diff options
39 files changed, 597 insertions, 812 deletions
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix index 50e04cf80..4e035e725 100644 --- a/krebs/3modules/bepasty-server.nix +++ b/krebs/3modules/bepasty-server.nix @@ -22,6 +22,16 @@ let servers = mkOption { type = with types; attrsOf optionSet; + example = '' + { + "paste.r" = { + defaultPermissions = "read,delete,create"; + }; + "paste.krebsco.de" = { + defaultPermissions = "read"; + }; + } + ''; options = singleton { nginx = mkOption { # TODO use the correct type @@ -30,7 +40,6 @@ let additional nginx configuration. see krebs.nginx for all options ''; }; - secretKey = mkOption { type = types.str; description = '' @@ -39,6 +48,7 @@ let default = ""; }; + # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi workDir = mkOption { type = types.str; @@ -143,25 +153,25 @@ let }; nginx-imp = { - assertions = [{ assertion = config.krebs.nginx.enable; - message = "krebs.nginx.enable must be true"; }]; - - krebs.nginx.servers = mapAttrs' (name: server: - nameValuePair("bepasty-server-${name}") - (mkMerge [ server.nginx { - extraConfig = '' - client_max_body_size 32M; - ''; - locations = [ - (nameValuePair "/" '' - proxy_set_header Host $http_host; - proxy_pass http://unix:${server.workDir}/gunicorn-${name}.sock; - '') - (nameValuePair "/static/" '' - alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/; - '') - ]; - }])) cfg.servers ; + assertions = [{ assertion = config.services.nginx.enable; + message = "services.nginx.enable must be true"; }]; + + services.nginx.virtualHosts = mapAttrs ( name: server: + (mkMerge [ + server.nginx + { + extraConfig = '' + client_max_body_size 32M; + ''; + locations = { + "/".extraConfig = "proxy_set_header Host $http_host;"; + "/".proxyPass = "http://unix:${server.workDir}/gunicorn-${name}.sock"; + "/static/".extraConfig = '' + alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/; + ''; + }; + }]) + ) cfg.servers ; }; in out diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 20907a3ed..164831846 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -400,29 +400,24 @@ let chown ${toString cfg.cgit.fcgiwrap.user.uid}:${toString cfg.cgit.fcgiwrap.group.gid} ${cfg.cgit.settings.cache-root} ''; - krebs.nginx = { - enable = true; - servers.cgit = { - server-names = [ - "cgit.${config.networking.hostName}" - "cgit.${config.networking.hostName}.r" - "cgit.${config.networking.hostName}.retiolum" - ]; - locations = [ - (nameValuePair "/" '' - include ${pkgs.nginx}/conf/fastcgi_params; - fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi; - fastcgi_param PATH_INFO $uri; - fastcgi_param QUERY_STRING $args; - fastcgi_param HTTP_HOST $server_name; - fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; - '') - (nameValuePair "/static/" '' - root ${pkgs.cgit}/cgit; - rewrite ^/static(/.*)$ $1 break; - '') - ]; - }; + services.nginx.virtualHosts.cgit = { + serverAliases = [ + "cgit.${config.networking.hostName}" + "cgit.${config.networking.hostName}.r" + "cgit.${config.networking.hostName}.retiolum" + ]; + locations."/".extraConfig = '' + include ${pkgs.nginx}/conf/fastcgi_params; + fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi; + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_param HTTP_HOST $server_name; + fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; + ''; + locations."/static/".extraConfig = '' + root ${pkgs.cgit}/cgit; + rewrite ^/static(/.