summaryrefslogtreecommitdiff
path: root/os
diff options
context:
space:
mode:
Diffstat (limited to 'os')
-rw-r--r--os/core/bootloader.nix1
-rw-r--r--os/core/users.nix15
-rw-r--r--os/srv/aide.nix30
-rw-r--r--os/srv/clamav.nix8
-rw-r--r--os/srv/default.nix1
-rw-r--r--os/srv/monero.nix19
-rw-r--r--os/srv/nix-helper.nix6
-rw-r--r--os/srv/sops.nix11
-rw-r--r--os/srv/ssh.nix30
9 files changed, 64 insertions, 57 deletions
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index 91502e9..e8dfc11 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -48,6 +48,7 @@ in
};
};
+ #TODO add boot.initrd.luks.reusePassphrases = true; somewhere
luks.enable = lib.mkEnableOption "LUKS encryption support";
};
diff --git a/os/core/users.nix b/os/core/users.nix
index 4bd0221..1ba471f 100644
--- a/os/core/users.nix
+++ b/os/core/users.nix
@@ -12,13 +12,24 @@ in
options.os.core.users.enable = lib.mkEnableOption "enables user accounts";
config = lib.mkIf cfg.enable {
programs.fish.enable = true;
+ assertions = [
+ {
+ assertion = config.os.srv.sops.enable;
+ message = "required for storing the ssh key";
+ }
+ ];
+ sops.secrets = {
+ "users/root_password".neededForUsers = true;
+ "users/main_password".neededForUsers = true;
+ "users/opc_password".neededForUsers = true;
+ };
users = {
mutableUsers = false;
users = {
"${username}" = {
isNormalUser = true;
- hashedPasswordFile = config.sops.secrets.user_password.path;
+ hashedPasswordFile = config.sops.secrets."users/main_password".path;
shell = pkgs.fish;
extraGroups = lib.mkMerge [
[
@@ -36,7 +47,7 @@ in
(lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ])
];
};
- root.hashedPasswordFile = config.sops.secrets.root_password.path;
+ root.hashedPasswordFile = config.sops.secrets."users/root_password".path;
};
};
};
diff --git a/os/srv/aide.nix b/os/srv/aide.nix
deleted file mode 100644
index 8bd4c6a..0000000
--- a/os/srv/aide.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
- config,
- lib,
- pkgs,
- ...
-}:
-let
- cfg = config.os.srv.aide;
-in
-{
- options.os.srv.aide.enable = lib.mkEnableOption "enables aide checking";
- config = lib.mkIf cfg.enable {
- systemd = {
- services.aide-check = {
- description = "Daily File Integrity Operational Check";
- serviceConfig = {
- Type = "oneshot";
- ExecStart = "${pkgs.aide}/bin/aide --check";
- };
- };
- timers.aide-check = {
- wantedBy = [ "timers.target" ];
- timerConfig = {
- OnCalendar = "daily";
- Persistent = true;
- };
- };
- };
- };
-}
diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix
index cc84802..d2dc49f 100644
--- a/os/srv/clamav.nix
+++ b/os/srv/clamav.nix
@@ -1,9 +1,4 @@
-{
- config,
- lib,
- pkgs,
- ...
