Add 'old-conf/' from commit '62a64a79a8'
git-subtree-dir: old-conf git-subtree-mainline:4667974392git-subtree-split:62a64a79a8
This commit is contained in:
commit
83de52d5db
195 changed files with 13408 additions and 0 deletions
495
old-conf/hosts/ds9/default.nix
Normal file
495
old-conf/hosts/ds9/default.nix
Normal file
|
|
@ -0,0 +1,495 @@
|
|||
{
|
||||
config,
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
pubkeys = import ../../data/pubkeys.nix;
|
||||
caddy-with-plugins = import ./custom-caddy.nix { inherit pkgs; };
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
||||
./containers.nix
|
||||
./backup.nix
|
||||
./grist.nix
|
||||
# ./plex.nix
|
||||
./samba.nix
|
||||
./paperless.nix
|
||||
./maubot.nix
|
||||
./woodpecker.nix
|
||||
./attic.nix
|
||||
./ytdl-sub.nix
|
||||
./snipe-it.nix
|
||||
./radicale.nix
|
||||
./lms.nix
|
||||
|
||||
../../nixos-modules/networking/tailscale.nix
|
||||
../../nixos-modules/services/docker.nix
|
||||
../../nixos-modules/services/libvirt.nix
|
||||
../../nixos-modules/services/msmtp.nix
|
||||
# ../../nixos-modules/services/paperless.nix
|
||||
# ../../nixos-modules/services/photoprism.nix
|
||||
../../nixos-modules/services/samba.nix
|
||||
../../nixos-modules/services/ssh.nix
|
||||
../../nixos-modules/services/caddy
|
||||
../../nixos-modules/system/agenix.nix
|
||||
../../nixos-modules/system/fs.nix
|
||||
../../nixos-modules/system/persist.nix
|
||||
../../nixos-modules/system/security.nix
|
||||
../../nixos-modules/user
|
||||
];
|
||||
|
||||
# Don't Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
||||
# power save stuffzies
|
||||
services.udev.path = [ pkgs.hdparm ];
|
||||
services.udev.extraRules = ''
|
||||
ACTION=="add|change", KERNEL=="sd[a-z]", ATTRS{queue/rotational}=="1", RUN+="${pkgs.hdparm}/bin/hdparm -S 60 -B 100 /dev/%k"
|
||||
'';
|
||||
|
||||
services.syncthing.enable = true;
|
||||
services.syncthing.user = "ragon";
|
||||
|
||||
programs.mosh.enable = true;
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
networking.useDHCP = true;
|
||||
networking.useNetworkd = true;
|
||||
systemd.network.networks."enp1s0f1".ipv6AcceptRAConfig = {
|
||||
Token = "prefixstable";
|
||||
};
|
||||
networking.bridges."br0".interfaces = [ ];
|
||||
networking.hostId = "7b4c2932";
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
9000
|
||||
25565
|
||||
80
|
||||
443
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [ 443 ]; # http3 :3
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
postCommands = ''
|
||||
zpool import rpool
|
||||
zpool import spool
|
||||
echo "zfs load-key -a; killall zfs" >> /root/.profile
|
||||
'';
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 2222;
|
||||
hostKeys = [
|
||||
"/persistent/etc/nixos/secrets/initrd/ssh_host_rsa_key"
|
||||
"/persistent/etc/nixos/secrets/initrd/ssh_host_ed25519_key"
|
||||
];
|
||||
authorizedKeys = pubkeys.ragon.computers;
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
boot.kernel.sysctl."fs.inotify.max_user_instances" = 512;
|
||||
|
||||
# Immutable users due to tmpfs
|
||||
users.mutableUsers = false;
|
||||
|
||||
# users.users.nia = {
|
||||
# createHome = true;
|
||||
# isNormalUser = true;
|
||||
# extraGroups = [
|
||||
# "docker"
|
||||
# "podman"
|
||||
# "wheel"
|
||||
# ];
|
||||
# openssh.authorizedKeys.keys = [
|
||||
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDq+jk1Bi8/x0lYDiVi/iVnp9nEleocoQ+xHmlpDt9Qs"
|
||||
# ];
|
||||
# };
|
||||
users.users.bzzt = {
|
||||
description = "bzzt server service user";
|
||||
home = "/var/lib/bzzt";
