summaryrefslogtreecommitdiffstats
path: root/lass
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2023-03-02 09:20:37 +0100
committertv <tv@krebsco.de>2023-03-02 09:20:37 +0100
commit03a9448a0922fcf158c4357922bed689245105e3 (patch)
tree7dbedf90d0443bd1e375aac61f63735f43e64984 /lass
parent177fd1eeec05f0821f1ccc63733b3e0fd5aed7b6 (diff)
parent8639d428c2e9f2190ec4e4b5dd931f24a4166f36 (diff)
Merge remote-tracking branch 'prism/master' into head
Diffstat (limited to 'lass')
-rw-r--r--lass/1systems/aergia/config.nix6
-rw-r--r--lass/1systems/aergia/physical.nix73
-rw-r--r--lass/1systems/coaxmetal/config.nix6
-rw-r--r--lass/1systems/green/config.nix1
-rw-r--r--lass/1systems/lasspi/config.nix5
-rw-r--r--lass/1systems/lasspi/physical.nix21
-rw-r--r--lass/1systems/neoprism/config.nix11
-rw-r--r--lass/1systems/orange/config.nix1
-rw-r--r--lass/1systems/prism/config.nix5
-rw-r--r--lass/1systems/radio/config.nix2
-rw-r--r--lass/1systems/yellow/config.nix330
-rw-r--r--lass/2configs/antimicrox/default.nix33
-rw-r--r--lass/2configs/antimicrox/empty.amgp20
-rw-r--r--lass/2configs/antimicrox/mouse.amgp272
-rw-r--r--lass/2configs/baseX.nix2
-rw-r--r--lass/2configs/browsers.nix14
-rw-r--r--lass/2configs/jitsi.nix24
-rw-r--r--lass/2configs/mail.nix6
-rw-r--r--lass/2configs/mumble-reminder.nix6
-rw-r--r--lass/2configs/murmur.nix42
-rw-r--r--lass/2configs/print.nix14
-rw-r--r--lass/2configs/services/coms/default.nix6
-rw-r--r--lass/2configs/services/coms/jitsi.nix43
-rw-r--r--lass/2configs/services/coms/murmur.nix47
-rw-r--r--lass/2configs/services/coms/proxy.nix41
-rw-r--r--lass/2configs/services/flix/container-host.nix40
-rw-r--r--lass/2configs/services/flix/default.nix316
-rw-r--r--lass/2configs/services/flix/proxy.nix12
-rw-r--r--lass/2configs/services/radio/container-host.nix (renamed from lass/2configs/radio/container-host.nix)0
-rw-r--r--lass/2configs/services/radio/controls.html (renamed from lass/2configs/radio/controls.html)0
-rw-r--r--lass/2configs/services/radio/default.nix (renamed from lass/2configs/radio/default.nix)0
-rw-r--r--lass/2configs/services/radio/news.nix (renamed from lass/2configs/radio/news.nix)0
-rw-r--r--lass/2configs/services/radio/proxy.nix17
-rw-r--r--lass/2configs/services/radio/radio.liq (renamed from lass/2configs/radio/radio.liq)0
-rw-r--r--lass/2configs/services/radio/shell.nix (renamed from lass/2configs/radio/shell.nix)0
-rw-r--r--lass/2configs/services/radio/weather.nix (renamed from lass/2configs/radio/weather.nix)0
-rw-r--r--lass/2configs/services/radio/weather_for_ips.py (renamed from lass/2configs/radio/weather_for_ips.py)0
-rw-r--r--lass/2configs/xdg-open.nix26
-rw-r--r--lass/2configs/xmonad.nix6
-rw-r--r--lass/2configs/yellow-host.nix14
-rw-r--r--lass/3modules/browsers.nix94
-rw-r--r--lass/3modules/default.nix2
-rw-r--r--lass/3modules/xjail.nix173
43 files changed, 997 insertions, 734 deletions
diff --git a/lass/1systems/aergia/config.nix b/lass/1systems/aergia/config.nix
index ed5bbcf12..6992db4a5 100644
--- a/lass/1systems/aergia/config.nix
+++ b/lass/1systems/aergia/config.nix
@@ -26,6 +26,7 @@
