diff options
Diffstat (limited to 'os/srv')
| -rw-r--r-- | os/srv/dns.nix | 36 | ||||
| -rw-r--r-- | os/srv/monero.nix | 36 | ||||
| -rw-r--r-- | os/srv/nginx.nix | 18 |
3 files changed, 63 insertions, 27 deletions
diff --git a/os/srv/dns.nix b/os/srv/dns.nix index f0c50a6..2da4c66 100644 --- a/os/srv/dns.nix +++ b/os/srv/dns.nix @@ -1,10 +1,22 @@ -{ config, lib, ... }: +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: let cfg = config.os.srv.dns; unboundPort = 5335; in { - options.os.srv.dns.enable = lib.mkEnableOption "enables dns scanning"; + options.os.srv.dns = { + enable = lib.mkEnableOption "enables dns scanning"; + adguardProxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; config = lib.mkIf cfg.enable { services.unbound = { enable = true; @@ -63,11 +75,17 @@ in config.os.core.network.wg.ip config.os.core.network.hs.ip ]; + rewrites = [ + { + domain = "router.local"; + answer = config.os.core.network.ips.vm1-opnsense; + } + ]; port = 53; upstream_dns = [ "127.0.0.1:${toString unboundPort}" ]; bootstrap_dns = [ "9.9.9.9" ]; cache_size = 536870912; - # anonymize_client_ip = true; + anonymize_client_ip = true; }; filtering = { @@ -239,6 +257,18 @@ in }; }; + os.srv.dns.adguardProxyConfig = { + "adguard.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }; + networking.firewall = { allowedUDPPorts = [ 53 ]; allowedTCPPorts = [ 53 ]; diff --git a/os/srv/monero.nix b/os/srv/monero.nix index 4e74432..f00413d 100644 --- a/os/srv/monero.nix +++ b/os/srv/monero.nix @@ -12,7 +12,13 @@ in { options.os.srv.monero = { wallet.enable = lib.mkEnableOption "enables the monero wallet"; - service.enable = lib.mkEnableOption "enables hosting a monero node"; + service = { + enable = lib.mkEnableOption "enables hosting a monero node"; + proxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; }; config = lib.mkMerge [ @@ -22,10 +28,6 @@ in (lib.mkIf cfg.service.enable { assertions = [ { - assertion = config.os.srv.nginx.enable; - message = "Hosting a Monero node requires nginx for proxying"; - } - { assertion = config.os.srv.sops.enable; message = "Required for password secure password storing"; } @@ -55,19 +57,21 @@ in }; }; - services.nginx.virtualHosts."xmr.${masterDomain}" = { - enableACME = true; - forceSSL = true; + os.srv.monero.service.proxyConfig = { + "xmr.${masterDomain}" = { + enableACME = true; + forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:18081"; - extraConfig = '' - proxy_read_timeout 600s; - proxy_send_timeout 600s; - client_max_body_size 50m; + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.vm9-relays}:18081"; + extraConfig = '' + proxy_read_timeout 600s; + proxy_send_timeout 600s; + client_max_body_size 50m; - ${securityTemplates.restrictToInternal} - ''; + ${securityTemplates.restrictToInternal} + ''; + }; }; }; diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix index 6159e25..a38b703 100644 --- a/os/srv/nginx.nix +++ b/os/srv/nginx.nix @@ -42,14 +42,16 @@ in recommendedTlsSettings = true; recommendedOptimisation = true; recommendedGzipSettings = true; - virtualHosts = { - default = { - serverName = "_"; - default = true; - rejectSSL = true; - locations."/".return = "444"; - }; - }; + virtualHosts = lib.mkMerge [ + { + "_" = { + default = true; + rejectSSL = true; + locations."/".return = "444"; + }; + } + config.os.srv.monero.proxyConfig + ]; }; security.acme = { |