summaryrefslogtreecommitdiff
path: root/os
diff options
context:
space:
mode:
Diffstat (limited to 'os')
-rw-r--r--os/core/default.nix1
-rw-r--r--os/core/networking.nix25
-rw-r--r--os/core/persistance.nix50
-rw-r--r--os/core/users.nix2
-rw-r--r--os/core/zfs.nix (renamed from os/srv/zfs.nix)6
-rw-r--r--os/srv/avahi.nix41
-rw-r--r--os/srv/backup.nix3
-rw-r--r--os/srv/crowdsec.nix74
-rw-r--r--os/srv/default.nix1
-rw-r--r--os/srv/dns.nix13
-rw-r--r--os/srv/gaming.nix31
-rw-r--r--os/srv/lldap.nix11
-rw-r--r--os/srv/monero.nix32
-rw-r--r--os/srv/simplex.nix13
-rw-r--r--os/srv/ssh.nix69
-rw-r--r--os/vms/microvms.nix3
16 files changed, 224 insertions, 151 deletions
diff --git a/os/core/default.nix b/os/core/default.nix
index 1146f2d..963436b 100644
--- a/os/core/default.nix
+++ b/os/core/default.nix
@@ -17,6 +17,7 @@ in
./security.nix
./storage.nix
./users.nix
+ ./zfs.nix
];
options.os.core = {
diff --git a/os/core/networking.nix b/os/core/networking.nix
index b94b540..9e4c329 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -20,20 +20,21 @@ in
ips = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
- default = rec {
- router = opnsense-vm;
- host = "10.0.0.2";
+ default = {
+ bare-metal = "10.0.0.2";
opnsense-vm = "10.0.0.1";
gateway-vm = "10.0.0.3";
- databse-vm = "10.0.0.4";
- monitor-vm = "10.0.0.5";
- media-vm = "10.0.0.6";
- sandbox-vm = "10.0.0.7";
- storage-vm = "10.0.0.8";
- web-vm = "10.0.0.9";
- mail-vm = "10.0.0.10";
- relay-vm = "10.0.0.11";
- gameserver-vm = "10.0.0.12";
+ auth-vm = "10.0.0.4";
+ database-vm = "10.0.0.5";
+ monitor-vm = "10.0.0.6";
+ media-vm = "10.0.0.7";
+ torrent-vm = "10.0.0.8";
+ storage-vm = "10.0.0.9";
+ web-vm = "10.0.0.10";
+ comm-vm = "10.0.0.11";
+ mail-vm = "10.0.0.12";
+ relay-vm = "10.0.0.13";
+ gameserver-vm = "10.0.0.14";
};
description = "Central registry of static IP allocations for the cluster.";
};
diff --git a/os/core/persistance.nix b/os/core/persistance.nix
new file mode 100644
index 0000000..89f3702
--- /dev/null
+++ b/os/core/persistance.nix
@@ -0,0 +1,50 @@
+{
+ config,
+ lib,
+ inputs,
+ ...
+}:
+let
+ cfg = config.os.srv.persistance;
+in
+{
+ imports = [ inputs.impermanence.nixosModules.impermanence ];
+
+ options.os.srv.persistance.enable = lib.mkEnableOption "enables persistance drive maintnance";
+ config = lib.mkMerge [
+ (lib.mkIf cfg.enable {
+ environment.persistence."/persist" = {
+ hideMounts = true;
+ directories = [
+ "/var/lib/nixos"
+ "/var/lib/systemd"
+ "/var/lib/microvm"
+ ];
+ files = [
+ "/etc/machine-id"
+ ];
+ };
+ })
+ (lib.mkIf (cfg.enable && config.os.srv.ssh.server.enable) {
+ environment.persistence."/persist" = {
+ files = [
+ "/etc/ssh/ssh_host_ed25519_key"
+ "/etc/ssh/ssh_host_ed25519_key.pub"
+ ];
+ };
+ })
+ (lib.mkIf (cfg.enable && config.os.srv.crowdsec.agent.enable) {
+ environment.persistence."/persist" = lib.mkIf cfg.agent.enable {
+ hideMounts = true;
+ directories = [
+ {
+ directory = "/var/lib/crowdsec";
+ user = "crowdsec";
+ group = "crowdsec";
+ mode = "0750";
+ }
+ ];
+ };
+ })
+ ];
+}
diff --git a/os/core/users.nix b/os/core/users.nix
index 494406b..ff45a99 100644
--- a/os/core/users.nix
+++ b/os/core/users.nix
@@ -43,7 +43,7 @@ in
"render"
])
(lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ])