*)$ $1 break; + ''; }; }; diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index ff187b878..c85bf1ccd 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -26,6 +26,31 @@ with import <stockholm/lib>; }; }; }; + fileleech = rec { + cores = 4; + ssh.privkey.path = <secrets/ssh_host_ed25519_key>; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+jB5QdPsAJc90alYDhAEP3sPDJb6eIj9bebj+rTBEJ fileleech"; + nets = { + retiolum = { + ip4.addr = "10.243.113.98"; + ip6.addr = "42:5cf1:e7f2:3fd:cd4c:a1ee:ec71:7096"; + aliases = [ + "fileleech.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEA2W20+jYvuFUjPQ+E+7Xlabf8fW/XSnTTelfo2uRcJ3FMLYQ9H3rF + 8L8StPmxn8Q20FFH/MvRmgW8pU9z4RQ3nAi+utVYqAJQtOYA9FPMxssC08w82r0K + YC6sgc9MeRjnCjQxQrQs4fqA6KpqSLxRf2c6kfNwYRgCxFMns2ncxOiPOoGLZait + nJR3m0cSRm8yCTMbznlGH99+5+3HgvuBE/UYXmmGBs7w8DevaX76butzprZ8fm4z + e5C7R9ofdVW70GGksfSI81y5xODWMbfjTRHKm4OBX7NOCiOTwx1wu8bYDN3EzN6V + UM5PJfU42sViPEZmVuC8cDcP1xemHTkh9QIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; + pnp = { cores = 1; nets = { diff --git a/krebs/3modules/rtorrent.nix b/krebs/3modules/rtorrent.nix index bcc52fb6e..0c478aded 100644 --- a/krebs/3modules/rtorrent.nix +++ b/krebs/3modules/rtorrent.nix @@ -73,22 +73,23 @@ let # authentication also applies to rtorrent.rutorrent enable = mkEnableOption "rtorrent nginx web RPC"; - listenAddress = mkOption { - type = types.str; + port = mkOption { + type = types.nullOr types.int; description ='' - nginx listen address for rtorrent web + nginx listen port for rtorrent ''; - default = "localhost:8006"; + default = 8006; }; - enableAuth = mkEnableOption "rutorrent authentication"; - authfile = mkOption { - type = types.path; + basicAuth = mkOption { + type = types.attrsOf types.str ; description = '' - basic authentication file to be used. - Use `${pkgs.apacheHttpd}/bin/htpasswd -c <file> <username>` to create the file. - Only in use if authentication is enabled. + basic authentication to be used. If unset, no authentication will be + enabled. + + Refer to `services.nginx.virtualHosts.<name>.basicAuth` ''; + default = {}; }; }; @@ -104,7 +105,6 @@ let default = pkgs.rutorrent; }; - webdir = mkOption { type = types.path; description = '' @@ -286,36 +286,28 @@ let }; rpcweb-imp = { - krebs.nginx.enable = mkDefault true; - krebs.nginx.servers.rtorrent = { - listen = [ webcfg.listenAddress ]; - server-names = [ "default" ]; - extraConfig = '' - ${optionalString webcfg.enableAuth '' - auth_basic "rtorrent"; - auth_basic_user_file ${webcfg.authfile}; - ''} - ${optionalString rucfg.enable '' - root ${webdir}; - ''} - ''; - locations = [ - (nameValuePair "/RPC2" '' + services.nginx.enable = mkDefault true; + services.nginx.virtualHosts.rtorrent = { + default = mkDefault true; + inherit (webcfg) basicAuth port; + root = optionalString rucfg.enable webdir; + + locations = { + "/RPC2".extraConfig = '' include ${pkgs.nginx}/conf/scgi_params; scgi_param SCRIPT_NAME /RPC2; scgi_pass unix:${cfg.xmlrpc-socket}; - '') - ] ++ (optional rucfg.enable - (nameValuePair "~ \.php$" '' + ''; + } // (optionalAttrs rucfg.enable { + "~ \.php$".extraConfig = '' client_max_body_size 200M; - root ${webdir}; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:${fpm-socket}; try_files $uri =404; fastcgi_index index.php; include ${pkgs.nginx}/conf/fastcgi_params; include ${pkgs.nginx}/conf/fastcgi.conf; - '') + ''; } ); }; }; diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix index 26a51de00..197835e73 100644 --- a/krebs/3modules/tinc_graphs.nix +++ b/krebs/3modules/tinc_graphs.nix @@ -35,35 +35,28 @@ let nginx = { enable = mkEnableOption "enable tinc_graphs to be served with nginx"; - anonymous = { - server-names = mkOption { - type = with types; listOf str; - description = "hostnames which serve anonymous graphs"; - default = [ "graphs.