summaryrefslogtreecommitdiffstats
path: root/makefu/2configs/bgt
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2018-12-18 20:17:03 +0100
committertv <tv@krebsco.de>2018-12-18 20:17:03 +0100
commit1fa1fa53062069de970548f88ad0211b4502f18d (patch)
tree30413fa29c1c43ff7af5ea684d92e613de4af295 /makefu/2configs/bgt
parent8b4428816d1385e1dd5ec9bf0ce44ae0e284130a (diff)
parent23562e36190e07f338211541ac3d2cc77ebdbafa (diff)
Merge remote-tracking branch 'prism/master'
Diffstat (limited to 'makefu/2configs/bgt')
-rw-r--r--makefu/2configs/bgt/auphonic.pub1
-rw-r--r--makefu/2configs/bgt/download.binaergewitter.de.nix38
-rw-r--r--makefu/2configs/bgt/hidden_service.nix48
3 files changed, 87 insertions, 0 deletions
diff --git a/makefu/2configs/bgt/auphonic.pub b/makefu/2configs/bgt/auphonic.pub
new file mode 100644
index 000000000..37b8e0599
--- /dev/null
+++ b/makefu/2configs/bgt/auphonic.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvP50lgtHhlC3LKzC1/4yzJNxkZFDSIBvEfavNfchNKJUEBPo82oVtfFgJR5XfjI7c2U9dHl+0q4qMl+9ZiZWr2YgDpAr78kpur4gjWKrnBa2eT9GIfXB3Tm1+OpI2HoeOHUKEK1gKqqe9tJfS+CLb7DLCjulW8zdLiiH6KmvyaH78hGjZv+bpx7H4rItAinl8vGe+ceRIk4tZbmkyhphXbQZa3Ov+imiJXIr7fmX3tkOhUp4YwrVlUK8J0MEa1Kf7ZYWRqvGnKYFQ73LwLPz7UIOZ93zPF4d0R7xqvdEEhIx+u1/gToQZSMUczbVqg3dixr3yeBhFA/6h0lTA61mx
diff --git a/makefu/2configs/bgt/download.binaergewitter.de.nix b/makefu/2configs/bgt/download.binaergewitter.de.nix
new file mode 100644
index 000000000..6d64848f5
--- /dev/null
+++ b/makefu/2configs/bgt/download.binaergewitter.de.nix
@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+let
+ ident = (builtins.readFile ./auphonic.pub);
+in {
+ services.openssh = {
+ allowSFTP = true;
+ sftpFlags = [ "-l VERBOSE" ];
+ extraConfig = ''
+ Match User auphonic
+ ForceCommand internal-sftp
+ AllowTcpForwarding no
+ X11Forwarding no
+ PasswordAuthentication no
+ '';
+ };
+ users.users.auphonic = {
+ uid = genid "auphonic";
+ group = "nginx";
+ useDefaultShell = true;
+ openssh.authorizedKeys.keys = [ ident config.krebs.users.makefu.pubkey ];
+ };
+ services.nginx = {
+ enable = lib.mkDefault true;
+ recommendedGzipSettings = true;
+ recommendedOptimisation = true;
+ virtualHosts."download.binaergewitter.de" = {
+ serverAliases = [ "dl2.binaergewitter.de" ];
+ root = "/var/www/binaergewitter";
+ extraConfig = ''
+ access_log /var/spool/nginx/logs/binaergewitter.access.log combined;
+ error_log /var/spool/nginx/logs/binaergewitter.error.log error;
+ autoindex on;
+ '';
+ };
+ };
+}
diff --git a/makefu/2configs/bgt/hidden_service.nix b/makefu/2configs/bgt/hidden_service.nix
new file mode 100644
index 000000000..c1a31b8dc
--- /dev/null
+++ b/makefu/2configs/bgt/hidden_service.nix
@@ -0,0 +1,48 @@
+{ pkgs, lib, ... }:
+
+with lib;
+let
+ name = "bgt_cyberwar_hidden_service";
+ sec = (toString <secrets>) + "/";
+ secdir = sec + name;
+ srvdir = "/var/lib/tor/onion/";
+ basedir = srvdir + name;
+ hn = builtins.readFile (secdir + "/hostname");
+in
+{
+ systemd.services.prepare-hidden-service = {
+ wantedBy = [ "local-fs.target" ];
+ before = [ "tor.service" ];
+ serviceConfig = {
+ ExecStart = pkgs.writeScript "prepare-euer-blog-service" ''
+ #!/bin/sh
+ set -euf
+ if ! test -d "${basedir}" ;then
+ mkdir -p "${srvdir}"
+ cp -r "${secdir}" "${srvdir}"
+ chown -R tor:tor "${srvdir}"
+ chmod -R 700 "${basedir}"
+ else
+ echo "not overwriting ${basedir}"
+ fi
+ '';
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ TimeoutSec = "0";
+ };
+ };
+ services.nginx.virtualHosts."${hn}".locations."/" = {
+ proxyPass = "https://blog.binaergewitter.de";
+ extraConfig = ''
+ proxy_set_header Host blog.binaergewitter.de;
+ proxy_ssl_server_name on;
+ '';
+ };
+ services.tor = {
+ enable = true;
+ hiddenServices."${name}".map = [
+ { port = "80"; }
+ # { port = "443"; toHost = "blog.binaergewitter.de"; }
+ ];
+ };
+}