diff options
Diffstat (limited to 'krebs')
-rw-r--r-- | krebs/0tests/data/secrets/initrd/host_ecdsa.pub | 0 | ||||
-rw-r--r-- | krebs/0tests/data/secrets/initrd/host_ecdsa_key | 0 | ||||
-rw-r--r-- | krebs/0tests/data/secrets/initrd/hostname | 0 | ||||
-rw-r--r-- | krebs/0tests/data/secrets/initrd/hs_ed25519_public_key | 0 | ||||
-rw-r--r-- | krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key | 0 | ||||
-rw-r--r-- | krebs/1systems/puyak/config.nix | 87 | ||||
-rw-r--r-- | krebs/1systems/wolf/config.nix | 80 | ||||
-rw-r--r-- | krebs/2configs/shack/share.nix | 3 | ||||
-rw-r--r-- | krebs/2configs/tor/initrd.nix | 50 |
9 files changed, 144 insertions, 76 deletions
diff --git a/krebs/0tests/data/secrets/initrd/host_ecdsa.pub b/krebs/0tests/data/secrets/initrd/host_ecdsa.pub new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/krebs/0tests/data/secrets/initrd/host_ecdsa.pub diff --git a/krebs/0tests/data/secrets/initrd/host_ecdsa_key b/krebs/0tests/data/secrets/initrd/host_ecdsa_key new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/krebs/0tests/data/secrets/initrd/host_ecdsa_key diff --git a/krebs/0tests/data/secrets/initrd/hostname b/krebs/0tests/data/secrets/initrd/hostname new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/krebs/0tests/data/secrets/initrd/hostname diff --git a/krebs/0tests/data/secrets/initrd/hs_ed25519_public_key b/krebs/0tests/data/secrets/initrd/hs_ed25519_public_key new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/krebs/0tests/data/secrets/initrd/hs_ed25519_public_key diff --git a/krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key b/krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix index 08a3392bd..0cadc3a10 100644 --- a/krebs/1systems/puyak/config.nix +++ b/krebs/1systems/puyak/config.nix @@ -7,19 +7,104 @@ <stockholm/krebs/2configs/secret-passwords.nix> <stockholm/krebs/2configs/hw/x220.nix> + + ## initrd unlocking + # (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase' + <stockholm/krebs/2configs/tor/initrd.nix> + <stockholm/krebs/2configs/binary-cache/nixos.nix> <stockholm/krebs/2configs/binary-cache/prism.nix> <stockholm/krebs/2configs/go.nix> <stockholm/krebs/2configs/ircd.nix> <stockholm/krebs/2configs/news.nix> <stockholm/krebs/2configs/news-spam.nix> + + ### shackspace + # handle the worlddomination map via coap + <stockholm/krebs/2configs/shack/worlddomination.nix> <stockholm/krebs/2configs/shack/ssh-keys.nix> + + # drivedroid.shack for shackphone + <stockholm/krebs/2configs/shack/drivedroid.nix> + # <stockholm/krebs/2configs/shack/nix-cacher.nix> + + # Say if muell will be collected + <stockholm/krebs/2configs/shack/muell_caller.nix> + # provide muellshack api: muell.shack + <stockholm/krebs/2configs/shack/muellshack.nix> + # send mail if muell was not handled + <stockholm/krebs/2configs/shack/muell_mail.nix> + + # provide light control api + <stockholm/krebs/2configs/shack/node-light.nix> # light.shack lounge.light.shack power.light.shack openhab.shack lightapi.shack + # light.shack web-ui + <stockholm/krebs/2configs/shack/light.shack.nix> #light.shack + + # powerraw usb serial to mqtt and raw socket + <stockholm/krebs/2configs/shack/powerraw.nix> # powerraw.shack standby.shack + # send power stats to s3 + <stockholm/krebs/2configs/shack/s3-power.nix> # powerraw.shack must be available + + + { # do not log to /var/spool/log + services.nginx.appendHttpConfig = '' + map $request_method $loggable { + default 1; + GET 0; + } + log_format vhost '$host $remote_addr - $remote_user ' + '[$time_local] "$request" $status ' + '$body_bytes_sent "$http_referer" ' + '"$http_user_agent"'; + error_log stderr; + access_log syslog:server=unix:/dev/log vhost; + ''; + services.journald.rateLimitBurst = 10000; + } + + # create samba share for anonymous usage with the laser and 3d printer pc + <stockholm/krebs/2configs/shack/share.nix> + + # mobile.lounge.mpd.shack + <stockholm/krebs/2configs/shack/mobile.mpd.nix> + + # hass.shack + <stockholm/krebs/2configs/shack/glados> + + # connect to git.shackspace.de as group runner for rz + <stockholm/krebs/2configs/shack/gitlab-runner.nix> + + # Statistics collection and visualization + # <stockholm/krebs/2configs/shack/graphite.nix> # graphiteApi is broken and unused(hopefully) + ## Collect data from mqtt.shack and store in graphite database + <stockholm/krebs/2configs/shack/mqtt_sub.nix> + ## Collect radioactive data and put into graphite + <stockholm/krebs/2configs/shack/radioactive.nix> + ## mqtt.shack + <stockholm/krebs/2configs/shack/mqtt.nix> + ## influx.shack + <stockholm/krebs/2configs/shack/influx.nix> + + ## Collect local statistics via collectd and send to collectd + <stockholm/krebs/2configs/stats/shack-client.nix> + <stockholm/krebs/2configs/stats/shack-debugging.nix> + + ## netbox.shack: Netbox is disabled as nobody seems to be using it anyway + # <stockholm/krebs/2configs/shack/netbox.nix> + + # grafana.shack + <stockholm/krebs/2configs/shack/grafana.nix> + + # shackdns.shack + # replacement for leases.shack and shackles.shack + <stockholm/krebs/2configs/shack/shackDNS.nix> + + # monitoring: prometheus.shack <stockholm/krebs/2configs/shack/prometheus/node.nix> <stockholm/krebs/2configs/shack/prometheus/server.nix> <stockholm/krebs/2configs/shack/prometheus/blackbox.nix> <stockholm/krebs/2configs/shack/prometheus/unifi.nix> <stockholm/krebs/2configs/shack/prometheus/alertmanager-telegram.nix> - <stockholm/krebs/2configs/shack/gitlab-runner.nix> ## Collect local statistics via collectd and send to collectd <stockholm/krebs/2configs/stats/shack-client.nix> diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix index 0160f9ebb..25e7c5f06 100644 --- a/krebs/1systems/wolf/config.nix +++ b/krebs/1systems/wolf/config.nix @@ -14,85 +14,15 @@ in <stockholm/krebs/2configs/binary-cache/nixos.nix> <stockholm/krebs/2configs/binary-cache/prism.nix> - # handle the worlddomination map via coap - <stockholm/krebs/2configs/shack/worlddomination.nix> - <stockholm/krebs/2configs/shack/ssh-keys.nix> + #### shackspace services + <stockholm/krebs/2configs/shack/share.nix> # wolf.shack - # drivedroid.shack for shackphone - <stockholm/krebs/2configs/shack/drivedroid.nix> - # <stockholm/krebs/2configs/shack/nix-cacher.nix> - # Say if muell will be collected - <stockholm/krebs/2configs/shack/muell_caller.nix> - # provide muellshack api - <stockholm/krebs/2configs/shack/muellshack.nix> - # provide light control api - <stockholm/krebs/2configs/shack/node-light.nix> - # light.shack web-ui - <stockholm/krebs/2configs/shack/light.shack.nix> - # send mail if muell was not handled - <stockholm/krebs/2configs/shack/muell_mail.nix> - # send mail if muell was not handled - <stockholm/krebs/2configs/shack/s3-power.nix> - # powerraw usb serial to mqtt and raw socket - <stockholm/krebs/2configs/shack/powerraw.nix> - - { # do not log to /var/spool/log - services.nginx.appendHttpConfig = '' - map $request_method $loggable { - default 1; - GET 0; - } - log_format vhost '$host $remote_addr - $remote_user ' - '[$time_local] "$request" $status ' - '$body_bytes_sent "$http_referer" ' - '"$http_user_agent"'; - error_log stderr; - access_log syslog:server=unix:/dev/log