From c337e2593b9b28c4248cffc07edf530351df491f Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 25 Dec 2022 01:08:39 +0100 Subject: l mors.r: add autotether --- lass/1systems/mors/config.nix | 1 + lass/2configs/autotether.nix | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 lass/2configs/autotether.nix (limited to 'lass') diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix index dd479f267..6d0d177ec 100644 --- a/lass/1systems/mors/config.nix +++ b/lass/1systems/mors/config.nix @@ -41,6 +41,7 @@ with import ; # # + { krebs.iptables.tables.filter.INPUT.rules = [ #risk of rain diff --git a/lass/2configs/autotether.nix b/lass/2configs/autotether.nix new file mode 100644 index 000000000..98712303e --- /dev/null +++ b/lass/2configs/autotether.nix @@ -0,0 +1,16 @@ +{ config, lib, pkgs, ... }: +{ + systemd.services.usb_tether = { + script = '' + ${pkgs.android-tools}/bin/adb -s QV770FAMEK wait-for-device + ${pkgs.android-tools}/bin/adb -s QV770FAMEK shell svc usb setFunctions rndis + ''; + }; + services.udev.extraRules = '' + ACTION=="add", SUBSYSTEM=="usb", ENV{PRODUCT}=="fce/320d/510", TAG+="systemd", ENV{SYSTEMD_WANTS}="usb_tether.service" + ''; + systemd.network.networks.android = { + matchConfig.Name = "enp0s20u1"; + DHCP = "yes"; + }; +} -- cgit v1.3.1 From ea9dbc8caf3111f80cc94de51eb6d6dace05e3c4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 27 Dec 2022 12:20:42 +0100 Subject: types host: remove cores --- kartei/krebs/default.nix | 5 ----- kartei/lass/blue.nix | 1 - kartei/lass/coaxmetal.nix | 1 - kartei/lass/daedalus.nix | 1 - kartei/lass/dishfire.nix | 1 - kartei/lass/echelon.nix | 1 - kartei/lass/green.nix | 1 - kartei/lass/hilum.nix | 1 - kartei/lass/icarus.nix | 1 - kartei/lass/lasspi.nix | 1 - kartei/lass/littleT.nix | 1 - kartei/lass/massulus.nix | 1 - kartei/lass/mors.nix | 1 - kartei/lass/prism.nix | 1 - kartei/lass/shodan.nix | 1 - kartei/lass/skynet.nix | 1 - kartei/lass/styx.nix | 1 - kartei/lass/xerxes.nix | 1 - kartei/lass/yellow.nix | 1 - kartei/makefu/default.nix | 18 ------------------ kartei/others/default.nix | 3 --- kartei/tv/default.nix | 9 --------- krebs/0tests/data/test-config.nix | 1 - krebs/5pkgs/simple/generate-secrets/default.nix | 1 - lass/2configs/default.nix | 1 - lass/5pkgs/l-gen-secrets/default.nix | 1 - lib/types.nix | 3 --- makefu/2configs/tools/init-host/default.nix | 1 - 28 files changed, 61 deletions(-) (limited to 'lass') diff --git a/kartei/krebs/default.nix b/kartei/krebs/default.nix index e5626d923..7419ba13f 100644 --- a/kartei/krebs/default.nix +++ b/kartei/krebs/default.nix @@ -15,7 +15,6 @@ with import ../../lib; "test-all-krebs-modules" ] (name: { inherit name; - cores = 1; nets = { retiolum = { ip4.addr = "10.243.73.57"; @@ -36,7 +35,6 @@ in { hosts = mapAttrs hostDefaults ({ filebitch = { ci = true; - cores = 4; nets = { shack = { ip4 = { @@ -134,7 +132,6 @@ in { ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHl5cDF9QheXyMlNYIX17ILbgd94K50fZy7w0fDLvZlo "; }; onebutton = { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.0.101"; @@ -163,7 +160,6 @@ in { ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcZg+iLaPZ0SpLM+nANxIjZC/RIsansjyutK0+gPhIe "; }; ponte = { - cores = 1; owner = config.krebs.users.krebs; extraZones = { "krebsco.de" = /* bindzone */ '' @@ -212,7 +208,6 @@ in { }; puyak = { ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.77.2"; diff --git a/kartei/lass/blue.nix b/kartei/lass/blue.nix index b26e7fba6..ddec9553d 100644 --- a/kartei/lass/blue.nix +++ b/kartei/lass/blue.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.0.77"; diff --git a/kartei/lass/coaxmetal.nix b/kartei/lass/coaxmetal.nix index 80d49dd97..d32f279fe 100644 --- a/kartei/lass/coaxmetal.nix +++ b/kartei/lass/coaxmetal.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 16; nets = { retiolum = { ip4.addr = "10.243.0.17"; diff --git a/kartei/lass/daedalus.nix b/kartei/lass/daedalus.nix index 3033178ae..891cbd293 100644 --- a/kartei/lass/daedalus.nix +++ b/kartei/lass/daedalus.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; nets = rec { retiolum = { ip4.addr = "10.243.133.115"; diff --git a/kartei/lass/dishfire.nix b/kartei/lass/dishfire.nix index a76d76e83..548320584 100644 --- a/kartei/lass/dishfire.nix +++ b/kartei/lass/dishfire.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 4; nets = rec { internet = { ip4 = rec { diff --git a/kartei/lass/echelon.nix b/kartei/lass/echelon.nix index cc38ccb1a..d66033ba4 100644 --- a/kartei/lass/echelon.nix +++ b/kartei/lass/echelon.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.0.3"; diff --git a/kartei/lass/green.nix b/kartei/lass/green.nix index 7623533b5..1c5d0aead 100644 --- a/kartei/lass/green.nix +++ b/kartei/lass/green.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.0.66"; diff --git a/kartei/lass/hilum.nix b/kartei/lass/hilum.nix index ce24a916c..27fd0620a 100644 --- a/kartei/lass/hilum.nix +++ b/kartei/lass/hilum.nix @@ -1,7 +1,6 @@ { r6, w6, ... }: { consul = false; - cores = 1; nets = { retiolum = { ip4.addr = "10.243.20.123"; diff --git a/kartei/lass/icarus.nix b/kartei/lass/icarus.nix index c9c7fc410..c19d4e15c 100644 --- a/kartei/lass/icarus.nix +++ b/kartei/lass/icarus.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; nets = rec { retiolum = { ip4.addr = "10.243.133.114"; diff --git a/kartei/lass/lasspi.nix b/kartei/lass/lasspi.nix index 3461e8f34..aab44bc5e 100644 --- a/kartei/lass/lasspi.nix +++ b/kartei/lass/lasspi.nix @@ -1,7 +1,6 @@ { r6, w6, ... }: { consul = false; - cores = 1; nets = { retiolum = { ip4.addr = "10.243.1.89"; diff --git a/kartei/lass/littleT.nix b/kartei/lass/littleT.nix index 10e3a62e2..297d2dc62 100644 --- a/kartei/lass/littleT.nix +++ b/kartei/lass/littleT.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; nets = { retiolum = { ip4.addr = "10.243.133.77"; diff --git a/kartei/lass/massulus.nix b/kartei/lass/massulus.nix index 39e3254f7..6876e02b9 100644 --- a/kartei/lass/massulus.nix +++ b/kartei/lass/massulus.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 1; ci = false; nets = { retiolum = { diff --git a/kartei/lass/mors.nix b/kartei/lass/mors.nix index f912e5c02..c483fe5a3 100644 --- a/kartei/lass/mors.nix +++ b/kartei/lass/mors.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; nets = { retiolum = { ip4.addr = "10.243.0.2"; diff --git a/kartei/lass/prism.nix b/kartei/lass/prism.nix index 06fbdda16..c7965debf 100644 --- a/kartei/lass/prism.nix +++ b/kartei/lass/prism.nix @@ -1,6 +1,5 @@ { config, krebs, r6, w6, ... }: rec { - cores = 4; extraZones = { "krebsco.de" = '' cache 60 IN A ${nets.internet.ip4.addr} diff --git a/kartei/lass/shodan.nix b/kartei/lass/shodan.nix index 0f6080709..50ab86e6e 100644 --- a/kartei/lass/shodan.nix +++ b/kartei/lass/shodan.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; nets = { retiolum = { ip4.addr = "10.243.0.4"; diff --git a/kartei/lass/skynet.nix b/kartei/lass/skynet.nix index da7434e5e..2109d2e35 100644 --- a/kartei/lass/skynet.nix +++ b/kartei/lass/skynet.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; nets = rec { retiolum = { ip4.addr = "10.243.133.116"; diff --git a/kartei/lass/styx.nix b/kartei/lass/styx.nix index 6c0b98075..0b13c1184 100644 --- a/kartei/lass/styx.nix +++ b/kartei/lass/styx.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.11.1"; diff --git a/kartei/lass/xerxes.nix b/kartei/lass/xerxes.nix index 94fbc78d4..96f619a70 100644 --- a/kartei/lass/xerxes.nix +++ b/kartei/lass/xerxes.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 2; consul = false; nets = rec { retiolum = { diff --git a/kartei/lass/yellow.nix b/kartei/lass/yellow.nix index 99a9eb35e..ebf824950 100644 --- a/kartei/lass/yellow.nix +++ b/kartei/lass/yellow.nix @@ -1,6 +1,5 @@ { r6, w6, ... }: { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.0.14"; diff --git a/kartei/makefu/default.nix b/kartei/makefu/default.nix index ecb834bbf..bf49a1766 100644 --- a/kartei/makefu/default.nix +++ b/kartei/makefu/default.nix @@ -58,21 +58,18 @@ with import ../../lib; in { hosts = mapAttrs hostDefaults { cake = rec { - cores = 4; ci = false; nets = { retiolum.ip4.addr = "10.243.136.236"; }; }; crapi = rec { # raspi1 - cores = 1; ci = false; nets = { retiolum.ip4.addr = "10.243.136.237"; }; }; firecracker = { - cores = 4; nets = { retiolum.ip4.addr = "10.243.12.12"; }; @@ -80,28 +77,24 @@ in { studio = rec { ci = false; - cores = 4; nets = { retiolum.ip4.addr = "10.243.227.163"; }; }; fileleech = rec { ci = false; - cores = 4; nets = { retiolum.ip4.addr = "10.243.113.98"; }; }; tsp = { ci = true; - cores = 1; nets = { retiolum.ip4.addr = "10.243.0.212"; }; }; x = { ci = true; - cores = 4; syncthing.id = "OA36OF6-JEFCUJQ-OEYVTMH-DPCACQI-3AJRE5G-BFVMOUG-RPYJQE3-4ZCUWA5"; nets = { retiolum.ip4.addr = "10.243.0.91"; @@ -113,7 +106,6 @@ in { }; filepimp = rec { ci = false; - cores = 1; nets = { retiolum.ip4.addr = "10.243.153.102"; }; @@ -121,7 +113,6 @@ in { omo = rec { ci = true; - cores = 2; syncthing.id = "Y5OTK3S-JOJLAUU-KTBXKUW-M7S5UEQ-MMQPUK2-7CXO5V6-NOUDLKP-PRGAFAK"; nets = { retiolum = { @@ -139,7 +130,6 @@ in { }; wbob = rec { ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.214.15"; @@ -164,7 +154,6 @@ in { latte.euer IN A ${nets.internet.ip4.addr} ''; }; - cores = 4; nets = rec { internet = { ip4.addr = "178.254.30.202"; @@ -246,7 +235,6 @@ in { music.euer IN A ${nets.internet.ip4.addr} ''; }; - cores = 8; nets = rec { internet = { ip4.addr = "142.132.189.140"; @@ -302,7 +290,6 @@ in { sdev = rec { ci = true; - cores = 1; nets = { retiolum.ip4.addr = "10.243.83.237"; }; @@ -312,7 +299,6 @@ in { # non-stockholm flap = rec { - cores = 1; extraZones = { "krebsco.de" = '' flap IN A ${nets.internet.ip4.addr} @@ -332,7 +318,6 @@ in { }; nukular = rec { - cores = 1; nets = { retiolum = { ip4.addr = "10.243.231.219"; @@ -342,17 +327,14 @@ in { shackdev = rec { # router@shack - cores = 1; nets.wiregrill.ip4.addr = "10.244.245.2"; }; rockit = rec { # router@home - cores = 1; nets.wiregrill.ip4.addr = "10.244.245.3"; }; senderechner = rec { - cores = 2; nets = { retiolum = { ip4.addr = "10.243.0.163"; diff --git a/kartei/others/default.nix b/kartei/others/default.nix index f3ea8b80c..de0bd2f7f 100644 --- a/kartei/others/default.nix +++ b/kartei/others/default.nix @@ -43,7 +43,6 @@ in { }; }; horisa = { - cores = 2; owner = config.krebs.users.ulrich; # main laptop nets = { retiolum = { @@ -57,7 +56,6 @@ in { }; }; hasegateway = { - cores = 1; owner = config.krebs.users.hase; nets = { #internet = { @@ -343,7 +341,6 @@ in { }; }; tpsw = { - cores = 2; owner = config.krebs.users.ciko; # main laptop nets = { retiolum = { diff --git a/kartei/tv/default.nix b/kartei/tv/default.nix index f7e86c598..005c26e88 100644 --- a/kartei/tv/default.nix +++ b/kartei/tv/default.nix @@ -40,7 +40,6 @@ in { hosts = mapAttrs evalHost { alnus = { ci = true; - cores = 2; nets = { retiolum = { ip4.addr = "10.243.21.1"; @@ -64,7 +63,6 @@ in { }; au = { ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.13.39"; @@ -89,7 +87,6 @@ in { }; bu = { ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.13.36"; @@ -138,7 +135,6 @@ in { }; mu = { ci = true; - cores = 2; nets = { retiolum = { ip4.addr = "10.243.20.1"; @@ -230,7 +226,6 @@ in { }; nomic = { ci = true; - cores = 2; nets = { retiolum = { ip4.addr = "10.243.0.110"; @@ -256,7 +251,6 @@ in { }; wu = { ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.13.37"; @@ -282,7 +276,6 @@ in { }; querel = { ci = true; - cores = 2; nets = { retiolum = { ip4.addr = "10.243.22.22"; @@ -313,7 +306,6 @@ in { pubkey = "xu-1:pYRENvaxZqGeImwLA9qHmRwHV4jfKaYx4u1VcZ31x0s="; }; ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.13.38"; @@ -339,7 +331,6 @@ in { }; zu = { ci = true; - cores = 4; nets = { retiolum = { ip4.addr = "10.243.13.40"; diff --git a/krebs/0tests/data/test-config.nix