moved ssh and tailscale to srv, revamped netwroking modules

10 files changed, 342 insertions, 15 deletions

diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
new file mode 100644
index 0000000..79c8718
--- /dev/null
+++ b/os/srv/crowdsec.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.security.crowdsec;
+in
+{
+  options.os.srv.security.crowdsec = {
+    enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.nftables.enable;
+        message = "CrowdSec requires networking.nftables to be enabled for blocking.";
+      }
+    ];
+
+    services.crowdsec = {
+      enable = true;
+      autoUpdateService = true;
+
+      localConfig = {
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+          {
+            filenames = [
+              "/var/log/nginx/access.log"
+              "/var/log/nginx/error.log"
+            ];
+            labels.type = "nginx";
+          }
+        ];
+
+        parsers.s02Enrich = [
+          {
+            name = "myips/whitelist";
+            description = "Prevent local address ranges from triggering bans";
+            whitelist = {
+              reason = "Internal private subnets";
+              cidr = [
+                "10.0.0.0/16"
+              ];
+            };
+          }
+        ];
+      };
+
+      hub = {
+        collections = [
+          "crowdsecurity/linux"
+          "crowdsecurity/nginx"
+          "crowdsecurity/sshd"
+        ];
+      };
+
+      settings = {
+        lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
+        capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
+      };
+    };
+
+    services.crowdsec-firewall-bouncer = {
+      enable = true;
+      settings = {
+        update_frequency = "10s";
+      };
+    };
+
+    users.users.crowdsec.extraGroups = [
+      "nginx"
+      "systemd-journal"
+    ];
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index b83e892..76351e2 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -3,7 +3,10 @@
   imports = [
     ./bluetooth.nix
     ./compat.nix
+    ./crowdsec.nix
+    ./fail2ban.nix
     ./files.nix
+    ./firewall.nix
     ./gaming.nix
     ./i2p.nix
     ./kdeconnect.nix
@@ -15,8 +18,10 @@
     ./opnsense.nix
     ./simplex.nix
     ./sops.nix
+    ./ssh.nix
     ./sunshine.nix
     ./syncthing.nix
+    ./tailscale.nix
     ./tor.nix
     ./virtualization.nix
     ./vpn.nix
diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix
new file mode 100644
index 0000000..9b51ceb
--- /dev/null
+++ b/os/srv/fail2ban.nix
@@ -0,0 +1,69 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.os.srv.fail2ban;
+in
+{
+  options.os.srv.fail2ban = {
+    enable = lib.mkEnableOption "the NGINX reverse proxy service";
+    nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.firewall.enable || config.networking.nftables.enable;
+        message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs.";
+      }
+      {
+        assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable;
+        message = "Fail2ban Nginx jails require your custom Nginx service to be enabled.";
+      }
+    ];
+
+    services.fail2ban = {
+      enable = true;
+
+      bantime = "24h";
+      # findtime = "10m";
+      maxretry = 5;
+
+      banaction = "nftables-multiport";
+
+      ignoreIP = [ "10.0.0.0/16" ];
+
+      jails = lib.mkMerge [
+        {
+          sshd = {
+            enabled = true;
+            settings = {
+              maxretry = 3;
+            };
+          };
+        }
+
+        (lib.mkIf cfg.nginxJails.enable {
+          nginx-http-auth = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-http-auth";
+              maxretry = 5;
+            };
+          };
+
+          nginx-botsearch = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-botsearch";
+              maxretry = 3;
+            };
+          };
+        })
+      ];
+    };
+  };
+}
diff --git a/os/srv/firewall.nix b/os/srv/firewall.nix
new file mode 100644
index 0000000..9242007
--- /dev/null
+++ b/os/srv/firewall.nix
@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.firewall;
+in
+{
+  options.os.srv.firewall = {
+    enable = lib.mkEnableOption "enables the firewall";
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking = {
+      nftables.enable = true;
+
+      firewall = {
+        enable = true;
+
+        allowedTCPPorts = [ ];
+        allowedUDPPorts = [ ];
+      };
+    };
+  };
+}
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index afe6d1e..1e3e9cd 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -66,7 +66,7 @@ in
 