- (lib.mkIf (config.os.srv.virtualization.enable or false) [ "libvirtd" ])
+ (lib.mkIf (config.os.srv.virtualization.kvm.enable or false) [ "libvirtd" ])
(lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ])
];
};
diff --git a/os/srv/zfs.nix b/os/core/zfs.nix
index 3bfd2de..771644d 100644
--- a/os/srv/zfs.nix
+++ b/os/core/zfs.nix
@@ -21,8 +21,8 @@ in
boot = {
kernelParams = [ "zfs.zfs_arc_max=${toString (32 * 1024 * 1024 * 1024)}" ];
zfs = {
- requestEncryptionCredentials = [ "zroot" ];
- useKeyringForCredentials = true;
+ # requestEncryptionCredentials = [ "zroot" ];
+ # useKeyringForCredentials = true;
extraPools = [ "tank" ];
};
supportedFilesystems = [ "zfs" ];
@@ -37,7 +37,6 @@ in
flags = "-k -p --utc";
};
zed = {
- enableCustomScripts = true;
settings = {
ZED_DEBUG_LOG = "/var/log/zed.debug.log";
@@ -56,5 +55,6 @@ in
};
systemd.services.zfs-zed.serviceConfig.EnvironmentFile = config.sops.secrets."ntfy/zed".path;
networking.hostId = "4e3e22e1";
+
};
}
diff --git a/os/srv/avahi.nix b/os/srv/avahi.nix
new file mode 100644
index 0000000..f14b33a
--- /dev/null
+++ b/os/srv/avahi.nix
@@ -0,0 +1,41 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.avahi;
+in
+{
+ options.os.srv.avahi.enable = lib.mkEnableOption "enables avahis";
+ config = lib.mkIf cfg.enable {
+ services.avahi = {
+ enable = true;
+ ipv4 = true;
+
+ publish = {
+ enable = true;
+ addresses = true;
+ workstation = true;
+ };
+
+ nssmdns4 = true;
+
+ extraServiceFiles = {
+ nfs = ''
+ <?xml version="1.0" standalone='no'?>
+ <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+ <service-group>
+ <name replace-wildcards="yes">NFS Share on %h</name>
+ <service>
+ <type>_nfs._tcp</type>
+ <port>2049</port>
+ <txt-record>path=/data/vault</txt-record>
+ </service>
+ <service>
+ <type>_nfs._tcp</type>
+ <port>2049</port>
+ <txt-record>path=/data/media</txt-record>
+ </service>
+ </service-group>
+ '';
+ };
+ };
+ };
+}
diff --git a/os/srv/backup.nix b/os/srv/backup.nix
index 3d1d583..e7c07f9 100644
--- a/os/srv/backup.nix
+++ b/os/srv/backup.nix
@@ -58,7 +58,8 @@ in
syncoid = {
enable = true;
commonArgs = [
- "-w"
+ "-c"
+ "-p"
"--delete-target-snapshots"
"--use-hold"
"--no-sync-snap"
diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
index 71818bd..c3df81b 100644
--- a/os/srv/crowdsec.nix
+++ b/os/srv/crowdsec.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+ config,
+ lib,
+ masterDomain,
+ ...
+}:
let
cfg = config.os.srv.security.crowdsec;
in
@@ -22,14 +27,71 @@ in
}
];
+ sops = {
+ secrets."crowdsec/env" = {
+ owner = "crowdsec";
+ group = "crowdsec";
+ restartUnits = [ "crowdsec.service" ];
+ };
+
+ templates."local_api_credentials.yaml" = {
+ owner = "crowdsec";
+ group = "crowdsec";
+ restartUnits = [ "crowdsec.service" ];
+ content = ''
+ url: http://${config.os.core.network.ips.gateway-vm}:8080
+ login: ${config.networking.hostName}
+ password: ${config.sops.placeholder."crowdsec/client_password"}
+ '';
+ };
+ };
+
+ systemd.services.crowdsec.serviceConfig.EnvironmentFile = config.sops.secrets."crowdsec/env".path;
+
services.crowdsec = {
enable = true;
autoUpdateService = true;
- openFirewall = cfg.aggregator.enable;
+ openFirewall = true;
settings = {
- api.server.enable = cfg.aggregator.enable;
+ common = {
+ compress_logs = true;
+ log_format = "json";
