summaryrefslogtreecommitdiff
path: root/os/srv
diff options
context:
space:
mode:
Diffstat (limited to 'os/srv')
-rw-r--r--os/srv/authelia.nix18
-rw-r--r--os/srv/default.nix7
-rw-r--r--os/srv/dns.nix247
-rw-r--r--os/srv/files.nix3
-rw-r--r--os/srv/gaming.nix19
-rw-r--r--os/srv/headscale.nix42
-rw-r--r--os/srv/kdeconnect.nix18
-rw-r--r--os/srv/kea.nix58
-rw-r--r--os/srv/mailserver.nix59
-rw-r--r--os/srv/monero.nix10
-rw-r--r--os/srv/nginx.nix71
-rw-r--r--os/srv/omnisearch.nix62
-rw-r--r--os/srv/opnsense.nix102
-rw-r--r--os/srv/sops.nix9
-rw-r--r--os/srv/ssh.nix52
-rw-r--r--os/srv/syncthing.nix2
-rw-r--r--os/srv/ups.nix8
-rw-r--r--os/srv/wireguard.nix15
-rw-r--r--os/srv/yggdrasil.nix2
19 files changed, 591 insertions, 213 deletions
diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix
index a7a8c19..52b7114 100644
--- a/os/srv/authelia.nix
+++ b/os/srv/authelia.nix
@@ -8,11 +8,13 @@ let
cfg = config.os.srv.authelia;
in
{
- options.os.srv.authelia.enable = lib.mkEnableOption "enables authelia scanning";
- options.os.services.authelia.extraRules = lib.mkOption {
- type = lib.types.listOf lib.types.attrs;
- default = [ ];
- description = "Additional access control rules to be appended to Authelia.";
+ options.os.srv.authelia = {
+ enable = lib.mkEnableOption "enables authelia scanning";
+ extraRules = lib.mkOption {
+ type = lib.types.listOf lib.types.attrs;
+ default = [ ];
+ description = "Additional access control rules to be appended to Authelia.";
+ };
};
config = lib.mkIf cfg.enable {
assertions = [
@@ -20,6 +22,10 @@ in
assertion = config.os.srv.sops.enable;
message = "Required for password secure password storing";
}
+ {
+ assertion = config.os.srv.lldap.enable;
+ message = "required for user accounts";
+ }
];
services.authelia.instances.main = {
enable = true;
@@ -46,7 +52,7 @@ in
policy = "bypass";
}
]
- ++ config.os.services.authelia.extraRules;
+ ++ cfg.extraRules;
};
session.domain = masterDomain;
};
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 715b0e0..5729e10 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -7,13 +7,16 @@
./clamav.nix
./compat.nix
./crowdsec.nix
+ ./dns.nix
./fail2ban.nix
./files.nix
./firewall.nix
./gaming.nix
+ ./headscale.nix
./i2p.nix
- ./kdeconnect.nix
+ ./kea.nix
./lldap.nix
+ ./mailserver.nix
./monero.nix
./nfs.nix
./nginx.nix
@@ -21,7 +24,6 @@
./ntopng.nix
./oci.nix
./omnisearch.nix
- ./opnsense.nix
./simplex.nix
./sops.nix
./ssh.nix
@@ -29,6 +31,7 @@
./syncthing.nix
./tailscale.nix
./tor.nix
+ ./ups.nix
./virtualization.nix
./wireguard.nix
./yggdrasil.nix
diff --git a/os/srv/dns.nix b/os/srv/dns.nix
new file mode 100644
index 0000000..f0c50a6
--- /dev/null
+++ b/os/srv/dns.nix
@@ -0,0 +1,247 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.dns;
+ unboundPort = 5335;
+in
+{
+ options.os.srv.dns.enable = lib.mkEnableOption "enables dns scanning";
+ config = lib.mkIf cfg.enable {
+ services.unbound = {
+ enable = true;
+ settings = {
+ server = {
+ interface = [ "127.0.0.1" ];
+ port = unboundPort;
+
+ do-ip4 = true;
+ do-ip6 = false;
+ do-udp = true;
+ do-tcp = true;
+
+ num-threads = 4;
+ msg-cache-slabs = 4;
+ rrset-cache-slabs = 4;
+ infra-cache-slabs = 4;
+ key-cache-slabs = 4;
+
+ msg-cache-size = "256m";
+ rrset-cache-size = "512m";
+ infra-cache-numhosts = 20000;
+
+ so-rcvbuf = "8m";
+ so-sndbuf = "8m";
+ so-reuseport = true;
+
+ qname-minimisation = true;
+ prefetch = true;
+ prefetch-key = true;
+ harden-glue = true;
+ harden-dnssec-stripped = true;
+ hide-identity = true;
+ hide-version = true;