<stockholm/lass/2configs/dunst.nix>
<stockholm/lass/2configs/print.nix>
<stockholm/lass/2configs/br.nix>
+ <stockholm/lass/2configs/c-base.nix>
];
system.stateVersion = "22.11";
@@ -47,11 +48,6 @@
};
hardware.pulseaudio.package = pkgs.pulseaudioFull;
- lass.browser.config = {
- fy = { browser = "chromium"; groups = [ "audio" "video" ]; hidden = true; };
- qt = { browser = "qutebrowser"; groups = [ "audio" "video" ]; hidden = true; };
- };
-
nix.trustedUsers = [ "root" "lass" ];
# nix.extraOptions = ''
diff --git a/lass/1systems/aergia/physical.nix b/lass/1systems/aergia/physical.nix
index de5f7540e..023639083 100644
--- a/lass/1systems/aergia/physical.nix
+++ b/lass/1systems/aergia/physical.nix
@@ -3,6 +3,7 @@
imports = [
./config.nix
(modulesPath + "/installer/scan/not-detected.nix")
+ <stockholm/lass/2configs/antimicrox>
];
disko.devices = import ./disk.nix;
@@ -20,15 +21,41 @@
boot.kernelParams = [
# Enable energy savings during sleep
"mem_sleep_default=deep"
- "initcall_blacklist=acpi_cpufreq_init"
+
+ # use less power with pstate
+ "amd_pstate=passive"
# for ryzenadj -i
"iomem=relaxed"
+
+ # suspend
+ "resume_offset=178345675"
];
- # Enables the amd cpu scaling https://www.kernel.org/doc/html/latest/admin-guide/pm/amd-pstate.html
- # On recent AMD CPUs this can be more energy efficient.
- boot.kernelModules = [ "amd-pstate" "kvm-amd" ];
+ boot.kernelModules = [
+ # Enables the amd cpu scaling https://www.kernel.org/doc/html/latest/admin-guide/pm/amd-pstate.html
+ # On recent AMD CPUs this can be more energy efficient.
+ "amd-pstate"
+ "kvm-amd"
+
+ # needed for zenstates
+ "msr"
+
+ # zenpower
+ "zenpower"
+ ];
+
+ boot.extraModulePackages = [
+ (config.boot.kernelPackages.zenpower.overrideAttrs (old: {
+ src = pkgs.fetchFromGitea {
+ domain = "git.exozy.me";
+ owner = "a";
+ repo = "zenpower3";
+ rev = "c176fdb0d5bcba6ba2aba99ea36812e40f47751f";
+ hash = "sha256-d2WH8Zv7F0phZmEKcDiaak9On+Mo9bAFhMulT/N5FWI=";
+ };
+ }))
+ ];
# hardware.cpu.amd.updateMicrocode = true;
@@ -36,7 +63,16 @@
"amdgpu"
];
- boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
+ boot.initrd.availableKernelModules = [
+ "nvme"
+ "thunderbolt"
+ "xhci_pci"
+ "usbhid"
+ ];
+
+ boot.initrd.kernelModules = [
+ "amdgpu"
+ ];
environment.systemPackages = [
pkgs.vulkan-tools
@@ -54,7 +90,13 @@
hardware.video.hidpi.enable = lib.mkDefault true;
# corectrl
- programs.corectrl.enable = true;
+ programs.corectrl = {
+ enable = true;
+ gpuOverclock = {
+ enable = true;
+ ppfeaturemask = "0xffffffff";
+ };
+ };
users.users.mainUser.extraGroups = [ "corectrl" ];
# use newer ryzenadj
@@ -72,7 +114,7 @@
# keyboard quirks
services.xserver.displayManager.sessionCommands = ''
- xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert
+ ${pkgs.xorg.xmodmap}/bin/xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert
'';
services.udev.extraHwdb = /* sh */ ''
# disable back buttons
@@ -82,5 +124,20 @@
'';
# ignore power key
- services.logind.extraConfig = "HandlePowerKey=ignore";
+
+ # update cpu microcode
+ hardware.cpu.amd.updateMicrocode = true;
+
