added old config files and started moving stuff to seperate modules.
This commit is contained in:
=
parent
7a5af0638a
commit
74518dbefa
|
|
@ -0,0 +1,5 @@
|
|||
# ignore all unencrypted secrets files in this directory
|
||||
./secrets/secrets.priv.yaml
|
||||
./secrets/secrets.yaml.priv
|
||||
./secrets/secrets.priv.yaml.gpg
|
||||
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
# things to setup on new headscale server
|
||||
### setup nixos
|
||||
1. get nixos running (preferably 22.11 or later)
|
||||
2. get a way to paste the config file from this repo to /etc/nixos/configuration.nix (like over ssh)
|
||||
|
||||
### domain provider
|
||||
1. setup domain and domain and domain with wildcard to point to new server ip.
|
||||
2. make sure any other domains that require this ingress points to it.
|
||||
3. create a api key or similar to fit in a file like this. https://go-acme.github.io/lego/dns
|
||||
4. create api kay file in /ver/lib/secrets/cert.secret, you can drop the \ and the last config line in the example from lego as this is not needed with nixos
|
||||
|
||||
|
||||
|
||||
|
||||
### setup tailscale headscale
|
||||
1. create a namespace in headscale.
|
||||
2. add tailscale to headscale with ```sudo tailscale up --login-server https://vpn.example.domain ``` (could be localhost)
|
||||
3. follow link in a browser, copy result command on this server, but replace USERNAME in --user USERNAME with namespace name (might be that headscale has updated and only uses namespaces as term now?)
|
||||
4. add all other clients needed to tailscale again with the same process
|
||||
|
||||
### done
|
||||
|
||||
# add a new remote or nated service
|
||||
1. add the machine running the service to the tailscale/headscale network like in install process
|
||||
2. get the headscale name with ``` headscale nodes list ```
|
||||
3. go to configuration.nix with vim or another editor
|
||||
4. add a virtual host to nginx for proxy, can copy one and change subdomain and proxy to machine + port, might remove basic auth if the service is intendend for everyone.
|
||||
|
||||
|
||||
#Other solutions
|
||||
might end in the situation where nixos is not an option and docker containers with diffrent things is my backup solution.
|
||||
nothing is created yet but plan to use headscale with headscale-ui docker container in addition to something like nginxproxymanager,træfik or caddy. In this case use certbot or acme for certs i think.
|
||||
|
||||
NGINX alternative: Caddy seems promising with tailscale integrated in the future.
|
||||
|
||||
Tailscale/headscale alternative: plain wireguard, openvpn or
|
||||
|
||||
|
|
@ -0,0 +1,197 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../profiles/base.nix
|
||||
../services/ssh.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
#boot.loader.grub.version = 2; #Depreciated
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only # Define on which hard drive you want to install Grub.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.useDHCP = true;
|
||||
networking.hostName = "addictedmaker"; # Define your hostname.
|
||||
networking.domain = "addictedmaker.eu"; # Define your domain.
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.conf.all.forwarding" = true;
|
||||
"net.ipv6.conf.all.forwarding" = true;
|
||||
};
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "no";
|
||||
|
||||
};
|
||||
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
wget
|
||||
tailscale
|
||||
config.services.headscale.package
|
||||
kanidm
|
||||
];
|
||||
|
||||
users.users.gunalx = { # Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
initialPassword = "pw123"; # this is changed imedeately.