b/krebs/0tests/data/test-config.nix index f0927ddd9..33cb01245 100644 --- a/krebs/0tests/data/test-config.nix +++ b/krebs/0tests/data/test-config.nix @@ -8,7 +8,6 @@ ]; krebs.hosts.minimal = { - cores = 1; secure = false; }; diff --git a/krebs/5pkgs/simple/generate-secrets/default.nix b/krebs/5pkgs/simple/generate-secrets/default.nix index f9a7450f7..a3c9f67c5 100644 --- a/krebs/5pkgs/simple/generate-secrets/default.nix +++ b/krebs/5pkgs/simple/generate-secrets/default.nix @@ -23,7 +23,6 @@ pkgs.writers.writeDashBin "generate-secrets" '' cat <; ]; networking.hostName = config.krebs.build.host.name; - nix.maxJobs = config.krebs.build.host.cores; krebs = { enable = true; diff --git a/lass/5pkgs/l-gen-secrets/default.nix b/lass/5pkgs/l-gen-secrets/default.nix index d999a4334..6cb60eaa1 100644 --- a/lass/5pkgs/l-gen-secrets/default.nix +++ b/lass/5pkgs/l-gen-secrets/default.nix @@ -25,7 +25,6 @@ pkgs.writeDashBin "l-gen-secrets" '' cat < Date: Tue, 27 Dec 2022 22:57:16 +0100 Subject: l l-gen-secrets: refactor, add tinc ed25519 & tor --- lass/5pkgs/l-gen-secrets/default.nix | 102 ++++++++++++++++++++++------------- 1 file changed, 64 insertions(+), 38 deletions(-) (limited to 'lass') diff --git a/lass/5pkgs/l-gen-secrets/default.nix b/lass/5pkgs/l-gen-secrets/default.nix index 6cb60eaa1..b6e565245 100644 --- a/lass/5pkgs/l-gen-secrets/default.nix +++ b/lass/5pkgs/l-gen-secrets/default.nix @@ -1,56 +1,82 @@ { pkgs }: -pkgs.writeDashBin "l-gen-secrets" '' - HOSTNAME="$1" +pkgs.writers.writeDashBin "l-gen-secrets" '' + set -efu + HOSTNAME=$1 TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d) + if [ "''${DRYRUN-n}" = "n" ]; then + trap 'rm -rf $TMPDIR' EXIT + else + echo "$TMPDIR" + set -x + fi + mkdir -p $TMPDIR/out + PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1) HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null + # ssh ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null - ${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null - ${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null - ${pkgs.wireguard-tools}/bin/wg genkey > $TMPDIR/wiregrill.key - ${pkgs.coreutils}/bin/cat $TMPDIR/wiregrill.key | ${pkgs.wireguard-tools}/bin/wg pubkey > $TMPDIR/wiregrill.pub - cat < $TMPDIR/hashedPasswords.nix + ${pkgs.coreutils}/bin/mv $TMPDIR/ssh.id_ed25519 $TMPDIR/out/ + + # tor + ${pkgs.coreutils}/bin/timeout 1 ${pkgs.tor}/bin/tor --HiddenServiceDir $TMPDIR/tor --HiddenServicePort 1 --SocksPort 0 || : + ${pkgs.coreutils}/bin/mv $TMPDIR/tor/hs_ed25519_secret_key $TMPDIR/out/ssh-tor.priv + + # tinc + ${pkgs.coreutils}/bin/mkdir -p $TMPDIR/tinc + ${pkgs.tinc_pre}/bin/tinc --config $TMPDIR/tinc generate-keys 4096 $TMPDIR/out/wiregrill.key + ${pkgs.coreutils}/bin/cat $TMPDIR/out/wiregrill.key | ${pkgs.wireguard-tools}/bin/wg pubkey > $TMPDIR/wiregrill.pub + + # system passwords + cat < $TMPDIR/out/hashedPasswords.nix { root = "$HASHED_PASSWORD"; mainUser = "$HASHED_PASSWORD"; } EOF - cd $TMPDIR - for x in *; do - ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null - done - echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/pass > /dev/null + set +f + if [ "''${DRYRUN-n}" = "n" ]; then + cd $TMPDIR/out + for x in *; do + ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null + done + echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/pass > /dev/null + ${pkgs.coreutils}/bin/cat $TMPDIR/tor/hostname | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/torname > /dev/null + fi + set -f cat <; - ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)"; }; + ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)"; + } EOF - - rm -rf $TMPDIR '' - -- cgit v1.3.1 From 351667fe85202192fdc442ce22dd5e75aa844598 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 11:18:24 +0100 Subject: l-gen-secrets: fix key indent --- lass/5pkgs/l-gen-secrets/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lass') diff --git a/lass/5pkgs/l-gen-secrets/default.nix b/lass/5pkgs/l-gen-secrets/default.nix index b6e565245..27e59bb96 100644 --- a/lass/5pkgs/l-gen-secrets/default.nix +++ b/lass/5pkgs/l-gen-secrets/default.nix @@ -19,7 +19,7 @@ pkgs.writers.writeDashBin "l-gen-secrets" '' ${pkgs.coreutils}/bin/mv $TMPDIR/ssh.id_ed25519 $TMPDIR/out/ # tor - ${pkgs.coreutils}/bin/timeout 1 ${pkgs.tor}/bin/tor --HiddenServiceDir $TMPDIR/tor --HiddenServicePort 1 --SocksPort 0 || : + ${pkgs.coreutils}/bin/timeout 1 ${pkgs.tor}/bin/tor --HiddenServiceDir $TMPDIR/tor --HiddenServicePort 1 --SocksPort 0 >/dev/null || : ${pkgs.coreutils}/bin/mv $TMPDIR/tor/hs_ed25519_secret_key $TMPDIR/out/ssh-tor.priv # tinc @@ -62,7 +62,7 @@ pkgs.writers.writeDashBin "l-gen-secrets" '' "$HOSTNAME.r" ]; tinc.pubkey = ${"''"} - $(cat $TMPDIR/tinc/rsa_key.pub | sed 's/^/ /') + $(cat $TMPDIR/tinc/rsa_key.pub | sed 's/^/ /') ${"''"}; tinc.pubkey_ed25519 = "$(cat $TMPDIR/tinc/ed25519_key.pub | ${pkgs.gnused}/bin/sed 's/.* = //')"; }; -- cgit v1.3.1 From adc11cf679970da26f82e5200f2ea2a94c59e8be Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 11:18:54 +0100 Subject: l neoprism.r: init --- kartei/lass/neoprism.nix | 38 ++++++++++++ lass/1systems/neoprism/config.nix | 25 ++++++++ lass/1systems/neoprism/disk.nix | 116 ++++++++++++++++++++++++++++++++++++ lass/1systems/neoprism/physical.nix | 42 +++++++++++++ 4 files changed, 221 insertions(+) create mode 100644 kartei/lass/neoprism.nix create mode 100644 lass/1systems/neoprism/config.nix create mode 100644 lass/1systems/neoprism/disk.nix create mode 100644 lass/1systems/neoprism/physical.nix (limited to 'lass') diff --git a/kartei/lass/neoprism.nix b/kartei/lass/neoprism.nix new file mode 100644 index 000000000..74b8aca3c --- /dev/null +++ b/kartei/lass/neoprism.nix @@ -0,0 +1,38 @@ +{ r6, w6, ... }: +{ + nets = { + retiolum = { + ip4.addr = "10.243.0.99"; + ip6.addr = r6 "99"; + aliases = [ + "neoprism.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAwQiPQT9XQkeAIMohNhIVH1Er73LS36JQu/bokNSAlgRjiHfmWVQw + hpmI0hO5ewI/HSxVH8MqITTjj8fp5+TOY5rxb3qj9SKGmoDpENw7g7BJsrpydu8+ + hdvC4btCibAeTeaNqubPMoJLnwuh7NJ9ucYAcRU24FI6qR/Q973a3rzWYBfPd4w9 + +Lq3ltFE4m6eLiL4ruQGR9Fc4HOJshJlUDUovGIC/98Fu468OuCaka4fR/IXD13O + khc5LfAzm2PLuD25YZRjw27Pv3txYOWzb9ZfI8BS+7WUg1nKPDVZErvj97OouqVH + binDgKLdLsamJgi+BrZs9uoxmXK9b459B3J6z4/d8dXTAW/cczqsODzsJnvw8IEE + u45Pm3sY49vmnNsVhDEIPad3ZDitgeWW6UVBR+EJHp+r1TZ8eLaeUTdV6x3zIrHv + dkobgI/0ynujSeMVzXA8cRDuLLVz0CwvNQ9FWzciZw4prOPjUDeSaOlIISOD4q8O + u/jRfaIzPuQNyQN/0B9gUacHOGkQ3sZ33gFt1j6YdfjWnHn2Ddxm99nXfYUo82oC + tEMui/7Vtj5G9dqDCzEacECvKqNVY2MRq5gpX+X5IwSbNc/vmykqhuDB5fzZWXRD + AmRfNCsuFCw3EehPWkdH9JJxysBa52sAB387CL44bJ2rfRglTAKZYNUCAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + tinc.pubkey_ed25519 = "/k2/hpq3XdSKfPPSAolfIx/AUgtKNF6kgv+WRTKtMqG"; + }; + wiregrill = { + ip6.addr = w6 "99"; + aliases = [ + "neoprism.w" + ]; + wireguard.pubkey = '' + lhMJvEZOREjCSS3BbBxel0dJ3Mxjj0m82sUXqyYlUx0= + ''; + }; + }; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEljpF/rqA2o9CcZny8Kdg1Ij9JmHsmuS/ii+HS5T7rW "; +} diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix new file mode 100644 index 000000000..e4f9d2560 --- /dev/null +++ b/lass/1systems/neoprism/config.nix @@ -0,0 +1,25 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + + + + { # TODO make new hfos.nix out of this vv + users.users.riot = { + uid = pkgs.stockholm.lib.genid_uint31 "riot"; + isNormalUser = true; + extraGroups = [ "libvirtd" ]; + openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" + ]; + }; + # krebs.iptables.tables.filter.FORWARD.rules = [ + # { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } + # { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } + # ]; + } + ]; + + krebs.build.host = config.krebs.hosts.neoprism; +} diff --git a/lass/1systems/neoprism/disk.nix b/lass/1systems/neoprism/disk.nix new file mode 100644 index 000000000..cf9a8cef4 --- /dev/null +++ b/lass/1systems/neoprism/disk.nix @@ -0,0 +1,116 @@ +{ lib, ... }: +{ + disk = (lib.genAttrs [ "/dev/nvme0n1" "/dev/nvme1n1" ] (disk: { + type = "disk"; + device = disk; + content = { + type = "table"; + format = "gpt"; + partitions = [ + { + name = "boot"; + type = "partition"; + start = "0"; + end = "1M"; + part-type = "primary"; + flags = ["bios_grub"]; + } + { + type = "partition"; + name = "ESP"; + start = "1M"; + end = "1GiB"; + fs-type = "fat32"; + bootable = true; + content = { + type = "mdraid"; + name = "boot"; + }; + } + { + type = "partition"; + name = "zfs"; + start = "1GiB"; + end = "100%"; + content = { + type = "zfs"; + pool = "zroot"; + }; + } + ]; + }; + })) // { + hdd1 = { + type = "disk"; + device = "/dev/sda"; + content = { + type = "zfs"; + pool = "tank"; + }; + }; + }; + mdadm = { + boot = { + type = "mdadm"; + level = 1; + metadata = "1.0"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + }; + zpool = { + zroot = { + type = "zpool"; + mode = "mirror"; + mountpoint = "/"; + rootFsOptions = { + }; + datasets.reserved = { + zfs_type = "filesystem"; + options.refreservation = "1G"; + }; + }; + tank = { + type = "zpool"; + datasets = { + reserved = { + zfs_type = "filesystem"; + options.refreservation = "1G"; + }; + containers = { + zfs_type = "filesystem"; + mountpoint = "/var/lib/containers"; + }; + home = { + zfs_type = "filesystem"; + mountpoint = "/home"; + }; + srv = { + zfs_type = "filesystem"; + mountpoint = "/srv"; + }; + libvirt = { + zfs_type = "filesystem"; + mountpoint = "/var/lib/libvirt"; + }; + # encrypted = { + # zfs_type = "filesystem"; + # options = { + # mountpoint = "none"; + # encryption = "aes-256-gcm"; + # keyformat = "passphrase"; + # keylocation = "prompt"; + # }; + # }; + + # "encrypted/download" = { + # zfs_type = "filesystem"; + # mountpoint = "/var/download"; + # }; + }; + }; + }; +} diff --git a/lass/1systems/neoprism/physical.nix b/lass/1systems/neoprism/physical.nix new file mode 100644 index 000000000..4ffb749f1 --- /dev/null +++ b/lass/1systems/neoprism/physical.nix @@ -0,0 +1,42 @@ +{ config, lib, pkgs, ... }: + +{ + + imports = [ + ./config.nix + + ]; + + disko.devices = import ./disk.nix; + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.efiSupport = true; + boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ]; + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ]; + boot.kernelModules = [ "kvm-amd" ]; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + + # networking config + boot.kernelParams = [ "net.ifnames=0" ]; + networking.bridges."ext-br".interfaces = [ "eth0" ]; + networking = { + hostId = "2283aaae"; + defaultGateway = "95.217.192.1"; + defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; }; + # Use google's public DNS server + nameservers = [ "8.8.8.8" ]; + interfaces.ext-br.ipv4.addresses = [ + { + address = "95.217.192.59"; + prefixLength = 26; + } + ]; + interfaces.ext-br.ipv6.addresses = [ + { + address = "2a01:4f9:4a:4f1a::1"; + prefixLength = 64; + } + ]; + }; + +} -- cgit v1.3.1 From 5c6815ff41d04a460e5e35cf34639fb34185e65f Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 11:19:37 +0100 Subject: l install-system: init helper script to install systems --- lass/5pkgs/install-system/default.nix | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 lass/5pkgs/install-system/default.nix (limited to 'lass') diff --git a/lass/5pkgs/install-system/default.nix b/lass/5pkgs/install-system/default.nix new file mode 100644 index 000000000..9a392e669 --- /dev/null +++ b/lass/5pkgs/install-system/default.nix @@ -0,0 +1,26 @@ +{ pkgs }: +pkgs.writers.writeDashBin "install-system" '' + set -efux + SYSTEM=$1 + TARGET=$2 + # format + if ! (sshn "$TARGET" -- mountpoint /mnt); then + nix run github:numtide/nixos-remote -- --stop-after-disko --store-paths "$(nix-build --no-out-link -I stockholm="$HOME"/sync/stockholm -I nixos-config="$HOME"/sync/stockholm/lass/1systems/"$SYSTEM"/physical.nix '' -A