+ use-caps-for-id = false; # might try this later
+ edns-buffer-size = 1232;
+
+ access-control = [
+ "127.0.0.0/8 allow"
+ "0.0.0.0/0 deny"
+ ];
+ };
+ };
+ };
+
+ services.adguardhome = {
+ enable = true;
+ mutableSettings = true;
+
+ settings = {
+ http.address = "0.0.0.0:3000";
+ dns = {
+ bind_hosts = [
+ "127.0.0.1"
+ config.os.core.network.lan.ip
+ config.os.core.network.wg.ip
+ config.os.core.network.hs.ip
+ ];
+ port = 53;
+ upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
+ bootstrap_dns = [ "9.9.9.9" ];
+ cache_size = 536870912;
+ # anonymize_client_ip = true;
+ };
+
+ filtering = {
+ filtering_enabled = true;
+ interval = 24;
+ };
+ filters = [
+ {
+ enabled = true;
+ name = "Black Mirror Blocklist";
+ url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt";
+ }
+ {
+ enabled = true;
+ name = "Scam Blocklist by DurableNapkin";
+ url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt";
+ }
+ {
+ enabled = true;
+ name = "Neo Dev Host Blocklist";
+ url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker";
+ }
+ {
+ enabled = true;
+ name = "hBlock Blocklist";
+ url = "https://hblock.molinero.dev/hosts_adblock.txt";
+ }
+ {
+ enabled = true;
+ name = "OISD Big Blocklist";
+ url = "https://big.oisd.nl";
+ }
+ {
+ enabled = true;
+ name = "StevenBlack Unified";
+ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
+ }
+ {
+ enabled = true;
+ name = "StevenBlack Fakenews";
+ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts";
+ }
+ {
+ enabled = true;
+ name = "StevenBlack Gambling";
+ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts";
+ }
+
+ #-----------------------------------------------------------------------------
+
+ # HaGeZi's Blocklists
+
+ {
+ enabled = true;
+ name = "HaGeZi's Ultimate Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt";
+ }
+ {
+ enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive
+ name = "HaGeZi's Pro++ DNS Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Fake DNS Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Dynamic DNS Blocklsit";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Badware Hoster Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's URL Shortener Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's DNS Rebind Protection";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Gambling DNS Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt";
+ }
+
+ #-----------------------------------------------------------------------------
+
+ # NEWLY REGISTERED DOMAINS / ENTROPY DGAs
+
+ {
+ enabled = true;
+ name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt";
+ }
+ {
+ enabled = true;
+ name = "HaGeZi's Newly Registered High Entropy Domains";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt";
+ }
+
+ #-----------------------------------------------------------------------------
+
+ # DNS BYPASS BLOCKLISTS
+
+ {
+ enabled = true;
+ name = "HaGeZi's DNS Bypass Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt";
+ }
+ {
+ enabled = true;
+ name = "DNS HTTPS Blocklist";
+ url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt";
+ }
+
+ #-----------------------------------------------------------------------------
+
+ # NSFW DNS BLOCKLISTS
+
+ {
+ enabled = true;
+ name = "HaGeZi's NSFW DNS Blocklist";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt";
+ }
+ {
+ enabled = true;
+ name = "oisd NSFW";
+ url = "https://nsfw.oisd.nl";
+ }
+ {
+ enabled = true;
+ name = "StevenBlack NSFW Blocklist";
+ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts";
+ }
+ ];
+ };
