From 525dff002e7fe360b0c9803f1004ad2c8749c319 Mon Sep 17 00:00:00 2001 From: makefu Date: Fri, 13 Nov 2015 12:24:29 +0100 Subject: m 1 gum: disable ipv6, open up fw --- makefu/1systems/gum.nix | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) (limited to 'makefu/1systems') diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index 8dd347b4f..63db7a71c 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -16,7 +16,6 @@ in { krebs.build.target = "root@gum.krebsco.de"; krebs.build.host = config.krebs.hosts.gum; - # Chat environment.systemPackages = with pkgs;[ weechat @@ -33,21 +32,24 @@ in { services.udev.extraRules = '' SUBSYSTEM=="net", ATTR{address}=="c8:0a:a9:c8:ee:dd", NAME="et0" ''; + boot.kernelParams = [ "ipv6.disable=1" ]; networking = { - firewall = { - allowPing = true; - allowedTCPPorts = [ - # smtp - 25 - # http - 80 443 - # tinc - 655 - ]; - allowedUDPPorts = [ - # tinc - 655 53 - ]; + enableIPv6 = false; + firewall = { + allowPing = true; + logRefusedConnections = false; + allowedTCPPorts = [ + # smtp + 25 + # http + 80 443 + # tinc + 655 + ]; + allowedUDPPorts = [ + # tinc + 655 53 + ]; }; interfaces.et0.ip4 = [{ address = external-ip; -- cgit v1.3.1 From e0ae8c1a3fe333de8a14b04b4a7e2dd01163b727 Mon Sep 17 00:00:00 2001 From: makefu Date: Fri, 13 Nov 2015 12:25:18 +0100 Subject: m 1 {gum,wry}: disable dropped packet logging --- makefu/1systems/wry.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'makefu/1systems') diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index ba94972fb..cd39b4b9f 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -59,9 +59,12 @@ in { }; networking = { - firewall.allowPing = true; - firewall.allowedTCPPorts = [ 53 80 443 ]; - firewall.allowedUDPPorts = [ 655 ]; + firewall = { + allowPing = true; + logRefusedConnections = false; + allowedTCPPorts = [ 53 80 443 ]; + allowedUDPPorts = [ 655 ]; + }; interfaces.enp2s1.ip4 = [{ address = external-ip; prefixLength = 24; -- cgit v1.3.1 From 78660ea002d5912eb8d06da1895cc6e34bd5e6eb Mon Sep 17 00:00:00 2001 From: makefu Date: Sat, 14 Nov 2015 01:48:49 +0100 Subject: m 1 filepimp: remove legacy imports --- makefu/1systems/filepimp.nix | 2 -- 1 file changed, 2 deletions(-) (limited to 'makefu/1systems') diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix index fb1a57552..66ea2ce90 100644 --- a/makefu/1systems/filepimp.nix +++ b/makefu/1systems/filepimp.nix @@ -7,8 +7,6 @@ { imports = [ # Include the results of the hardware scan. - ../2configs/default.nix - ../2configs/fs/vm-single-partition.nix ../2configs/fs/single-partition-ext4.nix ../2configs/tinc-basic-retiolum.nix ]; -- cgit v1.3.1 From 2b9d7bdda10689e8bd8f7ed39830fd274c02457b Mon Sep 17 00:00:00 2001 From: makefu Date: Sat, 14 Nov 2015 01:49:31 +0100 Subject: m 1 gum: add swap to server config --- makefu/1systems/gum.nix | 1 + makefu/2configs/fs/simple-swap.nix | 11 +++++++++++ 2 files changed, 12 insertions(+) create mode 100644 makefu/2configs/fs/simple-swap.nix (limited to 'makefu/1systems') diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index 8dd347b4f..44ab8c6f8 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -9,6 +9,7 @@ in { # TODO: copy this config or move to krebs ../2configs/tinc-basic-retiolum.nix ../2configs/headless.nix + ../2configs/fs/simple-swap.nix ../2configs/fs/single-partition-ext4.nix # ../2configs/iodined.nix diff --git a/makefu/2configs/fs/simple-swap.nix b/makefu/2configs/fs/simple-swap.nix new file mode 100644 index 000000000..8c161b287 --- /dev/null +++ b/makefu/2configs/fs/simple-swap.nix @@ -0,0 +1,11 @@ +_: +{ + # do not swap that often + boot.kernel.sysctl = { + "vm.swappiness" = 25; + }; + + swapDevices = [ + { device = "/dev/disk/by-label/swap"; } + ]; +} -- cgit v1.3.1 From b69dcc6086c16ae996575bb00a1f55a14c26b63e Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 17 Nov 2015 13:54:55 +0100 Subject: m 1 gum: add ssh repo --- makefu/1systems/gum.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'makefu/1systems') diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index d8b7ed5f9..63ad18339 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -12,6 +12,7 @@ in { ../2configs/fs/simple-swap.nix ../2configs/fs/single-partition-ext4.nix # ../2configs/iodined.nix + ../2configs/git/cgit-retiolum.nix ]; -- cgit v1.3.1 From b2ac9b092a36c3196469099c73c64c8ca6626be0 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 17 Nov 2015 22:16:55 +0100 Subject: makefu: fix cgit for wry, add gc to wry --- makefu/1systems/wry.nix | 8 ++++++-- makefu/2configs/git/cgit-retiolum.nix | 23 ++++++++++++----------- 2 files changed, 18 insertions(+), 13 deletions(-) (limited to 'makefu/1systems') diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index cd39b4b9f..cd2b3f657 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -24,11 +24,11 @@ in { # other nginx ../2configs/nginx/euer.wiki.nix ../2configs/nginx/euer.blog.nix + ../2configs/nginx/euer.test.nix # collectd ../2configs/collectd/collectd-base.nix ]; - krebs.build.host = config.krebs.hosts.wry; krebs.Reaktor.enable = true; @@ -73,5 +73,9 @@ in { nameservers = [ "8.8.8.8" ]; }; - environment.systemPackages = [ pkgs.translate-shell ]; + # small machine - do not forget to gc every day + nix.gc.automatic = true; + nix.gc.dates = "03:10"; + + environment.systemPackages = [ ]; } diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix index 748cd6427..e12827697 100644 --- a/makefu/2configs/git/cgit-retiolum.nix +++ b/makefu/2configs/git/cgit-retiolum.nix @@ -22,7 +22,7 @@ let }; connector-repos = mapAttrs make-priv-repo { - autosync = { }; + connector = { }; }; @@ -36,7 +36,7 @@ let inherit name desc; public = true; hooks = { - post-receive = git.irc-announce { + post-receive = pkgs.git-hooks.irc-announce { nick = config.networking.hostName; verbose = config.krebs.build.host.name == "pnp"; channel = "#retiolum"; @@ -51,11 +51,11 @@ let # TODO: get the list of all krebsministers krebsminister = with config.krebs.users; [ lass tv uriel ]; all-makefu = with config.krebs.users; [ makefu makefu-omo makefu-tsp ]; - exco = with config.krebs.users; [ exco ]; + all-exco = with config.krebs.users; [ exco ]; priv-rules = repo: set-owners repo all-makefu; - connector-rules = repo: set-owners repo (all-makefu ++ exco); + connector-rules = repo: set-owners repo all-makefu ++ set-owners repo all-exco; krebs-rules = repo: set-owners repo all-makefu ++ set-ro-access repo krebsminister; @@ -76,18 +76,19 @@ let in { imports = [{ - krebs.users.makefu-omo = { + krebs.users = { + makefu-omo = { name = "makefu-omo" ; pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_omo.ssh.pub; - }; - krebs.users.makefu-tsp = { + }; + makefu-tsp = { name = "makefu-tsp" ; pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_tsp.ssh.pub; - }; - - krebs.users.exco = { - name = "exco" ; + }; + exco = { + name = "exco"; pubkey= with builtins; readFile ../../../krebs/Zpubkeys/exco.ssh.pub; + }; }; }]; krebs.git = { -- cgit v1.3.1