config.system.build.diskoNoDeps)" /dev/null "$TARGET" + fi + + # install dependencies + sshn "$TARGET" << SSH + nix-channel --update + nix-env -iA nixos.git + SSH + + # populate + $(nix-build --no-out-link "$HOME"/sync/stockholm/lass/krops.nix -A populate --argstr name "$SYSTEM" --argstr target "$TARGET"/mnt/var/src --arg force true) + + # install + sshn "$TARGET" << SSH + ln -s /mnt/var/src /var/src + NIXOS_CONFIG=/var/src/nixos-config nixos-install --no-root-password -I /var/src + zpool export -fa + SSH +'' -- cgit v1.3.1 From cc29be2d206e1093e036ef619c08e6d536257760 Mon Sep 17 00:00:00 2001 From: Kierán Meinhardt Date: Wed, 28 Dec 2022 19:06:08 +0100 Subject: l yellow.r: move to new deno port --- lass/1systems/yellow/config.nix | 12 ++++++++++-- lass/5pkgs/bruellwuerfel/default.nix | 26 -------------------------- 2 files changed, 10 insertions(+), 28 deletions(-) delete mode 100644 lass/5pkgs/bruellwuerfel/default.nix (limited to 'lass') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index f5071c4b7..52d7a0f1f 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -136,7 +136,15 @@ with import ; }; }; - systemd.services.bruellwuerfel = { + systemd.services.bruellwuerfel = + let + bruellwuerfelSrc = pkgs.fetchFromGitHub { + owner = "krebs"; + repo = "bruellwuerfel"; + rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015"; + sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd"; + }; + in { wantedBy = [ "multi-user.target" ]; environment = { IRC_CHANNEL = "#flix"; @@ -145,7 +153,7 @@ with import ; IRC_HISTORY_FILE = "/tmp/bruelli.history"; }; serviceConfig = { - ExecStart = "${pkgs.bruellwuerfel}/bin/bruellwuerfel"; + ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts"; }; }; diff --git a/lass/5pkgs/bruellwuerfel/default.nix b/lass/5pkgs/bruellwuerfel/default.nix deleted file mode 100644 index cb8f08fa8..000000000 --- a/lass/5pkgs/bruellwuerfel/default.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ yarn2nix-moretea, fetchFromGitHub, nodePackages, nodejs }: let - #src = ~/src/bruellwuerfel; - src = fetchFromGitHub { - owner = "krebs"; - repo = "bruellwuerfel"; - rev = "57e20e630f732ce4e15b495ec5f9bf72a121b959"; - sha256 = "08zwwl24sq21r497a03lqpy2x10az8frrsh6d38xm92snd1yf85b"; - }; - -in yarn2nix-moretea.mkYarnModules rec { - pname = "bruellwuerfel"; - version = "1.0"; - name = "${pname}-${version}"; - packageJSON = "${src}/package.json"; - yarnLock = "${src}/yarn.lock"; - postBuild = '' - cp -r ${src}/{src,tsconfig.json} $out/ - cd $out - ${nodePackages.typescript}/bin/tsc || : - mkdir -p $out/bin - echo '#!/bin/sh' > $out/bin/bruellwuerfel - echo "export NODE_PATH=$out/dist" >> $out/bin/bruellwuerfel - echo "${nodejs}/bin/node $out/dist/index.js" >> $out/bin/bruellwuerfel - chmod +x $out/bin/bruellwuerfel - ''; -} -- cgit v1.3.1 From 4ca3c828984c1ebe73fa6145592d1a5293e30ae8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 20:39:12 +0100 Subject: l retiolum: use networkd --- lass/2configs/retiolum.nix | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'lass') diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix index b8c9d4f8d..746bc069d 100644 --- a/lass/2configs/retiolum.nix +++ b/lass/2configs/retiolum.nix @@ -27,6 +27,15 @@ LocalDiscovery = no ''} ''; + tincUp = lib.mkIf config.systemd.network.enable ""; + }; + + systemd.network.networks.retiolum = { + matchConfig.Name = "retiolum"; + address = [ + "${config.krebs.build.host.nets.retiolum.ip4.addr}/16" + "${config.krebs.build.host.nets.retiolum.ip6.addr}/16" + ]; }; nixpkgs.config.packageOverrides = pkgs: { -- cgit v1.3.1 From e2ff8598a61a7ebd99e87de888f0d12d096c0b12 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 20:39:23 +0100 Subject: l wiregrill: use networkd --- lass/2configs/wiregrill.nix | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'lass') diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix index 54257d2c4..ba6358ab7 100644 --- a/lass/2configs/wiregrill.nix +++ b/lass/2configs/wiregrill.nix @@ -23,6 +23,13 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { { precedence = 1000; predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } { precedence = 1000; predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } ]; + systemd.network.networks.wiregrill = { + matchConfig.Name = "wiregrill"; + address = + (optional (!isNull self.ip4) "${self.ip4.addr}/16") ++ + (optional (!isNull self.ip6) "${self.ip6.addr}/48") + ; + }; networking.wireguard.interfaces.wiregrill = { ips = -- cgit v1.3.1 From 0a3e56ddf7f267cac008ab5421d796816d0ed2fa Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 21:41:00 +0100 Subject: l c-base: use networkd --- lass/2configs/c-base.nix | 188 ++++++++++++++++++++++++++--------------------- 1 file changed, 103 insertions(+), 85 deletions(-) (limited to 'lass') diff --git a/lass/2configs/c-base.nix b/lass/2configs/c-base.nix index 3e533fb74..a8dd3dd1d 100644 --- a/lass/2configs/c-base.nix +++ b/lass/2configs/c-base.nix @@ -1,97 +1,115 @@ { config, lib, pkgs, ... }: let - inherit (import ) genid; - in { - users.extraUsers = { - cbasevpn = rec { - name = "cbasevpn"; - uid = genid "cbasevpn"; - description = "user for running c-base openvpn"; - home = "/home/${name}"; - }; - }; - - users.extraGroups.cbasevpn.gid = genid "cbasevpn"; - environment.systemPackages = [ pkgs.cifs-utils ]; - services.openvpn.servers = { - c-base = { - config = '' - client - dev tap - proto tcp - remote vpn.ext.c-base.org 1194 - resolv-retry infinite - nobind - user cbasevpn - group cbasevpn - persist-key - persist-tun - - auth-nocache - #auth-user-pass - auth-user-pass ${toString } - - comp-lzo - verb 3 - - #script-security 2 - #up /etc/openvpn/update-resolv-conf - #down /etc/openvpn/update-resolv-conf - - - -----BEGIN CERTIFICATE----- - MIIDUjCCArugAwIBAgIJAOOk8EXgjsf5MA0GCSqGSIb3DQEBBQUAMHoxCzAJBgNV - BAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZj - LWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJ - ARYQYWRtYXhAYy1iYXNlLm9yZzAeFw0wOTAyMTMwOTE1MzdaFw0xOTAyMTEwOTE1 - MzdaMHoxCzAJBgNVBAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGlu - MQ8wDQYDVQQKEwZjLWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEf - MB0GCSqGSIb3DQEJARYQYWRtYXhAYy1iYXNlLm9yZzCBnzANBgkqhkiG9w0BAQEF - AAOBjQAwgYkCgYEAt3wEgXbqFKxs8z/E4rv13hkRi6J+QdshNzntm7rTOmUsXKE7 - IEwoJSglrmsDPv4UqE86A7bjW7YYSFjhzxFRkTEHJanyOCF48ZPItVl7Eq7T81co - uR+6lAhxnLDrwnPJCC83NzAa6lw8U1DsQRDkayKlrQrtZq6++pFFEvZvt1cCAwEA - AaOB3zCB3DAdBgNVHQ4EFgQUqkSbdXS90+HtqXDeAI+PcyTSSHEwgawGA1UdIwSB - pDCBoYAUqkSbdXS90+HtqXDeAI+PcyTSSHGhfqR8MHoxCzAJBgNVBAYTAkRFMQsw - CQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZjLWJhc2UxGzAZ - BgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhA - Yy1iYXNlLm9yZ4IJAOOk8EXgjsf5MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF - BQADgYEAOBANG1H4uEEWk3sbeQoSMeA3LFG1+6MgFGk2WAdeHYuV9GKYBq6/PLP5 - ffw+FNkiDjLSeSQO88vHYJr2V1v8n/ZoCIT+1VBcDWXTpGz0YxDI1iBauO3tUPzK - wGs46RA/S0YwiZw64MaUHd88ZVadjKy9kNoO3w6/vpAS6s/Mh+o= - -----END CERTIFICATE----- - - key-direction 1 - - # - # 2048 bit OpenVPN static key - # - -----BEGIN OpenVPN Static key V1----- - 5d49aa8c9cec18de7ab6e0b5cd09a368 - d3f1b8b77e055e448804fa0e14f487cb - 491681742f96b54a23fb8639aa9ed14e - c40b86a5546b888c4f3873f23c956e87 - 169076ec869127ffc85353fd5928871c - da19776b79f723abb366fae6cdfe4ad6 - 7ef667b7d05a7b78dfd5ea1d2da276dc - 5f6c82313fe9c1178c7256b8d1d081b0 - 4c80bc8f21add61fbc52c158579edc1d - bbde230afb9d0e531624ce289a17098a - 3261f9144a9a2a6f0da4250c9eed4086 - 187ec6fa757a454de743a349e32af193 - e9f8b49b010014bdfb3240d992f2f234 - 581d0ce05d4e07a2b588ad9b0555b704 - 9d5edc28efde59226ec8942feed690a1 - 2acd0c8bc9424d6074d0d495391023b6 - -----END OpenVPN Static key V1----- - - ''; + systemd.network.networks.c-base = { + matchConfig.Name = "c-base"; + networkConfig = { + IgnoreCarrierLoss = "3s"; + KeepConfiguration = "static"; + DNS = "10.0.1.254"; + Domains = "cbrp3.c-base.org"; }; + routes = [ + { routeConfig = { + Destination = "10.0.1.0/24"; + Gateway = "172.31.77.1"; + };} + { routeConfig = { + Destination = "91.102.9.99/32"; # vorstand.c-base.org + Gateway = "172.31.77.1"; + };} + ]; + }; + services.openvpn.servers.c-base = { + config = '' + remote vpn.ext.c-base.org 1194 + verify-x509-name vpn.ext.c-base.org name + client + proto udp + dev-type tun + dev c-base + resolv-retry infinite + nobind + # user openvpn + # group openvpn + persist-key + persist-tun + comp-lzo + # register-dns + # block-outside-dns + script-security 2 + auth-user-pass ${toString } + #auth-user-pass + key-direction 1 + + # + # 2048 bit OpenVPN static key + # + -----BEGIN OpenVPN Static key V1----- + 54a66ed1048bed7508703347e89d68d6 + 5586e6a5d1218cf8675941031d540be6 + 993e07200a16ad3b770b659932ee71e5 + f8080b5c9fa2acb3893abd40fad2552c + fdaf17565e617ae450efcccf5652dca5 + a16419509024b075941098731eb25ac0 + a64f963ece3dca1d2a64a9c5e17839d7 + 5b5080165a9b2dc90ef111879d7d3173 + 2d1027ae42d869394aca08da4472a9d0 + 6b724b4ed43a957feef7d6dfc86da241 + 74828fa0e1240941586f0d937cac32fc + 13cc81e7bed58817353d6afaff7e6a26 + 4f9cc086af79c1cdca660d86e18cff96 + 69dd3d392caf09a468894a8504f4cc7c + 7ae0072e6d9ad90b166ad13a39c57b3c + 3a869e27a1d89deb161c255227551713 + -----END OpenVPN Static key V1----- + + + -----BEGIN CERTIFICATE----- + MIIGsDCCBJigAwIBAgIJAPkM1l2zA306MA0GCSqGSIb3DQEBCwUAMIGWMQswCQYD + VQQGEwJERTEPMA0GA1UEBxMGQmVybGluMRswGQYDVQQLExJ2cG4uZXh0LmMtYmFz + ZS5vcmcxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEbMBkGA1UEKRMSdnBu + LmV4dC5jLWJhc2Uub3JnMR8wHQYJKoZIhvcNAQkBFhBhZG1heEBjLWJhc2Uub3Jn + MB4XDTE2MDcwOTE4MjkyMFoXDTI2MDcxMDE4MjkyMFowgZYxCzAJBgNVBAYTAkRF + MQ8wDQYDVQQHEwZCZXJsaW4xGzAZBgNVBAsTEnZwbi5leHQuYy1iYXNlLm9yZzEb + MBkGA1UEAxMSdnBuLmV4dC5jLWJhc2Uub3JnMRswGQYDVQQpExJ2cG4uZXh0LmMt + YmFzZS5vcmcxHzAdBgkqhkiG9w0BCQEWEGFkbWF4QGMtYmFzZS5vcmcwggIiMA0G + CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXEs+uWCXLNmm+lgP9x7u3FqWa4pPI + h64c6EWIULMATrhEw+Ej4fpCXwU9otFaO04fAeJmZGkDcnAYdBDiCeI0luOSdj44 + Bg9KecSei/TskqjhDVnEBp65hiz0rZE6c1baPdLYmD5xrXWb3i0zrlBYFawuL6C2 + lwVCEm3cadvkDJ2DleMuu3NblV8ViIDN0HZqzJNP72g1I0MgohkpetACXlf7MzQV + PFHfzvb04Rj2lJ8BDhceQ0WmjtVV/Ag6nka5oi954OeHMujRuH+rZYiQZDZpJLHK + Kh1KWTVlWPRy+AvCi9lweDWSmLccq7Ug4xMtDF4I5qW3tjCd0xqpZ21Xmo2JyKtY + 4h8wEDPqiJvgwvkXsH17GLn5ZxiMcQuRJQYZqJephkzR9uccJeWSS76kwm/vLqG3 + +eORlYnyjiNXtiMIhmAEFjpWUrGH8v4CijpUNP6E63ynGrRVXK684YQXkqL+xPAt + t6dsMBUwf94a2S1o2kgvuRCim1wlHvf1QsHrO/Hwgpzc8no/daWL+Z9Rq9okTHNK + nc1G5dv8TkmxIDYnLm07QMzzBoOT36BcGtkEBA+0xhQlX5PyQdM5/jnZVhdSBmoP + MbZXPoU/gJAIuuBuwdTlgCzYf44/9/YU/AnW8eLrbhm9KtMtoMpatrWorKqk/GPv + /lGNRQuNffrbiQIDAQABo4H+MIH7MB0GA1UdDgQWBBTf5cYbK+KCF9u9aobFlLbu + ilwX4jCBywYDVR0jBIHDMIHAgBTf5cYbK+KCF9u9aobFlLbuilwX4qGBnKSBmTCB + ljELMAkGA1UEBhMCREUxDzANBgNVBAcTBkJlcmxpbjEbMBkGA1UECxMSdnBuLmV4 + dC5jLWJhc2Uub3JnMRswGQYDVQQDExJ2cG4uZXh0LmMtYmFzZS5vcmcxGzAZBgNV + BCkTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhAYy1i + YXNlLm9yZ4IJAPkM1l2zA306MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQAD + ggIBAMs1moiS7UZ4neOivQjqwKrBbm1j3tgmPLhDfNMmXYarGhnBGAlLxLAQWtG+ + Fnbx8KcsJnrsWcGfZcst1z45S4a5oBdVNKOfgkMOG0glZorIDO8Odrb51rpyzU0v + 0wcNumMNWhkFuo2OTBHPnnJIWEAFwwCCSCL0I0hQxxoaV36kphjuIwzrMJhd+XAT + 24En58cNp6sPRDd+FzOH08uFINevyzKWYxkMgVj+e3fbuiyOB8RqvndKvtfBBcpB + cCO86lGnj/ETMDciTczUShxaMn9wV1zr1KH1xvT3ohUeOcQZGbGTcjG4mxlns8ZO + U5J3Yrcd1eMfJq9Bwd3zPsTLnT8LwIS8vfYRav9b34XdqcBG73dhrjsicMK0Qy0z + Qz7vKJzcvrEnKuaMyB3mCxz/UvbNc2Bupwm4FmzN5eFjDs+7paYFdfOzqMjoRP+8 + bcXSqDN5P2eUd7cdsZXaFNcsf1FkWlE3GudVBOmNJqz9zBab/T5J+l4Z90Pd6OUX + GNozEvLhcJkvPKA526TegHTGC8hMquxKc9tpOzNRqZJMFa+UG1mgMrMepRmM/B3s + QrKI1C11iCVYfb9J0tQUkfENHMx4J7mG2DZAhnKWQDU2awM41qU4A7aBYaJvDPnQ + RRcbaT0D794lKUQwH/mZuyKzF22oZNk1o1TV2SaFXqgX5tDt + -----END CERTIFICATE----- + + ''; }; } -- cgit v1.3.1 From 2ebbec1f2d9c16fe084abba87718d0f60e61bf88 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 30 Dec 2022 21:34:05 +0100 Subject: krebs.iptables: precedence -> mkOrder --- krebs/3modules/iptables.nix | 8 +------ lass/1systems/green/config.nix | 2 +- lass/1systems/neoprism/config.nix | 4 ++-- lass/1systems/prism/config.nix | 20 ++++++++--------- lass/2configs/AP.nix | 4 ++-- lass/2configs/container-networking.nix | 4 ++-- lass/2configs/default.nix | 40 +++++++++++++++++++--------------- lass/2configs/gg23.nix | 4 ++-- lass/2configs/hfos.nix | 24 ++++++++++---------- lass/2configs/libvirt.nix | 4 ++-- lass/2configs/wiregrill.nix | 14 ++++++------ 11 files changed, 64 insertions(+), 64 deletions(-) (limited to 'lass') diff --git a/krebs/3modules/iptables.nix b/krebs/3modules/iptables.nix index 7007090c0..052dad9c6 100644 --- a/krebs/3modules/iptables.nix +++ b/krebs/3modules/iptables.nix @@ -43,10 +43,6 @@ let target = mkOption { type = str; }; - precedence = mkOption { - type = int; - default = 0; - }; v4 = mkOption { type = bool; default = true; @@ -145,13 +141,11 @@ let buildChain = tn: cn: let filteredRules = filter (r: r."