summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--configurations/manwe/default.nix75
-rw-r--r--configurations/melian/default.nix116
-rw-r--r--configurations/varda/default.nix9
-rw-r--r--configurations/yavanna/default.nix34
-rw-r--r--modules/nixfiles/monitoring/default.nix80
-rw-r--r--modules/nixfiles/openssh.nix102
-rw-r--r--modules/nixfiles/profiles/headful.nix65
-rw-r--r--modules/nixfiles/rtorrent.nix2
-rw-r--r--modules/nixfiles/syncthing.nix50
-rw-r--r--modules/nixfiles/wireguard.nix18
10 files changed, 238 insertions, 313 deletions
diff --git a/configurations/manwe/default.nix b/configurations/manwe/default.nix
index 656667e..2599d78 100644
--- a/configurations/manwe/default.nix
+++ b/configurations/manwe/default.nix
@@ -1,6 +1,5 @@
{
config,
- inputs,
lib,
this,
...
@@ -11,8 +10,6 @@ with lib; {
./webserver.nix
];
- secrets.wireguard-private-key-manwe.file = "${inputs.self}/secrets/wireguard-private-key-manwe";
-
nixfiles.modules = {
nsd = {
enable = true;
@@ -20,10 +17,7 @@ with lib; {
};
unbound.enable = true;
- wireguard = {
- privateKeyFile = config.secrets.wireguard-private-key-manwe.path;
- server.enable = true;
- };
+ wireguard.server.enable = true;
acme.enable = true;
@@ -44,73 +38,6 @@ with lib; {
vaultwarden.enable = true;
};
- services.prometheus = {
- # TODO Make this generic.
- scrapeConfigs = with my.configurations;
- with config.services.prometheus.exporters; [
- {
- job_name = "endlessh-go";
- static_configs = [
- {
- targets = with config.services.endlessh-go.prometheus; [
- "${manwe.hostname}:${toString port}"
- "${varda.hostname}:${toString port}"
- "${yavanna.hostname}:${toString port}"
- ];
- }
- ];
- }
- {
- job_name = "nginx";
- static_configs = [
- {
- targets = with nginx; [
- "${manwe.hostname}:${toString port}"
- "${varda.hostname}:${toString port}"
- "${yavanna.hostname}:${toString port}"
- ];
- }
- ];
- }
- {
- job_name = "node";
- static_configs = [
- {
- targets = with node; [
- "${manwe.hostname}:${toString port}"
- "${varda.hostname}:${toString port}"
- "${yavanna.hostname}:${toString port}"
- ];
- }
- ];
- }
- {
- job_name = "postgres";
- static_configs = [
- {
- targets = with postgres; ["${manwe.hostname}:${toString port}"];
- }
- ];
- }
- {
- job_name = "unbound";
- static_configs = [
- {
- targets = with unbound; ["${manwe.hostname}:${toString port}"];
- }
- ];
- }
- {
- job_name = "wireguard";
- static_configs = [
- {
- targets = with wireguard; ["${manwe.hostname}:${toString port}"];
- }
- ];
- }
- ];
- };
-
networking = let
interface = "eth0";
in {
diff --git a/configurations/melian/default.nix b/configurations/melian/default.nix
index 8540c24..a3dbe35 100644
--- a/configurations/melian/default.nix
+++ b/configurations/melian/default.nix
@@ -1,27 +1,9 @@
{
- config,
- inputs,
lib,
pkgs,
...
}:
with lib; {
- secrets = {
- wireguard-private-key-melian.file = "${inputs.self}/secrets/wireguard-private-key-melian";
-
- syncthing-cert-melian = with config.services.syncthing; {
- file = "${inputs.self}/secrets/syncthing-cert-melian";
- owner = user;
- inherit group;
- };
-
- syncthing-key-melian = with config.services.syncthing; {
- file = "${inputs.self}/secrets/syncthing-key-melian";
- owner = user;
- inherit group;
- };
- };
-
nixfiles.modules = {
profiles.dev = {
containers.enable = true;
@@ -34,16 +16,9 @@ with lib; {
steam.enable = true;
};
- wireguard = {
- privateKeyFile = config.secrets.wireguard-private-key-melian.path;
- client.enable = true;
- };
+ wireguard.client.enable = true;
- syncthing = with config.secrets; {
- enable = true;
- key = syncthing-key-melian.path;
- cert = syncthing-cert-melian.path;
- };
+ syncthing.enable = true;
beets.enable = true;
bluetooth.enable = true;
@@ -54,93 +29,6 @@ with lib; {
throttled.enable = true;
};
- # TODO Move to a separate module so that it could be reused on other desktops
- # in the future.
