From cc29be2d206e1093e036ef619c08e6d536257760 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Wed, 28 Dec 2022 19:06:08 +0100 Subject: l yellow.r: move to new deno port --- lass/1systems/yellow/config.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index f5071c4b7..52d7a0f1f 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -136,7 +136,15 @@ with import ; }; }; - systemd.services.bruellwuerfel = { + systemd.services.bruellwuerfel = + let + bruellwuerfelSrc = pkgs.fetchFromGitHub { + owner = "krebs"; + repo = "bruellwuerfel"; + rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015"; + sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd"; + }; + in { wantedBy = [ "multi-user.target" ]; environment = { IRC_CHANNEL = "#flix"; @@ -145,7 +153,7 @@ with import ; IRC_HISTORY_FILE = "/tmp/bruelli.history"; }; serviceConfig = { - ExecStart = "${pkgs.bruellwuerfel}/bin/bruellwuerfel"; + ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts"; }; }; -- cgit v1.2.3 From 767c6fbd14fc8e5eb73cea2f738af88083fcea32 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 01:23:42 +0100 Subject: l yellow.r: move to neoprism, refactor --- lass/1systems/yellow/config.nix | 105 ++++++++++++++++++++++++++++++++++------ 1 file changed, 91 insertions(+), 14 deletions(-) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ecf0337ed..552dd7f00 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,20 +9,23 @@ in { krebs.build.host = config.krebs.hosts.yellow; + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; + }; + users.groups.download.members = [ "transmission" ]; networking.useHostResolvConf = false; networking.useNetworkd = true; - systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; - systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { enable = true; + home = "/var/state/transmission"; group = "download"; downloadDirPermissions = "775"; settings = { - download-dir = "/var/download/finished"; - incomplete-dir = "/var/download/incoming"; - incomplete-dir-enable = true; + download-dir = "/var/download/transmission"; + incomplete-dir-enabled = false; rpc-bind-address = "::"; message-level = 1; umask = 18; @@ -40,11 +43,8 @@ in { }; virtualHosts.default = { default = true; - locations."/dl".extraConfig = '' - return 301 /; - ''; locations."/" = { - root = "/var/download/finished"; + root = "/var/download"; extraConfig = '' fancyindex on; fancyindex_footer "/fancy.html"; @@ -136,6 +136,58 @@ in { ''}; ''; }; + virtualHosts."jelly.r" = { + locations."/".extraConfig = '' + proxy_pass http://localhost:8096/; + proxy_set_header Accept-Encoding ""; + ''; + }; + }; + + services.samba = { + enable = true; + enableNmbd = false; + extraConfig = '' + workgroup = WORKGROUP + server string = ${config.networking.hostName} + # only allow retiolum addresses + hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 + + # Use sendfile() for performance gain + use sendfile = true + + # No NetBIOS is needed + disable netbios = true + + # Only mangle non-valid NTFS names, don't care about DOS support + mangled names = illegal + + # Performance optimizations + socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 + + # Disable all printing + load printers = false + disable spoolss = true + printcap name = /dev/null + + map to guest = Bad User + max log size = 50 + dns proxy = no + security = user + + [global] + syslog only = yes + ''; + shares.public = { + comment = "Warez"; + path = "/var/download"; + public = "yes"; + "only guest" = "yes"; + "create mask" = "0644"; + "directory mask" = "2777"; + writable = "no"; + printable = "no"; + }; }; systemd.services.bruellwuerfel = @@ -164,14 +216,33 @@ in { tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web - { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin + { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr + { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr + { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + + # smbd + { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; } ]; tables.filter.OUTPUT = { policy = "DROP"; rules = [ + { predicate = "-o lo"; target = "ACCEPT"; } { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } @@ -279,7 +350,7 @@ in { ExecStart = pkgs.writers.writeDash "flix-index" '' set -efu - DIR=/var/download/finished + DIR=/var/download cd "$DIR" while inotifywait -rq -e create -e move -e delete "$DIR"; do find . -type f > "$DIR"/index.tmp @@ -294,9 +365,15 @@ in { group = "download"; }; - services.magnetico = { + services.radarr = { + enable = true; + }; + + services.sonarr = { + enable = true; + }; + + services.prowlarr = { enable = true; - web.address = "0.0.0.0"; - web.port = 9092; }; } -- cgit v1.2.3 From 4228b378c46db684ce0a33253bb51a5869a2ed23 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 09:45:53 +0100 Subject: l yellow.r: add rada.r and sona.r aliases --- lass/1systems/yellow/config.