moved ssh and tailscale to srv, revamped netwroking modules

1 files changed, 51 insertions, 4 deletions

diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 40675e0..c7db2d8 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  masterDomain,
   ...
 }:
 let
@@ -9,20 +10,66 @@ let
 in
 {
   options.os.srv.monero = {
-    enable = lib.mkEnableOption "enables the daemon and wallet";
+    wallet.enable = lib.mkEnableOption "enables the monero wallet";
     service.enable = lib.mkEnableOption "enables hosting a monero node";
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
+    (lib.mkIf cfg.wallet.enable {
       environment.systemPackages = [ pkgs.monero-cli ];
     })
     (lib.mkIf cfg.service.enable {
+      assertions = [
+        {
+          assertion = config.os.srv.nginx.enable;
+          message = "Hosting a Monero node requires nginx for proxying";
+        }
+        {
+          assertion = config.os.srv.sops.enable;
+          message = "Required for password secure password storing";
+        }
+      ];
+
+      sops.secrets."monero/rpc-password" = {
+        owner = "monero";
+        restartUnits = [ "monero.service" ];
+      };
+
       services.monero = {
         enable = true;
-        prune = true;
-        dataDir = "/home/monero";
+        environmentFile = config.sops.secrets."monero/rpc-password".path;
+        banlist = builtins.fetchurl {
+          url = "https://gui.xmr.pm/files/block.txt";
+          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
+        };
+        limits = {
+          upload = 1250;
+          download = 1250;
+          threads = 4;
+        };
+        rpc = {
+          restricted = true;
+          user = "admin";
+        };
+      };
+
+      services.nginx.virtualHosts."xmr.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:18081";
+          extraConfig = ''
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+
+            client_max_body_size 50m;
+          '';
+        };
       };
+
+      # Left open for P2P syncing
+      networking.firewall.allowedTCPPorts = [ 18080 ];
     })
   ];
 }