summaryrefslogtreecommitdiffstats
path: root/old/modules/lass
diff options
context:
space:
mode:
Diffstat (limited to 'old/modules/lass')
-rw-r--r--old/modules/lass/base.nix61
-rw-r--r--old/modules/lass/desktop-base.nix30
-rw-r--r--old/modules/lass/iptables/config.nix119
-rw-r--r--old/modules/lass/iptables/default.nix11
-rw-r--r--old/modules/lass/iptables/options.nix44
-rw-r--r--old/modules/lass/ircd.nix27
-rw-r--r--old/modules/lass/retiolum-cloudkrebs.nix21
-rw-r--r--old/modules/lass/retiolum-mors.nix21
-rw-r--r--old/modules/lass/retiolum-uriel.nix21
-rw-r--r--old/modules/lass/vim.nix2
-rw-r--r--old/modules/lass/xserver-lass.nix43
11 files changed, 261 insertions, 139 deletions
diff --git a/old/modules/lass/base.nix b/old/modules/lass/base.nix
index 3a8d879..159372a 100644
--- a/old/modules/lass/base.nix
+++ b/old/modules/lass/base.nix
@@ -3,6 +3,7 @@
{
imports = [
./sshkeys.nix
+ ./iptables
];
nix.useChroot = true;
@@ -65,6 +66,10 @@
'';
};
+ security.setuidPrograms = [
+ "sendmail"
+ ];
+
services.gitolite = {
enable = true;
dataDir = "/home/gitolite";
@@ -84,27 +89,41 @@
RuntimeMaxUse=128M
'';
- networking.firewall = {
+ lass.iptables = {
enable = true;
-
- allowedTCPPorts = [
- 22
- ];
-
- extraCommands = ''
- iptables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
- iptables -A INPUT -j ACCEPT -i lo
- iptables -A INPUT -j ACCEPT -p icmp
-
- #iptables -N Retiolum
- iptables -A INPUT -j Retiolum -i retiolum
- iptables -A Retiolum -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
- iptables -A Retiolum -j REJECT -p tcp --reject-with tcp-reset
- iptables -A Retiolum -j REJECT -p udp --reject-with icmp-port-unreachable
- iptables -A Retiolum -j REJECT --reject-with icmp-proto-unreachable
- iptables -A Retiolum -j REJECT
- '';
-
- extraStopCommands = "iptables -F";
+ tables = {
+ filter.INPUT.policy = "DROP";
+ filter.FORWARD.policy = "DROP";
+ filter.INPUT.rules = [
+ { predicate = "-i lo"; target = "ACCEPT"; }
+ { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+ { predicate = "-p icmp"; target = "ACCEPT"; }
+ { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
+ ];
+ };
};
+
+ #Networking.firewall = {
+ # enable = true;
+
+ # allowedTCPPorts = [
+ # 22
+ # ];
+
+ # extraCommands = ''
+ # iptables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
+ # iptables -A INPUT -j ACCEPT -i lo
+ # #http://serverfault.com/questions/84963/why-not-block-icmp
+ # iptables -A INPUT -j ACCEPT -p icmp
+
+ # #TODO: fix Retiolum firewall
+ # #iptables -N RETIOLUM
+ # #iptables -A INPUT -j RETIOLUM -i retiolum
+ # #iptables -A RETIOLUM -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
+ # #iptables -A RETIOLUM -j REJECT -p tcp --reject-with tcp-reset
+ # #iptables -A RETIOLUM -j REJECT -p udp --reject-with icmp-port-unreachable
+ # #iptables -A RETIOLUM -j REJECT --reject-with icmp-proto-unreachable
+ # #iptables -A RETIOLUM -j REJECT
+ # '';
+ #};
}
diff --git a/old/modules/lass/desktop-base.nix b/old/modules/lass/desktop-base.nix
index 9418454..ee7a94b 100644
--- a/old/modules/lass/desktop-base.nix
+++ b/old/modules/lass/desktop-base.nix
@@ -1,6 +1,8 @@
{ config, pkgs, ... }:
-{
+let
+ mainUser = config.users.extraUsers.mainUser;
+in {
imports = [
./base.nix
];
@@ -34,4 +36,30 @@
xlibs.fontschumachermisc
];
+ fonts.fonts = [
+ pkgs.xlibs.fontschumachermisc
+ ];
+
+ services.xserver = {
+ enable = true;
+
+ windowManager.xmonad.extraPackages = hspkgs: with hspkgs; [
+ X11-xshape
+ ];
+ windowManager.xmonad.enable = true;
+ windowManager.xmonad.enableContribAndExtras = true;
+ windowManager.default = "xmonad";
+ desktopManager.default = "none";
+ desktopManager.xterm.enable = false;
+ displayManager.slim.enable = true;
+ displayManager.auto.enable = true;
+ displayManager.auto.user = mainUser.name;
+
+ layout = "us,de";
+ xkbModel = "evdev";
+ xkbVariant = "altgr-intl,nodeadkeys";
+ xkbOptions = "grp:caps_toggle";
+
+ };
+
}
diff --git a/old/modules/lass/iptables/config.nix b/old/modules/lass/iptables/config.nix
new file mode 100644
index 0000000..be521fe
--- /dev/null
+++ b/old/modules/lass/iptables/config.nix
@@ -0,0 +1,119 @@
+{ cfg, lib, pkgs, ... }:
+
+let
+ inherit (pkgs) writeScript writeText;
+ inherit (lib) concatMapStringsSep concatStringsSep attrNames unique fold any attrValues catAttrs filter flatten length hasAttr;
+
+#===== new api v4
+
+ #buildTable :: iptablesAttrSet` -> str
+ #todo: differentiate by iptables-version
+ buildTables = iptv: ts:
+ let
+ declareChain = t: cn:
+ #TODO: find out what to do whit these count numbers
+ ":${cn} ${t."${cn}".policy} [0:0]";
+
+ buildChain = tn: cn:
+ #"${concatStringsSep " " ((attrNames t."${cn}") ++ [cn])}";
+
+ #TODO: sort by precedence
+ #TODO: double check should be unneccessary, refactor!
+ if (hasAttr "rules" ts."${tn}"."${cn}") then
+ if (ts."${tn}"."${cn}".rules == null) then
+ ""
+ else
+ concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([]
+ ++ map buildRule ts."${tn}"."${cn}".rules
+ )
+ else
+ ""
+ ;
+
+
+ buildRule = rule:
+ #TODO implement rule validation-test here
+ #
+ #target:
+ #target needs to be an existing chain (in the same table) or ACCEPT, REJECT, DROP, LOG, QUEUE, RETURN
+
+ #predicate:
+ #maybe use iptables-test
+ #TODO: howto exit with evaluation error by shellscript?
+ #apperantly not possible from nix because evalatution wouldn't be deterministic.
+ "${rule.predicate} -j ${rule.target}";
+
+ buildTable = tn:
+ "*${tn}\n" +
+ concatStringsSep "\n" ([]
+ ++ map (declareChain ts."${tn}") (attrNames ts."${tn}")
+ ) +
+ #this looks dirty, find a better way to do this (maybe optionalString)
+ concatStringsSep "" ([]
+ ++ map (buildChain tn) (attrNames ts."${tn}")
+ ) +
+ "\nCOMMIT";
+ in
+ concatStringsSep "\n" ([]
+ ++ map buildTable (attrNames ts)
+ );
+
+#=====
+
+ rules4 = iptables-version:
+ let
+ #TODO: find out good defaults.
+ tables-defaults = {
+ nat.PREROUTING.policy = "ACCEPT";
+ nat.INPUT.policy = "ACCEPT";
+ nat.OUTPUT.policy = "ACCEPT";
+ nat.POSTROUTING.policy = "ACCEPT";
+ filter.INPUT.policy = "ACCEPT";
+ filter.FORWARD.policy = "ACCEPT";
+ filter.OUTPUT.policy = "ACCEPT";
+
+ #if someone specifies any other rules on this chain, the default rules get lost.
+ #is this wanted beahiviour or a bug?
+ #TODO: implement abstraction of rules
+ filter.INPUT.rules = [
+ { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+ ];
+ };
+ tables = tables-defaults // cfg.tables;
+
+ in
+ writeText "lass-iptables-rules${toString iptables-version}" ''
+ ${buildTables iptables-version tables}
+ '';
+
+ startScript = writeScript "lass-iptables_start" ''
+ #! /bin/sh
+ set -euf
+ iptables-restore < ${rules4 4}
+ ip6tables-restore < ${rules4 6}
+ '';
+in
+
+{
+ networking.firewall.enable = false;
+
+ systemd.services.lass-iptables = {
+ description = "lass-iptables";
+ wantedBy = [ "network-pre.target" ];
+ before = [ "network-pre.target" ];
+ after = [ "systemd-modules-load.service" ];
+
+ path = with pkgs; [
+ iptables
+ ];
+
+ restartIfChanged = true;
+
+ serviceConfig = {
+ Type = "simple";
+ RemainAfterExit = true;
+ Restart = "always";
+ ExecStart = "@${startScript} lass-iptables_start";
+ };
+ };
+}
diff --git a/old/modules/lass/iptables/default.nix b/old/modules/lass/iptables/default.nix
new file mode 100644
index 0000000..7d46d45
--- /dev/null
+++ b/old/modules/lass/iptables/default.nix
@@ -0,0 +1,11 @@
+arg@{ config, lib, pkgs, ... }:
+
+let
+ cfg = config.lass.iptables;
+ arg' = arg // { inherit cfg; };
+in
+
+{
+ options.lass.iptables = import ./options.nix arg';
+ config = lib.mkIf cfg.enable (import ./config.nix arg');
+}
diff --git a/old/modules/lass/iptables/options.nix b/old/modules/lass/iptables/options.nix
new file mode 100644
index 0000000..eb3bfc0
--- /dev/null
+++ b/old/modules/lass/iptables/options.nix
@@ -0,0 +1,44 @@
+{ lib, ... }:
+
+let
+ inherit (lib) mkEnableOption mkOption types;
+in
+
+{
+ enable = mkEnableOption "iptables";
+
+ #tables.filter.INPUT = {
+ # policy = "DROP";
+ # rules = [
+ # { predicate = "-i retiolum"; target = "ACCEPT"; priority = -10; }
+ # ];
+ #};
+ #new api
+ tables = mkOption {
+ type = with types; attrsOf (attrsOf (submodule ({
+ options = {
+ policy = mkOption {
+ type = str;
+ default = "-";
+ };
+ rules = mkOption {
+ type = nullOr (listOf (submodule ({
+ options = {
+ predicate = mkOption {
+ type = str;
+ };
+ target = mkOption {
+ type = str;
+ };
+ precedence = mkOption {
+ type = int;
+ default = 0;
+ };
+ };
+ })));
+ default = null;
+ };
+ };
+ })));
+ };
+}
diff --git a/old/modules/lass/ircd.nix b/old/modules/lass/ircd.nix
index 3c9e257..c57f7dd 100644
--- a/old/modules/lass/ircd.nix
+++ b/old/modules/lass/ircd.nix
@@ -20,7 +20,7 @@
#ssl_dh_params = "etc/dh.pem";
#ssld_count = 1;
- #default_max_clients = 1024;
+ default_max_clients = 10000;
#nicklen = 30;
};
@@ -40,23 +40,28 @@
sslport = 9999;
};
- auth {
- user = "*@*";
- class = "users";
- };
-
class "users" {
ping_time = 2 minutes;
- number_per_ident = 10;
- number_per_ip = 10;
- number_per_ip_global = 50;
+ number_per_ident = 200;
+ number_per_ip = 200;
+ number_per_ip_global = 500;
cidr_ipv4_bitlen = 24;
cidr_ipv6_bitlen = 64;
- number_per_cidr = 200;
- max_number = 3000;
+ number_per_cidr = 9000;
+ max_number = 10000;
sendq = 400 kbytes;
};
+ exempt {
+ ip = "127.0.0.1";
+ };
+
+ auth {
+ user = "*@*";
+ class = "users";
+ flags = exceed_limit;
+ };
+
channel {
use_invex = yes;
use_except = yes;
diff --git a/old/modules/lass/retiolum-cloudkrebs.nix b/old/modules/lass/retiolum-cloudkrebs.nix
deleted file mode 100644
index 1f03527..0000000
--- a/old/modules/lass/retiolum-cloudkrebs.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, pkgs, ... }:
-
-{
- imports = [
- ../tv/retiolum.nix
- ];
-
- services.retiolum = {
- enable = true;
- hosts = ../../hosts;
- privateKeyFile = "/etc/nixos/secrets/cloudkrebs.retiolum.rsa_key.priv";
- connectTo = [
- "fastpoke"
- "gum"
- "ire"
- ];
- };
-
- networking.firewall.allowedTCPPorts = [ 655 ];
- networking.firewall.allowedUDPPorts = [ 655 ];
-}
diff --git a/old/modules/lass/retiolum-mors.nix b/old/modules/lass/retiolum-mors.nix
deleted file mode 100644
index 61a7856..0000000
--- a/old/modules/lass/retiolum-mors.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, pkgs, ... }:
-
-{
- imports = [
- ../tv/retiolum.nix
- ];
-
- services.retiolum = {
- enable = true;
- hosts = ../../hosts;
- privateKeyFile = "/etc/nixos/secrets/mors.retiolum.rsa_key.priv";
- connectTo = [
- "fastpoke"
- "gum"
- "ire"
- ];
- };
-
- networking.firewall.allowedTCPPorts = [ 655 ];
- networking.firewall.allowedUDPPorts = [ 655 ];
-}
diff --git a/old/modules/lass/retiolum-uriel.nix b/old/modules/lass/retiolum-uriel.nix
deleted file mode 100644
index 11dc61c..0000000
--- a/old/modules/lass/retiolum-uriel.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, pkgs, ... }:
-
-{
- imports = [
- ../tv/retiolum.nix
- ];
-
- services.retiolum = {
- enable = true;
- hosts = ../../hosts;
- privateKeyFile = "/etc/nixos/secrets/uriel.retiolum.rsa_key.priv";
- connectTo = [
- "fastpoke"
- "gum"
- "ire"
- ];
- };
-
- networking.firewall.allowedTCPPorts = [ 655 ];
- networking.firewall.allowedUDPPorts = [ 655 ];
-}
diff --git a/old/modules/lass/vim.nix b/old/modules/lass/vim.nix
index e1cff0d..3fe45e1 100644
--- a/old/modules/lass/vim.nix
+++ b/old/modules/lass/vim.nix
@@ -56,6 +56,8 @@ in {
vnoremap < <gv
vnoremap > >gv
+ nmap <esc>q :buffer
+
"Tabwidth
set ts=2 sts=2 sw=2 et
diff --git a/old/modules/lass/xserver-lass.nix b/old/modules/lass/xserver-lass.nix
deleted file mode 100644
index 5c2d169..0000000
--- a/old/modules/lass/xserver-lass.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ config, pkgs, ... }:
-
-let
- mainUser = config.users.extraUsers.mainUser;
-
-in {
- services.xserver.enable = true;
-
-
- #fonts.enableFontConfig = true;
- #fonts.enableFontDir = true;
- fonts.fonts = [
- pkgs.xlibs.fontschumachermisc
- ];
- #services.xfs.enable = true;
- #services.xserver.useXFS = "unix/:7100";
-
- #services.xserver.displayManager.desktopManagerHandlesLidAndPower = true;
-
- #services.xserver.display = 11;
- #services.xserver.tty = 11;
- # services.xserver.layout = "us";
- # services.xserver.xkbOptions = "eurosign:e";
-
- #services.xserver.multitouch.enable = true;
-
- services.xserver.windowManager.xmonad.extraPackages = hspkgs: with hspkgs; [
- X11-xshape
- ];
- services.xserver.windowManager.xmonad.enable = true;
- services.xserver.windowManager.xmonad.enableContribAndExtras = true;
- services.xserver.windowManager.default = "xmonad";
- services.xserver.desktopManager.default = "none";
- services.xserver.desktopManager.xterm.enable = false;
-
- services.xserver.displayManager.slim.enable = true;
- services.xserver.displayManager.auto.enable = true;
- services.xserver.displayManager.auto.user = mainUser.name;
- #services.xserver.displayManager.job.logsXsession = true;
-
- services.xserver.vaapiDrivers = [ pkgs.vaapiIntel ];
-
-}
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-30 23:23:05 +0000