|
||||
createHome = true;
|
||||
isSystemUser = true;
|
||||
group = "bzzt";
|
||||
};
|
||||
users.groups.bzzt = { };
|
||||
users.users.minecraft = {
|
||||
description = "Minecraft server service user";
|
||||
home = "/var/lib/minecraft";
|
||||
createHome = true;
|
||||
isSystemUser = true;
|
||||
group = "minecraft";
|
||||
};
|
||||
users.groups.minecraft = { };
|
||||
environment.systemPackages = [
|
||||
pkgs.jdk17
|
||||
pkgs.borgbackup
|
||||
pkgs.beets
|
||||
];
|
||||
|
||||
services.smartd = {
|
||||
enable = true;
|
||||
extraOptions = [ "--interval=7200" ];
|
||||
notifications.test = true;
|
||||
};
|
||||
|
||||
|
||||
services.zfs.zed.enableMail = true;
|
||||
services.zfs.zed.settings = {
|
||||
ZED_EMAIL_ADDR = [ "root" ];
|
||||
ZED_EMAIL_PROG = "${pkgs.msmtp}/bin/msmtp";
|
||||
ZED_EMAIL_OPTS = "@ADDRESS@";
|
||||
|
||||
ZED_NOTIFY_INTERVAL_SECS = 7200;
|
||||
ZED_NOTIFY_VERBOSE = true;
|
||||
|
||||
ZED_USE_ENCLOSURE_LEDS = false;
|
||||
ZED_SCRUB_AFTER_RESILVER = true;
|
||||
};
|
||||
|
||||
# dyndns
|
||||
|
||||
systemd.services."dyndns-refresh" = {
|
||||
script = ''
|
||||
set -eu
|
||||
export PATH=$PATH:${pkgs.curl}/bin:${pkgs.jq}/bin:${pkgs.iproute2}/bin
|
||||
${pkgs.bash}/bin/bash ${config.age.secrets.ds9DynDns.path}
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
};
|
||||
startAt = "*:0/10";
|
||||
};
|
||||
|
||||
# services.tailscaleAuth.enable = true;
|
||||
# services.tailscaleAuth.group = config.services.caddy.group;
|
||||
systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.desec.path;
|
||||
services.caddy = {
|
||||
# ragon.services.caddy is enabled
|
||||
extraConfig = ''
|
||||
(blockBots) {
|
||||
@botForbidden header_regexp User-Agent "(?i)AdsBot-Google|Amazonbot|anthropic-ai|Applebot|Applebot-Extended|AwarioRssBot|AwarioSmartBot|Bytespider|CCBot|ChatGPT|ChatGPT-User|Claude-Web|ClaudeBot|cohere-ai|DataForSeoBot|Diffbot|FacebookBot|Google-Extended|GPTBot|ImagesiftBot|magpie-crawler|omgili|Omgilibot|peer39_crawler|PerplexityBot|YouBot"
|
||||
|
||||
handle @botForbidden {
|
||||
redir https://hil-speed.hetzner.com/10GB.bin
|
||||
}
|
||||
handle /robots.txt {
|
||||
respond <<TXT
|
||||
User-Agent: *
|
||||
Disallow: /
|
||||
TXT 200
|
||||
}
|
||||
}
|
||||
(podmanRedir) {
|
||||
reverse_proxy {args[:]} {
|
||||
transport http {
|
||||
resolvers 10.88.0.1 # podman dns
|
||||
}
|
||||
}
|
||||
}
|
||||
(podmanRedirWithAuth) {
|
||||
route {
|
||||
# always forward outpost path to actual outpost
|
||||
reverse_proxy /outpost.goauthentik.io/* http://authentik-server:9000 {
|
||||
transport http {
|
||||
resolvers 10.88.0.1 # podman dns
|
||||
}
|
||||
}
|
||||
forward_auth http://authentik-server:9000 {
|
||||
transport http {
|
||||
resolvers 10.88.0.1 # podman dns
|
||||
}
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers {
|
||||
X-Authentik-Username
|
||||
X-Copyparty-Group
|
||||
X-Authentik-Groups
|
||||
X-Authentik-Entitlements
|
||||
X-Authentik-Email
|
||||
X-Authentik-Name
|
||||
X-Authentik-Uid
|
||||
X-Authentik-Jwt
|
||||
X-Authentik-Meta-Jwks
|
||||
X-Authentik-Meta-Outpost
|
||||
X-Authentik-Meta-Provider
|
||||
X-Authentik-Meta-App
|
||||
X-Authentik-Meta-Version
|
||||
X-Grafana-Role
|
||||
X-Authentik-Username>X-Remote-User
|
||||
}
|
||||
}
|
||||
reverse_proxy {args[:]} {
|
||||
transport http {
|
||||
resolvers 10.88.0.1 # podman dns
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
'';
|
||||
globalConfig = ''
|
||||
acme_ca https://acme-v02.api.letsencrypt.org/directory # hard coded so zerossl doesn't get used
|
||||