     # --- SPECIFIC GAMES ---
     (lib.mkIf cfg.games.enable {
-      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.system}; [
+      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [
         (pkgs.openttd-jgrpp)
 
         # OpenMW Specific
@@ -104,13 +104,15 @@ in
               DisableFamilyShareLock = true;
               SafeMode = false;
             };
-            home.packages = [ inputs.sls-steam.packages.${pkgs.system}.wrapped ];
+            home.packages = [ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped ];
 
             xdg.desktopEntries = {
               "SLSsteam" = {
                 name = "SLSsteam";
                 comment = "Library modification for Steam";
-                exec = "${lib.getExe' inputs.sls-steam.packages.${pkgs.system}.wrapped "SLSsteam"} %U";
+                exec = "${
+                  lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam"
+                } %U";
                 icon = "steam";
                 terminal = false;
                 type = "Application";
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 40675e0..c7db2d8 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  masterDomain,
   ...
 }:
 let
@@ -9,20 +10,66 @@ let
 in
 {
   options.os.srv.monero = {
-    enable = lib.mkEnableOption "enables the daemon and wallet";
+    wallet.enable = lib.mkEnableOption "enables the monero wallet";
     service.enable = lib.mkEnableOption "enables hosting a monero node";
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
+    (lib.mkIf cfg.wallet.enable {
       environment.systemPackages = [ pkgs.monero-cli ];
     })
     (lib.mkIf cfg.service.enable {
+      assertions = [
+        {
+          assertion = config.os.srv.nginx.enable;
+          message = "Hosting a Monero node requires nginx for proxying";
+        }
+        {
+          assertion = config.os.srv.sops.enable;
+          message = "Required for password secure password storing";
+        }
+      ];
+
+      sops.secrets."monero/rpc-password" = {
+        owner = "monero";
+        restartUnits = [ "monero.service" ];
+      };
+
       services.monero = {
         enable = true;
-        prune = true;
-        dataDir = "/home/monero";
+        environmentFile = config.sops.secrets."monero/rpc-password".path;
+        banlist = builtins.fetchurl {
+          url = "https://gui.xmr.pm/files/block.txt";
+          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
+        };
+        limits = {
+          upload = 1250;
+          download = 1250;
+          threads = 4;
+        };
+        rpc = {
+          restricted = true;
+          user = "admin";
+        };
+      };
+
+      services.nginx.virtualHosts."xmr.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:18081";
+          extraConfig = ''
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+
+            client_max_body_size 50m;
+          '';
+        };
       };
+
+      # Left open for P2P syncing
+      networking.firewall.allowedTCPPorts = [ 18080 ];
     })
   ];
 }
diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
index 9ea54c3..51b9577 100644
--- a/os/srv/simplex.nix
+++ b/os/srv/simplex.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
 let
   cfg = config.os.srv.simplex;
   internalSmpPort = 5223;
@@ -22,24 +27,48 @@ in
             assertion = config.os.srv.nginx.enable;
             message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
           }
+          {
+            assertion = config.os.srv.sops.enable;
+            message = "SimpleX requires sops for managing container passwords securely.";
+          }
         ];
 
+        sops.secrets."simplex/smp-env" = { };
+        sops.secrets."simplex/xftp-env" = { };
+
         virtualisation.oci-containers.containers = {
           simplex-smp = {
             image = "simplexchat/smp-server:latest";
             ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
+
+            environment = {
+              ADDR = "smp.${masterDomain}";
+              CONFIG_DIR = "/etc/opt/simplex";
+            };
+
+            environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
+
             volumes = [
               "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
               "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
+              "/var/lib/simplex/certs:/certificates:ro"
             ];
           };
 
