moved ssh and tailscale to srv, revamped netwroking modules

14 files changed, 326 insertions, 42 deletions

diff --git a/os/core/default.nix b/os/core/default.nix
index 1899553..1146f2d 100644
--- a/os/core/default.nix
+++ b/os/core/default.nix
@@ -15,9 +15,7 @@ in
     ./networking.nix
     ./power.nix
     ./security.nix
-    ./ssh.nix
     ./storage.nix
-    ./tailscale.nix
     ./users.nix
   ];
 
diff --git a/os/core/fonts.nix b/os/core/fonts.nix
index dac0ee7..ee61591 100644
--- a/os/core/fonts.nix
+++ b/os/core/fonts.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.os.core.fonts;
 in
@@ -18,6 +23,10 @@ in
       nerd-fonts.jetbrains-mono
       nerd-fonts.fira-mono
       nerd-fonts.fira-code
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-cjk-serif
+      noto-fonts-color-emoji
     ];
   };
 }
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 0a93cb9..22fc206 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -8,26 +8,50 @@ let
   cfg = config.os.core.network;
 in
 {
-  options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
-  config = lib.mkIf cfg.enable {
-    networking = {
-      networkmanager = {
-        enable = true;
-        wifi = {
-          macAddress = "random";
-          backend = "iwd";
-        };
-        ethernet.macAddress = "random";
-        dns = "systemd-resolved";
-      };
-      firewall = {
-        enable = true;
-        allowedTCPPorts = [ ];
-        allowedUDPPorts = [ ];
-      };
+  options.os.core.network = {
+    enable = lib.mkEnableOption "system-wide networking setup";
+
+    profile = lib.mkOption {
+      type = lib.types.enum [
+        "client"
+        "server"
+      ];
+      default = "client";
+      description = "Which networking profile configuration to apply";
     };
-    environment.systemPackages = [ pkgs.impala ];
-    services.resolved.enable = true;
-    systemd.services."NetworkManager-wait-online".enable = false;
   };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        networking.networkmanager = {
+          enable = true;
+          dns = "systemd-resolved";
+        };
+
+        services.resolved.enable = true;
+      }
+
+      (lib.mkIf (cfg.profile == "client") {
+        networking.networkmanager = {
+          wifi.macAddress = "random";
+          wifi.backend = "iwd";
+          ethernet.macAddress = "random";
+        };
+
+        systemd.services."NetworkManager-wait-online".enable = false;
+
+        environment.systemPackages = [
+          pkgs.impala
+        ];
+      })
+
+      (lib.mkIf (cfg.profile == "server") {
+        networking.networkmanager = {
+          wifi.macAddress = "keep";
+          ethernet.macAddress = "keep";
+        };
+      })
+    ]
+  );
 }
diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
new file mode 100644
index 0000000..79c8718
--- /dev/null
+++ b/os/srv/crowdsec.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.security.crowdsec;
+in
+{
+  options.os.srv.security.crowdsec = {
+    enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.nftables.enable;
+        message = "CrowdSec requires networking.nftables to be enabled for blocking.";
+      }
+    ];
+
+    services.crowdsec = {
+      enable = true;
+      autoUpdateService = true;
+
+      localConfig = {
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+          {
+            filenames = [
+              "/var/log/nginx/access.log"
+              "/var/log/nginx/error.log"
+            ];
+            labels.type = "nginx";
+          }
+        ];
+
+        parsers.s02Enrich = [
+          {
+            name = "myips/whitelist";
+            description = "Prevent local address ranges from triggering bans";
+            whitelist = {
+              reason = "Internal private subnets";
+              cidr = [
+                "10.0.0.0/16"
+              ];
+            };
+          }
+        ];
+      };
+
+      hub = {
+        collections = [
+          "crowdsecurity/linux"
+          "crowdsecurity/nginx"
+          "crowdsecurity/sshd"
+        ];
+      };
+
+      settings = {
+        lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
+        capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
+      };
+    };
+
+    services.crowdsec-firewall-bouncer = {
+      enable = true;
+      settings = {
+        update_frequency = "10s";
+      };
+    };
+
+    users.users.crowdsec.extraGroups = [
+      "nginx"
+      "systemd-journal"
+    ];
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index b83e892..76351e2 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -3,7 +3,10 @@
   imports = [
     ./bluetooth.nix
     ./compat.nix
+    ./crowdsec.nix
+    ./fail2ban.nix
     ./files.nix
+    ./firewall.nix
     ./gaming.nix
     ./i2p.nix
     ./kdeconnect.nix
@@ -15,8 +18,10 @@
     ./opnsense.nix
     ./simplex.nix
     ./sops.nix
+    ./ssh.nix
     ./sunshine.nix
     ./syncthing.nix
+    ./tailscale.nix
     ./tor.nix
     ./virtualization.nix
     ./vpn.nix
diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix
new file mode 100644
index 0000000..9b51ceb
--- /dev/null
+++ b/os/srv/fail2ban.nix
@@ -0,0 +1,69 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.os.srv.fail2ban;
+in
+{
+  options.os.srv.fail2ban = {
+    enable = lib.mkEnableOption "the NGINX reverse proxy service";
+    nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.firewall.enable || config.networking.nftables.enable;
+        message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs.";
+      }
+      {
+        assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable;
+        message = "Fail2ban Nginx jails require your custom Nginx service to be enabled.";
+      }
+    ];
+
+    services.fail2ban = {
+      enable = true;
+
+      bantime = "24h";
+      # findtime = "10m";
+      maxretry = 5;
+
+      banaction = "nftables-multiport";
+
+      ignoreIP = [ "10.0.0.0/16" ];
+
+      jails = lib.mkMerge [
+        {
+          sshd = {
+            enabled = true;
+            settings = {
+              maxretry = 3;
+            };
+          };
+        }
+
+        (lib.mkIf cfg.nginxJails.enable {
+          nginx-http-auth = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-http-auth";
+              maxretry = 5;
+            };
+          };
+
+          nginx-botsearch = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-botsearch";
+              maxretry = 3;
+            };
+          };
+        })
+      ];
+    };
+  };
+}
diff --git a/os/srv/firewall.nix b/os/srv/firewall.nix
new file mode 100644
index 0000000..9242007
--- /dev/null
+++ b/os/srv/firewall.nix
@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.firewall;
+in
+{
+  options.os.srv.firewall = {
+    enable = lib.mkEnableOption "enables the firewall";
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking = {
+      nftables.enable = true;
+
+      firewall = {
+        enable = true;
+
+        allowedTCPPorts = [ ];
+        allowedUDPPorts = [ ];
+      };
+    };
+  };
+}
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index afe6d1e..1e3e9cd 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -66,7 +66,7 @@ in
 
     # --- SPECIFIC GAMES ---
     (lib.mkIf cfg.games.enable {
-      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.system}; [
+      environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [
         (pkgs.openttd-jgrpp)
 
         # OpenMW Specific
@@ -104,13 +104,15 @@ in
               DisableFamilyShareLock = true;
               SafeMode = false;
             };
-            home.packages = [ inputs.sls-steam.packages.${pkgs.system}.wrapped ];
+            home.packages = [ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped ];
 
             xdg.desktopEntries = {
               "SLSsteam" = {
                 name = "SLSsteam";
                 comment = "Library modification for Steam";
-                exec = "${lib.getExe' inputs.sls-steam.packages.${pkgs.system}.wrapped "SLSsteam"} %U";
+                exec = "${
+                  lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam"
+                } %U";
                 icon = "steam";
                 terminal = false;
                 type = "Application";
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 40675e0..c7db2d8 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  masterDomain,
   ...
 }:
 let
@@ -9,20 +10,66 @@ let
 in
 {
   options.os.srv.monero = {
-    enable = lib.mkEnableOption "enables the daemon and wallet";
+    wallet.enable = lib.mkEnableOption "enables the monero wallet";
     service.enable = lib.mkEnableOption "enables hosting a monero node";
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
+    (lib.mkIf cfg.wallet.enable {
       environment.systemPackages = [ pkgs.monero-cli ];
     })
     (lib.mkIf cfg.service.enable {
+      assertions = [
+        {
+          assertion = config.os.srv.nginx.enable;
+          message = "Hosting a Monero node requires nginx for proxying";
+        }
+        {
+          assertion = config.os.srv.sops.enable;
+          message = "Required for password secure password storing";
+        }
+      ];
+
+      sops.secrets."monero/rpc-password" = {
+        owner = "monero";
+        restartUnits = [ "monero.service" ];
+      };
+
       services.monero = {
         enable = true;
-        prune = true;
-        dataDir = "/home/monero";
+        environmentFile = config.sops.secrets."monero/rpc-password".path;
+        banlist = builtins.fetchurl {
+          url = "https://gui.xmr.pm/files/block.txt";
+          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
+        };
+        limits = {
+          upload = 1250;
+          download = 1250;
+          threads = 4;
+        };
+        rpc = {
+          restricted = true;
+          user = "admin";
+        };
+      };
+
+      services.nginx.virtualHosts."xmr.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:18081";
+          extraConfig = ''
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+
+            client_max_body_size 50m;
+          '';
+        };
       };
+
+      # Left open for P2P syncing
+      networking.firewall.allowedTCPPorts = [ 18080 ];
     })
   ];
 }
diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
index 9ea54c3..51b9577 100644
--- a/os/srv/simplex.nix
+++ b/os/srv/simplex.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
 let
   cfg = config.os.srv.simplex;
   internalSmpPort = 5223;
@@ -22,24 +27,48 @@ in
             assertion = config.os.srv.nginx.enable;
             message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying.";
           }
+          {
+            assertion = config.os.srv.sops.enable;
+            message = "SimpleX requires sops for managing container passwords securely.";
+          }
         ];
 
+        sops.secrets."simplex/smp-env" = { };
+        sops.secrets."simplex/xftp-env" = { };
+
         virtualisation.oci-containers.containers = {
           simplex-smp = {
             image = "simplexchat/smp-server:latest";
             ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ];
+
+            environment = {
+              ADDR = "smp.${masterDomain}";
+              CONFIG_DIR = "/etc/opt/simplex";
+            };
+
+            environmentFiles = [ config.sops.secrets."simplex/smp-env".path ];
+
             volumes = [
               "/var/lib/simplex/smp/config:/etc/opt/simplex:rw"
               "/var/lib/simplex/smp/logs:/var/opt/simplex:rw"
+              "/var/lib/simplex/certs:/certificates:ro"
             ];
           };
 
           simplex-xftp = {
             image = "simplexchat/xftp-server:latest";
             ports = [ "127.0.0.1:${toString internalXftpPort}:443" ];
+
+            environment = {
+              ADDR = "xftp.${masterDomain}";
+              QUOTA = "10gb";
+            };
+
+            environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ];
             volumes = [
               "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw"
               "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw"
+              "/var/lib/simplex/xftp/files:/srv/xftp:rw"
             ];
           };
         };
@@ -60,8 +89,16 @@ in
         systemd.tmpfiles.rules = [
           "d /var/lib/simplex/smp/config 0755 root root -"
           "d /var/lib/simplex/smp/logs 0755 root root -"
+          "d /var/lib/simplex/rsa_certs 0755 root root -"
+
           "d /var/lib/simplex/xftp/config 0755 root root -"
           "d /var/lib/simplex/xftp/logs 0755 root root -"
+          "d /var/lib/simplex/xftp/files 0755 root root -"
+        ];
+
+        networking.firewall.allowedTCPPorts = [
+          5223
+          5224
         ];
       }
 
diff --git a/os/core/ssh.nix b/os/srv/ssh.nix
index 52b7c32..089fb32 100644
--- a/os/core/ssh.nix
+++ b/os/srv/ssh.nix
@@ -5,14 +5,14 @@
   ...
 }:
 let
-  cfg = config.os.core.ssh;
+  cfg = config.os.srv.ssh;
   keys = {
     main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
     oci = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgWmRbNTP/kcaZ8JNV1boVTZ/FQVV4qP/9eTKL9buzDvz9HJdgyWmbCiVZicNSert31IRdWOF/wm1sFjZ48nSkGDHbrnc//MPSdHULTx+kMES/NW9SZwwpaquFIJClrObysxrFYBAqweD+DJ3bp451WIymBs7lRBMNKPgoHBpJ5WN2CfIQjl60Jqnli7ML5seCsrquPEemcMPr1TFPmrFCbirzgDVkzCLL5kOowSD2uprtSA08fFm/pZ6nZh6KTQaEgPO4zR9tK+NQ46oCynWwBTI7JOPB4/LtIOiC5TjEUrkXZ/sJzpCBiNPYSRI8RWnAD0N/uVFJ4EYPUKLO2C/d";
   };
 in
 {
-  options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+  options.os.srv.ssh.enable = lib.mkEnableOption "enables ssh server setup";
 
   config = lib.mkIf cfg.enable {
     services.openssh = {
diff --git a/os/core/tailscale.nix b/os/srv/tailscale.nix
index 795fdbb..5c8d72e 100644
--- a/os/core/tailscale.nix
+++ b/os/srv/tailscale.nix
@@ -1,9 +1,9 @@
 { config, lib, ... }:
 let
-  cfg = config.os.core.tailscale;
+  cfg = config.os.srv.tailscale;
 in
 {
-  options.os.core.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
+  options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
 
   config = lib.mkIf cfg.enable {
     services.tailscale = {
diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix
index 143e9da..8ff9f3f 100644
--- a/os/srv/virtualization.nix
+++ b/os/srv/virtualization.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  username,
   ...
 }:
 let
@@ -11,7 +10,6 @@ in
 {
   options.os.srv.virtualization = {
     kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
-    docker.enable = lib.mkEnableOption "Docker Container Virtualization";
     waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization";
   };
   config = lib.mkMerge [
@@ -28,11 +26,6 @@ in
         (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd")
         ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel");
     })
-    (lib.mkIf cfg.docker.enable {
-      virtualisation.docker.enable = true;
-      environment.systemPackages = [ pkgs.docker-compose ];
-      users.users.${username}.extraGroups = [ "docker" ];
-    })
     (lib.mkIf cfg.waydroid.enable {
       virtualisation.waydroid = {
         enable = true;
diff --git a/os/vms/default.nix b/os/vms/default.nix
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/os/vms/default.nix