fixed networking with new interface, removed nginx and acme to fix credentials.

machines/celebrian/configuration.nix

@@ -6,16 +6,10 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+      ../../profiles/base.nix
-      ../profiles/base.nix
+      ../../services/ssh.nix
-      ../services/ssh.nix
     ];
 
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  #boot.loader.grub.version = 2; #Depreciated
-  boot.loader.grub.efiSupport = true;
-  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only # Define on which hard drive you want to install Grub.
 
   # Set your time zone.
   time.timeZone = "Europe/Oslo";
@@ -25,8 +19,8 @@
   # Per-interface useDHCP will be mandatory in the future, so this generated config
   # replicates the default behaviour.
   networking.useDHCP = false;                   
-  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens3.useDHCP = true; # lmao interface is not constant. I really only want to use dhcp att all so could remove this in favor of the old way.
-  networking.hostName = "addictedmaker"; # Define your hostname.
+  networking.hostName = "celebrian"; # Define your hostname.
   networking.domain = "addictedmaker.eu"; # Define your domain.
   
   boot.kernel.sysctl = {
@@ -61,48 +55,48 @@
 
 
   #add proxyserver to acme
-  users.users.kanidm.extraGroups = [ "acme" ];
+  #users.users.kanidm.extraGroups = [ "acme" ];
 
 #sequrity managment through kanidm
-  systemd.services.kanidm = let
+#  systemd.services.kanidm = let
-    certName = config.services.nginx.virtualHosts.${config.services.kanidm.serverSettings.domain}.useACMEHost;
+#    certName = config.services.nginx.virtualHosts.${config.services.kanidm.serverSettings.domain}.useACMEHost;
-  in {
+#  in {
-    requires = [ "acme-finished-${certName}.target" ];
+#    requires = [ "acme-finished-${certName}.target" ];
-    serviceConfig.LoadCredential = let
+#    serviceConfig.LoadCredential = let
-      certDir = config.security.acme.certs.${certName}.directory;
+#      certDir = config.security.acme.certs.${certName}.directory;
-    in [
+#    in [
-      "fullchain.pem:${certDir}/fullchain.pem"
+#      "fullchain.pem:${certDir}/fullchain.pem"
-      "key.pem:${certDir}/key.pem"
+#      "key.pem:${certDir}/key.pem"
-    ];
+#    ];
-  };
-
-  services.kanidm = {
-    enableServer = true;
-    #enablePam = true;
-    serverSettings = let
-      credsDir = "/run/credentials/kanidm.service";
-      #credsDir = "/var/lib/acme/${config.networking.domain}"; #the files are here but not readable
-    in {
-      origin = "https://${config.services.kanidm.serverSettings.domain}";
-      domain = "auth.${config.networking.domain}";
-      tls_chain = "${credsDir}/fullchain.pem";
-      tls_key = "${credsDir}/key.pem";
-      bindaddress = "localhost:8300";
-    };
-
-    clientSettings = {
-      # This should be at /etc/kanidm/config or ~/.config/kanidm, and configures the kanidm command line tool
-      uri = "${config.services.kanidm.serverSettings.bindaddress}";
-      verify_ca = true;
-      verify_hostnames = true;
-    };
-  };
-
-  #environment = {
-  #  etc."kanidm/config".text = ''
-  #    uri="https://auth.${config.networking.domain}"
-  #  '';
 #  };
+#
+#  services.kanidm = {
+#    enableServer = true;
+#    #enablePam = true;
+#    serverSettings = let
+#      credsDir = "/run/credentials/kanidm.service";
+#      #credsDir = "/var/lib/acme/${config.networking.domain}"; #the files are here but not readable
+#    in {
+#      origin = "https://${config.services.kanidm.serverSettings.domain}";
+#      domain = "auth.${config.networking.domain}";
+#      tls_chain = "${credsDir}/fullchain.pem";
+#      tls_key = "${credsDir}/key.pem";
+#      bindaddress = "localhost:8300";
+#    };
+#
+#    clientSettings = {
+#      # This should be at /etc/kanidm/config or ~/.config/kanidm, and configures the kanidm command line tool
+#      uri = "${config.services.kanidm.serverSettings.bindaddress}";
+#      verify_ca = true;
+#      verify_hostnames = true;
+#    };
+			#  };
+#
+#  #environment = {
+#  #  etc."kanidm/config".text = ''
+#  #    uri="https://auth.${config.networking.domain}"
+#  #  '';
+#  #}; 
 