|
||||
};
|
||||
|
||||
|
||||
#add proxyserver to acme
|
||||
users.users.kanidm.extraGroups = [ "acme" ];
|
||||
|
||||
#sequrity managment through kanidm
|
||||
systemd.services.kanidm = let
|
||||
certName = config.services.nginx.virtualHosts.${config.services.kanidm.serverSettings.domain}.useACMEHost;
|
||||
in {
|
||||
requires = [ "acme-finished-${certName}.target" ];
|
||||
serviceConfig.LoadCredential = let
|
||||
certDir = config.security.acme.certs.${certName}.directory;
|
||||
in [
|
||||
"fullchain.pem:${certDir}/fullchain.pem"
|
||||
"key.pem:${certDir}/key.pem"
|
||||
];
|
||||
};
|
||||
|
||||
services.kanidm = {
|
||||
enableServer = true;
|
||||
#enablePam = true;
|
||||
serverSettings = let
|
||||
credsDir = "/run/credentials/kanidm.service";
|
||||
#credsDir = "/var/lib/acme/${config.networking.domain}"; #the files are here but not readable
|
||||
in {
|
||||
origin = "https://${config.services.kanidm.serverSettings.domain}";
|
||||
domain = "auth.${config.networking.domain}";
|
||||
tls_chain = "${credsDir}/fullchain.pem";
|
||||
tls_key = "${credsDir}/key.pem";
|
||||
bindaddress = "localhost:8300";
|
||||
};
|
||||
|
||||
clientSettings = {
|
||||
# This should be at /etc/kanidm/config or ~/.config/kanidm, and configures the kanidm command line tool
|
||||
uri = "${config.services.kanidm.serverSettings.bindaddress}";
|
||||
verify_ca = true;
|
||||
verify_hostnames = true;
|
||||
};
|
||||
};
|
||||
|
||||
#environment = {
|
||||
# etc."kanidm/config".text = ''
|
||||
# uri="https://auth.${config.networking.domain}"
|
||||
# '';
|
||||
#};
|
||||
|
||||
|
||||
#vpn stuff
|
||||
#need to run at fresh install to create namespace: headscale namespaces create <namespace_name>
|
||||
services.headscale = {
|
||||
enable = true;
|
||||
user = "headscale";
|
||||
address = "127.0.0.1";
|
||||
port = 8080;
|
||||
settings = {
|
||||
logtail.enabled = false;
|
||||
metrics_listen_addr = "127.0.0.1:9090";
|
||||
server_url = "https://${"vpn."+config.networking.domain}";
|
||||
dns_config = {
|
||||
base_domain = "${config.networking.domain}";
|
||||
magic_dns = true;
|
||||
nameservers = [
|
||||
"1.1.1.1"
|
||||
];
|
||||
};
|
||||
|
||||
##should really implement with fex github and kanidm
|
||||
#oidc = {
|
||||
# issuer = "{config.services.kanidm.serverSettings.origin}";
|
||||
# allowed_domains = Domains;
|
||||
#};
|
||||
};
|
||||
};
|
||||
|
||||
#tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.settings.UseDns = true;
|
||||
services.openssh.settings.PermitRootLogin = "prohibit-password";
|
||||
services.openssh.startWhenNeeded = true;
|
||||
services.openssh.ports = [ 6969 ];
|
||||
services.endlessh.enable = true; #ssh honeypot
|
||||
services.endlessh.port = 22;
|
||||
services.endlessh.openFirewall = true;
|
||||
services.sshguard.enable = true; #protection against brute force attacks like fail2ban
|
||||
|
||||
users.users."root".openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTExYoT3+flrd2wPYiT7sFFDmAUqi2YAz0ldQg7WMop"
|
||||
];
|
||||
users.users."gunalx".openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTExYoT3+flrd2wPYiT7sFFDmAUqi2YAz0ldQg7WMop"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEj+Y0RUrSaF8gUW8m2BY6i8e7/0bUWhu8u8KW+AoHDh gunalx@nixos"
|
||||
];
|
||||
|
||||
#fail2ban
|
||||
services.fail2ban = {
|
||||
enable = true;
|
||||
maxretry = 5;
|
||||
ignoreIP = [
|
||||
"127.0.0.0/8"
|
||||
"10.0.0.0/8"
|
||||
"100.64.0.0/8"
|
||||
"172.16.0.0/12"
|
||||
"192.168.0.0/16"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
|
||||
#firewall options
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
checkReversePath = "loose";
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
allowedUDPPorts = [
|
||||
8096
|
||||
80
|
||||
443
|
||||
#config.services.openssh.ports
|
||||
config.services.tailscale.port
|
||||
config.services.headscale.port
|
||||
];
|
||||
allowedTCPPorts = config.networking.firewall.allowedUDPPorts;
|
||||
};
|
||||
|
||||
# not needed in this config but should sty in default configuration.nix
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
#system.stateVersion = "20.09"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
gitserver with gitea
|
||||
webserver with homepage
|
||||
|
||||
webserver implementation is in works
|
||||
thinking of doing something like
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
services
|
||||
jellyfin
|
||||
|
||||
services in need of configuration
|
||||
transmission
|
||||
sonarr
|
||||
|
||||
to be implemented
|
||||
calibre
|
||||
|
|
@ -0,0 +1,181 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./vim.nix
