diff options
Diffstat (limited to 'lass')
| -rw-r--r-- | lass/1systems/iso.nix | 12 | ||||
| -rw-r--r-- | lass/1systems/mors.nix | 11 | ||||
| -rw-r--r-- | lass/1systems/prism.nix | 34 | ||||
| -rw-r--r-- | lass/2configs/default.nix | 4 | ||||
| -rw-r--r-- | lass/2configs/newsbot-js.nix | 1 | ||||
| -rw-r--r-- | lass/2configs/nixpkgs.nix | 2 | ||||
| -rw-r--r-- | lass/2configs/realwallpaper.nix | 16 | ||||
| -rw-r--r-- | lass/2configs/syncthing.nix | 12 |
8 files changed, 66 insertions, 26 deletions
diff --git a/lass/1systems/iso.nix b/lass/1systems/iso.nix index 9dfbf7cb8..01d698c4c 100644 --- a/lass/1systems/iso.nix +++ b/lass/1systems/iso.nix @@ -15,7 +15,6 @@ with import <stockholm/lib>; krebs.enable = true; krebs.build.user = config.krebs.users.lass; krebs.build.host = config.krebs.hosts.iso; - krebs.build.source.nixos-config.symlink = "stockholm/lass/1systems/${config.krebs.buil.host.name}.nix"; } { nixpkgs.config.allowUnfree = true; @@ -122,18 +121,12 @@ with import <stockholm/lib>; { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } ]; }; + systemd.services.sshd.wantedBy = mkForce [ "multi-user.target" ]; } { krebs.iptables = { enable = true; tables = { - nat.PREROUTING.rules = [ - { predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; } - { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; } - ]; - nat.OUTPUT.rules = [ - { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; } - ]; filter.INPUT.policy = "DROP"; filter.FORWARD.policy = "DROP"; filter.INPUT.rules = [ @@ -148,5 +141,8 @@ with import <stockholm/lib>; }; }; } + { + krebs.hidden-ssh.enable = true; + } ]; } diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index c196b391a..c8d9465d5 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -25,6 +25,7 @@ with import <stockholm/lib>; ../2configs/repo-sync.nix ../2configs/ircd.nix ../2configs/logf.nix + ../2configs/syncthing.nix { #risk of rain port krebs.iptables.tables.filter.INPUT.rules = [ @@ -77,10 +78,6 @@ with import <stockholm/lib>; services.redis.enable = true; } { - #ipfs-testing - services.ipfs.enable = true; - } - { environment.systemPackages = [ pkgs.krebszones ]; @@ -89,6 +86,12 @@ with import <stockholm/lib>; #ps vita stuff boot.extraModulePackages = [ config.boot.kernelPackages.exfat-nofuse ]; } + { + services.tor = { + enable = true; + client.enable = true; + }; + } ]; krebs.build.host = config.krebs.hosts.mors; diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index e5cbacfc8..41a909f16 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -46,6 +46,7 @@ in { ../2configs/monitoring/server.nix ../2configs/monitoring/monit-alarms.nix ../2configs/paste.nix + ../2configs/syncthing.nix { imports = [ ../2configs/bepasty.nix @@ -158,7 +159,7 @@ in { } { users.users.chat.openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkmIvB8BekIE2W24+I0gnzkvkEoeulz/zQkDUVJK4oScbIvgTYmcHzQuHJyPueTm67bJCOcYaTwEDNhcR/ZvcyiCQ7Jwa5cLDTkCkcR9LQq8ry5jMNEanvTgrnBIEcwfS7jFpyFb/PRVG6hh2bPOfP+ksFplkq1BTzKt/UTaCBwVEZqi5XuFIlq/MqJg+FIjh+wyeNR5jHtqgAhVjR+YLVNXLgtVPE+dlSfbyRQHuA9FTkUj8BxxnTdwM5Sx33S61ddik1XvRn++IYqFl68fZhzyTME7t/Mvjdz8J7ew2bF2IbJrXt37yQCAOEEp9/RC5OloA7dd/5ZJjZxSzT2HnYROILsYr3S0WV4e+H2G66ZN0ftdUCYh1o5rtY7IrSes6yHsKYbpoij1IAkRkyt2XgEH5EZCk1Omx8AY3ekW1KFIEhz2DZEfnCEjPf4AGCYZ0uy4XEztxzTDkh25TVs/tym1+96qCJ1yAxwWZDbVhS/Z6aSBpsyeDRKcak8qoWVC2dEPdYuTUmwvmo3pmGn/a4UfOLNJTn0jSRjy3kSv1hYzosN4NSYZqEylFB0ABnlqoLpX3tmWtrkiKv19S+djVGxbaaYm3hjPJfds3qCWTJWPvxPPeCE8wGXVLYqOQxa5ZPYeoTwRof5YNSbj5RFYy9sDLTlHl+U4ASTHZM5S3akQ== JuiceSSH" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDjesiOnhpT9XgWZqw/64M5lVQg3q0k22BtMyCv+33sGX8VmfTyD11GuwSjNGf5WiswKLqFvYBQsHfDDtS3k0ZNTDncGw3Pbilm6QoCuHEyDPaQYin0P+JmkocrL/6QF5uhZVFnsXCH5wntwOa00VFGwpMgQYSfRlReRx42Pu9Jk+iJduZMRBbOMvJI68Z7iJ4DgW/1U9J4MQdCsk7QlFgUstQQfV1zk4VfVfXuxDP3hjx6Q05nDChjpmzJbFunzb7aiy/1/Sl0QhROTpvxrQLksg7yYLw4BRs9ptjehX45A2Sxi8WKOb/g5u3xJNy0X07rE+N+o5v2hS7wF0DLQdK5+4TGtO+Y+ABUCqqA+T1ynAjNBWvsgY5uD4PZjuPgCMSw0JBmIy/P0THi3v5/8Cohvfnspl7Jpf80qENMu3unvvE9EePzgSRZY1PvDjPQfkWy0yBX1yQMhHuVGke9QgaletitwuahRujml37waeUuOl8Rpz+2iV+6OIS4tfO368uLFHKWbobXTbTDXODBgxZ/IyvO7vxM2uDX/kIWaeYKrip3nSyWBYnixwrcS4vm6ZQcoejwp2KCfGQwIE4MnGYRlwcOEYjvyjLkZHDiZEivUQ0rThMYBzec8bQ08QW8oxF+NXkFKG3awt3f7TKTRkYqQcOMpFKmV24KDiwgwm0miQ== JuiceSSH" ]; } { @@ -194,7 +195,7 @@ in { ../2configs/realwallpaper.nix ]; services.nginx.virtualHosts."lassul.us".locations."