+ };
+
+ networking.firewall = {
+ allowedUDPPorts = [ 53 ];
+ allowedTCPPorts = [ 53 ];
+ };
+ };
+}
diff --git a/os/srv/files.nix b/os/srv/files.nix
index d4b9363..777a394 100644
--- a/os/srv/files.nix
+++ b/os/srv/files.nix
@@ -35,9 +35,8 @@ in
pcmanfm
file-roller
gdu
- duc
pxz
- pigz
+ ripunzip
];
})
(lib.mkIf cfg.localsend.enable {
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 28e309a..7e9099d 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -42,14 +42,19 @@ in
general.renice = 10;
};
};
+ environment = {
+ # sets the optiscaler shortcut key to be home by default
+ sessionVariables = {
+ OPTISCALER_ShortcutKey = "0x24";
+ };
- home-manager.users.${username}.hm.soft.mangohud.enable = true;
-
- environment.systemPackages = with pkgs; [
- theclicker
- ludusavi
- protonplus
- ];
+ systemPackages = with pkgs; [
+ mangohud
+ theclicker
+ ludusavi
+ protonplus
+ ];
+ };
})
# --- EXTERNAL LAUNCHERS ---
diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix
new file mode 100644
index 0000000..a650067
--- /dev/null
+++ b/os/srv/headscale.nix
@@ -0,0 +1,42 @@
+{
+ config,
+ lib,
+ masterDomain,
+ ...
+}:
+let
+ cfg = config.os.srv.headscale;
+in
+{
+ options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales";
+ config = lib.mkIf cfg.enable {
+ services.headscale = {
+ enable = true;
+ address = "127.0.0.1";
+ port = 8080;
+
+ settings = {
+ server_url = "https://vpn.${masterDomain}";
+
+ dns = {
+ magic_dns = true;
+ base_domain = "vpn.internal";
+ nameservers = [ "10.255.1.1" ];
+ };
+
+ ip_prefixes = [
+ "10.254.0.0/16"
+ ];
+ };
+ };
+
+ services.nginx.virtualHosts."vpn.${masterDomain}" = {
+ enableACME = true;
+ forceSSL = true;
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:8080";
+ proxyWebsockets = true;
+ };
+ };
+ };
+}
diff --git a/os/srv/kdeconnect.nix b/os/srv/kdeconnect.nix
deleted file mode 100644
index 0b54f98..0000000
--- a/os/srv/kdeconnect.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
- config,
- lib,
- pkgs,
- ...
-}:
-let
- cfg = config.os.srv.kdeconnect;
-in
-{
- options.os.srv.kdeconnect.enable = lib.mkEnableOption "enables kde connect";
- config = lib.mkIf cfg.enable {
- programs.kdeconnect = {
- enable = true;
- package = pkgs.valent;
- };
- };
-}
diff --git a/os/srv/kea.nix b/os/srv/kea.nix
new file mode 100644
index 0000000..168590e
--- /dev/null
+++ b/os/srv/kea.nix
@@ -0,0 +1,58 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.kea;
+in
+{
+ options.os.srv.kea.enable = lib.mkEnableOption "enables kea dhcp server";
+ config = lib.mkIf cfg.enable {
+ services.kea.dhcp4 = {
+ enable = true;
+ settings = {
+ interfaces-config = {
+ # To be used in a VM
+ interfaces = [ "eth0" ];
+ dhcp-socket-type = "udp";
+ };
+
+ lease-database = {
+ type = "memfile";
+ persist = true;
+ name = "/var/lib/kea/dhcp4.leases";
+ };
+
+ subnet4 = [
+ {
+ id = 1;
+ subnet = "10.1.0.0/24";
+ pools = [ { pool = "10.1.0.50 - 10.1.0.250"; } ];
+ option-data = [
+ {
+ name = "routers";
+ data = "10.1.0.1";
+ }
+ {
+ name = "domain-name-servers";
+ data = "10.0.0.3";
+ }
+ ];
+ }
+ {
+ id = 2;
+ subnet = "10.2.0.0/24";
+ pools = [ { pool = "10.2.0.50 - 10.2.0.250"; } ];
+ option-data = [
+ {
+ name = "routers";
+ data = "10.2.0.1";
+ }
+ {
+ name = "domain-name-servers";
+ data = "10.0.0.3";
+ }
+ ];
+ }
+ ];
+ };
+ };
+ };
+}
diff --git a/os/srv/mailserver.nix b/os/srv/mailserver.nix
new file mode 100644
index 0000000..7bcd008
--- /dev/null
+++ b/os/srv/mailserver.nix
@@ -0,0 +1,59 @@
+{
+ config,
+ lib,
+ inputs,
+ masterDomain,
+ ...