 
 #vpn stuff
@@ -135,17 +129,6 @@
   #tailscale
   services.tailscale.enable = true;
 
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-  services.openssh.settings.UseDns = true;
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
-  services.openssh.startWhenNeeded = true;
-  services.openssh.ports = [ 6969 ];
-  services.endlessh.enable = true; #ssh honeypot
-  services.endlessh.port = 22;
-  services.endlessh.openFirewall = true;
-  services.sshguard.enable = true; #protection against brute force attacks like fail2ban
-
   users.users."root".openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTExYoT3+flrd2wPYiT7sFFDmAUqi2YAz0ldQg7WMop"
   ];

profiles/base.nix

@@ -3,7 +3,7 @@
 imports =
     [ 
       ../packages/vim.nix
-      ./sops.nix
+      #./sops.nix
     ];
 
   #nix stuff

profiles/sops.nix

@@ -10,18 +10,20 @@
   # This will add secrets.yml to the nix store
   # You can avoid this by adding a string to the full path instead, i.e.
   # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-  sops.defaultSopsFile = ./secrets.yaml;
+  sops.defaultSopsFile = ../secrets/secrets.yaml;
   # This will automatically import SSH keys as age keys
-  sops.age.sshKeyPaths = [ "/etc/ssh/nixos" "/$HOME/.ssh/nixos" "/home/gunalx/.ssh/nixos" ];
+  sops.age.sshKeyPaths = [
+			 "/etc/ssh/nixos"
+			 #"/$HOME/.ssh/nixos"
+		         #"/home/gunalx/.ssh/nixos"
+			 ];
   # This is using an age key that is expected to already be in the filesystem
-  # sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   # This will generate a new key if the key specified above does not exist
-  sops.age.generateKey = true
+  sops.age.generateKey = true;
 
   # This is the actual specification of the secrets.
   #sops.secrets."myservice/my_subdir/my_secret" = {};
-  sops.secrets."acme/creds/domeneshop" = {
+  sops.secrets."acme/certs/domeneshop" = {  };
-    
-  };
 
 }

services/nginx.nix

@@ -15,7 +15,7 @@ in
       extraDomainNames = [ "*.${config.networking.domain}"   "lauterer.it" "*.lauterer.it" "*.256.no" "*.256.no"];
       dnsProvider = "domeneshop";   # from here according to privider https://go-acme.github.io/lego/dns/ 
       dnsPropagationCheck = true;
-      credentialsFile =  config.sops.secrets."acme/creds/domeneshop".path; #need to manually create this file according to dnsprovider secrets, and format of key according to lego in privider and add to secrets.yaml
+      credentialsFile =  config.sops.secrets."acme/certs/domeneshop".path; #need to manually create this file according to dnsprovider secrets, and format of key according to lego in privider and add to secrets.yaml
     };
   };
 

services/ssh.nix

@@ -11,23 +11,22 @@
     settings.UseDns = true;
     settings.PermitRootLogin = "prohibit-password";
     startWhenNeeded = true;
-    UseDns = true;
+    ports = [ 6969 ];
-    ports = [ 25264 ];
     openFirewall = true;
-    Ciphers = [
+    settings.Ciphers = [
       "chacha20-poly1305@openssh.com"
       "aes256-gcm@openssh.com"
       "aes128-gcm@openssh.com"
       "aes256-ctr"
       # remove some weaker ciphers
-    ]
+    ];
-  }
+  };
-  endlessh = {
+  services.endlessh = {
     enable = true;
     port = 22;
     openFirewall = true;
   };
-  sshguard.enable = true; #protection against brute force attacks like fail2ban
+  services.sshguard.enable = true; #protection against brute force attacks like fail2ban
 
 
 }