diff options
| -rw-r--r-- | default.nix | 230 |
1 files changed, 226 insertions, 4 deletions
diff --git a/default.nix b/default.nix index b582d8e..4febfd0 100644 --- a/default.nix +++ b/default.nix @@ -1,11 +1,229 @@ -{ config, lib, pkgs, ... }: - +{ config, pkgs, ... }: +with import <stockholm/lib>; { imports = [ - <stockholm/krebs/5pkgs> + <stockholm/krebs> + # TODO TLS + <stockholm/tv/2configs/exim-smarthost.nix> + <stockholm/tv/2configs/backup.nix> + <stockholm/tv/2configs/git.nix> + <stockholm/tv/2configs/retiolum.nix> + <stockholm/tv/2configs/urlwatch.nix> <stockholm/tv/3modules/iptables.nix> + <stockholm/tv/3modules/ejabberd> + <stockholm/tv/3modules/charybdis> <stockholm/tv/5pkgs> ./base.nix + { + krebs.exim-smarthost.dkim = mkForce (singleton rec { + domain = "viljetic.de"; + private_key = { + path = "/run/krebs.secret/${domain}.dkim_private_key"; + owner.name = "exim"; + source-path = "${config.ni-key-path}/${domain}.dkim.priv"; + }; + }); + krebs.tinc.retiolum = { + privkey = { + path = "${config.krebs.tinc.retiolum.user.home}/tinc.rsa_key.priv"; + owner = config.krebs.tinc.retiolum.user; + source-path = "${config.ni-key-path}/retiolum.rsa_key.priv"; + }; + }; + } + { + services.nginx.enable = true; + + services.nginx.appendHttpConfig = '' + server { + listen 80 default_server; + server_name _; + return 404; + } + server { + listen 443 default_server; + server_name _; + return 404; + } + ''; + + + services.nginx.virtualHosts.cgit.serverAliases = [ + "cgit.krebsco.de" + "cgit.ni.krebsco.de" + "cgit.ni.viljetic.de" + "cgit.viljetic.de" + ]; + } + # [upstream-nginx] { + # [upstream-nginx] krebs.nginx.servers.cgit.server-names = [ + # [upstream-nginx] "cgit.krebsco.de" + # [upstream-nginx] "cgit.ni.krebsco.de" + # [upstream-nginx] "cgit.ni.viljetic.de" + # [upstream-nginx] "cgit.viljetic.de" + # [upstream-nginx] ]; + # [upstream-nginx] } + { + services.nginx.virtualHosts."viljetic.de" = { + enableACME = true; + forceSSL = true; + sslCertificate = "/var/lib/acme/viljetic.de/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/viljetic.de/key.pem"; + root = pkgs.viljetic-pages; + }; + # [upstream-nginx] #krebs.nginx.servers.ni-retiolum = { + # [upstream-nginx] # server-names = singleton "ni.r"; + # [upstream-nginx] # locations = [ + # [upstream-nginx] # (nameValuePair "= /retiolum-hosts.tar.bz2" '' + # [upstream-nginx] # root ${config.krebs.tinc.retiolum.hostsArchive}; + # [upstream-nginx] # '') + # [upstream-nginx] # ]; + # [upstream-nginx] #}; + # [upstream-nginx] # TODO make public_html also available to ni, ni.retiolum (AKA default) + # [upstream-nginx] krebs.nginx.servers."https://viljetic.de" = { + # [upstream-nginx] server-names = singleton "viljetic.de"; + # [upstream-nginx] listen = mkForce []; # disable default + # [upstream-nginx] ssl = { + # [upstream-nginx] enable = true; + # [upstream-nginx] certificate = "/var/lib/acme/viljetic.de/fullchain.pem"; + # [upstream-nginx] certificate_key = "/var/lib/acme/viljetic.de/key.pem"; + # [upstream-nginx] }; + # [upstream-nginx] locations = [ + # [upstream-nginx] (nameValuePair "/" '' + # [upstream-nginx] root ${pkgs.viljetic-pages}; + # [upstream-nginx] '') + # [upstream-nginx] (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' + # [upstream-nginx] alias /home/$1/public_html$2; + # [upstream-nginx] '') + # [upstream-nginx] ]; + # [upstream-nginx] }; + # [upstream-nginx] krebs.nginx.servers."http://viljetic.de" = { + # [upstream-nginx] server-names = singleton "viljetic.de"; + # [upstream-nginx] locations = [ + # [upstream-nginx] (nameValuePair "/.well-known/acme-challenge/" '' + # [upstream-nginx] root /var/lib/acme/viljetic.de/; + # [upstream-nginx] '') + # [upstream-nginx] (nameValuePair "/" '' + # [upstream-nginx] return 301 https://viljetic.de$request_uri; + # [upstream-nginx] '') + # [upstream-nginx] ]; + # [upstream-nginx] }; + security.acme = { + certs."viljetic.de" = { + email = "tomislav@viljetic.de"; + #webroot = "/var/lib/acme/viljetic.de"; + plugins = [ + "account_key.json" + "key.pem" + "fullchain.pem" + ]; + user = "nginx"; + postRun = /* sh */ '' + ${pkgs.systemd}/bin/systemctl reload nginx + ''; + }; + }; + } + { + krebs.github-hosts-sync = { + enable = true; + ssh-identity-file = + "${config.ni-key-path}/github-hosts-sync.ssh.id_ed25519"; + }; + tv.iptables.input-internet-accept-tcp = + singleton config.krebs.github-hosts-sync.port; + } + { + tv.charybdis = { + enable = true; + ssl_cert = ./certs/charybdis.crt.pem; + ssl_dh_params = { + path = "${config.tv.charybdis.user.home}/charybdis.dh.pem"; + owner = config.tv.charybdis.user; + source-path = "${config.ni-key-path}/charybdis.dh.pem"; + }; + ssl_private_key = { + path = "${config.tv.charybdis.user.home}/charybdis.key.pem"; + owner = config.tv.charybdis.user; + source-path = "${config.ni-key-path}/charybdis.key.pem"; + }; + }; + tv.iptables.input-retiolum-accept-tcp = [ + config.tv.charybdis.port + config.tv.charybdis.sslport + ]; + } + { + services.nginx.virtualHosts."jabber.viljetic.de" = { + enableACME = true; + forceSSL = true; + sslCertificate = "/var/lib/acme/jabber.viljetic.de/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/jabber.viljetic.de/key.pem"; + }; + #[upstream-nginx] # TODO we define krebs.nginx.servers."https://jabber.viljetic.de" only + #[upstream-nginx] # because krebs.nginx.servers."https://viljetic.de" will serve + #[upstream-nginx] # jabber.viljetic.de otherwise. + #[upstream-nginx] krebs.nginx.servers."https://jabber.viljetic.de" = { + #[upstream-nginx] server-names = singleton "jabber.viljetic.de"; + #[upstream-nginx] listen = mkForce []; # disable default + #[upstream-nginx] ssl = { + #[upstream-nginx] enable = true; + #[upstream-nginx] certificate = "/var/lib/acme/jabber.viljetic.de/fullchain.pem"; + #[upstream-nginx] certificate_key = "/var/lib/acme/jabber.viljetic.de/key.pem"; + #[upstream-nginx] }; + #[upstream-nginx] }; + #[upstream-nginx] krebs.nginx.servers."http://jabber.viljetic.de" = { + #[upstream-nginx] server-names = singleton "jabber.viljetic.de"; + #[upstream-nginx] locations = [ + #[upstream-nginx] (nameValuePair "/.well-known/acme-challenge/" '' + #[upstream-nginx] root /var/lib/acme/jabber.viljetic.de/; + #[upstream-nginx] '') + #[upstream-nginx] (nameValuePair "/" '' + #[upstream-nginx] return 301 http://jabber.viljetic.de$request_uri; + #[upstream-nginx] '') + #[upstream-nginx] ]; + #[upstream-nginx] }; + # TODO do we need to restart ejabberd when certfile changes? + # TODO restart ejabberd when /etc/hosts changes? + tv.ejabberd = { + enable = true; + hosts = [ "jabber.viljetic.de" ]; + certfile = { + path = "${config.tv.ejabberd.user.home}/ejabberd.pem"; + owner = config.tv.ejabberd.user; + source-path = "/var/lib/acme/jabber.viljetic.de/key+fullchain.pem"; + }; + }; + tv.iptables.input-internet-accept-tcp = [ + "xmpp-client" + "xmpp-server" + ]; + security.acme = { + certs."jabber.viljetic.de" = { + email = "tomislav@viljetic.de"; + #webroot = "/var/lib/acme/jabber.viljetic.de"; + plugins = [ + "account_key.json" + "key.pem" + "fullchain.pem" + ]; + user = "nginx"; + postRun = /* sh */ '' + ( + set -efu + # XXX add missing newline + ${pkgs.coreutils}/bin/cat \ + /var/lib/acme/jabber.viljetic.de/key.pem \ + /var/lib/acme/jabber.viljetic.de/fullchain.pem \ + > /var/lib/acme/jabber.viljetic.de/key+fullchain.pem + # TODO restarting secret will restart ejabberd (and others :/) + # TODO reload + ${pkgs.systemd}/bin/systemctl restart secret + ) + ''; + }; + }; + } ]; boot.loader.grub.devices = [ config.ni-disk ]; @@ -51,5 +269,9 @@ tv.iptables.enable = true; tv.iptables.accept-echo-request = "internet"; - tv.iptables.input-internet-accept-tcp = [ "ssh" ]; + tv.iptables.input-internet-accept-tcp = [ + "http" + "https" + "ssh" + ]; } |