+ };
+ prometheus = {
+ enabled = true;
+ level = "full";
+ listen_addr = "0.0.0.0";
+ listen_port = 6060;
+ };
+ db_config = {
+ type = "postgresql";
+ host = config.os.core.network.ips.database-vm;
+ port = 5432;
+ db_name = "crowdsec";
+ user = "crowdsec";
+ password = "$CROWDSEC_DB_PASSWORD";
+ sslmode = "require";
+ };
+
+ api = {
+ server = {
+ enable = cfg.aggregator.enable;
+ listen_uri = "0.0.0.0:8080";
+ trusted_ips = [
+ "127.0.0.1"
+ "10.0.0.0/24"
+ ];
+
+ auto_registration = {
+ enabled = cfg.aggregator.enable;
+ token = "$CROWDSEC_REGISTER_TOKEN";
+ allowed_ranges = [ "10.0.0.0/24" ];
+ };
+ };
+ client.credentials_path = config.sops.templates."local_api_credentials.yaml".path;
+ };
lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
};
@@ -82,11 +144,11 @@ in
name = "ntfy_alerts";
type = "http";
method = "POST";
- #TODO add ntfy sops thing
- url = "https://ntfy.sh/your_secret_topic_here";
+ url = "https://ntfy.${masterDomain}/crowdsec-alerts";
headers = {
Title = "CrowdSec Alert on Bibus-Lab";
Priority = "high";
+ Authorization = "$NTFY_AUTH_TOKEN";
};
format = ''
{{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}}
@@ -105,8 +167,8 @@ in
settings = {
mode = "nftables";
update_frequency = "10s";
-
api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
+ api_key = lib.mkIf cfg.aggregator.enable "$CROWDSEC_LOCAL_BOUNCER_KEY";
};
};
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 073067d..c89d029 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -44,6 +44,5 @@
./virtualization.nix
./wireguard.nix
./yggdrasil.nix
- ./zfs.nix
];
}
diff --git a/os/srv/dns.nix b/os/srv/dns.nix
index 2da4c66..b8a973f 100644
--- a/os/srv/dns.nix
+++ b/os/srv/dns.nix
@@ -77,12 +77,21 @@ in
];
rewrites = [
{
- domain = "router.local";
- answer = config.os.core.network.ips.vm1-opnsense;
+ domain = "router.lan";
+ answer = config.os.core.network.ips.opnsense-vm;
+ }
+ {
+ domain = "nas.lan";
+ answer = config.os.core.network.ips.bare-metal;
+ }
+ {
+ domain = "ldap.${masterDomain}";
+ answer = config.os.core.network.ips.gateway-vm;
}
];
port = 53;
upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
+ fallback_dns = [ "9.9.9.9" ];
bootstrap_dns = [ "9.9.9.9" ];
cache_size = 536870912;
anonymize_client_ip = true;
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 730dcd2..b9b6766 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -103,35 +103,10 @@ in
}
(lib.mkIf cfg.steam.enableSls {
+ environment.systemPackages = [
+ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped
+ ];
home-manager.users.${username} = {
- imports = [ inputs.sls-steam.homeModules.sls-steam ];
-
- services.sls-steam.config = {
- PlayNotOwnedGames = true;
- DisableFamilyShareLock = true;
- SafeMode = false;
- AdditionalApps = [
- 2483190
- 4439260
- 4439270
- 4439280
- 4439300
- 4439750
- 4439790
- 4439800
- 4439810
- 4439820
- 4439830
- 4440380
- 4444140
- 4444150
- 4520350
- 4520360
- 4562050
- ];
- };
- home.packages = [ inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped ];
-
xdg.desktopEntries = {
steam = {
name = "Steam";
diff --git a/os/srv/lldap.nix b/os/srv/lldap.nix
index 1463ab6..6755dfe 100644
--- a/os/srv/lldap.nix
+++ b/os/srv/lldap.nix
@@ -2,7 +2,6 @@
config,
lib,
masterDomain,
- securityTemplates,
...