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 552dd7f00..a89b7dd76 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -142,6 +142,16 @@ in { proxy_set_header Accept-Encoding ""; ''; }; + virtualHosts."rada.r" = { + locations."/" = { + proxyPass = "http://localhost:7878"; + }; + }; + virtualHosts."sona.r" = { + locations."/" = { + proxyPass = "http://localhost:8989"; + }; + }; }; services.samba = { -- cgit v1.2.3 From c199c376fcbe6049b2d4c3fa9530b31d4e655bb0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 09:51:45 +0100 Subject: l sona.r, rada.r: proxy websockets --- lass/1systems/yellow/config.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index a89b7dd76..923654d9e 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -144,11 +144,13 @@ in { }; virtualHosts."rada.r" = { locations."/" = { + proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; virtualHosts."sona.r" = { locations."/" = { + proxyWebsockets = true; proxyPass = "http://localhost:8989"; }; }; -- cgit v1.2.3 From a6fae292ee20386d3c9eb4210ee7f304a6c230bd Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 12:04:44 +0100 Subject: l: {son,rad}a.r -> {son,rad}ar.r --- lass/1systems/yellow/config.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 923654d9e..484a7f5dc 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -142,13 +142,13 @@ in { proxy_set_header Accept-Encoding ""; ''; }; - virtualHosts."rada.r" = { + virtualHosts."radar.r" = { locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; - virtualHosts."sona.r" = { + virtualHosts."sonar.r" = { locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:8989"; -- cgit v1.2.3 From 23b2047c80b222ef1c59d70b25697c6624792d19 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 12:35:37 +0100 Subject: l yellow.r: add bazarr for subtitles --- lass/1systems/yellow/config.nix | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 484a7f5dc..72e2e0e85 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -234,6 +234,7 @@ in { { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr # smbd { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } @@ -379,13 +380,20 @@ in { services.radarr = { enable = true; + group = "download"; }; services.sonarr = { enable = true; + group = "download"; }; services.prowlarr = { enable = true; }; + + services.bazarr = { + enable = true; + group = "download"; + }; } -- cgit v1.2.3 From 2818476f710410f1c752ce12becce10be0a8a293 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 9 Jan 2023 20:37:40 +0100 Subject: l yellow.r: add acme ssl to yellow.r, radar.r and sonar.r --- lass/1systems/yellow/config.nix | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'lass/1systems/yellow') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 72e2e0e85..06561e9cf 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -34,6 +34,12 @@ in { }; }; + security.acme.defaults.email = "spam@krebsco.de"; + security.acme.acceptTerms = true; + security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL; services.nginx = { enable = true; package = pkgs.nginx.override { @@ -41,8 +47,10 @@ in { fancyindex ]; }; - virtualHosts.default = { + virtualHosts."yellow.r" = { default = true; + enableACME = true; + addSSL = true; locations."/" = { root = "/var/download"; extraConfig = '' @@ -137,18 +145,24 @@ in { ''; }; virtualHosts."jelly.r" = { + enableACME = true; + addSSL = true; locations."/".extraConfig = '' proxy_pass http://localhost:8096/; proxy_set_header Accept-Encoding ""; ''; }; virtualHosts."radar.r" = { + enableACME = true; + addSSL = true; locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; virtualHosts."sonar.r" = { + enableACME = true; + addSSL = true; locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:8989"; @@ -227,6 +241,7 @@ in { enable = true; tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir + { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic -- cgit v1.2.3