summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--kartei/kmein/default.nix2
-rw-r--r--kartei/krebs/default.nix12
-rw-r--r--kartei/tv/default.nix4
-rw-r--r--krebs/1systems/hotdog/config.nix1
-rw-r--r--krebs/1systems/ponte/config.nix26
-rw-r--r--krebs/3modules/default.nix5
-rw-r--r--krebs/3modules/krebs-pages.nix44
-rw-r--r--krebs/5pkgs/simple/krebs-pages/fixtures/index.html21
-rw-r--r--krebs/5pkgs/simple/krebs-pages/fixtures/thesauron.html133
-rw-r--r--krebs/5pkgs/simple/ukrepl.nix11
-rw-r--r--lib/default.nix10
-rw-r--r--makefu/2configs/gui/look-up.nix13
-rw-r--r--makefu/2configs/home/ham/automation/fenster_auf.nix2
-rw-r--r--makefu/2configs/home/ham/automation/shutdown_button.nix3
-rw-r--r--makefu/2configs/home/ham/default.nix6
-rw-r--r--makefu/2configs/home/ham/multi/heizung.nix11
-rw-r--r--makefu/2configs/home/ham/sensor/dwd.nix2
-rw-r--r--makefu/2configs/home/ham/sensor/outside.nix9
-rw-r--r--makefu/2configs/main-laptop.nix12
-rw-r--r--makefu/5pkgs/airsensor-py/default.nix6
m---------submodules/nix-writers0
-rw-r--r--tv/1systems/alnus/config.nix3
l---------tv/1systems/alnus/lib1
l---------tv/1systems/au/lib1
-rw-r--r--tv/1systems/bu/config.nix6
l---------tv/1systems/bu/lib1
l---------tv/1systems/lib1
-rw-r--r--tv/1systems/mu/config.nix3
l---------tv/1systems/mu/lib1
-rw-r--r--tv/1systems/nomic/config.nix3
l---------tv/1systems/nomic/lib1
-rw-r--r--tv/1systems/querel/config.nix3
l---------tv/1systems/querel/lib1
-rw-r--r--tv/1systems/wu/config.nix3
l---------tv/1systems/wu/lib1
-rw-r--r--tv/1systems/xu/config.nix3
l---------tv/1systems/xu/lib1
-rw-r--r--tv/1systems/zu/config.nix3
-rw-r--r--tv/2configs/backup.nix5
-rw-r--r--tv/2configs/bash/default.nix23
l---------tv/2configs/bash/lib1
-rw-r--r--tv/2configs/binary-cache/default.nix2
l---------tv/2configs/binary-cache/lib1
-rw-r--r--tv/2configs/br.nix2
-rw-r--r--tv/2configs/default.nix5
-rw-r--r--tv/2configs/exim-retiolum.nix7
-rw-r--r--tv/2configs/exim-smarthost.nix7
-rw-r--r--tv/2configs/gitconfig.nix7
-rw-r--r--tv/2configs/gitrepos.nix7
-rw-r--r--tv/2configs/htop.nix7
-rw-r--r--tv/2configs/hw/AO753.nix7
l---------tv/2configs/hw/lib1
-rw-r--r--tv/2configs/hw/w110er.nix5
-rw-r--r--tv/2configs/hw/x220.nix6
-rw-r--r--tv/2configs/imgur.nix3
l---------tv/2configs/lib1
-rw-r--r--tv/2configs/nginx/default.nix7
-rw-r--r--tv/2configs/nginx/krebs-pages.nix13
l---------tv/2configs/nginx/lib1
-rw-r--r--tv/2configs/nginx/public_html.nix7
-rw-r--r--tv/2configs/pki/default.nix2
l---------tv/2configs/pki/lib1
-rw-r--r--tv/2configs/ppp.nix2
-rw-r--r--tv/2configs/pulse.nix6
l---------tv/2configs/repo-sync/lib1
-rw-r--r--tv/2configs/repo-sync/wiki.nix5
-rw-r--r--tv/2configs/retiolum.nix7
-rw-r--r--tv/2configs/ssh.nix7
-rw-r--r--tv/2configs/sshd.nix2