+}:
+let
+ cfg = config.os.srv.mailserver;
+in
+{
+ options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning";
+ imports = [ inputs.nixos-mailserver.nixosModules.mailserver ];
+ config = lib.mkIf cfg.enable {
+ assertions = [
+ {
+ assertion = config.os.srv.sops.enable;
+ message = "Required for password secure password storing";
+ }
+ {
+ assertion = config.os.srv.lldap.enable;
+ message = "required for user accounts";
+ }
+ ];
+ mailserver = {
+ enable = true;
+ fqdn = "mail.${masterDomain}";
+ domains = [ masterDomain ];
+
+ # TODO setup ldap
+ ldap = {
+ enable = true;
+ uris = [ "ldap://127.0.0.1:3890" ];
+ base = "ou=people,dc=yourdomain,dc=com";
+
+ bind = {
+ dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com";
+ passwordFile = "/var/src/secrets/ldap-mail-password";
+ };
+
+ attributes = {
+ username = "uid";
+ mail = "mail";
+ password = "userPassword";
+ uuid = "entryUUID";
+ };
+
+ dovecot = {
+ userFilter = "(|(mail=%{user})(uid=%{user}))";
+ passFilter = "(uid=%{user})";
+ };
+
+ postfix = {
+ filter = "(mail=%s)";
+ };
+ };
+ };
+ };
+}
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 9088ef3..4e74432 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -3,6 +3,7 @@
lib,
pkgs,
masterDomain,
+ securityTemplates,
...
}:
let
@@ -57,20 +58,15 @@ in
services.nginx.virtualHosts."xmr.${masterDomain}" = {
enableACME = true;
forceSSL = true;
- listen = [
- {
- addr = "10.255.0.1";
- port = 443;
- }
- ];
locations."/" = {
proxyPass = "http://127.0.0.1:18081";
extraConfig = ''
proxy_read_timeout 600s;
proxy_send_timeout 600s;
-
client_max_body_size 50m;
+
+ ${securityTemplates.restrictToInternal}
'';
};
};
diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
index f0207b3..6159e25 100644
--- a/os/srv/nginx.nix
+++ b/os/srv/nginx.nix
@@ -19,39 +19,54 @@ in
};
};
- config = lib.mkIf cfg.enable {
- services.nginx = {
- enable = true;
- package = pkgs.nginx.override { openssl = pkgs.libressl; };
+ config = lib.mkMerge [
+ {
+ _module.args.securityTemplates.restrictToInternal = ''
+ allow 127.0.0.1;
+ allow ::1;
- recommendedProxySettings = true;
- recommendedTlsSettings = true;
- recommendedOptimisation = true;
- recommendedGzipSettings = true;
- virtualHosts = {
- default = {
- serverName = "_";
- default = true;
- rejectSSL = true;
- locations."/".return = "444";
+ allow ${config.os.core.network.lan.range};
+ allow ${config.os.core.network.wg.range};
+ allow ${config.os.core.network.hs.range};
+
+ deny all;
+ '';
+ }
+
+ (lib.mkIf cfg.enable {
+ services.nginx = {
+ enable = true;
+ package = pkgs.nginx.override { openssl = pkgs.libressl; };
+
+ recommendedProxySettings = true;