- hm = {
- home.packages = with pkgs; [
- (aspellWithDicts (p: with p; [en ru]))
- calibre
- kotatogram-desktop
- nheko
- tor-browser
- ];
-
- accounts.email = {
- maildirBasePath = "${config.my.home}/mail";
-
- accounts = let
- mkAccount = attrs:
- mkMerge [
- {
- mbsync = {
- enable = true;
- create = "both";
- expunge = "both";
- patterns = ["*"];
- };
- msmtp.enable = true;
- mu.enable = true;
- }
- attrs
- ];
-
- pass = path: "${pkgs.pass}/bin/pass show ${path}";
- in {
- shire = mkAccount {
- address = my.email;
- gpg = {
- inherit (my.pgp) key;
- signByDefault = true;
- encryptByDefault = false;
- };
-
- primary = true;
-
- imap.host = "shire.me";
- smtp.host = "shire.me";
- userName = "azahi@shire.me";
- passwordCommand = pass "email/shire.me/azahi";
- };
-
- yahoo = mkAccount {
- address = "a.gondor@yahoo.com";
-
- imap.host = "imap.yahoo.com";
- smtp.host = "smtp.yahoo.com";
- userName = "a.gondor@yahoo.com";
- passwordCommand = pass "email/yahoo.com/a.gondor";
- };
- };
- };
-
- programs = {
- mbsync.enable = true;
- msmtp.enable = true;
- mu.enable = true;
-
- ssh.matchBlocks = let
- mkBlock = {
- hostname,
- port ? 22022,
- user ? "azahi",
- }: {
- inherit hostname port user;
- identityFile = "${config.my.home}/.ssh/id_ed25519";
- };
- mkInternalHostname = hostname: "${hostname}.${my.domain.shire}";
- in
- with my.configurations; {
- # TODO Wrap this.
- manwe = mkBlock {hostname = mkInternalHostname "manwe";};
- manwe-init = mkBlock {hostname = manwe.ipv4.address;};
- varda = mkBlock {hostname = mkInternalHostname "varda";};
- varda-init = mkBlock {hostname = varda.ipv4.address;};
- yavanna = mkBlock {hostname = mkInternalHostname "yavanna";};
- yavanna-init = mkBlock {hostname = yavanna.ipv4.address;};
- };
- };
- };
-
networking = {
interfaces = {
eth0.useDHCP = true;
diff --git a/configurations/varda/default.nix b/configurations/varda/default.nix
index 313d2fb..7efeb61 100644
--- a/configurations/varda/default.nix
+++ b/configurations/varda/default.nix
@@ -1,18 +1,11 @@
{
- config,
- inputs,
lib,
this,
...
}:
with lib; {
- secrets.wireguard-private-key-varda.file = "${inputs.self}/secrets/wireguard-private-key-varda";
-
nixfiles.modules = {
- wireguard = {
- privateKeyFile = config.secrets.wireguard-private-key-varda.path;
- client.enable = true;
- };
+ wireguard.client.enable = true;
games.minecraft.server = {
enable = true;
diff --git a/configurations/yavanna/default.nix b/configurations/yavanna/default.nix
index 3ed114e..d390e40 100644
--- a/configurations/yavanna/default.nix
+++ b/configurations/yavanna/default.nix
@@ -1,45 +1,17 @@
{
- config,
- inputs,
lib,
this,
...