-}:
+{ config, lib, ... }:
let
cfg = config.os.srv.clamav;
in
@@ -22,6 +17,5 @@ in
updater.enable = true;
fangfrisch.enable = true;
};
- environment.systemPackages = [ pkgs.aide ];
};
}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 9bba42b..715b0e0 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -1,7 +1,6 @@
{ ... }:
{
imports = [
- ./aide.nix
./authelia.nix
./backup.nix
./bluetooth.nix
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index c7db2d8..9088ef3 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -37,25 +37,32 @@ in
services.monero = {
enable = true;
- environmentFile = config.sops.secrets."monero/rpc-password".path;
+ prune = true;
+ limits = {
+ upload = 1250;
+ download = 12500;
+ threads = 8;
+ };
banlist = builtins.fetchurl {
url = "https://gui.xmr.pm/files/block.txt";
hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
};
- limits = {
- upload = 1250;
- download = 1250;
- threads = 4;
- };
rpc = {
restricted = true;
user = "admin";
+ password = config.sops.secrets."monero/rpc-password".path;
};
};
services.nginx.virtualHosts."xmr.${masterDomain}" = {
enableACME = true;
forceSSL = true;
+ listen = [
+ {
+ addr = "10.255.0.1";
+ port = 443;
+ }
+ ];
locations."/" = {
proxyPass = "http://127.0.0.1:18081";
diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix
index 9734043..5e5e133 100644
--- a/os/srv/nix-helper.nix
+++ b/os/srv/nix-helper.nix
@@ -2,6 +2,7 @@
config,
lib,
pkgs,
+ username,
...
}:
let
@@ -11,7 +12,10 @@ in
options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper";
config = lib.mkIf cfg.enable {
nix.settings = {
- allowed-users = [ "@users" ];
+ trusted-users = [
+ "root"
+ "${username}"
+ ];
experimental-features = [
"nix-command"
"flakes"
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 20e1891..1b27042 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -12,10 +12,7 @@ in
{
imports = [ inputs.sops-nix.nixosModules.sops ];
- options.os.srv.sops = {
- enable = lib.mkEnableOption "enables sops-nix";
- diskEncryption = lib.mkEnableOption "enables initrd decryption key (LUKS)";
- };
+ options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix";
config = lib.mkIf cfg.enable {
sops = {
defaultSopsFile = ../../secrets.yaml;
@@ -24,20 +21,14 @@ in
secrets = {
"syncthing/gui_password".owner = username;
- "syncthing/encryption/openmw-config".owner = username;
- "syncthing/encryption/openmw-mods".owner = username;
- "syncthing/encryption/game-saves".owner = username;
"syncthing/encryption/keepass".owner = username;
"syncthing/encryption/sync".owner = username;
- "vpn/warp_private_key".owner = "root";
"obs/websocket_password".owner = username;
"yggdrasil-private-key" = {
owner = "root";
group = "wheel";
mode = "0440";
};
- root_password.neededForUsers = true;
- user_password.neededForUsers = true;
};
};
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
index 2c7a4ac..ec39bbd 100644
--- a/os/srv/ssh.nix
+++ b/os/srv/ssh.nix
@@ -12,6 +12,7 @@ in
options.os.srv.ssh = {
server = {
enable = lib.mkEnableOption "enables the ssh server module";
+ enableInitrd = lib.mkEnableOption "enables ssh access during initrd";
enableWireguard = lib.mkEnableOption "only allows connections from wireguard";
};
client = {
@@ -44,6 +45,35 @@ in
users.users.${username}.openssh.authorizedKeys.keys = [
"${keys.main} adikro@disroot.org"
];
+
+ })
+ (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) {
+ assertions = [
+ {
+ assertion = config.os.srv.sops.enable;
+ message = "required for storing the ssh key";
+ }
+ ];
+ sops.secrets."initrd_ssh_key" = {
+ path = "/etc/secrets/initrd/ssh_host_ed25519_key";
+ };
+ boot = {
+ initrd = {
+ secrets = {
+ "/etc/secrets/initrd/ssh_host_ed25519_key" = config.sops.secrets.initrd_ssh_key.path;
+ };
+ network = {
+ enable = true;
+ ssh = {
+ enable = true;
+ port = 2222;
+ authorizedKeys = [ "${keys.main}" ];
+ hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+ };
+ };
+ };
+ kernelParams = [ "ip=dhcp" ];
+ };
})
(lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) {
services.openssh.listenAddresses = [
generated by cgit v1.3 (git 2.53.0) at 2026-08-17 01:25:01 +0000