-rw-r--r--tv/2configs/urlwatch.nix2
-rw-r--r--tv/2configs/vim.nix7
-rw-r--r--tv/2configs/xdg.nix7
-rw-r--r--tv/2configs/xp-332.nix2
-rw-r--r--tv/2configs/xserver/Xmodmap.nix2
-rw-r--r--tv/2configs/xserver/default.nix5
l---------tv/2configs/xserver/lib1
-rw-r--r--tv/2configs/xserver/sxiv.nix2
-rw-r--r--tv/2configs/xserver/urxvt.nix2
-rw-r--r--tv/2configs/xserver/xserver.conf.nix5
-rw-r--r--tv/3modules/Xresources.nix2
-rw-r--r--tv/3modules/charybdis/config.nix2
-rw-r--r--tv/3modules/charybdis/default.nix3
l---------tv/3modules/charybdis/lib1
-rw-r--r--tv/3modules/dnsmasq.nix2
-rw-r--r--tv/3modules/ejabberd/default.nix4
l---------tv/3modules/ejabberd/lib1
-rw-r--r--tv/3modules/focus.nix2
-rw-r--r--tv/3modules/hosts.nix7
-rw-r--r--tv/3modules/hw.nix2
-rw-r--r--tv/3modules/im.nix2
-rw-r--r--tv/3modules/iptables.nix6
l---------tv/3modules/lib1
-rw-r--r--tv/3modules/org.freedesktop.machine1.host-shell.nix3
-rw-r--r--tv/3modules/slock.nix2
-rw-r--r--tv/3modules/x0vncserver.nix4
-rw-r--r--tv/5pkgs/default.nix9
-rw-r--r--tv/5pkgs/haskell/default.nix2
l---------tv/5pkgs/haskell/lib1
-rw-r--r--tv/5pkgs/haskell/xmonad-tv/src/main.hs9
l---------tv/5pkgs/lib1
-rw-r--r--tv/5pkgs/override/default.nix2
l---------tv/5pkgs/override/lib1
-rw-r--r--tv/5pkgs/rpi/default.nix4
l---------tv/5pkgs/rpi/lib1
-rw-r--r--tv/5pkgs/simple/alacritty-font-size.nix67
-rw-r--r--tv/5pkgs/simple/alacritty-tv.nix93
-rw-r--r--tv/5pkgs/simple/bash-fzf-history.nix2
-rw-r--r--tv/5pkgs/simple/default.nix2
l---------tv/5pkgs/simple/lib1
-rw-r--r--tv/5pkgs/simple/pinentry-urxvt/default.nix78
l---------tv/5pkgs/simple/pinentry-urxvt/lib1
-rw-r--r--tv/5pkgs/simple/q/default.nix4
l---------tv/5pkgs/simple/q/lib1
-rw-r--r--tv/5pkgs/vim/default.nix2
-rw-r--r--tv/5pkgs/vim/hack.nix2
l---------tv/5pkgs/vim/lib1
-rw-r--r--tv/5pkgs/vim/nix.nix2
-rw-r--r--tv/5pkgs/vim/vim.nix2
l---------tv/lib1
119 files changed, 530 insertions, 365 deletions
diff --git a/kartei/kmein/default.nix b/kartei/kmein/default.nix
index 39125e35c..1a5a57d1a 100644
--- a/kartei/kmein/default.nix
+++ b/kartei/kmein/default.nix
@@ -82,6 +82,8 @@ in
"makanek.r"
"makanek.kmein.r"
"grafana.kmein.r"
+ "alertmanager.kmein.r"
+ "prometheus.kmein.r"
"names.kmein.r"
"graph.r"
"rrm.r"
diff --git a/kartei/krebs/default.nix b/kartei/krebs/default.nix
index 6da73ff83..e5626d923 100644
--- a/kartei/krebs/default.nix
+++ b/kartei/krebs/default.nix
@@ -165,12 +165,20 @@ in {
ponte = {
cores = 1;
owner = config.krebs.users.krebs;
+ extraZones = {
+ "krebsco.de" = /* bindzone */ ''
+ krebsco.de. 60 IN A ${config.krebs.hosts.ponte.nets.internet.ip4.addr}
+ '';
+ };
nets = rec {
internet = {
- ip4 = {
+ ip4 = rec {
addr = "141.147.36.79";
- prefix = "0.0.0.0/0";
+ prefix = "${addr}/32";
};
+ aliases = [
+ "ponte.i"
+ ];