}:
with lib; {
- secrets = {
- wireguard-private-key-yavanna.file = "${inputs.self}/secrets/wireguard-private-key-yavanna";
-
- syncthing-cert-yavanna = with config.services.syncthing; {
- file = "${inputs.self}/secrets/syncthing-cert-yavanna";
- owner = user;
- inherit group;
- };
-
- syncthing-key-yavanna = with config.services.syncthing; {
- file = "${inputs.self}/secrets/syncthing-key-yavanna";
- owner = user;
- inherit group;
- };
- };
-
nixfiles.modules = {
- wireguard = {
- privateKeyFile = config.secrets.wireguard-private-key-yavanna.path;
- client.enable = true;
- };
+ wireguard.client.enable = true;
- syncthing = with config.secrets; {
- enable = true;
- key = syncthing-key-yavanna.path;
- cert = syncthing-cert-yavanna.path;
- };
+ syncthing.enable = true;
acme.enable = true;
- rtorrent = {
- enable = true;
- flood.enable = true;
- };
+ rtorrent.enable = true;
};
networking = let
diff --git a/modules/nixfiles/monitoring/default.nix b/modules/nixfiles/monitoring/default.nix
index 9758cff..c439614 100644
--- a/modules/nixfiles/monitoring/default.nix
+++ b/modules/nixfiles/monitoring/default.nix
@@ -64,12 +64,80 @@ in {
loki.configuration.ruler.alertmanager_url = "https://${config.nixfiles.modules.alertmanager.domain}";
- prometheus.alertmanagers = [
- {
- scheme = "https";
- static_configs = [{targets = [config.nixfiles.modules.alertmanager.domain];}];
- }
- ];
+ prometheus = {
+ scrapeConfigs = with my.configurations;
+ with config.services.prometheus.exporters; [
+ {
+ job_name = "endlessh-go";
+ static_configs = [
+ {
+ targets = with config.services.endlessh-go.prometheus; [
+ "${manwe.hostname}:${toString port}"
+ "${varda.hostname}:${toString port}"
+ "${yavanna.hostname}:${toString port}"
+ ];
+ }
+ ];
+ }
+ {
+ job_name = "nginx";
+ static_configs = [
+ {
+ targets = with nginx; [
+ "${manwe.hostname}:${toString port}"
+ "${varda.hostname}:${toString port}"
+ "${yavanna.hostname}:${toString port}"
+ ];
+ }
+ ];
+ }
+ {
+ job_name = "node";
+ static_configs = [
+ {
+ targets = with node; [
+ "${manwe.hostname}:${toString port}"
+ "${varda.hostname}:${toString port}"
+ "${yavanna.hostname}:${toString port}"
+ ];
+ }
+ ];
+ }
+ {
+ job_name = "postgres";
+ static_configs = [
+ {
+ targets = with postgres; ["${manwe.hostname}:${toString port}"];
+ }
+ ];
+ }
+ {
+ job_name = "unbound";
+ static_configs = [
+ {
+ targets = with unbound; ["${manwe.hostname}:${toString port}"];
+ }
+ ];
+ }
+ {
+ job_name = "wireguard";
+ static_configs = [
+ {
+ targets = with wireguard; ["${manwe.hostname}:${toString port}"];
+ }
+ ];
+ }
+ ];
+
+ alertmanagers = [
+ {
+ scheme = "https";
+ static_configs = [
+ {targets = [config.nixfiles.modules.alertmanager.domain];}
+ ];
+ }
+ ];
+ };
};
};
}
diff --git a/modules/nixfiles/openssh.nix b/modules/nixfiles/openssh.nix
index 3a526d7..2bae2da 100644
--- a/modules/nixfiles/openssh.nix
+++ b/modules/nixfiles/openssh.nix
@@ -12,41 +12,73 @@ in {
server.enable = mkEnableOption "OpenSSH server";
};
- config = mkMerge [
- (mkIf cfg.client.enable {
- hm = {
- home.packages = with pkgs; [mosh sshfs];
-
- programs.ssh = {
- enable = true;
- controlMaster = "auto";
- controlPersist = "24H";
- hashKnownHosts = true;
- serverAliveCountMax = 30;
- serverAliveInterval = 60;
- };
- };
- })
- (mkIf cfg.server.enable {
- programs.mosh.enable = true;
-
- services = let
- port = 22022;
- in {
- openssh = {
- enable = true;
- ports = [port];
- logLevel = "VERBOSE";
- permitRootLogin = "no";
- passwordAuthentication = false;
+ config = let
+ port = 22022; # Port 22 should be occupied by endlessh.