vhost; - ''; - services.journald.rateLimitBurst = 10000; - } - - # create samba share for anonymous usage with the laser and 3d printer pc - <stockholm/krebs/2configs/shack/share.nix> - - # mobile.lounge.mpd.shack - <stockholm/krebs/2configs/shack/mobile.mpd.nix> - - # hass.shack - <stockholm/krebs/2configs/shack/glados> - - # connect to git.shackspace.de as group runner for rz + # gitlab runner <stockholm/krebs/2configs/shack/gitlab-runner.nix> - - # Statistics collection and visualization - # <stockholm/krebs/2configs/shack/graphite.nix> # graphiteApi is broken and unused(hopefully) - ## Collect data from mqtt.shack and store in graphite database - <stockholm/krebs/2configs/shack/mqtt_sub.nix> - ## Collect radioactive data and put into graphite - <stockholm/krebs/2configs/shack/radioactive.nix> - ## mqtt.shack - <stockholm/krebs/2configs/shack/mqtt.nix> - ## influx.shack - <stockholm/krebs/2configs/shack/influx.nix> - - ## Collect local statistics via collectd and send to collectd - <stockholm/krebs/2configs/stats/shack-client.nix> - <stockholm/krebs/2configs/stats/shack-debugging.nix> - - <stockholm/krebs/2configs/shack/netbox.nix> - # prometheus.shack - #<stockholm/krebs/2configs/shack/prometheus/server.nix> - <stockholm/krebs/2configs/shack/prometheus/node.nix> - #<stockholm/krebs/2configs/shack/prometheus/unifi.nix> - # grafana.shack - <stockholm/krebs/2configs/shack/grafana.nix> - - # shackdns.shack - # replacement for leases.shack and shackles.shack - <stockholm/krebs/2configs/shack/shackDNS.nix> - # misc + <stockholm/krebs/2configs/shack/ssh-keys.nix> <stockholm/krebs/2configs/save-diskspace.nix> + <stockholm/krebs/2configs/shack/prometheus/node.nix> ]; # use your own binary cache, fallback use cache.nixos.org (which is used by diff --git a/krebs/2configs/shack/share.nix b/krebs/2configs/shack/share.nix index 465d6ef69..d8d65d309 100644 --- a/krebs/2configs/shack/share.nix +++ b/krebs/2configs/shack/share.nix @@ -37,6 +37,9 @@ # for legacy systems client min protocol = NT1 server min protocol = NT1 + workgroup = WORKGROUP + server string = ${config.networking.hostName} + netbios name = ${config.networking.hostName} ''; }; } diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix new file mode 100644 index 000000000..cb6008f73 --- /dev/null +++ b/krebs/2configs/tor/initrd.nix @@ -0,0 +1,50 @@ +{config, pkgs, ... }: +## unlock command: +# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase' +{ + boot.initrd.network.enable = true; + boot.initrd.network.ssh = { + enable = true; + port = 22; + authorizedKeys = [ + config.krebs.users.jeschli-brauerei.pubkey + config.krebs.users.lass.pubkey + config.krebs.users.lass-mors.pubkey + config.krebs.users.makefu.pubkey + config.krebs.users.tv.pubkey + ]; + hostECDSAKey = <secrets/initrd/host_ecdsa_key>; + }; + boot.initrd.availableKernelModules = [ "e1000e" ]; + + boot.initrd.secrets = { + "/etc/tor/onion/bootup" = <secrets/initrd>; + }; + + boot.initrd.extraUtilsCommands = '' + copy_bin_and_libs ${pkgs.tor}/bin/tor + ''; + + # start tor during boot process + boot.initrd.network.postCommands = let + torRc = (pkgs.writeText "tor.rc" '' + DataDirectory /etc/tor + SOCKSPort 127.0.0.1:9050 IsolateDestAddr + SOCKSPort 127.0.0.1:9063 + HiddenServiceDir /etc/tor/onion/bootup + HiddenServicePort 22 127.0.0.1:22 + ''); + in '' + echo "tor: preparing onion folder" + # have to do this otherwise tor does not want to start + chmod -R 700 /etc/tor + + echo "make sure localhost is up" + ip a a 127.0.0.1/8 dev lo + ip link set lo up + + echo "tor: starting tor" + tor -f ${torRc} --verify-config + tor -f ${torRc} & + ''; +} |