From c337e2593b9b28c4248cffc07edf530351df491f Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 25 Dec 2022 01:08:39 +0100 Subject: l mors.r: add autotether --- lass/1systems/mors/config.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/1systems') diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix index dd479f267..6d0d177ec 100644 --- a/lass/1systems/mors/config.nix +++ b/lass/1systems/mors/config.nix @@ -41,6 +41,7 @@ with import ; # # + { krebs.iptables.tables.filter.INPUT.rules = [ #risk of rain -- cgit v1.2.3 From adc11cf679970da26f82e5200f2ea2a94c59e8be Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 11:18:54 +0100 Subject: l neoprism.r: init --- lass/1systems/neoprism/config.nix | 25 ++++++++ lass/1systems/neoprism/disk.nix | 116 ++++++++++++++++++++++++++++++++++++ lass/1systems/neoprism/physical.nix | 42 +++++++++++++ 3 files changed, 183 insertions(+) create mode 100644 lass/1systems/neoprism/config.nix create mode 100644 lass/1systems/neoprism/disk.nix create mode 100644 lass/1systems/neoprism/physical.nix (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix new file mode 100644 index 000000000..e4f9d2560 --- /dev/null +++ b/lass/1systems/neoprism/config.nix @@ -0,0 +1,25 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + + + + { # TODO make new hfos.nix out of this vv + users.users.riot = { + uid = pkgs.stockholm.lib.genid_uint31 "riot"; + isNormalUser = true; + extraGroups = [ "libvirtd" ]; + openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" + ]; + }; + # krebs.iptables.tables.filter.FORWARD.rules = [ + # { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } + # { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } + # ]; + } + ]; + + krebs.build.host = config.krebs.hosts.neoprism; +} diff --git a/lass/1systems/neoprism/disk.nix b/lass/1systems/neoprism/disk.nix new file mode 100644 index 000000000..cf9a8cef4 --- /dev/null +++ b/lass/1systems/neoprism/disk.nix @@ -0,0 +1,116 @@ +{ lib, ... }: +{ + disk = (lib.genAttrs [ "/dev/nvme0n1" "/dev/nvme1n1" ] (disk: { + type = "disk"; + device = disk; + content = { + type = "table"; + format = "gpt"; + partitions = [ + { + name = "boot"; + type = "partition"; + start = "0"; + end = "1M"; + part-type = "primary"; + flags = ["bios_grub"]; + } + { + type = "partition"; + name = "ESP"; + start = "1M"; + end = "1GiB"; + fs-type = "fat32"; + bootable = true; + content = { + type = "mdraid"; + name = "boot"; + }; + } + { + type = "partition"; + name = "zfs"; + start = "1GiB"; + end = "100%"; + content = { + type = "zfs"; + pool = "zroot"; + }; + } + ]; + }; + })) // { + hdd1 = { + type = "disk"; + device = "/dev/sda"; + content = { + type = "zfs"; + pool = "tank"; + }; + }; + }; + mdadm = { + boot = { + type = "mdadm"; + level = 1; + metadata = "1.0"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + }; + zpool = { + zroot = { + type = "zpool"; + mode = "mirror"; + mountpoint = "/"; + rootFsOptions = { + }; + datasets.reserved = { + zfs_type = "filesystem"; + options.refreservation = "1G"; + }; + }; + tank = { + type = "zpool"; + datasets = { + reserved = { + zfs_type = "filesystem"; + options.refreservation = "1G"; + }; + containers = { + zfs_type = "filesystem"; + mountpoint = "/var/lib/containers"; + }; + home = { + zfs_type = "filesystem"; + mountpoint = "/home"; + }; + srv = { + zfs_type = "filesystem"; + mountpoint = "/srv"; + }; + libvirt = { + zfs_type = "filesystem"; + mountpoint = "/var/lib/libvirt"; + }; + # encrypted = { + # zfs_type = "filesystem"; + # options = { + # mountpoint = "none"; + # encryption = "aes-256-gcm"; + # keyformat = "passphrase"; + # keylocation = "prompt"; + # }; + # }; + + # "encrypted/download" = { + # zfs_type = "filesystem"; + # mountpoint = "/var/download"; + # }; + }; + }; + }; +} diff --git a/lass/1systems/neoprism/physical.nix b/lass/1systems/neoprism/physical.nix new file mode 100644 index 000000000..4ffb749f1 --- /dev/null +++ b/lass/1systems/neoprism/physical.nix @@ -0,0 +1,42 @@ +{ config, lib, pkgs, ... }: + +{ + + imports = [ + ./config.nix + + ]; + + disko.devices = import ./disk.nix; + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.efiSupport = true; + boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ]; + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ]; + boot.kernelModules = [ "kvm-amd" ]; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + + # networking config + boot.kernelParams = [ "net.ifnames=0" ]; + networking.bridges."ext-br".interfaces = [ "eth0" ]; + networking = { + hostId = "2283aaae"; + defaultGateway = "95.217.192.1"; + defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; }; + # Use google's public DNS server + nameservers = [ "8.8.8.8" ]; + interfaces.ext-br.ipv4.addresses = [ + { + address = "95.217.192.59"; + prefixLength = 26; + } + ]; + interfaces.ext-br.ipv6.addresses = [ + { + address = "2a01:4f9:4a:4f1a::1"; + prefixLength = 64; + } + ]; + }; + +} -- cgit v1.2.3 From cc29be2d206e1093e036ef619c08e6d536257760 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Wed, 28 Dec 2022 19:06:08 +0100 Subject: l yellow.r: move to new deno port --- lass/1systems/yellow/config.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index f5071c4b7..52d7a0f1f 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -136,7 +136,15 @@ with import ; }; }; - systemd.services.bruellwuerfel = { + systemd.services.bruellwuerfel = + let + bruellwuerfelSrc = pkgs.fetchFromGitHub { + owner = "krebs"; + repo = "bruellwuerfel"; + rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015"; + sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd"; + }; + in { wantedBy = [ "multi-user.target" ]; environment = { IRC_CHANNEL = "#flix"; @@ -145,7 +153,7 @@ with import ; IRC_HISTORY_FILE = "/tmp/bruelli.history"; }; serviceConfig = { - ExecStart = "${pkgs.bruellwuerfel}/bin/bruellwuerfel"; + ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts"; }; }; -- cgit v1.2.3 From 2ebbec1f2d9c16fe084abba87718d0f60e61bf88 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 30 Dec 2022 21:34:05 +0100 Subject: krebs.iptables: precedence -> mkOrder --- lass/1systems/green/config.nix | 2 +- lass/1systems/neoprism/config.nix | 4 ++-- lass/1systems/prism/config.nix | 20 ++++++++++---------- 3 files changed, 13 insertions(+), 13 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/green/config.nix b/lass/1systems/green/config.nix index 4c98091f1..cd38c3585 100644 --- a/lass/1systems/green/config.nix +++ b/lass/1systems/green/config.nix @@ -57,7 +57,7 @@ with import ; ]; krebs.iptables.tables.nat.PREROUTING.rules = [ - { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; } + { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; } ]; # workaround for ssh access from yubikey via android diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index e4f9d2560..89ad8cfdc 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -15,8 +15,8 @@ ]; }; # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } + # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } + # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } # ]; } ]; diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index 594a21c02..c2a405759 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -33,9 +33,9 @@ with import ; "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" ]; }; - krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } + krebs.iptables.tables.filter.FORWARD.rules = mkBefore [ + { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } + { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } ]; } { @@ -227,13 +227,13 @@ with import ; imports = [ ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } - { v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; } + krebs.iptables.tables.nat.PREROUTING.rules = mkOrder 999 [ + { v6 = false; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } + { v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; } ]; - krebs.iptables.tables.filter.FORWARD.rules = [ - { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } + krebs.iptables.tables.filter.FORWARD.rules = mkBefore [ + { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } + { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ { v4 = false; predicate = "-s 42:1::/32 ! -d 42:1::/48"; target = "MASQUERADE"; } @@ -252,7 +252,7 @@ with import ; } { krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";} + { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } ]; } -- cgit v1.2.3 From 767c6fbd14fc8e5eb73cea2f738af88083fcea32 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 01:23:42 +0100 Subject: l yellow.r: move to neoprism, refactor --- lass/1systems/neoprism/config.nix | 3 +- lass/1systems/yellow/config.nix | 105 +++++++++++++++++++++++++++++++++----- 2 files changed, 93 insertions(+), 15 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index 89ad8cfdc..b7bf7afb2 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,7 +4,8 @@ imports = [ - + + { # TODO make new hfos.nix out of this vv users.users.riot = { uid = pkgs.stockholm.lib.genid_uint31 "riot"; diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ecf0337ed..552dd7f00 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,20 +9,23 @@ in { krebs.build.host = config.krebs.hosts.yellow; + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; + }; + users.groups.download.members = [ "transmission" ]; networking.useHostResolvConf = false; networking.useNetworkd = true; - systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; - systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { enable = true; + home = "/var/state/transmission"; group = "download"; downloadDirPermissions = "775"; settings = { - download-dir = "/var/download/finished"; - incomplete-dir = "/var/download/incoming"; - incomplete-dir-enable = true; + download-dir = "/var/download/transmission"; + incomplete-dir-enabled = false; rpc-bind-address = "::"; message-level = 1; umask = 18; @@ -40,11 +43,8 @@ in { }; virtualHosts.default = { default = true; - locations."/dl".extraConfig = '' - return 301 /; - ''; locations."/" = { - root = "/var/download/finished"; + root = "/var/download"; extraConfig = '' fancyindex on; fancyindex_footer "/fancy.html"; @@ -136,6 +136,58 @@ in { ''}; ''; }; + virtualHosts."jelly.r" = { + locations."/".extraConfig = '' + proxy_pass http://localhost:8096/; + proxy_set_header Accept-Encoding ""; + ''; + }; + }; + + services.samba = { + enable = true; + enableNmbd = false; + extraConfig = '' + workgroup = WORKGROUP + server string = ${config.networking.hostName} + # only allow retiolum addresses + hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 + + # Use sendfile() for performance gain + use sendfile = true + + # No NetBIOS is needed + disable netbios = true + + # Only mangle non-valid NTFS names, don't care about DOS support + mangled names = illegal + + # Performance optimizations + socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 + + # Disable all printing + load printers = false + disable spoolss = true + printcap name = /dev/null + + map to guest = Bad User + max log size = 50 + dns proxy = no + security = user + + [global] + syslog only = yes + ''; + shares.public = { + comment = "Warez"; + path = "/var/download"; + public = "yes"; + "only guest" = "yes"; + "create mask" = "0644"; + "directory mask" = "2777"; + writable = "no"; + printable = "no"; + }; }; systemd.services.bruellwuerfel = @@ -164,14 +216,33 @@ in { tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web - { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin + { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr + { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr + { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + + # smbd + { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; } ]; tables.filter.OUTPUT = { policy = "DROP"; rules = [ + { predicate = "-o lo"; target = "ACCEPT"; } { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } @@ -279,7 +350,7 @@ in { ExecStart = pkgs.writers.writeDash "flix-index" '' set -efu - DIR=/var/download/finished + DIR=/var/download cd "$DIR" while inotifywait -rq -e create -e move -e delete "$DIR"; do find . -type f > "$DIR"/index.tmp @@ -294,9 +365,15 @@ in { group = "download"; }; - services.magnetico = { + services.radarr = { + enable = true; + }; + + services.sonarr = { + enable = true; + }; + + services.prowlarr = { enable = true; - web.address = "0.0.0.0"; - web.port = 9092; }; } -- cgit v1.2.3 From 7cb49c556efce96b15b28807464b8d5cdf1ea999 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 18:33:44 +0100 Subject: l neoprism.r: add riot container --- lass/1systems/neoprism/config.nix | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index b7bf7afb2..f203abc07 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -6,20 +6,7 @@ - { # TODO make new hfos.nix out of this vv - users.users.riot = { - uid = pkgs.stockholm.lib.genid_uint31 "riot"; - isNormalUser = true; - extraGroups = [ "libvirtd" ]; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" - ]; - }; - # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } - # ]; - } + ]; krebs.build.host = config.krebs.hosts.neoprism; -- cgit v1.2.3 From 6f0cd02c8c78545899fa4afeeeacd68a365349de Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 21:00:29 +0100 Subject: l: prism-mount -> yellow-mount --- lass/1systems/coaxmetal/config.nix | 2 +- lass/1systems/shodan/config.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix index dd8308bbd..2c88b68cc 100644 --- a/lass/1systems/coaxmetal/config.nix +++ b/lass/1systems/coaxmetal/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix index ef538f339..5e48c216a 100644 --- a/lass/1systems/shodan/config.nix +++ b/lass/1systems/shodan/config.nix @@ -16,7 +16,7 @@ - + -- cgit v1.2.3 From 0b2952f4ed9572521f7c4a21904943ac33c602b0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 6 Jan 2023 12:17:04 +0100 Subject: l radio.r: init --- lass/1systems/radio/config.nix | 24 ++++++++++++++++++++++++ lass/1systems/radio/physical.nix | 7 +++++++ 2 files changed, 31 insertions(+) create mode 100644 lass/1systems/radio/config.nix create mode 100644 lass/1systems/radio/physical.nix (limited to 'lass/1systems') diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix new file mode 100644 index 000000000..2fd23a448 --- /dev/null +++ b/lass/1systems/radio/config.nix @@ -0,0 +1,24 @@ +with import ; +{ config, lib, pkgs, ... }: +{ + imports = [ + + + + + + + ]; + + krebs.build.host = config.krebs.hosts.radio; + + security.acme = { + acceptTerms = true; + defaults.email = "acme@lassul.us"; + }; + + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt"; + }; +} diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/radio/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +} -- cgit v1.2.3 From ed18792d602c8b8138f6d6e35984f2dc8d335e13 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 21:42:03 +0100 Subject: l prism.r: use radio.r instead of running radio locally --- lass/1systems/prism/config.nix | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'lass/1systems') diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index c2a405759..bcc8c1a08 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -97,9 +97,35 @@ with import ; localAddress = "10.233.2.2"; }; } + { + services.nginx.virtualHosts."radio.lassul.us" = { + enableACME = true; + addSSL = true; + locations."/" = { + # recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://radio.r"; + extraConfig = '' + proxy_set_header Host radio.r; + # get source ip for weather reports + proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr"; + ''; + }; + }; + krebs.htgen.radio-redirect = { + port = 8000; + scriptFile = pkgs.writers.writeDash "redir" '' + printf 'HTTP/1.1 301 Moved Permanently\r\n' + printf "Location: http://radio.lassul.us''${Request_URI}\r\n" + printf '\r\n' + ''; + }; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; } + ]; + } - -- cgit v1.2.3 From 917889f8fcd9a6f4659dc46047d063333c2bb2a9 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 23:35:39 +0100 Subject: l neoprism.r: host radio.r container --- lass/1systems/neoprism/config.nix | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index f203abc07..8e5a60c36 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,8 +4,13 @@ imports = [ + + # sync-containers + + + # other containers ]; -- cgit v1.2.3 From 4228b378c46db684ce0a33253bb51a5869a2ed23 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 09:45:53 +0100 Subject: l yellow.r: add rada.r and sona.r aliases --- lass/1systems/yellow/config.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'lass/1systems') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 552dd7f00..a89b7dd76 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -142,6 +142,16 @@ in { proxy_set_header Accept-Encoding ""; ''; }; + virtualHosts."rada.r" = { + locations."/" = { + proxyPass = "http://localhost:7878"; + }; + }; + virtualHosts."sona.r" = { + locations."/" = { + proxyPass = "http://localhost:8989"; + }; + }; }; services.samba = { -- cgit v1.2.3 From c199c376fcbe6049b2d4c3fa9530b31d4e655bb0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 09:51:45 +0100 Subject: l sona.r, rada.r: proxy websockets --- lass/1systems/yellow/config.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lass/1systems') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index a89b7dd76..923654d9e 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -144,11 +144,13 @@ in { }; virtualHosts."rada.r" = { locations."/" = { + proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; virtualHosts."sona.r" = { locations."/" = { + proxyWebsockets = true; proxyPass = "http://localhost:8989"; }; }; -- cgit v1.2.3 From a6fae292ee20386d3c9eb4210ee7f304a6c230bd Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 12:04:44 +0100 Subject: l: {son,rad}a.r -> {son,rad}ar.r --- lass/1systems/yellow/config.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 923654d9e..484a7f5dc 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -142,13 +142,13 @@ in { proxy_set_header Accept-Encoding ""; ''; }; - virtualHosts."rada.r" = { + virtualHosts."radar.r" = { locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; - virtualHosts."sona.r" = { + virtualHosts."sonar.r" = { locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:8989"; -- cgit v1.2.3 From 23b2047c80b222ef1c59d70b25697c6624792d19 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 12:35:37 +0100 Subject: l yellow.r: add bazarr for subtitles --- lass/1systems/yellow/config.nix | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'lass/1systems') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 484a7f5dc..72e2e0e85 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -234,6 +234,7 @@ in { { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr # smbd { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } @@ -379,13 +380,20 @@ in { services.radarr = { enable = true; + group = "download"; }; services.sonarr = { enable = true; + group = "download"; }; services.prowlarr = { enable = true; }; + + services.bazarr = { + enable = true; + group = "download"; + }; } -- cgit v1.2.3 From 2818476f710410f1c752ce12becce10be0a8a293 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 9 Jan 2023 20:37:40 +0100 Subject: l yellow.r: add acme ssl to yellow.r, radar.r and sonar.r --- lass/1systems/yellow/config.nix | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'lass/1systems') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 72e2e0e85..06561e9cf 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -34,6 +34,12 @@ in { }; }; + security.acme.defaults.email = "spam@krebsco.de"; + security.acme.acceptTerms = true; + security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL; services.nginx = { enable = true; package = pkgs.nginx.override { @@ -41,8 +47,10 @@ in { fancyindex ]; }; - virtualHosts.default = { + virtualHosts."yellow.r" = { default = true; + enableACME = true; + addSSL = true; locations."/" = { root = "/var/download"; extraConfig = '' @@ -137,18 +145,24 @@ in { ''; }; virtualHosts."jelly.r" = { + enableACME = true; + addSSL = true; locations."/".extraConfig = '' proxy_pass http://localhost:8096/; proxy_set_header Accept-Encoding ""; ''; }; virtualHosts."radar.r" = { + enableACME = true; + addSSL = true; locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; virtualHosts."sonar.r" = { + enableACME = true; + addSSL = true; locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:8989"; @@ -227,6 +241,7 @@ in { enable = true; tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir + { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic -- cgit v1.2.3