+ # suspend to disk
+ swapDevices = [{
+ device = "/swapfile";
+ }];
+ boot.resumeDevice = "/dev/mapper/aergia1";
+ services.logind.lidSwitch = "suspend-then-hibernate";
+ services.logind.extraConfig = ''
+ HandlePowerKey=hibernate
+ '';
+
+ # firefox touchscreen support
+ environment.sessionVariables.MOZ_USE_XINPUT2 = "1";
}
diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix
index 2c88b68cc..1df56f591 100644
--- a/lass/1systems/coaxmetal/config.nix
+++ b/lass/1systems/coaxmetal/config.nix
@@ -54,12 +54,6 @@
};
hardware.pulseaudio.package = pkgs.pulseaudioFull;
- lass.browser.config = {
- dc = { browser = "chromium"; groups = [ "audio" "video" ]; hidden = true; };
- ff = { browser = "firefox"; groups = [ "audio" "video" ]; hidden = true; };
- fy = { browser = "chromium"; groups = [ "audio" "video" ]; hidden = true; };
- };
-
nix.trustedUsers = [ "root" "lass" ];
services.tor = {
diff --git a/lass/1systems/green/config.nix b/lass/1systems/green/config.nix
index 077f7b3fa..c232be9bd 100644
--- a/lass/1systems/green/config.nix
+++ b/lass/1systems/green/config.nix
@@ -35,6 +35,7 @@ with import <stockholm/lib>;
systemd.tmpfiles.rules = [
"d /home/lass/.local/share 0700 lass users -"
"d /home/lass/.local 0700 lass users -"
+ "d /home/lass/.config 0700 lass users -"
"d /var/state/lass_mail 0700 lass users -"
"L+ /home/lass/Maildir - - - - ../../var/state/lass_mail"
diff --git a/lass/1systems/lasspi/config.nix b/lass/1systems/lasspi/config.nix
index 9f823dfc8..d2207627d 100644
--- a/lass/1systems/lasspi/config.nix
+++ b/lass/1systems/lasspi/config.nix
@@ -1,4 +1,3 @@
-with import <stockholm/lib>;
{ config, lib, pkgs, ... }:
let
in
@@ -18,9 +17,9 @@ in
};
environment.systemPackages = with pkgs; [
vim
- rxvt_unicode.terminfo
+ rxvt-unicode-unwrapped.terminfo
];
services.openssh.enable = true;
- system.stateVersion = "21.05";
+ system.stateVersion = "22.05";
}
diff --git a/lass/1systems/lasspi/physical.nix b/lass/1systems/lasspi/physical.nix
index 868bafad5..07efb5ca5 100644
--- a/lass/1systems/lasspi/physical.nix
+++ b/lass/1systems/lasspi/physical.nix
@@ -1,15 +1,14 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
{
- # This configuration worked on 09-03-2021 nixos-unstable @ commit 102eb68ceec
- # The image used https://hydra.nixos.org/build/134720986
imports = [
+ (modulesPath + "/installer/scan/not-detected.nix")
./config.nix
];
boot = {
# kernelPackages = pkgs.linuxPackages_rpi4;
tmpOnTmpfs = true;
- initrd.availableKernelModules = [ "usbhid" "usb_storage" ];
+ initrd.availableKernelModules = [ "usbhid" "usb_storage" "xhci_pci" ];
# ttyAMA0 is the serial console broken out to the GPIO
kernelParams = [
"8250.nr_uarts=1"
@@ -20,19 +19,23 @@
];
};
- boot.loader.raspberryPi = {
- enable = true;
- version = 4;
- };
+ # boot.loader.raspberryPi = {
+ # enable = true;
+ # version = 4;
+ # # uboot.enable = true;
+ # };
boot.loader.grub.enable = false;
+ boot.loader.generic-extlinux-compatible.enable = true;
# Required for the Wireless firmware
hardware.enableRedistributableFirmware = true;
+ networking.interfaces.eth0.useDHCP = true;
+
# Assuming this is installed on top of the disk image.
fileSystems = {
"/" = {
- device = "/dev/disk/by-label/NIXOS_SD";
+ device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
fsType = "ext4";
options = [ "noatime" ];
};
diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix
index 7f6be782e..cc08070af 100644
--- a/lass/1systems/neoprism/config.nix
+++ b/lass/1systems/neoprism/config.nix
@@ -7,12 +7,19 @@
# sync-containers
<stockholm/lass/2configs/consul.nix>
- <stockholm/lass/2configs/yellow-host.nix>
- <stockholm/lass/2configs/radio/container-host.nix>
+ <stockholm/lass/2configs/services/flix/container-host.nix>
+ <stockholm/lass/2configs/services/radio/container-host.nix>
<stockholm/lass/2configs/ubik-host.nix>
+ <stockholm/lass/2configs/orange-host.nix>
+ <stockholm/krebs/2configs/hotdog-host.nix>
# other containers
<stockholm/lass/2configs/riot.nix>
+
+ # proxying of services
+ <stockholm/lass/2configs/services/radio/proxy.nix>
+ <stockholm/lass/2configs/services/flix/proxy.nix>
+ <stockholm/lass/2configs/services/coms/proxy.nix>
];
krebs.build.host = config.krebs.hosts.neoprism;
diff --git a/lass/1systems/orange/config.nix b/lass/1systems/orange/config.nix
index 3bc20878e..5e975dba8 100644
--- a/lass/1systems/orange/config.nix
+++ b/lass/1systems/orange/config.nix
@@ -5,6 +5,7 @@ with import <stockholm/lib>;
<stockholm/lass>
<stockholm/lass/2configs>
<stockholm/lass/2configs/retiolum.nix>
+ <stockholm/lass/2configs/mumble-reminder.nix>
];
krebs.build.host = config.krebs.hosts.orange;
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index bcc8c1a08..2e82fae6f 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -134,10 +134,9 @@ with import <stockholm/lib>;
<stockholm/lass/2configs/reaktor-coders.nix>
<stockholm/lass/2configs/ciko.nix>
<stockholm/lass/2configs/container-networking.nix>
- <stockholm/lass/2configs/jitsi.nix>
+ <stockholm/lass/2configs/services/coms/jitsi.nix>
<stockholm/lass/2configs/fysiirc.nix>
<stockholm/lass/2configs/bgt-bot>
- <stockholm/lass/2configs/mumble-reminder.nix>
<stockholm/krebs/2configs/mastodon-proxy.nix>
{
services.tor = {
@@ -281,7 +280,7 @@ with import <stockholm/lib>;
{ predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; }
];
}
- <stockholm/lass/2configs/murmur.nix>
+ <stockholm/lass/2configs/services/coms/murmur.nix>
<stockholm/lass/2configs/docker.nix>
{
systemd.services."container@yellow".reloadIfChanged = mkForce false;
diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix
index 5e34335d3..00e9bd3fe 100644
--- a/lass/1systems/radio/config.nix
+++ b/lass/1systems/radio/config.nix
@@ -7,7 +7,7 @@ with import <stockholm/lib>;
<stockholm/lass/2configs/retiolum.nix>
<stockholm/lass/2configs/syncthing.nix>
- <stockholm/lass/2configs/radio>
+ <stockholm/lass/2configs/services/radio>
];
krebs.build.host = config.krebs.hosts.radio;
diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix
index ff8189e24..fb28fb029 100644
--- a/lass/1systems/yellow/config.nix
+++ b/lass/1systems/yellow/config.nix
@@ -5,6 +5,7 @@ in {
<stockholm/lass>
<stockholm/lass/2configs>
<stockholm/lass/2configs/retiolum.nix>
+ <stockholm/lass/2configs/services/flix>
];
krebs.build.host = config.krebs.hosts.yellow;
@@ -14,281 +15,8 @@ in {
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL";
};
- users.groups.download.members = [ "transmission" ];
-
networking.useHostResolvConf = false;
networking.useNetworkd = true;
- services.transmission = {
- enable = true;
- home = "/var/state/transmission";
- group = "download";
- downloadDirPermissions = "775";
- settings = {
- download-dir = "/var/download/transmission";