};
retiolum = {
via = internet;
diff --git a/kartei/tv/default.nix b/kartei/tv/default.nix
index 428e1c3b9..f7e86c598 100644
--- a/kartei/tv/default.nix
+++ b/kartei/tv/default.nix
@@ -198,6 +198,7 @@ in {
aliases = [
"ni.r"
"cgit.ni.r"
+ "krebs.ni.r"
"search.ni.r"
];
tinc.pubkey = ''
@@ -319,7 +320,6 @@ in {
aliases = [
"xu.r"
"cgit.xu.r"
- "krebs.xu.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -369,7 +369,7 @@ in {
"http://cgit.krebsco.de" = {
desc = "Git repositories";
};
- "http://krebs.xu.r" = {
+ "http://krebs.ni.r" = {
desc = "krebs-pages mirror";
};
};
diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index a34df4bdc..9849937d5 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -22,6 +22,7 @@
krebs.build.host = config.krebs.hosts.hotdog;
krebs.github-hosts-sync.enable = true;
+ krebs.pages.enable = true;
boot.isContainer = true;
networking.useDHCP = false;
diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index 8250ebad9..2f55995cf 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -7,5 +7,31 @@
<stockholm/krebs/2configs/matterbridge.nix>
];
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
+ networking.firewall.logRefusedConnections = false;
+ networking.firewall.logRefusedUnicastsOnly = false;
+
+ # Move Internet-facing SSH port to reduce logspam.
+ networking.firewall.extraCommands = let
+ host = config.krebs.build.host;
+ in /* sh */ ''
+ iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
+ iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+
+ ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
+ ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+ '';
+
krebs.build.host = config.krebs.hosts.ponte;
+
+ krebs.pages.enable = true;
+ krebs.pages.nginx.addSSL = true;
+ krebs.pages.nginx.enableACME = true;
+
+ security.acme.acceptTerms = true;
+ security.acme.certs.${config.krebs.pages.domain}.email = "spam@krebsco.de";
}
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 0ac8cb743..6babac72e 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -34,6 +34,7 @@ let
./iptables.nix
./kapacitor.nix
./konsens.nix
+ ./krebs-pages.nix
./monit.nix
./nixpkgs.nix
./on-failure.nix
@@ -83,10 +84,6 @@ let
@ IN SOA dns19.ovh.net. tech.ovh.net. (2015052000 86400 3600 3600000 86400)
IN NS ns19.ovh.net.
IN NS dns19.ovh.net.
- IN A 185.199.108.153
- IN A 185.199.109.153
- IN A 185.199.110.153
- IN A 185.199.111.153
'';
};
};
diff --git a/krebs/3modules/krebs-pages.nix b/krebs/3modules/krebs-pages.nix
new file mode 100644
index 000000000..a2a5b723e
--- /dev/null
+++ b/krebs/3modules/krebs-pages.nix
@@ -0,0 +1,44 @@
+{ config, modulesPath, pkgs, ... }: let
+ cfg = config.krebs.pages;
+ lib = import ../../lib;
+ extraTypes.nginx-vhost = lib.types.submodule (
+ lib.recursiveUpdate