}:
let
@@ -49,16 +48,6 @@ in
environmentFile = config.sops.secrets."lldap/env_file".path;
};
- os.cluster.nginxProxies."lldap.${masterDomain}" = {
- enableACME = true;
- forceSSL = true;
-
- locations."/" = {
- proxyPass = "http://${config.os.core.network.ips.gateway-vm}:17170";
- extraConfig = securityTemplates.restrictToInternal;
- };
- };
-
networking.firewall.extraInputRules = ''
ip saddr 10.0.0.0/24 tcp dport 3890 accept
'';
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 6b50e1d..eb21abc 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -81,24 +81,24 @@ in
};
services.tor = lib.mkIf cfg.service.tor.enable {
- onionServices."xmr-rpc" = {
- to = [
- {
- port = 18081;
- address = config.os.core.network.ips.vm9-relays;
- }
- ];
- };
+ # onionServices."xmr-rpc" = {
+ # to = [
+ # {
+ # port = 18081;
+ # address = config.os.core.network.ips.relay-vm;
+ # }
+ # ];
+ # };
};
services.i2pd = lib.mkIf cfg.service.i2p.enable {
- tunnels.server."xmr-rpc" = {
- port = 18081;
- address = config.os.core.network.ips.vm9-relays;
- keys = "xmr-rpc-key.dat";
- inbound.length = 3;
- outbound.length = 3;
- };
+ # tunnels.server."xmr-rpc" = {
+ # port = 18081;
+ # address = config.os.core.network.ips.relay-vm;
+ # keys = "xmr-rpc-key.dat";
+ # inbound.length = 3;
+ # outbound.length = 3;
+ # };
};
os.cluster.nginxProxies."xmr.${masterDomain}" = {
@@ -106,7 +106,7 @@ in
forceSSL = true;
locations."/" = {
- proxyPass = "http://${config.os.core.network.ips.vm9-relays}:18081";
+ proxyPass = "http://${config.os.core.network.ips.relay-vm}:18081";
extraConfig = ''
proxy_read_timeout 600s;
proxy_send_timeout 600s;
diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix
index 51b9577..ca22192 100644
--- a/os/srv/simplex.nix
+++ b/os/srv/simplex.nix
@@ -73,19 +73,6 @@ in
};
};
- services.nginx = {
- streamConfig = ''
- server {
- listen 5223;
- proxy_pass 127.0.0.1:${toString internalSmpPort};
- }
- server {
- listen 5224;
- proxy_pass 127.0.0.1:${toString internalXftpPort};
- }
- '';
- };
-
systemd.tmpfiles.rules = [
"d /var/lib/simplex/smp/config 0755 root root -"
"d /var/lib/simplex/smp/logs 0755 root root -"
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
index d36df00..63b2034 100644
--- a/os/srv/ssh.nix
+++ b/os/srv/ssh.nix
@@ -10,11 +10,7 @@ let
in
{
options.os.srv.ssh = {
- server = {
- enable = lib.mkEnableOption "enables the ssh server module";
- enableInitrd = lib.mkEnableOption "enables ssh access during initrd";
- microvm.enable = lib.mkEnableOption "enables ssh for microvms";
- };
+ server.enable = lib.mkEnableOption "enables the ssh server module";
client = {
enable = lib.mkEnableOption "enables the ssh client module";
createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts";
@@ -32,19 +28,19 @@ in
addr = "127.0.0.1";
port = 22;
}
- {
- addr = config.os.core.network.lan.ip;
- port = 22;
- }
- {
- addr = config.os.core.network.wg.ip;
- port = 22;
- }
- {
- addr = config.os.core.network.hs.ip;
- port = 22;
- }
- ];
+ ]
+ ++ lib.optional (config.os.core.network ? lan.ip) {
+ addr = config.os.core.network.lan.ip;
+ port = 22;
+ }
+ ++ lib.optional (config.os.core.network ? wg.ip) {
+ addr = config.os.core.network.wg.ip;
+ port = 22;
+ }
+ ++ lib.optional (config.os.core.network ? hs.ip) {
+ addr = config.os.core.network.hs.ip;
+ port = 22;
+ };
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
@@ -54,7 +50,7 @@ in
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
- PermitRootLogin = if cfg.server.microvm.enable then "prohibit-password" else "no";
+ PermitRootLogin = "no";
PubkeyAcceptedAlgorithms = "ssh-ed25519";
};
@@ -69,41 +65,6 @@ in
);
})
- (lib.mkIf (cfg.server.enable && cfg.server.microvm.enable) {
- users.users.root.openssh.authorizedKeys.keys = [
- "${keys.main} adikro@disroot.org"
- ];
- })
-
- (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) {
- assertions = [
- {
- assertion = config.os.srv.sops.enable;
- message = "required for storing the ssh key";
- }
- ];
- sops.secrets."initrd_ssh_key" = {
- path = "/etc/secrets/initrd/ssh_host_ed25519_key";
- };
- boot = {
- initrd = {
- secrets = {
- "/etc/secrets/initrd/ssh_host_ed25519_key" = config.sops.secrets.initrd_ssh_key.path;
- };
- network = {
- enable = true;
- ssh = {
- enable = true;
- port = 2222;
- authorizedKeys = [ "${keys.main}" ];
- hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
- };
- };
- };
- kernelParams = [ "ip=dhcp" ];
- };
- })
-
(lib.mkIf cfg.client.enable {
programs.ssh.startAgent = true;
services.gnome.gcr-ssh-agent.enable = false;
diff --git a/os/vms/microvms.nix b/os/vms/microvms.nix
index 0a24c60..e2e1a0f 100644
--- a/os/vms/microvms.nix
+++ b/os/vms/microvms.nix
@@ -23,9 +23,6 @@ in
};
config = lib.mkMerge [
- (lib.mkIf cfg.enable {
- })
-
(lib.mkIf cfg.net-core.enable {
microvm.vms.net-core = {
autostart = true;
generated by cgit v1.3 (git 2.53.0) at 2026-08-17 03:33:22 +0000