- incomplete-dir-enabled = false;
- rpc-bind-address = "::";
- message-level = 1;
- umask = 18;
- rpc-whitelist-enabled = false;
- rpc-host-whitelist-enabled = false;
- };
- };
-
- security.acme.defaults.email = "spam@krebsco.de";
- security.acme.acceptTerms = true;
- security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
- security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
- security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
- security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
- security.acme.certs."transmission.r".server = config.krebs.ssl.acmeURL;
- services.nginx = {
- enable = true;
- package = pkgs.nginx.override {
- modules = with pkgs.nginxModules; [
- fancyindex
- ];
- };
- virtualHosts."yellow.r" = {
- default = true;
- enableACME = true;
- addSSL = true;
- locations."/" = {
- root = "/var/download";
- extraConfig = ''
- fancyindex on;
- fancyindex_footer "/fancy.html";
- include ${pkgs.nginx}/conf/mime.types;
- include ${pkgs.writeText "extrMime" ''
- types {
- video/webm mkv;
- }
- ''};
- create_full_put_path on;
- '';
- };
- locations."/chatty" = {
- proxyPass = "http://localhost:3000";
- extraConfig = ''
- rewrite /chatty/(.*) /$1 break;
- proxy_set_header Host $host;
- '';
- };
- locations."= /fancy.html".extraConfig = ''
- alias ${pkgs.writeText "nginx_footer" ''
- <div id="mydiv">
- <!-- Include a header DIV with the same name as the draggable DIV, followed by "header" -->
- <div id="mydivheader">Click here to move</div>
- <iframe src="/chatty/index.html"></iframe>
- </div>
- <style>
- #mydiv {
- position: absolute;
- z-index: 9;
- background-color: #f1f1f1;
- border: 1px solid #d3d3d3;
- text-align: center;
- }
-
- #mydivheader {
- padding: 10px;
- cursor: move;
- z-index: 10;
- background-color: #2196F3;
- color: #fff;
- }
- </style>
- <script>
- // Make the DIV element draggable:
- dragElement(document.getElementById("mydiv"));
-
- function dragElement(elmnt) {
- var pos1 = 0, pos2 = 0, pos3 = 0, pos4 = 0;
- if (document.getElementById(elmnt.id + "header")) {
- // if present, the header is where you move the DIV from:
- document.getElementById(elmnt.id + "header").onmousedown = dragMouseDown;
- } else {
- // otherwise, move the DIV from anywhere inside the DIV:
- elmnt.onmousedown = dragMouseDown;
- }
-
- function dragMouseDown(e) {
- e = e || window.event;
- e.preventDefault();
- // get the mouse cursor position at startup:
- pos3 = e.clientX;
- pos4 = e.clientY;
- document.onmouseup = closeDragElement;
- // call a function whenever the cursor moves:
- document.onmousemove = elementDrag;
- }
-
- function elementDrag(e) {
- e = e || window.event;
- e.preventDefault();
- // calculate the new cursor position:
- pos1 = pos3 - e.clientX;
- pos2 = pos4 - e.clientY;
- pos3 = e.clientX;
- pos4 = e.clientY;
- // set the element's new position:
- elmnt.style.top = (elmnt.offsetTop - pos2) + "px";
- elmnt.style.left = (elmnt.offsetLeft - pos1) + "px";
- }
-
- function closeDragElement() {
- // stop moving when mouse button is released:
- document.onmouseup = null;
- document.onmousemove = null;
- }
- }
- </script>
- ''};
- '';
- };
- virtualHosts."jelly.r" = {
- enableACME = true;
- addSSL = true;
- locations."/".extraConfig = ''
- proxy_pass http://localhost:8096/;
- proxy_set_header Accept-Encoding "";
- '';
- };
- virtualHosts."transmission.r" = {
- enableACME = true;
- addSSL = true;
- locations."/".extraConfig = ''
- proxy_pass http://localhost:9091/;
- proxy_set_header Accept-Encoding "";
- '';
- };
- virtualHosts."radar.r" = {
- enableACME = true;
- addSSL = true;
