From 767c6fbd14fc8e5eb73cea2f738af88083fcea32 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 01:23:42 +0100 Subject: l yellow.r: move to neoprism, refactor --- lass/1systems/neoprism/config.nix | 3 +- lass/1systems/yellow/config.nix | 105 +++++++++++++++++++++++++++++++++----- 2 files changed, 93 insertions(+), 15 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index 89ad8cfdc..b7bf7afb2 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,7 +4,8 @@ imports = [ - + + { # TODO make new hfos.nix out of this vv users.users.riot = { uid = pkgs.stockholm.lib.genid_uint31 "riot"; diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ecf0337ed..552dd7f00 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,20 +9,23 @@ in { krebs.build.host = config.krebs.hosts.yellow; + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; + }; + users.groups.download.members = [ "transmission" ]; networking.useHostResolvConf = false; networking.useNetworkd = true; - systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; - systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { enable = true; + home = "/var/state/transmission"; group = "download"; downloadDirPermissions = "775"; settings = { - download-dir = "/var/download/finished"; - incomplete-dir = "/var/download/incoming"; - incomplete-dir-enable = true; + download-dir = "/var/download/transmission"; + incomplete-dir-enabled = false; rpc-bind-address = "::"; message-level = 1; umask = 18; @@ -40,11 +43,8 @@ in { }; virtualHosts.default = { default = true; - locations."/dl".extraConfig = '' - return 301 /; - ''; locations."/" = { - root = "/var/download/finished"; + root = "/var/download"; extraConfig = '' fancyindex on; fancyindex_footer "/fancy.html"; @@ -136,6 +136,58 @@ in { ''}; ''; }; + virtualHosts."jelly.r" = { + locations."/".extraConfig = '' + proxy_pass http://localhost:8096/; + proxy_set_header Accept-Encoding ""; + ''; + }; + }; + + services.samba = { + enable = true; + enableNmbd = false; + extraConfig = '' + workgroup = WORKGROUP + server string = ${config.networking.hostName} + # only allow retiolum addresses + hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 + + # Use sendfile() for performance gain + use sendfile = true + + # No NetBIOS is needed + disable netbios = true + + # Only mangle non-valid NTFS names, don't care about DOS support + mangled names = illegal + + # Performance optimizations + socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 + + # Disable all printing + load printers = false + disable spoolss = true + printcap name = /dev/null + + map to guest = Bad User + max log size = 50 + dns proxy = no + security = user + + [global] + syslog only = yes + ''; + shares.public = { + comment = "Warez"; + path = "/var/download"; + public = "yes"; + "only guest" = "yes"; + "create mask" = "0644"; + "directory mask" = "2777"; + writable = "no"; + printable = "no"; + }; }; systemd.services.bruellwuerfel = @@ -164,14 +216,33 @@ in { tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web - { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin + { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr + { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr + { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + + # smbd + { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; } ]; tables.filter.OUTPUT = { policy = "DROP"; rules = [ + { predicate = "-o lo"; target = "ACCEPT"; } { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } @@ -279,7 +350,7 @@ in { ExecStart = pkgs.writers.writeDash "flix-index" '' set -efu - DIR=/var/download/finished + DIR=/var/download cd "$DIR" while inotifywait -rq -e create -e move -e delete "$DIR"; do find . -type f > "$DIR"/index.tmp @@ -294,9 +365,15 @@ in { group = "download"; }; - services.magnetico = { + services.radarr = { + enable = true; + }; + + services.sonarr = { + enable = true; + }; + + services.prowlarr = { enable = true; - web.address = "0.0.0.0"; - web.port = 9092; }; } -- cgit v1.3.1 From 7cb49c556efce96b15b28807464b8d5cdf1ea999 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 18:33:44 +0100 Subject: l neoprism.r: add riot container --- lass/1systems/neoprism/config.nix | 15 +---------- lass/2configs/riot.nix | 56 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 14 deletions(-) create mode 100644 lass/2configs/riot.nix (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index b7bf7afb2..f203abc07 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -6,20 +6,7 @@ - { # TODO make new hfos.nix out of this vv - users.users.riot = { - uid = pkgs.stockholm.lib.genid_uint31 "riot"; - isNormalUser = true; - extraGroups = [ "libvirtd" ]; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" - ]; - }; - # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } - # ]; - } + ]; krebs.build.host = config.krebs.hosts.neoprism; diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix new file mode 100644 index 000000000..37a6298ca --- /dev/null +++ b/lass/2configs/riot.nix @@ -0,0 +1,56 @@ +{ config, lib, pkgs, ... }: +{ + containers.riot = { + config = { + environment.systemPackages = [ + pkgs.dhcpcd + pkgs.git + pkgs.jq + ]; + networking.useDHCP = lib.mkForce true; + networking.firewall.enable = false; + systemd.services.autoswitch = { + environment = { + NIX_REMOTE = "daemon"; + }; + wantedBy = [ "multi-user.target" ]; + serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" '' + set -efu + if test -e /var/src/nixos-config; then + /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || : + fi + ''; + unitConfig.X-StopOnRemoval = false; + }; + }; + autoStart = true; + enableTun = true; + privateNetwork = true; + hostAddress = "10.233.1.1"; + localAddress = "10.233.1.2"; + forwardPorts = [ + { hostPort = 45622; containerPort = 22; } + ]; + }; + + systemd.network.networks."50-ve-riot" = { + matchConfig.Name = "ve-riot"; + + networkConfig = { + IPForward = "yes"; + # weirdly we have to use POSTROUTING MASQUERADE here + # IPMasquerade = "both"; + LinkLocalAddressing = "no"; + KeepConfiguration = "static"; + }; + }; + + # networking.nat can be used instead of this + krebs.iptables.tables.nat.POSTROUTING.rules = [ + { v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; } + ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { predicate = "-i ve-riot"; target = "ACCEPT"; } + { predicate = "-o ve-riot"; target = "ACCEPT"; } + ]; +} -- cgit v1.3.1 From 6f0cd02c8c78545899fa4afeeeacd68a365349de Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 21:00:29 +0100 Subject: l: prism-mount -> yellow-mount --- lass/1systems/coaxmetal/config.nix | 2 +- lass/1systems/shodan/config.nix | 2 +- lass/2configs/prism-mounts/samba.nix | 15 --------------- lass/2configs/yellow-mounts/samba.nix | 15 +++++++++++++++ 4 files changed, 17 insertions(+), 17 deletions(-) delete mode 100644 lass/2configs/prism-mounts/samba.nix create mode 100644 lass/2configs/yellow-mounts/samba.nix (limited to 'lass/1systems') diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix index dd8308bbd..2c88b68cc 100644 --- a/lass/1systems/coaxmetal/config.nix +++ b/lass/1systems/coaxmetal/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix index ef538f339..5e48c216a 100644 --- a/lass/1systems/shodan/config.nix +++ b/lass/1systems/shodan/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/2configs/prism-mounts/samba.nix b/lass/2configs/prism-mounts/samba.nix deleted file mode 100644 index 4b1475ef3..000000000 --- a/lass/2configs/prism-mounts/samba.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ - fileSystems."/mnt/prism" = { - device = "//prism.r/public"; - fsType = "cifs"; - options = [ - "guest" - "nofail" - "noauto" - "ro" - "x-systemd.automount" - "x-systemd.device-timeout=1" - "x-systemd.idle-timeout=1min" - ]; - }; - } diff --git a/lass/2configs/yellow-mounts/samba.nix b/lass/2configs/yellow-mounts/samba.nix new file mode 100644 index 000000000..e16f1cc47 --- /dev/null +++ b/lass/2configs/yellow-mounts/samba.nix @@ -0,0 +1,15 @@ +{ + fileSystems."/mnt/yellow" = { + device = "//yellow.r/public"; + fsType = "cifs"; + options = [ + "guest" + "nofail" + "noauto" + "ro" + "x-systemd.automount" + "x-systemd.device-timeout=1" + "x-systemd.idle-timeout=1min" + ]; + }; + } -- cgit v1.3.1 From 0b2952f4ed9572521f7c4a21904943ac33c602b0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 6 Jan 2023 12:17:04 +0100 Subject: l radio.r: init --- kartei/lass/radio.nix | 39 +++++++++++++++++++++++++++++++++++++++ lass/1systems/radio/config.nix | 24 ++++++++++++++++++++++++ lass/1systems/radio/physical.nix | 7 +++++++ 3 files changed, 70 insertions(+) create mode 100644 kartei/lass/radio.nix create mode 100644 lass/1systems/radio/config.nix create mode 100644 lass/1systems/radio/physical.nix (limited to 'lass/1systems') diff --git a/kartei/lass/radio.nix b/kartei/lass/radio.nix new file mode 100644 index 000000000..bfb177e19 --- /dev/null +++ b/kartei/lass/radio.nix @@ -0,0 +1,39 @@ +{ r6, w6, ... }: +{ + nets = { + retiolum = { + ip4.addr = "10.243.0.11"; + ip6.addr = r6 "4d10"; + aliases = [ + "radio.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAx08urv4sl22+pLchD6W6kprJ1JZBiG9/MVA50PqYAJmvTpYyDUCR + Dwgt7pR8n/zbbof98QS5D67J5rZPcrLI6PY2bBzlXFFKHZEj2AVwUjUbyvEvQqtf + yJM+AxFy1/CaXmDvYM9UF/Wh6rb/ZeUxFtbaIVfMPox0Zln0THEsOmCWvNzxMvjZ + rjouZGzrH+er3yxJVovxD/JT32COmK0R20DLDoofBdtBkFlB/VkrbxYfX/cWXX1K + WQVJuQ/H1xP9m4c4S8g/nM63rLUBOIkn06TcXyI/mEgRecEUDgC02PNXc5BDgB4A + seXx+BiLC/f6+64KOWODHEEm/iHjCyrOSZtdA2EbPCATfOHrj0EG5Y4V6d1Iw4WP + kiOIQByHMbOzRwm91yd/gM1DTxdy3j5nqaMhCzrM/QeOhSf5FXkWpARawUsChwh+ + eCuSZDg218u/NkzCrTvCPTdY1q+MZ5d5qgID4VQrenjBJq4AZxsw74Zd2G2uRWlF + paZ2pSCyAey19A/or2iG10tqNpXJzZy0HNhh7q/gKhQKKTh+ggzgOrRe2ZaxlbEy + P45JQKcR9/WJAohnYQ8uZJ6oin5EsEdVkapdYu60aReRGeyTmq3RLnu3Zn5MR5RH + 1r+W03KQcQzmmpE5YrxKSZL6OriXQYEPTa9/mSZT6TEUIvRT8W5jGQ0CAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + tinc.pubkey_ed25519 = "DmiyfmRsWd8Qg6M/ZsAd5lFM+vnkwRTfnMH/jCFwWFF"; + }; + wiregrill = { + ip6.addr = w6 "4d10"; + aliases = [ + "radio.w" + ]; + wireguard.pubkey = '' + iCe1O9qeziw18AlGuFt5tIxm6SIBtNpwO/6OZm9Bn30= + ''; + }; + }; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHsvyWrMN2lupBmjI8nW+NUSJIDPkr8c90Z4BcuZ7Myi"; + syncthing.id = "KMDPLE5-7FBYYXH-PF5LEET-G2AWR33-7XAPZJU-5S3VOB7-ZX5Q74V-PZKI6QN"; +} diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix new file mode 100644 index 000000000..2fd23a448 --- /dev/null +++ b/lass/1systems/radio/config.nix @@ -0,0 +1,24 @@ +with import ; +{ config, lib, pkgs, ... }: +{ + imports = [ + + + + + + + ]; + + krebs.build.host = config.krebs.hosts.radio; + + security.acme = { + acceptTerms = true; + defaults.email = "acme@lassul.us"; + }; + + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt"; + }; +} diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/radio/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +} -- cgit v1.3.1