${v}") ts."${tn}"."${cn}".rules; - sortedRules = sort (a: b: a.precedence > b.precedence) filteredRules; - in #TODO: double check should be unneccessary, refactor! if ts.${tn}.${cn}.rules or null != null then concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([] - ++ map (buildRule tn cn) sortedRules + ++ map (buildRule tn cn) filteredRules ) else "" diff --git a/lass/1systems/green/config.nix b/lass/1systems/green/config.nix index 4c98091f1..cd38c3585 100644 --- a/lass/1systems/green/config.nix +++ b/lass/1systems/green/config.nix @@ -57,7 +57,7 @@ with import ; ]; krebs.iptables.tables.nat.PREROUTING.rules = [ - { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; } + { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; } ]; # workaround for ssh access from yubikey via android diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index e4f9d2560..89ad8cfdc 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -15,8 +15,8 @@ ]; }; # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } + # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } + # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } # ]; } ]; diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index 594a21c02..c2a405759 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -33,9 +33,9 @@ with import ; "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" ]; }; - krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } + krebs.iptables.tables.filter.FORWARD.rules = mkBefore [ + { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } + { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } ]; } { @@ -227,13 +227,13 @@ with import ; imports = [ ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } - { v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; } + krebs.iptables.tables.nat.PREROUTING.rules = mkOrder 999 [ + { v6 = false; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } + { v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; } ]; - krebs.iptables.tables.filter.FORWARD.rules = [ - { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } + krebs.iptables.tables.filter.FORWARD.rules = mkBefore [ + { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } + { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ { v4 = false; predicate = "-s 42:1::/32 ! -d 42:1::/48"; target = "MASQUERADE"; } @@ -252,7 +252,7 @@ with import ; } { krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";} + { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } ]; } diff --git a/lass/2configs/AP.nix b/lass/2configs/AP.nix index dfffbfdf9..e38475381 100644 --- a/lass/2configs/AP.nix +++ b/lass/2configs/AP.nix @@ -68,8 +68,8 @@ in { { v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; } { v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; } ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; precedence = 1000; } + krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ + { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ #TODO find out what this is about? diff --git a/lass/2configs/container-networking.nix b/lass/2configs/container-networking.nix index f04e4342d..0cfe193d9 100644 --- a/lass/2configs/container-networking.nix +++ b/lass/2configs/container-networking.nix @@ -8,8 +8,8 @@ { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; } { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; } ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; predicate = "-s 10.233.2.0/24"; target = "ACCEPT"; precedence = 1000; } + krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [ + { v6 = false; predicate = "-s 10.233.2.0/24"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; } diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index e649c0dea..3d7188dc6 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -189,28 +189,34 @@ with import ; enable = true; tables = { nat.PREROUTING.rules = [ - { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; } - { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; } - { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; } - { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; } + { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; } + { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; } + { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; } ]; nat.OUTPUT.rules = [ - { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; } + { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; } ]; filter.INPUT.policy = "DROP"; filter.FORWARD.policy = "DROP"; - filter.INPUT.rules = [ - { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";} - { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; } - { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; } - { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; precedence = 10000; } - { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; } - { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; } - { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; } - { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; } - { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; } - { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; } - { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; } + filter.INPUT.rules = mkMerge [ + (mkBefore [ + { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } + { predicate = "-p icmp"; target = "ACCEPT"; } + { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; } + { predicate = "-i lo"; target = "ACCEPT"; } + { predicate = "-p tcp --dport 22"; target = "ACCEPT"; } + ]) + (mkOrder 1000 [ + { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; } + ]) + (mkAfter [ + { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; } + { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; } + { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; } + ]) ]; }; }; diff --git a/lass/2configs/gg23.nix b/lass/2configs/gg23.nix index 89ccae408..6bcbd7400 100644 --- a/lass/2configs/gg23.nix +++ b/lass/2configs/gg23.nix @@ -56,8 +56,8 @@ with import ; { v6 = false; predicate = "-o int0"; target = "REJECT --reject-with icmp-port-unreachable"; } { v6 = false; predicate = "-i int0"; target = "REJECT --reject-with icmp-port-unreachable"; } ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; precedence = 1000; } + krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ + { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ { v6 = false; predicate = "-s 10.42.0.0/24 ! -d 10.42.0.0/24"; target = "MASQUERADE"; } diff --git a/lass/2configs/hfos.nix b/lass/2configs/hfos.nix index f8dd2f0d2..9dafe086c 100644 --- a/lass/2configs/hfos.nix +++ b/lass/2configs/hfos.nix @@ -18,22 +18,22 @@ with import ; } ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; } - { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; } - { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; } - { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; } + krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ + { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; } + { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; } + { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; } + { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; } ]; - krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } - { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } - { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } - { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } + krebs.iptables.tables.filter.FORWARD.rules = mkBefore [ + { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } + { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } + { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } + { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } ]; - krebs.iptables.tables.nat.OUTPUT.rules = [ - { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; } + krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [ + { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; } ]; # TODO use bridge interfaces instead of this crap diff --git a/lass/2configs/libvirt.nix b/lass/2configs/libvirt.nix index d391e0d7b..6d07c7a77 100644 --- a/lass/2configs/libvirt.nix +++ b/lass/2configs/libvirt.nix @@ -20,8 +20,8 @@ krebs.iptables.tables.filter.OUTPUT.rules = [ { v6 = false; predicate = "-o virbr0 -p udp -m udp --dport 68"; target = "ACCEPT"; } ]; - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; precedence = 1000; } + krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [ + { v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; } ]; krebs.iptables.tables.nat.POSTROUTING.rules = [ { v6 = false; predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; target = "RETURN"; } diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix index ba6358ab7..a27e99ee2 100644 --- a/lass/2configs/wiregrill.nix +++ b/lass/2configs/wiregrill.nix @@ -16,13 +16,13 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; } ]; - krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [ - { precedence = 1000; predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - ]; + krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [ + { predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; } + { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } + { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } + { predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } + { predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } + ]); systemd.network.networks.wiregrill = { matchConfig.Name = "wiregrill"; address = -- cgit v1.3.1 From 8a04a15a7b812ad8c7aac1ae987ac2e970f4c0ae Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 30 Dec 2022 23:36:50 +0100 Subject: l sync-containers3: use networkd --- lass/3modules/sync-containers3.nix | 66 +++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 37 deletions(-) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 1371d5233..c04a7758b 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -64,7 +64,6 @@ in { privateNetwork = true; hostBridge = "ctr0"; bindMounts = { - "/etc/resolv.conf".hostPath = "/etc/resolv.conf"; "/var/lib/self/disk" = { hostPath = "/var/lib/sync-containers3/${ctr.name}/disk"; isReadOnly = false; @@ -257,44 +256,26 @@ in { }) (lib.mkIf (cfg.containers != {}) { # networking - networking.networkmanager.unmanaged = [ "ctr0" ]; - networking.interfaces.dummy0.virtual = true; - networking.bridges.ctr0.interfaces = [ "dummy0" ]; - networking.interfaces.ctr0.ipv4.addresses = [{ - address = "10.233.0.1"; - prefixLength = 24; - }]; - systemd.services."dhcpd-ctr0" = { - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - serviceConfig = { - Type = "forking"; - Restart = "always"; - DynamicUser = true; - StateDirectory = "dhcpd-ctr0"; - User = "dhcpd-ctr0"; - Group = "dhcpd-ctr0"; - AmbientCapabilities = [ - "CAP_NET_RAW" # to send ICMP messages - "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67) - ]; - ExecStartPre = "${pkgs.coreutils}/bin/touch /var/lib/dhcpd-ctr0/dhcpd.leases"; - ExecStart = "${pkgs.dhcp}/bin/dhcpd -4 -lf /var/lib/dhcpd-ctr0/dhcpd.leases -cf ${pkgs.writeText "dhpd.conf" '' - default-lease-time 600; - max-lease-time 7200; - authoritative; - ddns-update-style interim; - log-facility local1; # see dhcpd.nix - - option subnet-mask 255.255.255.0; - option routers 10.233.0.1; - # option domain-name-servers 8.8.8.8; # TODO configure dns server - subnet 10.233.0.0 netmask 255.255.255.0 { - range 10.233.0.10 10.233.0.250; - } - ''} ctr0"; + systemd.network.networks.ctr0 = { + name = "ctr0"; + address = [ + "10.233.0.1/24" + ]; + networkConfig = { + IPForward = "yes"; + IPMasquerade = "both"; + ConfigureWithoutCarrier = true; + DHCPServer = "yes"; }; }; + systemd.network.netdevs.ctr0.netdevConfig = { + Kind = "bridge"; + Name = "ctr0"; + }; + networking.networkmanager.unmanaged = [ "ctr0" ]; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-i ctr0"; target = "ACCEPT"; } + ]; }) (lib.mkIf cfg.inContainer.enable { users.groups.container_sync = {}; @@ -308,6 +289,17 @@ in { cfg.inContainer.pubkey ]; }; + + networking.useHostResolvConf = false; + networking.useNetworkd = true; + systemd.network = { + enable = true; + networks.eth0 = { + matchConfig.Name = "eth0"; + DHCP = "yes"; + dhcpV4Config.UseDNS = true; + }; + }; }) ]; } -- cgit v1.3.1 From 3918ad6cf863646d4f27aabfa9e1cd28a612df47 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 30 Dec 2022 23:37:04 +0100 Subject: l sync-containers3: add rsync timeout --- lass/3modules/sync-containers3.