acme_dns desec {
|
||||
token "{$TOKEN}"
|
||||
}
|
||||
metrics {
|
||||
per_host
|
||||
}
|
||||
servers {
|
||||
trusted_proxies static 100.96.45.2/32 fd7a:115c:a1e0:ab12:4843:cd96:6260:2d02/128
|
||||
}
|
||||
'';
|
||||
virtualHosts."*.hailsatan.eu ".logFormat = ''
|
||||
output file ${config.services.caddy.logDir}/access-*hailsatan.eu_internet.log
|
||||
'';
|
||||
virtualHosts."*.hailsatan.eu ".extraConfig = ''
|
||||
import blockBots
|
||||
@blog host blog.hailsatan.eu
|
||||
handle @blog {
|
||||
route {
|
||||
# always forward outpost path to actual outpost
|
||||
reverse_proxy /outpost.goauthentik.io/* http://authentik-server:9000 {
|
||||
transport http {
|
||||
resolvers 10.88.0.1 # podman dns
|
||||
}
|
||||
}
|
||||
forward_auth http://authentik-server:9000 {
|
||||
transport http {
|
||||
resolvers 10.88.0.1 # podman dns
|
||||
}
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Copyparty-Group X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version X-Grafana-Role
|
||||
}
|
||||
root * /srv/www/xynospace
|
||||
file_server
|
||||
|
||||
}
|
||||
}
|
||||
@jellyfin host j.hailsatan.eu
|
||||
handle @jellyfin {
|
||||
handle /metrics* {
|
||||
abort
|
||||
}
|
||||
import podmanRedir http://jellyfin:8096
|
||||
}
|
||||
@mautrix-signal host mautrix-signal.hailsatan.eu
|
||||
handle @mautrix-signal {
|
||||
import podmanRedir http://mautrix-signal:29328
|
||||
}
|
||||
@woodpecker host woodpecker.hailsatan.eu
|
||||
handle @woodpecker {
|
||||
import podmanRedir http://woodpecker-server:8000
|
||||
}
|
||||
@attic host attic.hailsatan.eu
|
||||
handle @attic {
|
||||
reverse_proxy http://[::1]:8089
|
||||
}
|
||||
@auth host auth.hailsatan.eu
|
||||
handle @auth {
|
||||
import podmanRedir http://authentik-server:9000
|
||||
}
|
||||
@radicale host radicale.hailsatan.eu
|
||||
handle @radicale {
|
||||
import podmanRedirWithAuth http://[::1]:5232
|
||||
}
|
||||
@grafana host grafana.hailsatan.eu
|
||||
handle @grafana {
|
||||
import podmanRedirWithAuth http://grafana:3000
|
||||
}
|
||||
@lms host lms.hailsatan.eu
|
||||
handle @lms {
|
||||
handle /rest* {
|
||||
|
||||
import podmanRedir http://localhost:5082
|
||||
}
|
||||
import podmanRedirWithAuth http://localhost:5082
|
||||
}
|
||||
@immich host immich.hailsatan.eu
|
||||
handle @immich {
|
||||
import podmanRedir http://immich-server:2283
|
||||
}
|
||||
@cd host cd.hailsatan.eu
|
||||
handle @cd {
|
||||
import podmanRedirWithAuth http://changedetection:5000
|
||||
}
|
||||
@node-red host node-red.hailsatan.eu
|
||||
handle @node-red {
|
||||
import podmanRedirWithAuth http://node-red:1880
|
||||
}
|
||||
@labello host labello.hailsatan.eu
|
||||
handle @labello {
|
||||
import podmanRedirWithAuth http://labello:4242
|
||||
}
|
||||
@paperless host paperless.hailsatan.eu
|
||||
handle @paperless {
|
||||
import podmanRedirWithAuth http://paperless-server:8000
|
||||
}
|
||||
@archivebox host archivebox.hailsatan.eu
|
||||
handle @archivebox {
|
||||
handle /api/* {
|
||||
import podmanRedir http://archivebox:8000
|
||||
}
|
||||
handle {
|
||||
import podmanRedirWithAuth http://archivebox:8000
|
||||
}
|
||||
}
|
||||
@grist host grist.hailsatan.eu
|
||||
handle @grist {
|
||||
import podmanRedir http://grist:8484
|
||||
|
||||
}
|
||||
@snipe-it host snipe-it.hailsatan.eu
|
||||
handle @snipe-it {
|
||||
root * ${pkgs.snipe-it}/share/php/snipe-it/public
|
||||
php_fastcgi unix//${config.services.phpfpm.pools."snipe-it".socket}
|
||||
file_server
|
||||
}
|
||||
@copyparty host c.hailsatan.eu
|
||||
handle @copyparty {
|
||||
# @proxy {
|