+ in
+ mkMerge [
+ (mkIf cfg.client.enable {
+ hm = {
+ home.packages = with pkgs; [mosh sshfs];
+
+ programs.ssh = {
+ enable = true;
+
+ hashKnownHosts = true;
+
+ controlMaster = "auto";
+ controlPersist = "24H";
+
+ serverAliveCountMax = 30;
+ serverAliveInterval = 60;
+
+ matchBlocks = let
+ mkBlock = name: {
+ hostname ? name,
+ port ? 22,
+ user ? my.username,
+ identityFile ? "${config.my.home}/.ssh/id_ed25519",
+ extraAttrs ? {},
+ }:
+ nameValuePair name ({inherit hostname port user identityFile;}
+ // extraAttrs);
+
+ internalServers =
+ mapAttrs' mkBlock
+ (mapAttrs (name: _: {
+ hostname = "${name}.${my.domain.shire}";
+ inherit port;
+ }) (filterAttrs (_: attr:
+ hasAttr "wireguard" attr
+ && attr.isHeadless)
+ my.configurations));
+ in
+ internalServers
+ // (mapAttrs' mkBlock {
+ # Custom blocks go here.
+ #
+ # example.hostname = "129.168.70.80";
+ });
+ };
};
+ })
+ (mkIf cfg.server.enable {
+ programs.mosh.enable = true;
- fail2ban.jails.sshd = ''
- enabled = true
- mode = aggressive
- port = ${toString port}
- '';
- };
- })
- ];
+ services = {
+ openssh = {
+ enable = true;
+ ports = [port];
+ logLevel = "VERBOSE"; # Required by fail2ban.
+ permitRootLogin = "no";
+ passwordAuthentication = false;
+ };
+
+ fail2ban.jails.sshd = ''
+ enabled = true
+ mode = aggressive
+ port = ${toString port}
+ '';
+ };
+ })
+ ];
}
diff --git a/modules/nixfiles/profiles/headful.nix b/modules/nixfiles/profiles/headful.nix
index 9fd7386..d8fc208 100644
--- a/modules/nixfiles/profiles/headful.nix
+++ b/modules/nixfiles/profiles/headful.nix
@@ -40,7 +40,70 @@ in {
xmonad.enable = mkDefault false;
};
- hm.home.packages = with pkgs; [convmv dos2unix];
+ hm = {
+ home.packages = with pkgs; [
+ calibre
+ convmv
+ dos2unix
+ kotatogram-desktop
+ nheko
+ tor-browser
+ ];
+
+ accounts.email = {
+ maildirBasePath = "${config.my.home}/mail";
+
+ accounts = let
+ mkAccount = attrs:
+ mkMerge [
+ {
+ mbsync = {
+ enable = true;
+ create = "both";
+ expunge = "both";
+ patterns = ["*"];
+ };
+ msmtp.enable = true;
+ mu.enable = true;
+ }
+ attrs
+ ];
+
+ pass = path: "${pkgs.pass}/bin/pass show ${path}";
+ in {
+ shire = mkAccount {
+ address = my.email;
+ gpg = {
+ inherit (my.pgp) key;
+ signByDefault = true;
+ encryptByDefault = false;
+ };
+
+ primary = true;
+
+ imap.host = "shire.me";
+ smtp.host = "shire.me";
+ userName = "azahi@shire.me";
+ passwordCommand = pass "email/shire.me/azahi";
+ };
+
+ yahoo = mkAccount {
+ address = "a.gondor@yahoo.com";
+
+ imap.host = "imap.yahoo.com";
+ smtp.host = "smtp.yahoo.com";
+ userName = "a.gondor@yahoo.com";
+ passwordCommand = pass "email/yahoo.com/a.gondor";
+ };
+ };
+ };
+
+ programs = {
+ mbsync.enable = true;
+ msmtp.enable = true;
+ mu.enable = true;
+ };
+ };
# There are (arguably) not a lot of reasons to keep mitigations enabled for
# on machine that is not web-facing. First of all, to completely mitigate
diff --git a/modules/nixfiles/rtorrent.nix b/modules/nixfiles/rtorrent.nix
index a91e83d..121f1ca 100644
--- a/modules/nixfiles/rtorrent.nix
+++ b/modules/nixfiles/rtorrent.nix
@@ -11,7 +11,7 @@ in {
enable = mkEnableOption "rTorrent";
flood = {
- enable = mkEnableOption "Flood";
+ enable = mkEnableOption "Flood" // {default = cfg.enable;};
domain = mkOption {
description = "Domain name sans protocol scheme.";
diff --git a/modules/nixfiles/syncthing.nix b/modules/nixfiles/syncthing.nix
index 6e6e629..31286fa 100644
--- a/modules/nixfiles/syncthing.nix
+++ b/modules/nixfiles/syncthing.nix
@@ -1,5 +1,6 @@
{
config,
+ inputs,
lib,
pkgs,
this,
@@ -16,34 +17,23 @@ in {
type = with types; str;
default = "syncthing.${config.networking.fqdn}";
};
-
- # TODO Set this automatically shire on the hostname.