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index c04a7758b..16e04d743 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -100,7 +100,7 @@ in { set -efux if /run/wrappers/bin/ping -c 1 ${ctr.name}.r; then touch "$HOME"/incomplete - rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --inplace container_sync@${ctr.name}.r:disk "$HOME"/disk + rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --timeout=30 --inplace container_sync@${ctr.name}.r:disk "$HOME"/disk rm "$HOME"/incomplete fi ''} -- cgit v1.3.1 From 4591d70e1c4478325f41c57bad8f2eeed4e1d722 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 30 Dec 2022 23:37:46 +0100 Subject: l sync-containers3: don't start if consul fails --- lass/3modules/sync-containers3.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 16e04d743..1a006835d 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -135,7 +135,8 @@ in { ;; 200) # echo 'got 200 from kv, will check payload' - export payload=$(consul kv get containers/${ctr.name}) + payload=$(consul kv get containers/${ctr.name}) || continue + export payload if [ "$(jq -rn 'env.payload | fromjson.host')" = '${config.networking.hostName}' ]; then # echo 'we are the host, trying to reach container' if $(retry -t 10 -d 10 -- /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null); then -- cgit v1.3.1 From 767c6fbd14fc8e5eb73cea2f738af88083fcea32 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 01:23:42 +0100 Subject: l yellow.r: move to neoprism, refactor --- kartei/lass/prism.nix | 1 - kartei/lass/yellow.nix | 1 + lass/1systems/neoprism/config.nix | 3 +- lass/1systems/yellow/config.nix | 105 +++++++++++++++++++++++++++++++++----- lass/2configs/yellow-host.nix | 14 +++++ 5 files changed, 108 insertions(+), 16 deletions(-) create mode 100644 lass/2configs/yellow-host.nix (limited to 'lass') diff --git a/kartei/lass/prism.nix b/kartei/lass/prism.nix index c7965debf..029216f88 100644 --- a/kartei/lass/prism.nix +++ b/kartei/lass/prism.nix @@ -66,7 +66,6 @@ rec { "cgit.prism.r" "bota.r" "flix.r" - "jelly.r" "paste.r" "c.r" "p.r" diff --git a/kartei/lass/yellow.nix b/kartei/lass/yellow.nix index ebf824950..a62c6167c 100644 --- a/kartei/lass/yellow.nix +++ b/kartei/lass/yellow.nix @@ -6,6 +6,7 @@ ip6.addr = r6 "3110"; aliases = [ "yellow.r" + "jelly.r" ]; tinc = { pubkey = '' diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index 89ad8cfdc..b7bf7afb2 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,7 +4,8 @@ imports = [ - + + { # TODO make new hfos.nix out of this vv users.users.riot = { uid = pkgs.stockholm.lib.genid_uint31 "riot"; diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ecf0337ed..552dd7f00 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,20 +9,23 @@ in { krebs.build.host = config.krebs.hosts.yellow; + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; + }; + users.groups.download.members = [ "transmission" ]; networking.useHostResolvConf = false; networking.useNetworkd = true; - systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; - systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { enable = true; + home = "/var/state/transmission"; group = "download"; downloadDirPermissions = "775"; settings = { - download-dir = "/var/download/finished"; - incomplete-dir = "/var/download/incoming"; - incomplete-dir-enable = true; + download-dir = "/var/download/transmission"; + incomplete-dir-enabled = false; rpc-bind-address = "::"; message-level = 1; umask = 18; @@ -40,11 +43,8 @@ in { }; virtualHosts.default = { default = true; - locations."/dl".extraConfig = '' - return 301 /; - ''; locations."/" = { - root = "/var/download/finished"; + root = "/var/download"; extraConfig = '' fancyindex on; fancyindex_footer "/fancy.html"; @@ -136,6 +136,58 @@ in { ''}; ''; }; + virtualHosts."jelly.r" = { + locations."/".extraConfig = '' + proxy_pass http://localhost:8096/; + proxy_set_header Accept-Encoding ""; + ''; + }; + }; + + services.samba = { + enable = true; + enableNmbd = false; + extraConfig = '' + workgroup = WORKGROUP + server string = ${config.networking.hostName} + # only allow retiolum addresses + hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 + + # Use sendfile() for performance gain + use sendfile = true + + # No NetBIOS is needed + disable netbios = true + + # Only mangle non-valid NTFS names, don't care about DOS support + mangled names = illegal + + # Performance optimizations + socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 + + # Disable all printing + load printers = false + disable spoolss = true + printcap name = /dev/null + + map to guest = Bad User + max log size = 50 + dns proxy = no + security = user + + [global] + syslog only = yes + ''; + shares.public = { + comment = "Warez"; + path = "/var/download"; + public = "yes"; + "only guest" = "yes"; + "create mask" = "0644"; + "directory mask" = "2777"; + writable = "no"; + printable = "no"; + }; }; systemd.services.bruellwuerfel = @@ -164,14 +216,33 @@ in { tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web - { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin + { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr + { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr + { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + + # smbd + { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; } ]; tables.filter.OUTPUT = { policy = "DROP"; rules = [ + { predicate = "-o lo"; target = "ACCEPT"; } { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } @@ -279,7 +350,7 @@ in { ExecStart = pkgs.writers.writeDash "flix-index" '' set -efu - DIR=/var/download/finished + DIR=/var/download cd "$DIR" while inotifywait -rq -e create -e move -e delete "$DIR"; do find . -type f > "$DIR"/index.tmp @@ -294,9 +365,15 @@ in { group = "download"; }; - services.magnetico = { + services.radarr = { + enable = true; + }; + + services.sonarr = { + enable = true; + }; + + services.prowlarr = { enable = true; - web.address = "0.0.0.0"; - web.port = 9092; }; } diff --git a/lass/2configs/yellow-host.nix b/lass/2configs/yellow-host.nix new file mode 100644 index 000000000..d07c222c6 --- /dev/null +++ b/lass/2configs/yellow-host.nix @@ -0,0 +1,14 @@ +{ config, pkgs, ... }: +{ + lass.sync-containers3.containers.yellow = { + sshKey = "${toString }/yellow.sync.key"; + }; + containers.yellow.bindMounts."/var/lib" = { + hostPath = "/var/lib/sync-containers3/yellow/state"; + isReadOnly = false; + }; + containers.yellow.bindMounts."/var/download" = { + hostPath = "/var/download"; + isReadOnly = false; + }; +} -- cgit v1.3.1 From d5a4c2181dcbd12fbb94d5bd7dcbf7f4f89763a8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:47:14 +0100 Subject: l sync-containers3: create dir, fix symlink --- lass/3modules/sync-containers3.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 1a006835d..e9f708690 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -50,7 +50,8 @@ in { wantedBy = [ "multi-user.target" ]; serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" '' set -efu - ln -frs /var/state/var_src /var/src + mkdir -p /var/state/var_src + ln -Tfrs /var/state/var_src /var/src if test -e /var/src/nixos-config; then /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || : fi -- cgit v1.3.1 From 5415114141754e6e1382e8e6841b902717c6de1f Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:47:26 +0100 Subject: l sync-containers3: fix group --- lass/3modules/sync-containers3.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index e9f708690..645809da5 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -247,7 +247,7 @@ in { users.groups = lib.mapAttrs' (_: ctr: lib.nameValuePair "${ctr.name}_container" { }) cfg.containers; users.users = lib.mapAttrs' (_: ctr: lib.nameValuePair "${ctr.name}_container" ({ - group = "container_${ctr.name}"; + group = "${ctr.name}_container"; isNormalUser = true; uid = slib.genid_uint31 "container_${ctr.name}"; home = "/var/lib/sync-containers3/${ctr.name}"; -- cgit v1.3.1 From 7bbcac3e5ee3ad65762e54d85a1786d077cca699 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:47:49 +0100 Subject: l sync-containers3: add init script --- lass/3modules/sync-containers3.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 645809da5..053175565 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -255,6 +255,24 @@ in { homeMode = "705"; })) cfg.containers; + environment.systemPackages = lib.mapAttrsToList (_: ctr: (pkgs.writers.writeDashBin "${ctr.name}_init" '' + set -efux + export PATH=${lib.makeBinPath [ + pkgs.coreutils + pkgs.cryptsetup + pkgs.libxfs.bin + ]}:$PATH + truncate -s 5G /var/lib/sync-containers3/${ctr.name}/disk + cryptsetup luksFormat /var/lib/sync-containers3/${ctr.name}/disk ${ctr.luksKey} + cryptsetup luksOpen --key-file ${ctr.luksKey} /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name} + mkfs.xfs /dev/mapper/${ctr.name} + mkdir -p /var/lib/sync-containers3/${ctr.name}/state + mountpoint /var/lib/sync-containers3/${ctr.name}/state || mount /dev/mapper/${ctr.name} /var/lib/sync-containers3/${ctr.name}/state + /run/current-system/sw/bin/nixos-container start ${ctr.name} + /run/current-system/sw/bin/nixos-container run ${ctr.name} -- ${pkgs.writeDash "init" '' + mkdir -p /var/state + ''} + '')) cfg.containers; }) (lib.mkIf (cfg.containers != {}) { # networking -- cgit v1.3.1 From a38c39424f29bbdfe1493061da05326f9d05d4a0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:48:12 +0100 Subject: l sync-containers3: allow ctr0 in FORWARD --- lass/3modules/sync-containers3.nix | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 053175565..02ba0a5ff 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -296,6 +296,10 @@ in { krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-i ctr0"; target = "ACCEPT"; } ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { predicate = "-i ctr0"; target = "ACCEPT"; } + { predicate = "-o ctr0"; target = "ACCEPT"; } + ]; }) (lib.mkIf cfg.inContainer.enable { users.groups.container_sync = {}; -- cgit v1.3.1 From 32966b38aed6f495e425bc5f1d54761534bc019b Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 23:31:53 +0100 Subject: l sync-containers3: add runContainer option --- lass/3modules/sync-containers3.