+ recommendedTlsSettings = true;
+ recommendedOptimisation = true;
+ recommendedGzipSettings = true;
+ virtualHosts = {
+ default = {
+ serverName = "_";
+ default = true;
+ rejectSSL = true;
+ locations."/".return = "444";
+ };
};
};
- };
- security.acme = {
- acceptTerms = true;
- defaults.email = "adikro@disroot.org";
- };
+ security.acme = {
+ acceptTerms = true;
+ defaults.email = "adikro@disroot.org";
+ };
- # users.users.nginx.extraGroups = [ "acme" ];
+ users.users.nginx.extraGroups = [ "acme" ];
- networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
- 80
- 443
- ];
+ networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+ 80
+ 443
+ ];
- systemd.tmpfiles.rules = [
- "d /var/log/nginx 0750 nginx adm -"
- ];
- };
+ systemd.tmpfiles.rules = [
+ "d /var/log/nginx 0750 nginx adm -"
+ ];
+ })
+ ];
}
diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix
index 756711f..ac36184 100644
--- a/os/srv/omnisearch.nix
+++ b/os/srv/omnisearch.nix
@@ -2,16 +2,72 @@
config,
lib,
inputs,
+ masterDomain,
+ templates,
...
}:
let
cfg = config.os.srv.omnisearch;
in
{
- options.os.srv.omnisearch.enable = lib.mkEnableOption "enables omnisearch";
imports = [ inputs.omnisearch.nixosModules.default ];
- config = lib.mkIf cfg.enable {
- services.omnisearch.enable = true;
+ options.os.srv.omnisearch = {
+ enable = lib.mkEnableOption "enables omnisearch tracking infrastructure";
+
+ role = lib.mkOption {
+ type = lib.types.enum [
+ "server"
+ "standalone"
+ ];
+ default = "standalone";
+ description = "Designates the deployment method";
+ };
};
+
+ config = lib.mkIf cfg.enable (
+ lib.mkMerge [
+ {
+ services.omnisearch = {
+ enable = true;
+ settings = {
+ server = {
+ host = "127.0.0.1";
+ port = 8087;
+ locale = "en";
+ domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087";
+ };
+ proxy = {
+ max_retries = 3;
+ randomize_username = true;
+ randomize_password = true;
+ };
+ cache = {
+ dir = "/var/cache/omnisearch";
+ ttl_search = 1800;
+ ttl_infobox = 86400;
+ };
+ };
+ };
+ }
+
+ (lib.mkIf (cfg.role == "server") {
+ assertions = [
+ {
+ assertion = config.os.srv.nginx.enable;
+ message = "Required for proxying";
+ }
+ ];
+ services.nginx.virtualHosts."search.${masterDomain}" = {
+ enableACME = true;
+ forceSSL = true;
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:8087";
+ proxyWebsockets = true;
+ extraConfig = templates.restrictToInternal;
+ };
+ };
+ })
+ ]
+ );
}
diff --git a/os/srv/opnsense.nix b/os/srv/opnsense.nix
deleted file mode 100644
index 7855e46..0000000
--- a/os/srv/opnsense.nix
+++ /dev/null
@@ -1,102 +0,0 @@
-{
- config,
- lib,
- inputs,
- ...
