ "${domain}" = defaultOpts // {
+ default = true;
+ globalRedirect = "www.${domain}";
+
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_request_buffering off;
+ client_max_body_size 0;
+ '';
- extraConfig = ''
- proxy_buffering off;
- proxy_request_buffering off;
- client_max_body_size 0;
- '';
+ locations = {
+ "/.well-known/matrix/server".return = ''
+ 200 '{ "m.server": "${domain}:443" }'
+ '';
- locations = {
- "/.well-known/matrix/server".return = ''
- 200 '{ "m.server": "${domain}:443" }'
- '';
+ "/.well-known/matrix/client".return = ''
+ 200 '${
+ builtins.toJSON {
+ "m.homeserver".base_url = "https://${domain}";
+ "org.matrix.msc3575.proxy".url = "https://sliding.${domain}";
+ "m.identity_server".base_url = "https://vector.im";
+ }
+ }'
+ '';
+
+ "~ ^(\\/_matrix|\\/_synapse\\/client)".proxyPass =
+ "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+ };
+ };
- "/.well-known/matrix/client".return = ''
- 200 '${builtins.toJSON {
- "m.homeserver".base_url = "https://${domain}";
- "org.matrix.msc3575.proxy".url = "https://sliding.${domain}";
- "m.identity_server".base_url = "https://vector.im";
- }}'
+ "sliding.${domain}" = defaultOpts // {
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_request_buffering off;
+ client_max_body_size 0;
'';
- "~ ^(\\/_matrix|\\/_synapse\\/client)".proxyPass = "http://127.0.0.1:${toString
- config.services.dendrite.httpPort
- }";
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://${config.services.matrix-sliding-sync-dirty.settings.SYNCV3_BINDADDR}";
+ };
};
- };
- "sliding.${domain}" = defaultOpts // {
- extraConfig = ''
- proxy_buffering off;
- proxy_request_buffering off;
- client_max_body_size 0;
- '';
+ "${config.services.grafana.settings.server.domain}" = defaultOpts // {
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_request_buffering off;
+ client_max_body_size 0;
+ '';
- locations."/" = {
- proxyWebsockets = true;
- proxyPass =
- "http://${config.services.matrix-sliding-sync-dirty.settings.SYNCV3_BINDADDR}";
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://${config.services.grafana.settings.server.http_addr}:${builtins.toString config.services.grafana.settings.server.http_port}";
+ };
};
- };
- "${config.services.grafana.settings.server.domain}" = defaultOpts // {
- extraConfig = ''
- proxy_buffering off;
- proxy_request_buffering off;
- client_max_body_size 0;
- '';
+ "www.${domain}" = defaultOpts // {
+ extraConfig = ''
+ ssl_early_data on;
+ '';
- locations."/" = {
- proxyWebsockets = true;
- proxyPass =
- "http://${config.services.grafana.settings.server.http_addr}:${builtins.toString config.services.grafana.settings.server.http_port}";
+ root = "/var/www/${domain}";
};
- };
-
- "www.${domain}" = defaultOpts // {
- extraConfig = ''
- ssl_early_data on;
- '';
- root = "/var/www/${domain}";
- };
+ "git.${domain}" = defaultOpts // {
+ extraConfig = ''
+ ssl_early_data on;
+ '';
+ };
- "git.${domain}" = defaultOpts // {
- extraConfig = ''
- ssl_early_data on;
- '';
- };
+ "bin.${domain}" = defaultOpts // {
+ extraConfig = ''
+ ssl_early_data on;
+ '';
+ root = "${storage}/bin";
+ locations."= /".return = "307 https://www.${domain}";
+ };
- "bin.${domain}" = defaultOpts // {
- extraConfig = ''
- ssl_early_data on;
- '';
- root = "${storage}/bin";
- locations."= /".return = "307 https://www.${domain}";
- };
+ "static.${domain}" = defaultOpts // {
+ extraConfig = ''
+ ssl_early_data on;
+ '';
+ root = "${storage}/static";
+ locations."= /".return = "301 https://www.${domain}";
+ };
- "static.${domain}" = defaultOpts // {
- extraConfig = ''
- ssl_early_data on;
- '';
- root = "${storage}/static";
- locations."= /".return = "301 https://www.${domain}";
- };
+ "home.${domain}" = defaultOpts // {
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://127.0.0.1:${builtins.toString config.services.home-assistant.config.http.server_port}";
+ };
+ };
- "home.${domain}" = defaultOpts // {
- locations."/" = {
- proxyWebsockets = true;
- proxyPass = "http://127.0.0.1:${
- builtins.toString config.services.home-assistant.config.http.server_port
- }";
+ "mail.${domain}" = defaultOpts // {
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://127.0.0.1:8085";
+ };
};
- };
- "mail.${domain}" = defaultOpts // {
- locations."/" = {
- proxyWebsockets = true;
- proxyPass = "http://127.0.0.1:8085";
