meow

2025-11-26 11:11:49 +01:00 · 2025-11-26 11:11:49 +01:00 · d74a131529
commit d74a131529
parent 0eb6953b0d
14 changed files with 259 additions and 67 deletions
--- a/instances/nemesis/configuration.nix
+++ b/instances/nemesis/configuration.nix
@ -21,6 +21,7 @@

  containers.ds9 = {
    autoStart = true;
+    timeoutStartSec = "10000000min";
    privateNetwork = true;
    enableTun = true;
    additionalCapabilities = [
@ -33,28 +34,40 @@
    ];
    hostAddress = "192.168.100.10";
    localAddress = "192.168.100.11";
+    # hostAddress6 = "fc00::1";
+    # localAddress6 = "fc00::2";

    path = inputs.oldConf.nixosConfigurations.ds9.config.system.build.toplevel;
-    
+
    bindMounts = {
      "/data" = {
        hostPath = "/data";
        isReadOnly = false;
      };
-      "/backup" = {
-        hostPath = "/backup";
+      "/backups" = {
+        hostPath = "/backups";
        isReadOnly = false;
      };
      "/persistent" = {
        hostPath = "/oldds9/persistent";
        isReadOnly = false;
      };
+      "/var/lib/containers" = {
+        hostPath = "/oldds9/persistent/var/lib/containers";
+        isReadOnly = false;
+      };
    };
  };
  networking.nat.enable = true;
+  networking.nat.enableIPv6 = true;
  networking.nat.internalInterfaces = [ "ve-+" ];
  networking.nat.externalInterface = "enp1s0f1"; # TODO: changeme

+  services.traefik.dynamicConfigOptions.http.routers.simpleproxy-oldds9-router.rule =
+    lib.mkForce "HostRegexp(`^.+\.hailsatan\.eu$`)";
+  # services.traefik.dynamicConfigOptions.http.routers.simpleproxy-oldds9-router.tls.options = "old";
+  services.traefik.dynamicConfigOptions.http.routers.simpleproxy-oldds9-router-robotstxt.rule =
+    lib.mkForce "HostRegexp(`^.+\.hailsatan\.eu$`) && Path(`/robots.txt`)";
  xyno.services.traefik = {
    enable = true;
    simpleProxy.oldds9 = {
@ -63,8 +76,27 @@
    };
  };

+  users.users.root.password = "hunter2";
+
+  systemd.services."dyndns-refresh" = {
+    script = ''
+      set -eu
+      export PATH=$PATH:${pkgs.curl}/bin:${pkgs.jq}/bin:${pkgs.iproute2}/bin
+      ${pkgs.bash}/bin/bash ${config.sops.secrets.dyndns.path}
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+    startAt = "*:0/10";
+  };
+  sops.secrets.dyndns = {
+    sopsFile = ./secrets/dyndns.yaml;
+  };
+
  xyno.presets.cli.enable = true;
  xyno.presets.server.enable = true;
+  xyno.impermanence.enable = true;
  # xyno.services.wireguard.enable = true;
  # xyno.services.caddy.enable = true;
  # xyno.services.monitoring.enable = true;
@ -74,6 +106,16 @@
  xyno.networking.networkd = {
    enable = true;
  };
+  networking.useDHCP = lib.mkForce false;
+  networking.interfaces."enp1s0f1" = {
+    useDHCP = true;
+    tempAddress = "enabled";
+  };
+  systemd.network.networks."40-enp1s0f1" = {
+    networkConfig = {
+      IPv6AcceptRA = true;
+    };
+  };

  system.stateVersion = "25.11";
 }
--- a/instances/nemesis/default.nix
+++ b/instances/nemesis/default.nix
@ -6,6 +6,6 @@
  };
  # xyno.services.wireguard.pubKey = "aZvSeAhKG3B5I2My5IqQoSlntMzbCHM6OU92WEScohc=";
  deployment = {
-    targetHost = "nemesis.xyno.systems";
+    targetHost = "10.0.0.2";
  };
 }
--- a/instances/nemesis/hardware-configuration.nix
+++ b/instances/nemesis/hardware-configuration.nix
@ -98,7 +98,7 @@
    fsType = "zfs";
    neededForBoot = true;
  };
-  fileSystems."/var/log" = {
+  fileSystems."/var/log" = lib.mkForce {
    device = "spool/nemesis/varlog";
    fsType = "zfs";
    neededForBoot = true;
@ -130,6 +130,11 @@
    fsType = "zfs";
    neededForBoot = true;
  };
+  fileSystems."/oldds9/persistent/var/lib/containers" = {
+    device = "spool/safe/containers";
+    fsType = "zfs";
+    neededForBoot = true;
+  };
  fileSystems."/oldds9/varlog" = {
    device = "spool/local/journal";
    fsType = "zfs";
--- a/instances/nemesis/secrets/dyndns.yaml
+++ b/instances/nemesis/secrets/dyndns.yaml
@ -0,0 +1,38 @@
+dyndns: ENC[AES256_GCM,data:yDDTTBimaFcd/MG+eSbYmOHq/Ij0fAoz0zDY+C4bv7ZNn1yAA6C8DE3fXnvAvWhatLLSbRGDxHRRm7JuAHOfGGisN9cXwL+fkB7rZMVZemaL2wrOAQxyzHDEeZnZHRwsVGYhAmTsbUCVLi4CyzjRHGbCLZtZ8b+DzT0644uTi9IQovcLrWun62KMt7yjFS+Wb85XItMrIk4gJRCOhllrAXKY/z0idgv8GCNRDsDsmKL8arfcWzo2+bU/Uqhqt1Md6++jySPNPxwwcORYUudqQM63N0g47jSnmbXJ11XRRq6ZBQJaHhx25YOj2WiDH1382Kn71hnnObWS8HcXI3pwAg51mQ7Wlu+Mlt/3iZjOS1ble4IrQGItLVQUqWjyKSLvTbPfe6P/AuQ9VFGLZ7VGhVUAuyum727bx7jg1oQmqETrkL9BwaW/2FsBCVfKobgBOM6s/XMO07dOrzkO14BxOgM7zcILkz0J3IClXDOnK+Qtqe9d0E4JiSItk1hlL+PI256dGt3J2oHHAZTNOhCn1f3/t1nwkDaPM379LhVHVGhGNFtPkwp1itAQPe/zY6apHCOrcd4sti7QjVssW+ekWjMGqIC0D41aw5oRUhE0pGSwVzVTwrxqc/IiLag8UxjFpBEWO9826I5qD3LQhH+sAfsrcBp9SeRrrt5icNbqLhKDxeB2,iv:Bj9aQZ8X1j5tV+iRPwFQ9NvNaxtlaRn6u60qqzHmWmw=,tag:gDKAPd8FEomSwyiT3yy2iw==,type:str]
+sops:
+    lastmodified: "2025-11-24T15:13:32Z"
+    mac: ENC[AES256_GCM,data:f+3n2Xc7jU+qW+vHk98BTgwLwVHTXzWHMjLwNr3Y3Pp8VIQf8d8iF8QwhDFPWN1uqsxsb/XD48CXbd5AwxuVcgcSM7FIHkjfIn0pHRk0jTAkXTxjWIwg9pqnGAZ5B/fA8XAvcyPpE299gMYzU2soAL11DZtrEVVXJWN2sD5IlL8=,iv:Uykx2R6xO/KW1XP0Nm8GyaoepmdU96AfGQQhLz6BlNQ=,tag:bqe0gZF6WhQg55NhWyNC5A==,type:str]
+    pgp:
+        - created_at: "2025-11-24T13:05:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hL4DAAAAAAAAAAASBAMEDMeIdplYrk7VppUFRCTcB7Pv+xnVKSLhhSoN6kqbHXqA
+            YYv8o4AbT9bf1+L9wywA+Eg55tj8aocse/tdRQWTymy4+8grb/sm0oZQT22T51JP
+            mWxhWIX+sliCqHnS/W2tuVLyDzAiJ/Tg19kOc576OH1z6f2HMIM7yvADoKupfqIw
+            rbwo0G8CdZCW1hzutCnC2mD4Op2BxK1b26oZdNA06y+BMHHefyDTl/wXwiNQKWiq
+            0l4BoaYNx2ma5ZTSBk7YNeIXikwM3XtZnUZU+V17EgClNbxhmTRc0h7fmeprjYcW
+            zETvhSIm+JFTR0mdQsrDvTs7kt+PnaYptoM0CHaYCHTq48pyYKL3Gm0NtCAHuFc3
+            =UlnU
+            -----END PGP MESSAGE-----
+          fp: 0D98D5964AC8BB1CA034CE4EC456133700066642
+        - created_at: "2025-11-24T15:13:16Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMAwAAAAAAAAAAAQv/SQPw9p1r4Sg9zYTyX1n3n6xJzhr+hEGLwwGhcmJh8mup
+            D9n+aaZU4WK2Huha8Jd1bNqNo3J9UpqQMIaexfd64HoVdDHCxBzfThiMvgwpQ30a
+            kTQqC0DGkLaFM5W8IVOremwjhLzrTBesu8ny8CasQYJ0tZ+QFU51OvxD4q0r9OLT
+            BcCGqDsKZ3HDr7OIi4FsqdZRfxinJ+zteK93uxA+fB8Hkxok2g7Z2A5Nv2cOo54X
+            NJxwsCN4l2Hs8MaVMTC+KGASn87m+Q1xwcVD7ujPmGGjMYb84j2sBn0DP3mNQh7y
+            89jz6HPbq9goF++Sp172bwswmJwZLVCWkgvzQo+szfCqGnq6LTlG9JaVswkkSz7N
+            z9kvF6L2dg7N2XlkLLP9UnxMkNxUrA615LvSn/z9AA7Dp6ay7TCsOeSWrz5m7+PF
+            VVfTp4PN3y7hsZXvWWk1eqsOaThI5GY7N7W6aQlNmvhibjw7FJEF4Iv4FBJsOD23
+            vYv+38yn377hnimtzoVt0lgBFtO8QhedShEvVjROUNjjEE2WB2jpP5/wZVIsrefs
+            tl87MAyLedE/Zs5MByubb0buC2jifQnkxsA1QSvbZB2/NTi/SLSPeCMdFrVkYdcG
+            hP8cp1HkI81F
+            =iDKg
+            -----END PGP MESSAGE-----
+          fp: b730b2bf54eb792a14bfd3e68c14c08894376c5f
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/instances/picard/configuration.nix
+++ b/instances/picard/configuration.nix
@ -20,7 +20,7 @@
  xyno.presets.server.enable = true;
  xyno.presets.cli.enable = true;
  xyno.services.wireguard.enable = true;
-  xyno.services.caddy.enable = true;
+  # xyno.services.caddy.enable = true;
  xyno.services.monitoring.enable = true;
  xyno.presets.home-manager.enable = true;
  xyno.system.user.enable = true;