- locations."/" = {
- proxyWebsockets = true;
- proxyPass = "http://localhost:7878";
- };
- };
- virtualHosts."sonar.r" = {
- enableACME = true;
- addSSL = true;
- locations."/" = {
- proxyWebsockets = true;
- proxyPass = "http://localhost:8989";
- };
- };
- };
-
- services.samba = {
- enable = true;
- enableNmbd = false;
- extraConfig = ''
- workgroup = WORKGROUP
- server string = ${config.networking.hostName}
- # only allow retiolum addresses
- hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
-
- # Use sendfile() for performance gain
- use sendfile = true
-
- # No NetBIOS is needed
- disable netbios = true
-
- # Only mangle non-valid NTFS names, don't care about DOS support
- mangled names = illegal
-
- # Performance optimizations
- socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
-
- # Disable all printing
- load printers = false
- disable spoolss = true
- printcap name = /dev/null
-
- map to guest = Bad User
- max log size = 50
- dns proxy = no
- security = user
-
- [global]
- syslog only = yes
- '';
- shares.public = {
- comment = "Warez";
- path = "/var/download";
- public = "yes";
- "only guest" = "yes";
- "create mask" = "0644";
- "directory mask" = "2777";
- writable = "no";
- printable = "no";
- };
- };
-
- systemd.services.bruellwuerfel =
- let
- bruellwuerfelSrc = pkgs.fetchFromGitHub {
- owner = "krebs";
- repo = "bruellwuerfel";
- rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
- sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
- };
- in {
- wantedBy = [ "multi-user.target" ];
- environment = {
- IRC_CHANNEL = "#flix";
- IRC_NICK = "bruelli";
- IRC_SERVER = "irc.r";
- IRC_HISTORY_FILE = "/tmp/bruelli.history";
- };
- serviceConfig = {
- ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
- };
- };
-
- krebs.iptables = {
- enable = true;
- tables.filter.INPUT.rules = [
- { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
- { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
- { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
- { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
- { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
- { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
- { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
- { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
- { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
- { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
-
- # smbd
- { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
- { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
- { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
- { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
- { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
- { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
- { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
- { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
- ];
- tables.filter.OUTPUT = {
- policy = "DROP";
- rules = [
- { predicate = "-o lo"; target = "ACCEPT"; }
- { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; }
- { predicate = "-o tun0"; target = "ACCEPT"; }
- { predicate = "-o retiolum"; target = "ACCEPT"; }
- { v6 = false; predicate = "-d 1.1.1.1/32"; target = "ACCEPT"; }
- { v6 = false; predicate = "-d 1.0.0.1/32"; target = "ACCEPT"; }
- { v6 = false; predicate = "-o eth0 -d 10.233.2.0/24"; target = "ACCEPT"; }
- ];
- };
- };
services.openvpn.servers.nordvpn.config = ''
client
@@ -375,49 +103,19 @@ in {
</tls-auth>
'';
- systemd.services.flix-index = {
- wantedBy = [ "multi-user.target" ];
- path = [
- pkgs.coreutils
- pkgs.findutils
- pkgs.inotify-tools