||||
# header_regexp Cookie authentik_proxy_([a-zA-Z0-9])
|
||||
# }
|
||||
# handle @proxy {
|
||||
# import podmanRedirWithAuth http://copyparty:3923
|
||||
# }
|
||||
handle /shr/* {
|
||||
import podmanRedir http://copyparty:3923
|
||||
}
|
||||
handle /.cpr/* {
|
||||
import podmanRedir http://copyparty:3923
|
||||
}
|
||||
# @noauth {
|
||||
# path_regexp ^\/(noauth(\/.*|)|[a-z.]+\.(css|js)|[1-9].png)$
|
||||
# }
|
||||
# @getoptionshead {
|
||||
# method GET OPTIONS HEAD
|
||||
# }
|
||||
# handle @noauth {
|
||||
# handle @getoptionshead {
|
||||
# import podmanRedir http://copyparty:3923
|
||||
# }
|
||||
# }
|
||||
handle {
|
||||
import podmanRedirWithAuth http://copyparty:3923
|
||||
}
|
||||
}
|
||||
handle {
|
||||
import podmanRedirWithAuth http://127.0.0.1:8001
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
exporters.node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
};
|
||||
exporters.postgres = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.ds9PostgresExporterEnv.path;
|
||||
};
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "postgres";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"localhost:${toString config.services.prometheus.exporters.postgres.port}"
|
||||
"picard.kangaroo-galaxy.ts.net:${toString config.services.prometheus.exporters.postgres.port}"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "caddy";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"localhost:2019"
|
||||
"picard.kangaroo-galaxy.ts.net:2019"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "node";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"localhost:${toString config.services.prometheus.exporters.node.port}"
|
||||
"picard.kangaroo-galaxy.ts.net:${toString config.services.prometheus.exporters.node.port}"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
home-manager.users.ragon =
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
# ../../hm-modules/nvim
|
||||
../../hm-modules/helix
|
||||
# ../../hm-modules/zsh
|
||||
../../hm-modules/tmux
|
||||
# ../../hm-modules/xonsh
|
||||
../../hm-modules/cli.nix
|
||||
../../hm-modules/files.nix
|
||||
];
|
||||
# ragon.xonsh.enable = true;
|
||||
|
||||
programs.home-manager.enable = true;
|
||||
home.stateVersion = "23.11";
|
||||
};
|
||||
|
||||
# begin kube
|
||||
# services.k3s = {
|
||||
# enable = true;
|
||||
# extraFlags = "--disable=traefik --cluster-cidr 10.42.0.0/16,2001:cafe:42::/56 --service-cidr=10.43.0.0/16,2001:cafe:43::/112 --vpn-auth-file=/persistent/tailscale-auth-file";
|
||||
#};
|
||||
# systemd.services.k3s.path = [pkgs.tailscale pkgs.coreutils pkgs.bash];
|
||||
# end kube
|
||||
|
||||
ragon = {
|
||||
agenix.secrets."desec" = { };
|
||||
agenix.secrets."ds9DynDns" = { };
|
||||
agenix.secrets."ds9PostgresExporterEnv" = { };
|
||||
user.enable = true;
|
||||
persist.enable = true;
|
||||
persist.extraDirectories = [
|
||||
"/home/nia"
|
||||
"/var/lib/syncthing"
|
||||
"/var/lib/minecraft"
|
||||
"/var/lib/bzzt"
|
||||
"/var/lib/rancher"
|
||||
"/etc/rancher"
|
||||
"/root/.cache"
|
||||
"/srv/www"
|
||||
"/var/lib/${config.services.prometheus.stateDir}"
|
||||
];
|
||||
|
||||
services = {
|
||||
caddy.enable = true;
|
||||
docker.enable = true;
|
||||
ssh.enable = true;
|
||||
msmtp.enable = true;
|
||||
# photoprism.enable = true;
|
||||
tailscale.enable = true;
|
||||
tailscale.exitNode = true;
|
||||
tailscale.extraUpCommands = "--advertise-routes=10.0.0.0/16";
|
||||
# libvirt.enable = true;
|
||||
# paperless.enable = true;
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue