blob: a47cd88c32c5348213108407b6a39540e64d80a2 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
{
config,
inputs,
lib,
...
}:
with lib; {
imports = [
./mailserver.nix
./webserver.nix
];
nixfiles.modules = {
nsd = {
enable = true;
fqdn = "ns1.${config.networking.domain}";
};
unbound.enable = true;
wireguard.server.enable = true;
acme.enable = true;
monitoring.enable = true;
postgresql.enable = true;
git.server = {
enable = true;
domain = "git.${my.domain.azahi}";
};
gotify.enable = true;
matrix.dendrite = {
enable = true;
domain = my.domain.azahi;
};
murmur.enable = true;
radicale.enable = true;
rss-bridge.enable = true;
shadowsocks.enable = true;
soju = {
enable = true;
domain = my.domain.azahi;
};
vaultwarden.enable = true;
};
# To play old LAN games with the boys.
secrets."wireguard-private-key-70".file = "${inputs.self}/secrets/wireguard-private-key-70";
networking = mkIf config.nixfiles.modules.wireguard.server.enable {
wireguard.interfaces.wg70 = {
ips = ["10.70.0.1/16"];
listenPort = 7070;
privateKeyFile = config.secrets."wireguard-private-key-70".path;
peers = [
{
publicKey = "@PUBLIC_KEY@";
allowedIPs = ["10.70.1.1/32"];
}
{
publicKey = "@PUBLIC_KEY@";
allowedIPs = ["10.70.1.2/32"];
}
{
publicKey = "@PUBLIC_KEY@";
allowedIPs = ["10.70.1.3/32"];
}
{
publicKey = "@PUBLIC_KEY@";
allowedIPs = ["10.70.1.4/32"];
}
];
};
firewall.allowedUDPPorts = [7070];
};
boot = {
loader.grub = {
enable = true;
device = "/dev/sda";
};
initrd.availableKernelModules = [
"virtio_pci"
"virtio_scsi"
];
};
fileSystems = {
"/" = {
device = "/dev/sda2";
fsType = "xfs";
options = ["noatime"];
};
"/boot" = {
device = "/dev/sda1";
fsType = "xfs";
options = ["noatime"];
};
};
swapDevices = [
{
device = "/dev/sda3";
}
];
zramSwap = {
enable = true;
memoryPercent = 25;
};
}
|