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'lass') diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 02ba0a5ff..86aa40f03 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -28,6 +28,10 @@ in { type = lib.types.bool; default = false; }; + runContainer = lib.mkOption { + type = lib.types.bool; + default = true; + }; }; })); }; @@ -74,7 +78,7 @@ in { isReadOnly = false; }; }; - }) cfg.containers; + }) (lib.filterAttrs (_: ctr: ctr.runContainer) cfg.containers); systemd.services = lib.foldr lib.recursiveUpdate {} (lib.flatten (map (ctr: [ { "${ctr.name}_syncer" = { @@ -108,7 +112,7 @@ in { ''; }; }; } - { "${ctr.name}_watcher" = { + { "${ctr.name}_watcher" = lib.mkIf ctr.runContainer { path = with pkgs; [ coreutils consul @@ -164,7 +168,7 @@ in { ''; }; }; } - { "${ctr.name}_scheduler" = { + { "${ctr.name}_scheduler" = lib.mkIf ctr.runContainer { wantedBy = [ "multi-user.target" ]; path = with pkgs; [ coreutils -- cgit v1.3.1 From 4555a8858d652ce713afcf415b56bd0d82ca2d49 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 3 Jan 2023 14:04:21 +0100 Subject: l radio: add c-base weather --- lass/2configs/radio/weather_for_ips.py | 49 +++++++++++++++++++++------------- 1 file changed, 30 insertions(+), 19 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/weather_for_ips.py b/lass/2configs/radio/weather_for_ips.py index 1f8489bd1..447c6389b 100644 --- a/lass/2configs/radio/weather_for_ips.py +++ b/lass/2configs/radio/weather_for_ips.py @@ -3,32 +3,43 @@ import fileinput import json import requests import os +import random geoip = geoip2.database.Reader(os.environ['MAXMIND_GEOIP_DB']) seen = {} output = [] for ip in fileinput.input(): - location = geoip.city(ip.strip()) - if location.city.geoname_id not in seen: - seen[location.city.geoname_id] = True - weather_api_key = os.environ['OPENWEATHER_API_KEY'] - url = ( - f'https://api.openweathermap.org/data/2.5/onecall' - f'?lat={location.location.latitude}' - f'&lon={location.location.longitude}' - f'&appid={weather_api_key}' - f'&units=metric' - ) - resp = requests.get(url) - weather = json.loads(resp.text) + if "80.147.140.51" in ip: output.append( - f'Weather report for {location.city.name}, {location.country.name}. ' - f'It is {weather["current"]["weather"][0]["description"]} outside ' - f'with a temperature of {weather["current"]["temp"]:.1f} degrees, ' - f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second ' - f'and a humidity of {weather["current"]["humidity"]} percent. ' - f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. ' + 'Weather report for c-base, space.' + 'It is empty space outside ' + 'with a temperature of -270 degrees, ' + 'a lightspeed of 299792 kilometers per second ' + 'and a humidity of Not a Number percent. ' + f'The probability of reincarnation is {random.randrange(0, 100)} percent.' ) + else: + location = geoip.city(ip.strip()) + if location.city.geoname_id not in seen: + seen[location.city.geoname_id] = True + weather_api_key = os.environ['OPENWEATHER_API_KEY'] + url = ( + f'https://api.openweathermap.org/data/2.5/onecall' + f'?lat={location.location.latitude}' + f'&lon={location.location.longitude}' + f'&appid={weather_api_key}' + f'&units=metric' + ) + resp = requests.get(url) + weather = json.loads(resp.text) + output.append( + f'Weather report for {location.city.name}, {location.country.name}. ' + f'It is {weather["current"]["weather"][0]["description"]} outside ' + f'with a temperature of {weather["current"]["temp"]:.1f} degrees, ' + f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second ' + f'and a humidity of {weather["current"]["humidity"]} percent. ' + f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. ' + ) print('\n'.join(output)) -- cgit v1.3.1 From 7cb49c556efce96b15b28807464b8d5cdf1ea999 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 18:33:44 +0100 Subject: l neoprism.r: add riot container --- lass/1systems/neoprism/config.nix | 15 +---------- lass/2configs/riot.nix | 56 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 14 deletions(-) create mode 100644 lass/2configs/riot.nix (limited to 'lass') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index b7bf7afb2..f203abc07 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -6,20 +6,7 @@ - { # TODO make new hfos.nix out of this vv - users.users.riot = { - uid = pkgs.stockholm.lib.genid_uint31 "riot"; - isNormalUser = true; - extraGroups = [ "libvirtd" ]; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" - ]; - }; - # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } - # ]; - } + ]; krebs.build.host = config.krebs.hosts.neoprism; diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix new file mode 100644 index 000000000..37a6298ca --- /dev/null +++ b/lass/2configs/riot.nix @@ -0,0 +1,56 @@ +{ config, lib, pkgs, ... }: +{ + containers.riot = { + config = { + environment.systemPackages = [ + pkgs.dhcpcd + pkgs.git + pkgs.jq + ]; + networking.useDHCP = lib.mkForce true; + networking.firewall.enable = false; + systemd.services.autoswitch = { + environment = { + NIX_REMOTE = "daemon"; + }; + wantedBy = [ "multi-user.target" ]; + serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" '' + set -efu + if test -e /var/src/nixos-config; then + /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || : + fi + ''; + unitConfig.X-StopOnRemoval = false; + }; + }; + autoStart = true; + enableTun = true; + privateNetwork = true; + hostAddress = "10.233.1.1"; + localAddress = "10.233.1.2"; + forwardPorts = [ + { hostPort = 45622; containerPort = 22; } + ]; + }; + + systemd.network.networks."50-ve-riot" = { + matchConfig.Name = "ve-riot"; + + networkConfig = { + IPForward = "yes"; + # weirdly we have to use POSTROUTING MASQUERADE here + # IPMasquerade = "both"; + LinkLocalAddressing = "no"; + KeepConfiguration = "static"; + }; + }; + + # networking.nat can be used instead of this + krebs.iptables.tables.nat.POSTROUTING.rules = [ + { v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; } + ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { predicate = "-i ve-riot"; target = "ACCEPT"; } + { predicate = "-o ve-riot"; target = "ACCEPT"; } + ]; +} -- cgit v1.3.1 From 7d244baf9e05e73a11eec9e429b71734f354f486 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 19:02:33 +0100 Subject: l riot: add ssh key, add default route --- lass/2configs/riot.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'lass') diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix index 37a6298ca..559e7b20d 100644 --- a/lass/2configs/riot.nix +++ b/lass/2configs/riot.nix @@ -7,8 +7,11 @@ pkgs.git pkgs.jq ]; - networking.useDHCP = lib.mkForce true; - networking.firewall.enable = false; + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" + ]; + networking.defaultGateway = "10.233.1.1"; systemd.services.autoswitch = { environment = { NIX_REMOTE = "daemon"; -- cgit v1.3.1 From 6f0cd02c8c78545899fa4afeeeacd68a365349de Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 21:00:29 +0100 Subject: l: prism-mount -> yellow-mount --- lass/1systems/coaxmetal/config.nix | 2 +- lass/1systems/shodan/config.nix | 2 +- lass/2configs/prism-mounts/samba.nix | 15 --------------- lass/2configs/yellow-mounts/samba.nix | 15 +++++++++++++++ 4 files changed, 17 insertions(+), 17 deletions(-) delete mode 100644 lass/2configs/prism-mounts/samba.nix create mode 100644 lass/2configs/yellow-mounts/samba.nix (limited to 'lass') diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix index dd8308bbd..2c88b68cc 100644 --- a/lass/1systems/coaxmetal/config.nix +++ b/lass/1systems/coaxmetal/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix index ef538f339..5e48c216a 100644 --- a/lass/1systems/shodan/config.nix +++ b/lass/1systems/shodan/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/2configs/prism-mounts/samba.nix b/lass/2configs/prism-mounts/samba.nix deleted file mode 100644 index 4b1475ef3..000000000 --- a/lass/2configs/prism-mounts/samba.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ - fileSystems."/mnt/prism" = { - device = "//prism.r/public"; - fsType = "cifs"; - options = [ - "guest" - "nofail" - "noauto" - "ro" - "x-systemd.automount" - "x-systemd.device-timeout=1" - "x-systemd.idle-timeout=1min" - ]; - }; - } diff --git a/lass/2configs/yellow-mounts/samba.nix b/lass/2configs/yellow-mounts/samba.nix new file mode 100644 index 000000000..e16f1cc47 --- /dev/null +++ b/lass/2configs/yellow-mounts/samba.nix @@ -0,0 +1,15 @@ +{ + fileSystems."/mnt/yellow" = { + device = "//yellow.r/public"; + fsType = "cifs"; + options = [ + "guest" + "nofail" + "noauto" + "ro" + "x-systemd.automount" + "x-systemd.device-timeout=1" + "x-systemd.idle-timeout=1min" + ]; + }; + } -- cgit v1.3.1 From 00226d6e2ae44dbbca0555f10ecb52acb56e6704 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 5 Jan 2023 01:18:06 +0100 Subject: l radio: move music to /var/music --- lass/2configs/radio/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index dfb3d7e0b..46540969b 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -3,7 +3,7 @@ let name = "radio"; - music_dir = "/home/radio/music"; + music_dir = "/var/music"; skip_track = pkgs.writers.writeBashBin "skip_track" '' set -eu @@ -303,10 +303,10 @@ in { ''; }; services.syncthing.declarative.folders."the_playlist" = { - path = "/home/radio/music/the_playlist"; + path = "/var/music/the_playlist"; devices = [ "mors" "phone" "prism" "omo" ]; }; - krebs.acl."/home/radio/music/the_playlist"."u:syncthing:X".parents = true; - krebs.acl."/home/radio/music/the_playlist"."u:syncthing:rwX" = {}; - krebs.acl."/home/radio/music/the_playlist"."u:radio:rwX" = {}; + krebs.acl."/var/music/the_playlist"."u:syncthing:X".parents = true; + krebs.acl."/var/music/the_playlist"."u:syncthing:rwX" = {}; + krebs.acl."/var/music/the_playlist"."u:radio:rwX" = {}; } -- cgit v1.3.1 From 0bbbfe153a0752bbe337bef1bac8c52aa285d4da Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 5 Jan 2023 01:19:01 +0100 Subject: l radio: set timeout for hooks, rename filter --- lass/2configs/radio/radio.liq | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/radio.liq b/lass/2configs/radio/radio.liq index 70d316043..1366287a7 100644 --- a/lass/2configs/radio/radio.liq +++ b/lass/2configs/radio/radio.liq @@ -10,7 +10,7 @@ def stringify_attrs(attrs) = out end -def filter_graveyard(req) = +def filter_music(req) = filename = request.filename(req) if string.match(pattern = '.*/\\.graveyard/.*', filename) then false @@ -27,7 +27,7 @@ end env = environment() port = string.to_int(env["RADIO_PORT"], default = 8000) -all_music = playlist(env["MUSIC"], check_next = filter_graveyard) +all_music = playlist(env["MUSIC"], check_next = filter_music) wishlist = request.queue() tracks = fallback(track_sensitive = true, [wishlist, all_music]) tracks = blank.eat(tracks) @@ -36,7 +36,7 @@ last_metadata = ref([]) def on_metadata(m) = last_metadata := m print("changing tracks") - out = process.read(env["HOOK_TRACK_CHANGE"], env = m) + out = process.read(env["HOOK_TRACK_CHANGE"], env = m, timeout = 5.0) print(out) end tracks.on_metadata(on_metadata) -- cgit v1.3.1 From 727ef7fa8e4581ebf3c792b6f9ff7fba6c8504dd Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 5 Jan 2023 01:19:27 +0100 Subject: l radio weather: unique ips --- lass/2configs/radio/weather.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/weather.nix b/lass/2configs/radio/weather.nix index 704bf7218..ad96d8ec0 100644 --- a/lass/2configs/radio/weather.nix +++ b/lass/2configs/radio/weather.nix @@ -18,11 +18,14 @@ let MAXMIND_GEOIP_DB="/tmp/GeoLite2-City.mmdb"; export MAXMIND_GEOIP_DB OPENWEATHER_API_KEY=$(cat "$CREDENTIALS_DIRECTORY/openweather_api"); export OPENWEATHER_API_KEY ss -no 'sport = :8000' | - jc --ss | jq -r '.[] | - select( - .local_address != "[::ffff:127.0.0.1]" - and .local_address != "[::1]" - ) | .peer_address | gsub("[\\[\\]]"; "") + jc --ss | jq -r ' + [ + .[] | + select( + .local_address != "[::ffff:127.0.0.1]" + and .local_address != "[::1]" + ) | .peer_address | gsub("[\\[\\]]"; "") + ] | unique[] ' | ${weather_for_ips}/bin/weather_for_ips ''; -- cgit v1.3.1 From 0b2952f4ed9572521f7c4a21904943ac33c602b0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 6 Jan 2023 12:17:04 +0100 Subject: l radio.r: init --- kartei/lass/radio.nix | 39 +++++++++++++++++++++++++++++++++++++++ lass/1systems/radio/config.nix | 24 ++++++++++++++++++++++++ lass/1systems/radio/physical.nix | 7 +++++++ 3 files changed, 70 insertions(+) create mode 100644 kartei/lass/radio.nix create mode 100644 lass/1systems/radio/config.nix create mode 100644 lass/1systems/radio/physical.nix (limited to 'lass') diff --git a/kartei/lass/radio.nix b/kartei/lass/radio.nix new file mode 100644 index 000000000..bfb177e19 --- /dev/null +++ b/kartei/lass/radio.nix @@ -0,0 +1,39 @@ +{ r6, w6, ... }: +{ + nets = { + retiolum = { + ip4.addr = "10.243.0.11"; + ip6.addr = r6 "4d10"; + aliases = [ + "radio.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAx08urv4sl22+pLchD6W6kprJ1JZBiG9/MVA50PqYAJmvTpYyDUCR + Dwgt7pR8n/zbbof98QS5D67J5rZPcrLI6PY2bBzlXFFKHZEj2AVwUjUbyvEvQqtf + yJM+AxFy1/CaXmDvYM9UF/Wh6rb/ZeUxFtbaIVfMPox0Zln0THEsOmCWvNzxMvjZ + rjouZGzrH+er3yxJVovxD/JT32COmK0R20DLDoofBdtBkFlB/VkrbxYfX/cWXX1K + WQVJuQ/H1xP9m4c4S8g/nM63rLUBOIkn06TcXyI/mEgRecEUDgC02PNXc5BDgB4A + seXx+BiLC/f6+64KOWODHEEm/iHjCyrOSZtdA2EbPCATfOHrj0EG5Y4V6d1Iw4WP + kiOIQByHMbOzRwm91yd/gM1DTxdy3j5nqaMhCzrM/QeOhSf5FXkWpARawUsChwh+ + eCuSZDg218u/NkzCrTvCPTdY1q+MZ5d5qgID4VQrenjBJq4AZxsw74Zd2G2uRWlF + paZ2pSCyAey19A/or2iG10tqNpXJzZy0HNhh7q/gKhQKKTh+ggzgOrRe2ZaxlbEy + P45JQKcR9/WJAohnYQ8uZJ6oin5EsEdVkapdYu60aReRGeyTmq3RLnu3Zn5MR5RH + 1r+W03KQcQzmmpE5YrxKSZL6OriXQYEPTa9/mSZT6TEUIvRT8W5jGQ0CAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + tinc.pubkey_ed25519 = "DmiyfmRsWd8Qg6M/ZsAd5lFM+vnkwRTfnMH/jCFwWFF"; + }; + wiregrill = { + ip6.addr = w6 "4d10"; + aliases = [ + "radio.w" + ]; + wireguard.pubkey = '' + iCe1O9qeziw18AlGuFt5tIxm6SIBtNpwO/6OZm9Bn30= + ''; + }; + }; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHsvyWrMN2lupBmjI8nW+NUSJIDPkr8c90Z4BcuZ7Myi"; + syncthing.id = "KMDPLE5-7FBYYXH-PF5LEET-G2AWR33-7XAPZJU-5S3VOB7-ZX5Q74V-PZKI6QN"; +} diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix new file mode 100644 index 000000000..2fd23a448 --- /dev/null +++ b/lass/1systems/radio/config.nix @@ -0,0 +1,24 @@ +with import ; +{ config, lib, pkgs, ... }: +{ + imports = [ + + + + + + + ]; + + krebs.build.host = config.krebs.hosts.radio; + + security.acme = { + acceptTerms = true; + defaults.email = "acme@lassul.us"; + }; + + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt"; + }; +} diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/radio/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +} -- cgit v1.3.1 From ed18792d602c8b8138f6d6e35984f2dc8d335e13 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 21:42:03 +0100 Subject: l prism.r: use radio.r instead of running radio locally --- lass/1systems/prism/config.nix | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index c2a405759..bcc8c1a08 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -97,9 +97,35 @@ with import ; localAddress = "10.233.2.2"; }; } + { + services.nginx.virtualHosts."radio.lassul.us" = { + enableACME = true; + addSSL = true; + locations."/" = { + # recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://radio.r"; + extraConfig = '' + proxy_set_header Host radio.r; + # get source ip for weather reports + proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr"; + ''; + }; + }; + krebs.htgen.radio-redirect = { + port = 8000; + scriptFile = pkgs.writers.writeDash "redir" '' + printf 'HTTP/1.1 301 Moved Permanently\r\n' + printf "Location: http://radio.lassul.us''${Request_URI}\r\n" + printf '\r\n' + ''; + }; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; } + ]; + } - -- cgit v1.3.1 From f611ce80c94ff85e8be8abd9d607494464e1eff8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 22:39:19 +0100 Subject: l radio: use localhost for listeners count --- lass/2configs/radio/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index 46540969b..e883ed91b 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -113,7 +113,7 @@ in { LIMIT=1000 #how many tracks to keep in the history HISTORY_FILE=/var/lib/radio/recent - listeners=$(${pkgs.curl}/bin/curl -fSs lassul.us:8000/status-json.xsl | + listeners=$(${pkgs.curl}/bin/curl -fSs http://localhost:8000/status-json.xsl | ${pkgs.jq}/bin/jq '[.icestats.source[].listeners] | add' || echo 0) echo "$(${pkgs.coreutils}/bin/date -Is)" "$filename" | ${pkgs.coreutils}/bin/tee -a "$HISTORY_FILE" echo "$(${pkgs.coreutils}/bin/tail -$LIMIT "$HISTORY_FILE")" > "$HISTORY_FILE" -- cgit v1.3.1 From 060080342a214bd88b06b301ce3360671fe45711 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 22:39:58 +0100 Subject: l radio: use icecast 2.5-beta3 --- lass/2configs/radio/default.nix | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index e883ed91b..3eab68e9f 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -128,14 +128,33 @@ in { serviceConfig.User = lib.mkForce "radio"; }; + nixpkgs.config.packageOverrides = opkgs: { + icecast = opkgs.icecast.overrideAttrs (old: rec { + version = "2.5-beta3"; + + src = pkgs.fetchurl { + url = "http://downloads.xiph.org/releases/icecast/icecast-${version}.tar.gz"; + sha256 = "sha256-4FDokoA9zBDYj8RAO/kuTHaZ6jZYBLSJZiX/IYFaCW8="; + }; + + buildInputs = old.buildInputs ++ [ pkgs.pkg-config ]; + }); + }; services.icecast = { enable = true; hostname = "radio.lassul.us"; admin.password = "hackme"; extraConf = '' - hackme + hackme + admin + hackme + + - + - + 3 + ''; }; -- cgit v1.3.1 From 38e41bff20ddfbbcdfd8dfd176e55e9907a9d12b Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 23:26:40 +0100 Subject: l radio: use http proxying, get proxied listeners --- lass/2configs/radio/default.nix | 59 +++++++++++++++++++---------------------- lass/2configs/radio/weather.nix | 26 +++++++++--------- 2 files changed, 42 insertions(+), 43 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index 3eab68e9f..f13181088 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -253,18 +253,38 @@ in { ''; }; + networking.firewall.allowedTCPPorts = [ 80 ]; services.nginx = { enable = true; - virtualHosts."radio.lassul.us" = { - forceSSL = true; - enableACME = true; + virtualHosts."radio.r" = { locations."/".extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-Server $host; - proxy_set_header X-Real-IP $remote_addr; + # https://github.com/aswild/icecast-notes#core-nginx-config proxy_pass http://localhost:8000; + # Disable request size limit, very important for uploading large files + client_max_body_size 0; + + # Enable support `Transfer-Encoding: chunked` + chunked_transfer_encoding on; + + # Disable request and response buffering, minimize latency to/from Icecast + proxy_buffering off; + proxy_request_buffering off; + + # Icecast needs HTTP/1.1, not 1.0 or 2 + proxy_http_version 1.1; + + # Forward all original request headers + proxy_pass_request_headers on; + + # Set some standard reverse proxy headers. Icecast server currently ignores these, + # but may support them in a future version so that access logs are more useful. + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # get source ip for weather reports + proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr"; ''; locations."= /recent".extraConfig = '' default_type "text/plain"; @@ -297,29 +317,6 @@ in { add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; ''; }; - virtualHosts."lassul.us".locations."= /the_playlist".extraConfig = let - html = pkgs.writeText "index.html" '' - - - - - lassulus playlist - - -
- -
-
- -
- - - - ''; - in '' - default_type "text/html"; - alias ${html}; - ''; }; services.syncthing.declarative.folders."the_playlist" = { path = "/var/music/the_playlist"; diff --git a/lass/2configs/radio/weather.nix b/lass/2configs/radio/weather.nix index ad96d8ec0..dca8a7843 100644 --- a/lass/2configs/radio/weather.nix +++ b/lass/2configs/radio/weather.nix @@ -10,23 +10,25 @@ let export PATH="${lib.makeBinPath [ pkgs.coreutils pkgs.curl - pkgs.iproute2 - pkgs.jc pkgs.jq ]}" curl -fSsz /tmp/GeoLite2-City.mmdb -o /tmp/GeoLite2-City.mmdb http://c.r/GeoLite2-City.mmdb MAXMIND_GEOIP_DB="/tmp/GeoLite2-City.mmdb"; export MAXMIND_GEOIP_DB OPENWEATHER_API_KEY=$(cat "$CREDENTIALS_DIRECTORY/openweather_api"); export OPENWEATHER_API_KEY - ss -no 'sport = :8000' | - jc --ss | jq -r ' - [ - .[] | - select( - .local_address != "[::ffff:127.0.0.1]" - and .local_address != "[::1]" - ) | .peer_address | gsub("[\\[\\]]"; "") - ] | unique[] - ' | + ( + curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.ogg' + curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.mp3' + curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.opus' + ) | jq -rs ' + [ + .[][].source|values|to_entries[].value | + (.listener//[]) [] | + (.useragent | capture("client-ip=(?[a-f0-9.:]+)")).ip // .ip + ] | + unique[] | + select(. != "127.0.0.1") | + select(. != "::1") + ' | ${weather_for_ips}/bin/weather_for_ips ''; in { -- cgit v1.3.1 From 9bd4b62502304cb54983bf2c2ce1fb40c596ec19 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 23:27:16 +0100 Subject: l radio.sh: use radio.lassul.us --- lass/2configs/radio/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index f13181088..cfc9252bd 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -305,7 +305,7 @@ in { while sleep 1; do mpv \ --cache-secs=0 --demuxer-readahead-secs=0 --untimed --cache-pause=no \ - 'http://lassul.us:8000/radio.ogg' + 'http://radio.lassul.us/radio.ogg' done ''; locations."= /controls".extraConfig = '' -- cgit v1.3.1 From b0b89a392b8ed402c73801e2488da34397786b6b Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 23:27:46 +0100 Subject: l sync radio: sync to radio.r --- lass/2configs/radio/default.nix | 2 +- lass/2configs/sync/the_playlist.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index cfc9252bd..a511196fd 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -320,7 +320,7 @@ in { }; services.syncthing.declarative.folders."the_playlist" = { path = "/var/music/the_playlist"; - devices = [ "mors" "phone" "prism" "omo" ]; + devices = [ "mors" "phone" "prism" "omo" "radio" ]; }; krebs.acl."/var/music/the_playlist"."u:syncthing:X".parents = true; krebs.acl."/var/music/the_playlist"."u:syncthing:rwX" = {}; diff --git a/lass/2configs/sync/the_playlist.nix b/lass/2configs/sync/the_playlist.nix index c01a11cc3..233ca8fb7 100644 --- a/lass/2configs/sync/the_playlist.nix +++ b/lass/2configs/sync/the_playlist.nix @@ -1,7 +1,7 @@ { services.syncthing.folders.the_playlist = { path = "/home/lass/tmp/the_playlist"; - devices = [ "mors" "phone" "prism" "omo" ]; + devices = [ "mors" "phone" "prism" "omo" "radio" ]; }; krebs.acl."/home/lass/tmp/the_playlist"."u:syncthing:X".parents = true; krebs.acl."/home/lass/tmp/the_playlist"."u:syncthing:rwX" = {}; -- cgit v1.3.1 From 917889f8fcd9a6f4659dc46047d063333c2bb2a9 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 23:35:39 +0100 Subject: l neoprism.r: host radio.r container --- lass/1systems/neoprism/config.nix | 5 +++++ lass/2configs/radio/container-host.nix | 23 +++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 lass/2configs/radio/container-host.nix (limited to 'lass') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index f203abc07..8e5a60c36 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,8 +4,13 @@ imports = [ + + # sync-containers + + + # other containers ]; diff --git a/lass/2configs/radio/container-host.nix b/lass/2configs/radio/container-host.nix new file mode 100644 index 000000000..e32095ffa --- /dev/null +++ b/lass/2configs/radio/container-host.nix @@ -0,0 +1,23 @@ +{ config, pkgs, ... }: +{ + lass.sync-containers3.containers.radio = { + sshKey = "${toString }/radio.sync.key"; + }; + containers.radio = { + bindMounts."