From b726b7588d2dcf83507ed138723efed73efebe9f Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 28 Nov 2022 17:40:13 +0100 Subject: init xandikos as calendar.r --- krebs/1systems/hotdog/config.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs/1systems') diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix index cf07d3b4d..02749dafe 100644 --- a/krebs/1systems/hotdog/config.nix +++ b/krebs/1systems/hotdog/config.nix @@ -13,6 +13,8 @@ + + ## shackie irc bot ]; -- cgit v1.3.1 From 645c3564f75589531abcf17fd3c3f920d93a394a Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 2 Dec 2022 09:05:42 +0100 Subject: init social.krebsco.de --- kartei/lass/default.nix | 11 ++++++----- krebs/1systems/hotdog/config.nix | 1 + krebs/2configs/mastodon-proxy.nix | 24 +++++++++++++++++++++++ krebs/2configs/mastodon.nix | 40 +++++++++++++++++++++++++++++++++++++++ lass/1systems/prism/config.nix | 1 + 5 files changed, 72 insertions(+), 5 deletions(-) create mode 100644 krebs/2configs/mastodon-proxy.nix create mode 100644 krebs/2configs/mastodon.nix (limited to 'krebs/1systems') diff --git a/kartei/lass/default.nix b/kartei/lass/default.nix index 0c314e9ec..1452d4943 100644 --- a/kartei/lass/default.nix +++ b/kartei/lass/default.nix @@ -59,11 +59,12 @@ in { cores = 4; extraZones = { "krebsco.de" = '' - cache IN A ${nets.internet.ip4.addr} - p IN A ${nets.internet.ip4.addr} - c IN A ${nets.internet.ip4.addr} - paste IN A ${nets.internet.ip4.addr} - prism IN A ${nets.internet.ip4.addr} + cache 60 IN A ${nets.internet.ip4.addr} + p 60 IN A ${nets.internet.ip4.addr} + c 60 IN A ${nets.internet.ip4.addr} + paste 60 IN A ${nets.internet.ip4.addr} + prism 60 IN A ${nets.internet.ip4.addr} + social 60 IN A ${nets.internet.ip4.addr} ''; "lassul.us" = '' $TTL 3600 diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix index 02749dafe..a34df4bdc 100644 --- a/krebs/1systems/hotdog/config.nix +++ b/krebs/1systems/hotdog/config.nix @@ -14,6 +14,7 @@ + ## shackie irc bot diff --git a/krebs/2configs/mastodon-proxy.nix b/krebs/2configs/mastodon-proxy.nix new file mode 100644 index 000000000..4d359c3fe --- /dev/null +++ b/krebs/2configs/mastodon-proxy.nix @@ -0,0 +1,24 @@ +{ config, lib, pkgs, ... }: +{ + services.nginx = { + enable = true; + virtualHosts."social.krebsco.de" = { + forceSSL = true; + enableACME = true; + locations."/" = { + # TODO use this in 22.11 + # recommendedProxySettings = true; + proxyPass = "http://hotdog.r"; + proxyWebsockets = true; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Server $host; + ''; + }; + }; + }; +} diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix new file mode 100644 index 000000000..d0c1943cc --- /dev/null +++ b/krebs/2configs/mastodon.nix @@ -0,0 +1,40 @@ +{ config, lib, pkgs, ... }: +{ + services.postgresql = { + enable = true; + dataDir = "/var/state/postgresql/${config.services.postgresql.package.psqlSchema}"; + package = pkgs.postgresql_11; + }; + systemd.tmpfiles.rules = [ + "d /var/state/postgresql 0700 postgres postgres -" + ]; + + services.mastodon = { + enable = true; + localDomain = "social.krebsco.de"; + configureNginx = true; + trustedProxy = config.krebs.hosts.prism.nets.retiolum.ip6.addr; + smtp.createLocally = false; + smtp.fromAddress = "mastodon@social.krebsco.de"; + }; + + services.nginx.virtualHosts.${config.services.mastodon.localDomain} = { + forceSSL = lib.mkForce false; + enableACME = lib.mkForce false; + locations."@proxy".extraConfig = '' + proxy_redirect off; + proxy_pass_header Server; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + ''; + }; + + networking.firewall.allowedTCPPorts = [ + 80 + ]; + + environment.systemPackages = [ + (pkgs.writers.writeDashBin "tootctl" '' + sudo -u mastodon /etc/profiles/per-user/mastodon/bin/mastodon-env /etc/profiles/per-user/mastodon/bin/tootctl "$@" + '') + ]; +} diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index 7bffc39aa..75f84bca9 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -111,6 +111,7 @@ with import ; + { services.tor = { enable = true; -- cgit v1.3.1 From f207532a0e34d6316ffc904e88097ee2c87b1505 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 9 Dec 2022 16:01:25 +0100 Subject: hotdog: enable krebs.pages --- krebs/1systems/hotdog/config.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'krebs/1systems') diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix index a34df4bdc..9849937d5 100644 --- a/krebs/1systems/hotdog/config.nix +++ b/krebs/1systems/hotdog/config.nix @@ -22,6 +22,7 @@ krebs.build.host = config.krebs.hosts.hotdog; krebs.github-hosts-sync.enable = true; + krebs.pages.enable = true; boot.isContainer = true; networking.useDHCP = false; -- cgit v1.3.1 From 54300dfe750340d1e61947400ea86f71dad877af Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 9 Dec 2022 17:00:03 +0100 Subject: ponte: enable krebs.pages --- krebs/1systems/ponte/config.nix | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'krebs/1systems') diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix index 8250ebad9..de01b92ca 100644 --- a/krebs/1systems/ponte/config.nix +++ b/krebs/1systems/ponte/config.nix @@ -8,4 +8,11 @@ ]; krebs.build.host = config.krebs.hosts.ponte; + + krebs.pages.enable = true; + krebs.pages.nginx.addSSL = true; + krebs.pages.nginx.enableACME = true; + + security.acme.acceptTerms = true; + security.acme.certs.${config.krebs.pages.domain}.email = "spam@krebsco.de"; } -- cgit v1.3.1 From 8062bf67e3481214883f0d41a624c0ccfb1cf275 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 9 Dec 2022 17:11:30 +0100 Subject: ponte: open TCP 80 and 443 --- krebs/1systems/ponte/config.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs/1systems') diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix index de01b92ca..ba817692f 100644 --- a/krebs/1systems/ponte/config.nix +++ b/krebs/1systems/ponte/config.nix @@ -7,6 +7,8 @@ ]; + networking.firewall.allowedTCPPorts = [ 80 443 ]; + krebs.build.host = config.krebs.hosts.ponte; krebs.pages.enable = true; -- cgit v1.3.1 From ea30ea8661dbc83f8d2f96f2c511aa04992d3ffe Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 9 Dec 2022 17:42:52 +0100 Subject: ponte firewall: disable logging --- krebs/1systems/ponte/config.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs/1systems') diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix index ba817692f..f896c507b 100644 --- a/krebs/1systems/ponte/config.nix +++ b/krebs/1systems/ponte/config.nix @@ -8,6 +8,8 @@ ]; networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.logRefusedConnections = false; + networking.firewall.logRefusedUnicastsOnly = false; krebs.build.host = config.krebs.hosts.ponte; -- cgit v1.3.1 From b17cd6133b92b9f936ee83f86bb8ff8f54e9565d Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 9 Dec 2022 18:07:20 +0100 Subject: ponte: modify internet-facing SSH port --- krebs/1systems/ponte/config.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'krebs/1systems') diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix index f896c507b..2f55995cf 100644 --- a/krebs/1systems/ponte/config.nix +++ b/krebs/1systems/ponte/config.nix @@ -11,6 +11,21 @@ networking.firewall.logRefusedConnections = false; networking.firewall.logRefusedUnicastsOnly = false; + # Move Internet-facing SSH port to reduce logspam. + networking.firewall.extraCommands = let + host = config.krebs.build.host; + in /* sh */ '' + iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22 + iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22 + iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT + iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0 + + ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22 + ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22 + ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT + ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0 + ''; + krebs.build.host = config.krebs.hosts.ponte; krebs.pages.enable = true; -- cgit v1.3.1