- cert = mkOption {
- description = "Path to the cert file.";
- type = with types; nullOr string;
- default = null;
- };
-
- # TODO Set this automatically shire on the hostname.
- key = mkOption {
- description = "Path to the key file.";
- type = with types; nullOr string;
- default = null;
- };
};
config = mkIf cfg.enable (mkMerge [
{
- assertions = [
- {
- assertion = cfg.cert != null;
- message = "Cert file needs to be specified.";
- }
- {
- assertion = cfg.key != null;
- message = "Key file needs to be specified.";
- }
- ];
+ secrets = {
+ "syncthing-cert-${this.hostname}" = with config.services.syncthing; {
+ file = "${inputs.self}/secrets/syncthing-cert-${this.hostname}";
+ owner = user;
+ inherit group;
+ };
+
+ "syncthing-key-${this.hostname}" = with config.services.syncthing; {
+ file = "${inputs.self}/secrets/syncthing-key-${this.hostname}";
+ owner = user;
+ inherit group;
+ };
+ };
services.syncthing = {
enable = true;
@@ -55,7 +45,8 @@ in {
guiAddress = "127.0.0.1:8384";
- inherit (cfg) key cert;
+ cert = config.secrets."syncthing-cert-${this.hostname}".path;
+ key = config.secrets."syncthing-key-${this.hostname}".path;
overrideDevices = true;
devices = mapAttrs (name: attr:
@@ -94,9 +85,8 @@ in {
versioning = trashcan;
};
pass = {
- path =
- config.hm.programs.password-store.settings.PASSWORD_STORE_DIR;
- devices = all;
+ path = config.hm.programs.password-store.settings.PASSWORD_STORE_DIR;
+ devices = notOther;
versioning = trashcan;
};
org = {
@@ -114,8 +104,8 @@ in {
devices = notOther;
versioning = trashcan;
};
- vidya = {
- path = "${documents}/vidya";
+ books = {
+ path = "${documents}/books";
devices = notOther;
versioning = trashcan;
};
diff --git a/modules/nixfiles/wireguard.nix b/modules/nixfiles/wireguard.nix
index c4fca1e..f98b4e3 100644
--- a/modules/nixfiles/wireguard.nix
+++ b/modules/nixfiles/wireguard.nix
@@ -1,5 +1,6 @@
{
config,
+ inputs,
lib,
pkgs,
this,
@@ -9,13 +10,6 @@ with lib; let
cfg = config.nixfiles.modules.wireguard;
in {
options.nixfiles.modules.wireguard = {
- # TODO Set this automatically shire on the hostname.
- privateKeyFile = mkOption {
- description = "Path to the private key file.";
- type = with types; nullOr string;
- default = null;
- };
-
client = {
enable = mkEnableOption "WireGuard client";
@@ -98,10 +92,6 @@ in {
{
assertions = [
{
- assertion = cfg.privateKeyFile != null;
- message = "Key file must be specified.";
- }
- {
assertion = config.security.sudo.enable;
message = "Sudo is not enabled.";
}
@@ -113,12 +103,14 @@ in {
}
// mkMerge [
(mkIf (cfg.client.enable || cfg.server.enable) {
+ secrets."wireguard-private-key-${this.hostname}".file = "${inputs.self}/secrets/wireguard-private-key-${this.hostname}";
+
networking.firewall.trustedInterfaces = [cfg.interface];
})
(mkIf cfg.client.enable {
networking.wg-quick.interfaces.${cfg.interface} = mkMerge [
(with this.wireguard; {
- inherit (cfg) privateKeyFile;
+ privateKeyFile = config.secrets."wireguard-private-key-${this.hostname}".path;
address = ["${ipv4.address}/16" "${ipv6.address}/16"];
})
(with cfg.server; {
@@ -173,7 +165,7 @@ in {
wireguard = {
enable = true;
interfaces.${cfg.interface} = with cfg.server; {
- inherit (cfg) privateKeyFile;
+ privateKeyFile = config.secrets."wireguard-private-key-${this.hostname}".path;
ips = ["${ipv4.address}/16" "${ipv6.address}/16"];
listenPort = port;
inherit peers;
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-20 00:55:17 +0000