           simplex-xftp = {
             image = "simplexchat/xftp-server:latest";
             ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
+
+            environment = {
+              ADDR = "xftp.${masterDomain}";
+              QUOTA = "10gb";
+            };
+
+            environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
             volumes = [
               "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
               "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
+              "/var/lib/simplex/xftp/files:/srv/xftp:rw"
             ];
           };
         };
@@ -60,8 +89,16 @@ in
         systemd.tmpfiles.rules = [
           "d /var/lib/simplex/smp/config 0755 root root -"
           "d /var/lib/simplex/smp/logs 0755 root root -"
+          "d /var/lib/simplex/rsa_certs 0755 root root -"
+
           "d /var/lib/simplex/xftp/config 0755 root root -"
           "d /var/lib/simplex/xftp/logs 0755 root root -"
+          "d /var/lib/simplex/xftp/files 0755 root root -"
+        ];
+
+        networking.firewall.allowedTCPPorts = [
+          5223
+          5224
         ];
       }
 
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
new file mode 100644
index 0000000..089fb32
--- /dev/null
+++ b/os/srv/ssh.nix
@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  username,
+  ...
+}:
+let
+  cfg = config.os.srv.ssh;
+  keys = {
+    main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
+    oci = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgWmRbNTP/kcaZ8JNV1boVTZ/FQVV4qP/9eTKL9buzDvz9HJdgyWmbCiVZicNSert31IRdWOF/wm1sFjZ48nSkGDHbrnc//MPSdHULTx+kMES/NW9SZwwpaquFIJClrObysxrFYBAqweD+DJ3bp451WIymBs7lRBMNKPgoHBpJ5WN2CfIQjl60Jqnli7ML5seCsrquPEemcMPr1TFPmrFCbirzgDVkzCLL5kOowSD2uprtSA08fFm/pZ6nZh6KTQaEgPO4zR9tK+NQ46oCynWwBTI7JOPB4/LtIOiC5TjEUrkXZ/sJzpCBiNPYSRI8RWnAD0N/uVFJ4EYPUKLO2C/d";
+  };
+in
+{
+  options.os.srv.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+
+    programs.ssh.startAgent = true;
+    services.gnome.gcr-ssh-agent.enable = false;
+
+    users.users.${username}.openssh.authorizedKeys.keys = [ "${keys.main} adikro@disroot.org" ];
+
+    environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}";
+    home-manager.users.${username} = {
+      programs.ssh = {
+        enable = true;
+        enableDefaultConfig = false;
+
+        matchBlocks = {
+          "github.com codeberg.org" = {
+            identityFile = "~/.ssh/main_id_ed25519.pub";
+            identitiesOnly = true;
+            user = "git";
+          };
+          "oci" = {
+            hostname = "130.162.223.123";
+            user = "opc";
+          };
+        };
+      };
+      home.file = {
+        ".ssh/main_id_ed25519.pub".text = keys.main;
+        ".ssh/oci.pub".text = keys.oci;
+      };
+    };
+  };
+}
diff --git a/os/srv/tailscale.nix b/os/srv/tailscale.nix
new file mode 100644
index 0000000..5c8d72e
--- /dev/null
+++ b/os/srv/tailscale.nix
@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.tailscale;
+in
+{
+  options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "client";
+    };
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
+  };
+}
diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix
index 143e9da..8ff9f3f 100644
--- a/os/srv/virtualization.nix
+++ b/os/srv/virtualization.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  username,
   ...
 }:
 let
@@ -11,7 +10,6 @@ in
 {
   options.os.srv.virtualization = {
     kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
-    docker.enable = lib.mkEnableOption "Docker Container Virtualization";
     waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization";
   };
   config = lib.mkMerge [
@@ -28,11 +26,6 @@ in
         (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd")
         ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel");
     })
-    (lib.mkIf cfg.docker.enable {
-      virtualisation.docker.enable = true;
-      environment.systemPackages = [ pkgs.docker-compose ];
-      users.users.${username}.extraGroups = [ "docker" ];
-    })
     (lib.mkIf cfg.waydroid.enable {
       virtualisation.waydroid = {
         enable = true;