-}:
-let
- cfg = config.os.srv.opnsense;
- makePciArgs =
- ids:
- builtins.concatLists (
- map (id: [
- "-device"
- "vfio-pci,host=${id}"
- ]) ids
- );
-in
-{
- imports = [ inputs.microvm.nixosModules.host ];
- options.os.srv.opnsense = {
- enable = lib.mkEnableOption "enables an opnsense microvm";
- pciIDs = lib.mkOption {
- type = lib.types.listOf lib.types.str;
- default = [ ];
- example = [
- "01:00.0"
- "01:00.1"
- "01:00.2"
- "01:00.3"
- ];
- description = "List of PCI bus addresses to pass through to the VM.";
- };
- vendorIDs = lib.mkOption {
- type = lib.types.listOf lib.types.str;
- default = [ ];
- example = [ "8086:1521" ];
- description = "List of Vendor:Device IDs to bind to the vfio-pci driver.";
- };
- imagePath = lib.mkOption {
- type = lib.types.path;
- default = /var/lib/microvm/images/opnsense.qcow2;
- description = "Path to the OPNsense qcow2 image";
- };
- };
- config = lib.mkIf cfg.enable {
- networking = {
- bridges."br-lan".interfaces = [ ];
-
- # TODO configure this
- interfaces."br-lan".ipv4.addresses = [
- {
- address = "10.0.0.2";
- prefixLenght = 16;
- }
- ];
- };
- boot = {
- kernelParams = [
- "intel_iommu=on"
- "iommu=pt"
- ];
- kernelModules = [
- "vfio_pci"
- "vfio"
- "vfio_iommu_type1"
- ];
- extraModprobeConfig = ''
- options vfio-pci ids=${lib.concatStringsSep "," cfg.vendorIDs}
- '';
- };
- microvm.vms.opnsense = {
- autostart = true;
- config = {
- imports = [ inputs.microvm.nixosModules.microvm ];
-
- networking.hostName = "opnsense";
-
- microvm = {
- vcpu = 2;
- mem = 4096;
- hypervisor = "qemu";
-
- interfaces = [
- {
- type = "bridge";
- id = "vm-lan";
- bridge = "br-lan";
- }
- ];
-
- qemu.extraArgs = [
- "-machine"
- "q35,accel=kvm,kernel-irqchip=on"
- "-cpu"
- "host"
- ]
- ++ (makePciArgs cfg.pciIDs);
- };
- };
- };
- };
-}
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 1b27042..3ca2d16 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -15,20 +15,15 @@ in
options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix";
config = lib.mkIf cfg.enable {
sops = {
- defaultSopsFile = ../../secrets.yaml;
+ defaultSopsFile = ../../secrets/common.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets = {
- "syncthing/gui_password".owner = username;
+ # "syncthing/gui_password".owner = username;
"syncthing/encryption/keepass".owner = username;
"syncthing/encryption/sync".owner = username;
"obs/websocket_password".owner = username;
- "yggdrasil-private-key" = {
- owner = "root";
- group = "wheel";
- mode = "0440";
- };
};
};
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
index ec39bbd..d36df00 100644
--- a/os/srv/ssh.nix
+++ b/os/srv/ssh.nix
@@ -13,7 +13,7 @@ in
server = {
enable = lib.mkEnableOption "enables the ssh server module";
enableInitrd = lib.mkEnableOption "enables ssh access during initrd";
- enableWireguard = lib.mkEnableOption "only allows connections from wireguard";
+ microvm.enable = lib.mkEnableOption "enables ssh for microvms";
};
client = {
enable = lib.mkEnableOption "enables the ssh client module";
@@ -27,6 +27,24 @@ in
services.openssh = {
enable = true;
+ listenAddresses = [
+ {
+ addr = "127.0.0.1";
+ port = 22;
+ }
+ {
+ addr = config.os.core.network.lan.ip;
+ port = 22;
+ }
+ {
+ addr = config.os.core.network.wg.ip;
+ port = 22;
+ }
+ {
+ addr = config.os.core.network.hs.ip;
+ port = 22;
+ }
+ ];
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
@@ -36,17 +54,27 @@ in
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
- PermitRootLogin = "no";
+ PermitRootLogin = if cfg.server.microvm.enable then "prohibit-password" else "no";
PubkeyAcceptedAlgorithms = "ssh-ed25519";
};
};
- users.users.${username}.openssh.authorizedKeys.keys = [
+ users.users = (