+ "mta-sts.${domain}" = defaultOpts // {
+ extraConfig = ''
+ ssl_early_data on;
+ '';
+ locations."= /.well-known/mta-sts.txt".return = ''200 "${
+ lib.strings.concatStringsSep "\\n" [
+ "version: STSv1"
+ "mode: enforce"
+ "mx: mail.${domain}"
+ "max_age: 86400"
+ ]
+ }"'';
};
- };
- "mta-sts.${domain}" = defaultOpts // {
- extraConfig = ''
- ssl_early_data on;
- '';
- locations."= /.well-known/mta-sts.txt".return = ''200 "${
- lib.strings.concatStringsSep "\\n" [
- "version: STSv1"
- "mode: enforce"
- "mx: mail.${domain}"
- "max_age: 86400"
- ]
- }"'';
- };
+ "immich.${domain}" = defaultOpts // {
+ locations."/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://${config.services.immich.host}:${builtins.toString config.services.immich.port}";
+ };
- "immich.${domain}" = defaultOpts // {
- locations."/" = {
- proxyWebsockets = true;
- proxyPass = "http://${config.services.immich.host}:${builtins.toString config.services.immich.port}";
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_request_buffering off;
+ client_max_body_size 0;
+ '';
};
- extraConfig = ''
- proxy_buffering off;
- proxy_request_buffering off;
- client_max_body_size 0;
- '';
- };
-
- "nixbin.${domain}" = defaultOpts // {
- extraConfig = ''
- proxy_buffering off;
- proxy_request_buffering off;
- client_max_body_size 0;
- '';
+ "nixbin.${domain}" = defaultOpts // {
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_request_buffering off;
+ client_max_body_size 0;
+ '';
- locations = {
- "= /files".return = "301 https://nixbin.${domain}/files/";
- "/files/" = {
+ locations = {
+ "= /files".return = "301 https://nixbin.${domain}/files/";
+ "/files/" = {
alias = "/nix/store/";
extraConfig = "autoindex on;";
+ };
+
+ "= /" = {
+ extraConfig = ''
+ add_header Content-Type text/html;
+ add_header Alt-Svc 'h3=":443"; ma=2592000; persist=1';
+ '';
+ return = ''
+ 200
+ '<!DOCTYPE html>
+ <html lang="en">
+ <head>
+ <meta charset="UTF-8">
+ <title>Nix Cache</title>
+ </head>
+ <body>
+ <center>
+ <h1 style="font-size: 8em">
+ ❄️ Nix Cache
+ </h1>
+ <p style="font-weight: bold">
+ Public Key: nixbin.sinanmohd.com:dXV3KDPVrm+cGJ2M1ZmTeQJqFGaEapqiVoWHgYDh03k=
+ </p>
+ </center>
+ </body>
+ </html>'
+ '';
+ };
+
+ "/".proxyPass =
+ "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
};
-
- "= /" = {
- extraConfig = ''
- add_header Content-Type text/html;
- add_header Alt-Svc 'h3=":443"; ma=2592000; persist=1';
- '';
- return = ''200
- '<!DOCTYPE html>
- <html lang="en">
- <head>
- <meta charset="UTF-8">
- <title>Nix Cache</title>
- </head>
- <body>
- <center>
- <h1 style="font-size: 8em">
- ❄️ Nix Cache
- </h1>
- <p style="font-weight: bold">
- Public Key: nixbin.sinanmohd.com:dXV3KDPVrm+cGJ2M1ZmTeQJqFGaEapqiVoWHgYDh03k=
- </p>
- </center>
- </body>
- </html>'
- '';
- };
-
- "/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${
- toString config.services.nix-serve.port
- }";
};
- };
-
-
- "www.alinafs.com" = defaultOpts // {
- useACMEHost = null;
- enableACME = true;
- globalRedirect = "alinafs.com/home";
- extraConfig = ''
- ssl_early_data on;
- '';
- };
- "alinafs.com" = defaultOpts // {
- useACMEHost = null;
- enableACME = true;
- locations = {
- "/metrics".return = "307 /home/";
- "/" = {
- proxyWebsockets = true;
- proxyPass = "http://127.0.0.1:${builtins.toString config.services.alina.port}";
- };
+ "www.alinafs.com" = defaultOpts // {
+ useACMEHost = null;
+ enableACME = true;
+ globalRedirect = "alinafs.com/home";
+ extraConfig = ''
+ ssl_early_data on;
+ '';
};
+ "alinafs.com" = defaultOpts // {
+ useACMEHost = null;
+ enableACME = true;
+
+ locations = {
+ "/metrics".return = "307 /home/";
+ "/" = {
+ proxyWebsockets = true;
+ proxyPass = "http://127.0.0.1:${builtins.toString config.services.alina.port}";
+ };
+ };
- extraConfig = ''
- proxy_buffering off;
- proxy_request_buffering off;
- client_max_body_size 0;
- '';
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_request_buffering off;
+ client_max_body_size 0;
+ '';
+ };
};
- };
};
}
diff --git a/os/kay/pkgs/matrix-sliding-sync.nix b/os/kay/pkgs/matrix-sliding-sync.nix
index 17051dc..2095817 100644
--- a/os/kay/pkgs/matrix-sliding-sync.nix
+++ b/os/kay/pkgs/matrix-sliding-sync.nix
@@ -1,6 +1,7 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+ lib,
+ buildGoModule,
+ fetchFromGitHub,
}:
buildGoModule rec {