${config.krebs.build.host.name}" ]; - }; - - listen = mkOption { - # use the type of the nginx listen option - type = with types; listOf str; - description = "listen address for anonymous graphs"; - default = [ "80" ]; - }; - + anonymous = mkOption { + type = types.attrsOf types.unspecified; + description = '' + nginx virtualHost options to be merged into the anonymous graphs + vhost entry. + ''; + }; + anonymous-domain = mkOption { + type = types.str; + description = '' + external domainname to be used for anonymous graphs + it will be used if you want to enable ACME + ''; + default = "graphs.krebsco.de"; }; - complete = { - server-names = mkOption { - type = with types; listOf str; - description = "hostname which serves complete graphs"; - default = [ "graphs.${config.krebs.build.host.name}" ]; - }; - - listen = mkOption { - type = with types; listOf str; - description = "listen address for complete graphs"; - default = [ "127.0.0.1:80" ]; - }; - + complete = mkOption { + type = types.attrsOf types.unspecified; + description = '' + nginx virtualHost options to be merged into the complete graphs + vhost entry. + ''; }; }; @@ -134,24 +127,20 @@ let uid = genid "tinc_graphs"; home = "/var/spool/tinc_graphs"; }; - krebs.nginx = mkIf cfg.nginx.enable { + services.nginx = mkIf cfg.nginx.enable { enable = mkDefault true; - servers = { + virtualHosts = { tinc_graphs_complete = mkMerge [ cfg.nginx.complete { - locations = [ - (nameValuePair "/" '' - autoindex on; - root ${internal_dir}; - '') - ]; - }] ; - tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous { - locations = [ - (nameValuePair "/" '' - autoindex on; - root ${external_dir}; - '') - ]; + locations = { + "/".extraConfig = "autoindex on;"; + "/".root = internal_dir; + }; + }]; + "${cfg.nginx.anonymous-domain}" = mkMerge [ cfg.nginx.anonymous { + locations = { + "/".extraConfig = "autoindex on;"; + "/".root = external_dir; + }; }]; }; }; diff --git a/krebs/5pkgs/rutorrent/default.nix b/krebs/5pkgs/rutorrent/default.nix index 5a2259552..1084e7ce7 100644 --- a/krebs/5pkgs/rutorrent/default.nix +++ b/krebs/5pkgs/rutorrent/default.nix @@ -1,11 +1,11 @@ { pkgs, ... }: pkgs.stdenv.mkDerivation { - name = "rutorrent-src-3.7"; + name = "rutorrent-src_2016-12-09"; src = pkgs.fetchFromGitHub { owner = "Novik"; repo = "rutorrent"; - rev = "b727523a153454d4976f04b0c47336ae57cc50d5"; - sha256 = "0s5wa0jnck781amln9c2p4pc0i5mq3j5693ra151lnwhz63aii4a"; + rev = "580bba8c538b55c1f75f3ad65310ff4ff2a153f7"; + sha256 = "1d9lgrzipy58dnx88z393p152kx6lki0x4aw40k8w9awsci4cx7p"; }; phases = [ "installPhase" ]; diff --git a/makefu/1systems/fileleech.nix b/makefu/1systems/fileleech.nix new file mode 100644 index 000000000..1eac141dc --- /dev/null +++ b/makefu/1systems/fileleech.nix @@ -0,0 +1,111 @@ +{ config, pkgs, lib, ... }: +let + toMapper = id: "/media/crypt${builtins.toString id}"; + byid = dev: "/dev/disk/by-id/" + dev; + keyFile = byid "usb-Intuix_DiskOnKey_09A07360336198F8-0:0"; + rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN"; + rootPartition = rootDisk + "-part3"; + + dataDisks = let + idpart = dev: byid dev + "-part1"; + in [ + { name = "crypt0"; device = idpart "scsi-1ATA_HUA722020ALA330_B9GDLJEF";} + { name = "crypt1"; device = idpart "scsi-1ATA_HUA722020ALA330_B9GGWG8F";} + { name = "crypt2"; device = idpart "scsi-1ATA_HUA722020ALA330_B9GH5NAF";} + { name = "crypt3"; device = idpart "scsi-1ATA_HUA722020ALA330_B9GJWGDF";} + { name = "crypt4"; device = idpart "scsi-1ATA_HUA722020ALA330_B9GKKXHF";} + { name = "crypt5"; device = idpart "scsi-1ATA_HUA722020ALA330_B9GKKXVF";} + { name = "crypt6"; device = idpart "scsi-1ATA_HUA722020ALA330_YAJJ8WRV";} + { name = "crypt7"; device = idpart "scsi-1ATA_HUA722020ALA330_YBKTUS4F";} # parity + ]; + + disks = [ { name = "luksroot"; device = rootPartition; } ] ++ dataDisks; +in { + imports = [ + ../. + ../2configs/tinc/retiolum.nix + ../2configs/disable_v6.nix + ../2configs/torrent.nix + ../2configs/fs/sda-crypto-root.nix + + ../2configs/elchos/irc-token.nix + ../2configs/elchos/log.nix + ../2configs/elchos/search.nix + ../2configs/elchos/stats.nix + + ]; + makefu.server.primary-itf = "enp8s0f0"; + krebs = { + enable = true; + build.host = config.krebs.hosts.fileleech; + }; + # git clone https://github.com/makefu/docker-pyload + # docker build . + # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P docker-pyload + + virtualisation.docker.enable = true; # for pyload + networking.firewall.allowedTCPPorts = [ + 51412 # torrent + 8112 # rutorrent-web + 8113 # pyload + 8080 # sabnzbd + 9090 # sabnzbd-ssl + 655 # tinc + ]; + networking.firewall.allowedUDPPorts = [ + 655 # tinc + 51412 # torrent + ]; + + services.sabnzbd.enable = true; + systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + + boot.initrd.luks = { + devices = let + usbkey = name: device: { + inherit name device keyFile; + keyFileSize = 4096; + allowDiscards = true; + }; + in builtins.map (x: usbkey x.name x.device) disks; + }; + environment.systemPackages = with pkgs;[ mergerfs ]; + + fileSystems = let + cryptMount = name: + { "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };}; + in cryptMount "crypt0" + // cryptMount "crypt1" + // cryptMount "crypt2" + // cryptMount "crypt3" + // cryptMount "crypt4" + // cryptMount "crypt5" + // cryptMount "crypt6" + // cryptMount "crypt7" + + # this entry sometimes creates issues + // { "/media/cryptX" = { + device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 3 4 5 6 ]); + fsType = "mergerfs"; + noCheck = true; + options = [ "defaults" "nofail" "allow_other" "nonempty" ]; }; + } + + ; + makefu.snapraid = { + enable = true; + disks = map toMapper [ 0 1 2 3 4 5 6 ]; + parity = toMapper 7; + }; + + boot.loader.grub.device = rootDisk; + + boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "aacraid" "usb_storage" "usbhid" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + # http://blog.hackathon.de/using-unsupported-sfp-modules-with-linux.html + boot.extraModprobeConfig = '' + options ixgbe allow_unsupported_sfp=1 + ''; +} diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index e8a368fa2..e7761a642 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -15,6 +15,7 @@ in { ../2configs/git/cgit-retiolum.nix # ../2configs/mattermost-docker.nix ../2configs/nginx/euer.test.nix + ../2configs/nginx/public_html.nix ../2configs/nginx/update.connector.one.nix ../2configs/deployment/mycube.connector.one.nix @@ -31,7 +32,9 @@ in { ]; services.smartd.devices = [ { device = "/dev/sda";} ]; + ###### stable + services.nginx.virtualHosts.cgit.serverAliases = [ "cgit.euer.krebsco.de" ]; krebs.build.host = config.krebs.hosts.gum; krebs.tinc.retiolum = { extraConfig = '' @@ -48,10 +51,6 @@ in { makefu.taskserver.enable = true; - krebs.nginx.servers.cgit = { - server-names = [ "cgit.euer.krebsco.de" ]; - listen = [ "${external-ip}:80" "${internal-ip}:80" ]; - }; # access users.users = { @@ -76,9 +75,8 @@ in { services.udev.extraRules = '' SUBSYSTEM=="net", ATTR{address}=="c8:0a:a9:c8:ee:dd", NAME="et0" ''; - boot.kernelParams = [ "ipv6.disable=1" ]; + boot.kernelParams = [ ]; networking = { - enableIPv6 = false; firewall = { allowPing = true; logRefusedConnections = false; diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 4fbbd653d..609d52134 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -48,12 +48,16 @@ in { ../2configs/exim-retiolum.nix ../2configs/smart-monitor.nix ../2configs/mail-client.nix - ../2configs/disable_v6.nix + # ../2configs/disable_v6.nix #../2configs/graphite-standalone.nix #../2configs/share-user-sftp.nix ../2configs/omo-share.nix ../2configs/tinc/retiolum.nix - ../2configs/torrent.nix + # ../2configs/torrent.nix + + # ../2configs/elchos/search.nix + # ../2configs/elchos/log.nix + # ../2configs/elchos/irc-token.nix ## as long as pyload is not in nixpkgs: # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload @@ -121,7 +125,8 @@ in { // { "/media/cryptX" = { device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 ]); fsType = "mergerfs"; - options = [ "defaults" "allow_other" ]; + noCheck = true; + options = [ "defaults" "allow_other" "nofail" "nonempty" ]; }; }; diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index 17e81f793..81ee37bbe 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -13,7 +13,7 @@ in { ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/save-diskspace.nix - ../2configs/bepasty-dual.nix + # ../2configs/bepasty-dual.nix ../2configs/iodined.nix ../2configs/backup.nix @@ -21,9 +21,7 @@ in { # other nginx ../2configs/nginx/euer.wiki.nix ../2configs/nginx/euer.blog.nix - ../2configs/nginx/euer.test.nix - - #../2configs/elchos/stats.nix + # ../2configs/nginx/euer.test.nix # collectd # ../2configs/collectd/collectd-base.nix @@ -52,7 +50,7 @@ in { krebs.bepasty.servers.external.nginx.listen = [ "${external-ip}:80" "${external-ip}:443 ssl" ]; # prepare graphs - krebs.nginx.enable = true; + services.nginx.enable = true; krebs.retiolum-bootstrap.enable = true; krebs.tinc_graphs = { @@ -61,12 +59,17 @@ in { enable = true; # TODO: remove hard-coded hostname complete = { - listen = [ "${internal-ip}:80" ]; - server-names = [ "graphs.wry" "graphs.retiolum" "graphs.wry.retiolum" ]; + extraConfig = '' + if ( $server_addr = "${external-ip}" ) { + return 403; + } + ''; + serverAliases = [ "graphs.retiolum" "graphs.wry" "graphs.retiolum" "graphs.wry.retiolum" ]; }; anonymous = { - listen = [ "${external-ip}:80" ] ; - server-names = [ "graphs.krebsco.de" ]; + enableSSL = true; + forceSSL = true; + enableACME = true; }; }; }; diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix index a6be04876..936aaf004 100644 --- a/makefu/2configs/bepasty-dual.nix +++ b/makefu/2configs/bepasty-dual.nix @@ -20,54 +20,29 @@ let ext-dom = "paste.krebsco.de" ; in { - krebs.nginx.enable = mkDefault true; + services.nginx.enable = mkDefault true; krebs.bepasty = { enable = true; serveNginx= true; servers = { - internal = { + "paste.r" = { nginx = { - server-names = [ "paste.retiolum" "paste.r" "paste.${config.krebs.build.host.name}" ]; + serverAliases = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ]; }; defaultPermissions = "admin,list,create,read,delete"; secretKey = secKey; }; - external = { + "${ext-dom}" = { nginx = { - server-names = [ ext-dom ]; - ssl = { - enable = true; - certificate = "${acmepath}/${ext-dom}/fullchain.pem"; - certificate_key = "${acmepath}/${ext-dom}/key.pem"; - # these certs will be needed if acme has not yet created certificates: - #certificate = "${sec}/wildcard.krebsco.de.crt"; - #certificate_key = "${sec}/wildcard.krebsco.de.key"; - ciphers = "RC4:HIGH:!aNULL:!MD5" ; - force_encryption = true; - }; - locations = singleton ( nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${ext-dom}/; - ''); - extraConfig = '' - ssl_session_cache shared:SSL:1m; - ssl_session_timeout 10m; - ssl_verify_client off; - proxy_ssl_session_reuse off; - ''; + enableSSL = true; + forceSSL = true; + enableACME = true; }; defaultPermissions = "read"; secretKey = secKey; }; }; }; - security.acme.certs."${ext-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${ext-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - post |