/wallpaper.png".extraConfig = '' - alias /tmp/wallpaper.png; + alias /var/realwallpaper/realwallpaper.png; ''; } { @@ -254,19 +255,20 @@ in { ]; } { - krebs.Reaktor.coders = let - lambdabot = (import (pkgs.fetchFromGitHub { - owner = "NixOS"; repo = "nixpkgs"; - rev = "a4ec1841da14fc98c5c35cc72242c23bb698d4ac"; - sha256 = "148fpw31s922hxrf28yhrci296f7c7zd81hf0k6zs05rq0i3szgy"; - }) {}).lambdabot; - in { - nickname = "reaktor-lass"; + krebs.Reaktor.coders = { + nickname = "Reaktor|lass"; channels = [ "#coders" ]; extraEnviron = { REAKTOR_HOST = "irc.hackint.org"; }; plugins = with pkgs.ReaktorPlugins; let + + lambdabot = (import (pkgs.fetchFromGitHub { + owner = "NixOS"; repo = "nixpkgs"; + rev = "a4ec1841da14fc98c5c35cc72242c23bb698d4ac"; + sha256 = "148fpw31s922hxrf28yhrci296f7c7zd81hf0k6zs05rq0i3szgy"; + }) {}).lambdabot; + lambdabotflags = '' -XStandaloneDeriving -XGADTs -XFlexibleContexts \ -XFlexibleInstances -XMultiParamTypeClasses \ @@ -349,6 +351,18 @@ in { ]; }; } + { + krebs.Reaktor.prism = { + nickname = "Reaktor|lass"; + channels = [ "#retiolum" ]; + extraEnviron = { + REAKTOR_HOST = "ni.r"; + }; + plugins = with pkgs.ReaktorPlugins; [ + sed-plugin + ]; + }; + } ]; krebs.build.host = config.krebs.hosts.prism; diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 69f8a681e..b53efa75d 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -151,6 +151,10 @@ with import <stockholm/lib>; p7zip unzip unrar + + (pkgs.writeDashBin "sshn" '' + ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@" + '') ]; programs.bash = { diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix index 3c6c5dc88..d38af211f 100644 --- a/lass/2configs/newsbot-js.nix +++ b/lass/2configs/newsbot-js.nix @@ -163,7 +163,6 @@ let us_math_society|http://www.ams.org/cgi-bin/content/news_items.cgi?rss=1|#news vimperator|https://sites.google.com/a/vimperator.org/www/blog/posts.xml|#news weechat|http://dev.weechat.org/feed/atom|#news - wired_sci|http://www.wired.com/category/science/feed/|#news wp_world|http://feeds.washingtonpost.com/rss/rss_blogpost|#news xkcd|https://xkcd.com/rss.xml|#news zdnet|http://www.zdnet.com/news/rss.xml|#news diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix index 24437d040..5309c9551 100644 --- a/lass/2configs/nixpkgs.nix +++ b/lass/2configs/nixpkgs.nix @@ -3,6 +3,6 @@ { krebs.build.source.nixpkgs.git = { url = https://cgit.lassul.us/nixpkgs; - ref = "a563923"; + ref = "5acb454"; }; } diff --git a/lass/2configs/realwallpaper.nix b/lass/2configs/realwallpaper.nix index cf9795071..116d66276 100644 --- a/lass/2configs/realwallpaper.nix +++ b/lass/2configs/realwallpaper.nix @@ -10,11 +10,23 @@ in { krebs.realwallpaper.enable = true; services.nginx.virtualHosts.wallpaper = { + extraConfig = '' + if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) { + return 403; + } + ''; serverAliases = [ hostname + "${hostname}.r" ]; - locations."/wallpaper.png".extraConfig = '' - root /tmp/; + locations."/realwallpaper.png".extraConfig = '' + root /var/realwallpaper/; + ''; + locations."/realwallpaper-sat.png".extraConfig = '' + root /var/realwallpaper/; + ''; + locations."/realwallpaper-sat-krebs.png".extraConfig = '' + root /var/realwallpaper/; ''; }; diff --git a/lass/2configs/syncthing.nix b/lass/2configs/syncthing.nix new file mode 100644 index 000000000..cef43d1e6 --- /dev/null +++ b/lass/2configs/syncthing.nix @@ -0,0 +1,12 @@ +{ config, pkgs, ... }: +with import <stockholm/lib>; +{ + services.syncthing = { + enable = true; + useInotify = true; + }; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p tcp --dport 22000"; target = "ACCEPT";} + { predicate = "-p udp --dport 21027"; target = "ACCEPT";} + ]; +} |