+ lib.optionalAttrs (username != "" && username != null) {
+ ${username}.openssh.authorizedKeys.keys = [
+ "${keys.main} adikro@disroot.org"
+ ];
+ }
+ );
+ })
+
+ (lib.mkIf (cfg.server.enable && cfg.server.microvm.enable) {
+ users.users.root.openssh.authorizedKeys.keys = [
"${keys.main} adikro@disroot.org"
];
-
})
+
(lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) {
assertions = [
{
@@ -75,13 +103,6 @@ in
kernelParams = [ "ip=dhcp" ];
};
})
- (lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) {
- services.openssh.listenAddresses = [
- {
- addr = "10.255.0.1";
- }
- ];
- })
(lib.mkIf cfg.client.enable {
programs.ssh.startAgent = true;
@@ -89,6 +110,7 @@ in
})
(lib.mkIf (cfg.client.enable && cfg.client.createAliases) {
+ # TODO use hjem
programs.ssh.extraConfig = ''
Host github.com codeberg.org
IdentityFile /home/${username}/.ssh/main_id_ed25519.pub
@@ -98,14 +120,6 @@ in
Host oci
HostName 130.162.223.123
User opc
-
- Host bibus
- HostName bibus.top
- User opc
-
- Host bibus-local
- HostName 10.255.0.1
- user opc
'';
systemd.tmpfiles.rules = [
"d /home/${username}/.ssh 0700 ${username} users - -"
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
index bcbf665..0c5e53e 100644
--- a/os/srv/syncthing.nix
+++ b/os/srv/syncthing.nix
@@ -124,7 +124,7 @@ in
user = username;
dataDir = "/home/${username}/.local/share/syncthing";
configDir = "/home/${username}/.config/syncthing";
- guiPasswordFile = config.sops.secrets."syncthing/gui_password".path;
+ # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path;
settings = {
devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ";
diff --git a/os/srv/ups.nix b/os/srv/ups.nix
index 8a36007..260f346 100644
--- a/os/srv/ups.nix
+++ b/os/srv/ups.nix
@@ -26,10 +26,10 @@ in
passwordFile = "sops";
type = "master";
};
- settings = {
- MINSUPPLIES = 1;
- POWERDOWNFLAG = "/run/killpower";
- };
+ # settings = {
+ # MINSUPPLIES = 1;
+ # POWERDOWNFLAG = "/run/killpower";
+ # };
};
};
}
diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix
index 15675a4..363ac9f 100644
--- a/os/srv/wireguard.nix
+++ b/os/srv/wireguard.nix
@@ -27,6 +27,11 @@ in
default = "eth0";
description = "The public WAN interface of the server";
};
+ publicKey = lib.mkOption {
+ type = lib.types.nullOr lib.types.str;
+ default = null;
+ description = "The public key of your primary WireGuard server node.";
+ };
peers = lib.mkOption {
type = lib.types.listOf (
@@ -93,17 +98,16 @@ in
iifname "wg0" accept
oifname "wg0" accept
}
-
chain postrouting {
type nat hook postrouting priority 100; policy accept;
- iifname "wg0" oifname "${cfg.server.externalInterface}" masquerade
+ oifname "${cfg.server.externalInterface}" masquerade
}
'';
};
};
networking.wireguard.interfaces.wg0 = {
- ips = [ "10.255.1.1/16" ];
+ ips = [ "10.255.1.1/24" ];
listenPort = 51280;
privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path;
@@ -129,13 +133,12 @@ in
];
networking.wireguard.interfaces.wg0 = {
- ips = [ "10.255.0.${toString cfg.client.index}/16" ];
+ ips = [ "10.255.0.${toString cfg.client.index}/24" ];
privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path;
peers = [
{
- # TODO get the server public key
- publicKey = "";
+ publicKey = cfg.server.publicKey;
endpoint = "${masterDomain}:51280";
persistentKeepalive = 25;
diff --git a/os/srv/yggdrasil.nix b/os/srv/yggdrasil.nix
index 1a18380..6fe91af 100644
--- a/os/srv/yggdrasil.nix
+++ b/os/srv/yggdrasil.nix
@@ -16,7 +16,7 @@ in
openMulticastPort = true;
settings = {
- PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path;
+ # PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path;
IfName = "ygg0";
NodeInfoPrivacy = true;
Peers = [
generated by cgit v1.3 (git 2.53.0) at 2026-08-17 01:33:36 +0000