/var/music" = { + hostPath = "/var/music"; + isReadOnly = false; + }; + }; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; } + ]; + krebs.htgen.radio-redirect = { + port = 8000; + scriptFile = pkgs.writers.writeDash "redir" '' + printf 'HTTP/1.1 301 Moved Permanently\r\n' + printf "Location: http://radio.lassul.us''${Request_URI}\r\n" + printf '\r\n' + ''; + }; +} -- cgit v1.3.1 From 0e7a071d81c22af41ae2313c3cc13d12407bd403 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 7 Jan 2023 23:51:29 +0100 Subject: l radio weather: don't fail on unknown ips --- lass/2configs/radio/weather_for_ips.py | 45 ++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 21 deletions(-) (limited to 'lass') diff --git a/lass/2configs/radio/weather_for_ips.py b/lass/2configs/radio/weather_for_ips.py index 447c6389b..62206a985 100644 --- a/lass/2configs/radio/weather_for_ips.py +++ b/lass/2configs/radio/weather_for_ips.py @@ -20,26 +20,29 @@ for ip in fileinput.input(): f'The probability of reincarnation is {random.randrange(0, 100)} percent.' ) else: - location = geoip.city(ip.strip()) - if location.city.geoname_id not in seen: - seen[location.city.geoname_id] = True - weather_api_key = os.environ['OPENWEATHER_API_KEY'] - url = ( - f'https://api.openweathermap.org/data/2.5/onecall' - f'?lat={location.location.latitude}' - f'&lon={location.location.longitude}' - f'&appid={weather_api_key}' - f'&units=metric' - ) - resp = requests.get(url) - weather = json.loads(resp.text) - output.append( - f'Weather report for {location.city.name}, {location.country.name}. ' - f'It is {weather["current"]["weather"][0]["description"]} outside ' - f'with a temperature of {weather["current"]["temp"]:.1f} degrees, ' - f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second ' - f'and a humidity of {weather["current"]["humidity"]} percent. ' - f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. ' - ) + try: + location = geoip.city(ip.strip()) + if location.city.geoname_id not in seen: + seen[location.city.geoname_id] = True + weather_api_key = os.environ['OPENWEATHER_API_KEY'] + url = ( + f'https://api.openweathermap.org/data/2.5/onecall' + f'?lat={location.location.latitude}' + f'&lon={location.location.longitude}' + f'&appid={weather_api_key}' + f'&units=metric' + ) + resp = requests.get(url) + weather = json.loads(resp.text) + output.append( + f'Weather report for {location.city.name}, {location.country.name}. ' + f'It is {weather["current"]["weather"][0]["description"]} outside ' + f'with a temperature of {weather["current"]["temp"]:.1f} degrees, ' + f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second ' + f'and a humidity of {weather["current"]["humidity"]} percent. ' + f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. ' + ) + except: # noqa E722 + pass print('\n'.join(output)) -- cgit v1.3.1 From 4228b378c46db684ce0a33253bb51a5869a2ed23 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 09:45:53 +0100 Subject: l yellow.r: add rada.r and sona.r aliases --- kartei/lass/yellow.nix | 2 ++ lass/1systems/yellow/config.nix | 10 ++++++++++ 2 files changed, 12 insertions(+) (limited to 'lass') diff --git a/kartei/lass/yellow.nix b/kartei/lass/yellow.nix index a62c6167c..669e94406 100644 --- a/kartei/lass/yellow.nix +++ b/kartei/lass/yellow.nix @@ -7,6 +7,8 @@ aliases = [ "yellow.r" "jelly.r" + "rada.r" + "sona.r" ]; tinc = { pubkey = '' diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 552dd7f00..a89b7dd76 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -142,6 +142,16 @@ in { proxy_set_header Accept-Encoding ""; ''; }; + virtualHosts."rada.r" = { + locations."/" = { + proxyPass = "http://localhost:7878"; + }; + }; + virtualHosts."sona.r" = { + locations."/" = { + proxyPass = "http://localhost:8989"; + }; + }; }; services.samba = { -- cgit v1.3.1 From c199c376fcbe6049b2d4c3fa9530b31d4e655bb0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 09:51:45 +0100 Subject: l sona.r, rada.r: proxy websockets --- lass/1systems/yellow/config.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lass') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index a89b7dd76..923654d9e 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -144,11 +144,13 @@ in { }; virtualHosts."rada.r" = { locations."/" = { + proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; virtualHosts."sona.r" = { locations."/" = { + proxyWebsockets = true; proxyPass = "http://localhost:8989"; }; }; -- cgit v1.3.1 From a6fae292ee20386d3c9eb4210ee7f304a6c230bd Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 12:04:44 +0100 Subject: l: {son,rad}a.r -> {son,rad}ar.r --- kartei/lass/yellow.nix | 4 ++-- lass/1systems/yellow/config.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'lass') diff --git a/kartei/lass/yellow.nix b/kartei/lass/yellow.nix index 669e94406..bb0b1f09b 100644 --- a/kartei/lass/yellow.nix +++ b/kartei/lass/yellow.nix @@ -7,8 +7,8 @@ aliases = [ "yellow.r" "jelly.r" - "rada.r" - "sona.r" + "radar.r" + "sonar.r" ]; tinc = { pubkey = '' diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 923654d9e..484a7f5dc 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -142,13 +142,13 @@ in { proxy_set_header Accept-Encoding ""; ''; }; - virtualHosts."rada.r" = { + virtualHosts."radar.r" = { locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; - virtualHosts."sona.r" = { + virtualHosts."sonar.r" = { locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:8989"; -- cgit v1.3.1 From 23b2047c80b222ef1c59d70b25697c6624792d19 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 12:35:37 +0100 Subject: l yellow.r: add bazarr for subtitles --- lass/1systems/yellow/config.nix | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'lass') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 484a7f5dc..72e2e0e85 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -234,6 +234,7 @@ in { { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr # smbd { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } @@ -379,13 +380,20 @@ in { services.radarr = { enable = true; + group = "download"; }; services.sonarr = { enable = true; + group = "download"; }; services.prowlarr = { enable = true; }; + + services.bazarr = { + enable = true; + group = "download"; + }; } -- cgit v1.3.1 From 5443f408973543d4228215edbd60c4c1082c1315 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 8 Jan 2023 20:39:39 +0100 Subject: l gg23: use networkd --- lass/2configs/gg23.nix | 91 +++++++++++++++++++++++++------------------------- 1 file changed, 46 insertions(+), 45 deletions(-) (limited to 'lass') diff --git a/lass/2configs/gg23.nix b/lass/2configs/gg23.nix index 6bcbd7400..51db9a40a 100644 --- a/lass/2configs/gg23.nix +++ b/lass/2configs/gg23.nix @@ -2,37 +2,56 @@ with import ; { + systemd.network.networks."50-et0" = { + matchConfig.Name = "et0"; + DHCP = "yes"; + # dhcpV4Config.UseDNS = false; + # dhcpV6Config.UseDNS = false; + linkConfig = { + RequiredForOnline = "routable"; + }; + # networkConfig = { + # LinkLocalAddressing = "no"; + # }; + # dhcpV6Config = { + # PrefixDelegationHint = "::/60"; + # }; + # networkConfig = { + # IPv6AcceptRA = true; + # }; + # ipv6PrefixDelegationConfig = { + # Managed = true; + # }; + }; + systemd.network.networks."50-int0" = { + name = "int0"; + address = [ + "10.42.0.1/24" + ]; + networkConfig = { + IPForward = "yes"; + IPMasquerade = "both"; + ConfigureWithoutCarrier = true; + DHCPServer = "yes"; + # IPv6SendRA = "yes"; + # DHCPPrefixDelegation = "yes"; + }; + }; networking.networkmanager.unmanaged = [ "int0" ]; - networking.interfaces.int0.ipv4.addresses = [{ - address = "10.42.0.1"; - prefixLength = 24; - }]; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-i int0"; target = "ACCEPT"; } + ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { predicate = "-i int0"; target = "ACCEPT"; } + { predicate = "-o int0"; target = "ACCEPT"; } + { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; } + ]; + krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ + { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; } + ]; networking.domain = "gg23"; - services.dhcpd4 = { - enable = true; - interfaces = [ "int0" ]; - extraConfig = '' - option subnet-mask 255.255.255.0; - option routers 10.42.0.1; - option domain-name-servers 10.42.0.1; - subnet 10.42.0.0 netmask 255.255.255.0 { - range 10.42.0.100 10.42.0.200; - } - ''; - machines = [ - { ethernetAddress = "a8:a6:48:65:ce:4c"; hostName = "tv"; ipAddress = "10.42.0.3"; } - { ethernetAddress = "3c:2a:f4:22:28:37"; hostName = "drucker"; ipAddress = "10.42.0.4"; } - { ethernetAddress = "80:7d:3a:67:b7:01"; hostName = "s20-tv"; ipAddress = "10.42.0.10"; } - { ethernetAddress = "80:7d:3a:68:04:f0"; hostName = "s20-drucker"; ipAddress = "10.42.0.11"; } - { ethernetAddress = "80:7d:3a:68:11:a5"; hostName = "s20-wasch"; ipAddress = "10.42.0.12"; } - { ethernetAddress = "80:7d:3a:67:bb:69"; hostName = "s20-stereo"; ipAddress = "10.42.0.13"; } - { ethernetAddress = "ec:b5:fa:07:78:16"; hostName = "hue-bridge"; ipAddress = "10.42.0.21"; } - { ethernetAddress = "80:8d:b7:c5:80:dc"; hostName = "arubaAP"; ipAddress = "10.42.0.99"; } - ]; - }; - services.dnsmasq = { enable = true; resolveLocalQueries = false; @@ -45,22 +64,4 @@ with import ; interface=int0 ''; }; - - boot.kernel.sysctl."net.ipv4.ip_forward" = 1; - krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-i int0 -p udp --dport 53"; target = "ACCEPT"; } # dns - ]; - krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; predicate = "-d 10.42.0.0/24 -o int0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - { v6 = false; predicate = "-s 10.42.0.0/24 -i int0"; target = "ACCEPT"; } - { v6 = false; predicate = "-o int0"; target = "REJECT --reject-with icmp-port-unreachable"; } - { v6 = false; predicate = "-i int0"; target = "REJECT --reject-with icmp-port-unreachable"; } - ]; - krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ - { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.nat.POSTROUTING.rules = [ - { v6 = false; predicate = "-s 10.42.0.0/24 ! -d 10.42.0.0/24"; target = "MASQUERADE"; } - ]; } - -- cgit v1.3.1 From 2818476f710410f1c752ce12becce10be0a8a293 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 9 Jan 2023 20:37:40 +0100 Subject: l yellow.r: add acme ssl to yellow.r, radar.r and sonar.r --- lass/1systems/yellow/config.nix | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'lass') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 72e2e0e85..06561e9cf 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -34,6 +34,12 @@ in { }; }; + security.acme.defaults.email = "spam@krebsco.de"; + security.acme.acceptTerms = true; + security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL; services.nginx = { enable = true; package = pkgs.nginx.override { @@ -41,8 +47,10 @@ in { fancyindex ]; }; - virtualHosts.default = { + virtualHosts."yellow.r" = { default = true; + enableACME = true; + addSSL = true; locations."/" = { root = "/var/download"; extraConfig = '' @@ -137,18 +145,24 @@ in { ''; }; virtualHosts."jelly.r" = { + enableACME = true; + addSSL = true; locations."/".extraConfig = '' proxy_pass http://localhost:8096/; proxy_set_header Accept-Encoding ""; ''; }; virtualHosts."radar.r" = { + enableACME = true; + addSSL = true; locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:7878"; }; }; virtualHosts."sonar.r" = { + enableACME = true; + addSSL = true; locations."/" = { proxyWebsockets = true; proxyPass = "http://localhost:8989"; @@ -227,6 +241,7 @@ in { enable = true; tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir + { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic -- cgit v1.3.1