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.loader.grub.useOSProber = true;
|
||||
|
||||
networking.hostName = "galadriel"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver = {
|
||||
layout = "no";
|
||||
xkbVariant = "";
|
||||
};
|
||||
|
||||
# Configure console keymap
|
||||
console.keyMap = "no";
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.gunalx = {
|
||||
isNormalUser = true;
|
||||
description = "gunalx";
|
||||
extraGroups = [ "networkmanager" "wheel" ];
|
||||
packages = with pkgs; [];
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
git
|
||||
rsync
|
||||
nfs-utils
|
||||
cifs-utils
|
||||
tailscale
|
||||
jellyfin
|
||||
jellyfin-web
|
||||
jellyfin-mpv-shim
|
||||
jftui
|
||||
sonixd
|
||||
sonarr
|
||||
bazarr
|
||||
unpackerr
|
||||
freshrss
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
##productivity
|
||||
services.tandoor-recipes.enable = true;
|
||||
|
||||
##media
|
||||
services.jellyfin.enable = true;
|
||||
services.komga.enable = true;
|
||||
|
||||
services.polaris.enable = true;
|
||||
services.navidrome.enable = true;
|
||||
|
||||
services.podgrab.enable = true;
|
||||
services.podgrab.port = 4242;
|
||||
|
||||
|
||||
services.calibre-web.enable = true;
|
||||
#services.calibre-server.enable = true;
|
||||
|
||||
services.freshrss.enable = true; #rss aggregator
|
||||
services.freshrss.baseUrl = "http://127.0.0.1";
|
||||
services.freshrss.passwordFile = "/run/secrets/freshrss";
|
||||
|
||||
##downloading
|
||||
#autodownload
|
||||
services.sonarr.enable = true;
|
||||
services.radarr.enable = true;
|
||||
services.lidarr.enable = true;
|
||||
services.bazarr.enable = true;
|
||||
|
||||
#indexing
|
||||
services.prowlarr.enable = true;
|
||||
services.jackett.enable = true;
|
||||
|
||||
#torrent managment
|
||||
services.transmission.enable = true;
|
||||
|
||||
##networking
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
#tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
networking.firewall.enable = false;
|
||||
|
||||
##storage
|
||||
|
||||
|
||||
#autofs
|
||||
#services.autofs.enable = true;
|
||||
|
||||
#smb share
|
||||
|
||||
#nfs share
|
||||
#services.nfs.server = {
|
||||
# enable = true;
|
||||
# # fixed rpc.statd port; for firewall
|
||||
# lockdPort = 4001;
|
||||
# mountdPort = 4002;
|
||||
# statdPort = 4000;
|
||||
# extraNfsdConfig = '''';
|
||||
#};
|
||||
|
||||
|
||||
#zfs stuff if needed
|
||||
|
||||
|
||||
#mounts
|
||||
fileSystems."/mnt/nas" = {
|
||||
device = "192.168.1.137:/mnt/Main/Home";
|
||||
fsType = "nfs";
|
||||
|
||||
options = [
|
||||
#"nfsvers=4.2"
|
||||
"x-systemd.automount" "noauto"
|
||||
"x-systemd.idle-timeout=600"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#default scary stuff
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
programs.neovim = {
|
||||
enable = true;
|
||||
viAlias = true;
|
||||
vimAlias = true;
|
||||
defaultEditor = true;
|
||||
|
||||
configure = {
|
||||
customRC = ''
|
||||
" your custom vimrc
|
||||
set nocompatible
|
||||
set backspace=indent,eol,start
|
||||
" Turn on syntax highlighting by default
|
||||
syntax on
|
||||
set autoindent
|
||||
" ...
|
||||
'';
|
||||
packages.myplugins = with pkgs.vimPlugins; {
|
||||
start = [ vim-nix vim-lastplace vim-yaml ];
|
||||
opt = [];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
programs.neovim = {
|
||||
enable = true;
|
||||
viAlias = true;
|
||||
vimAlias = true;
|
||||
defaultEditor = true;
|
||||
|
||||
configure = {
|
||||
customRC = ''
|
||||
" your custom vimrc
|
||||
set nocompatible
|
||||
set backspace=indent,eol,start
|
||||
" Turn on syntax highlighting by default
|
||||
syntax on
|
||||
" ...
|
||||
'';
|
||||
packages.myplugins = with pkgs.vimPlugins; {
|
||||
start = [ vim-nix vim-lastplace vim-yaml ];
|
||||
opt = [];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports =
|
||||
[
|
||||
../packages/vim.nix
|
||||
./sops.nix
|
||||
];
|
||||
|
||||
#nix stuff
|
||||
nix.gc.automatic = true;
|
||||
system.autoUpgrade.enable = true;
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.ssh-to-age
|
||||
pkgs.sops
|
||||
];
|
||||
|
||||
imports = [ "${builtins.fetchTarball "https://github.com/Mic92/sops-nix/archive/master.tar.gz"}/modules/sops" ];
|
||||
|
||||
# This will add secrets.yml to the nix store
|
||||
# You can avoid this by adding a string to the full path instead, i.e.
|
||||
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
# This will automatically import SSH keys as age keys
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/nixos" "/$HOME/.ssh/nixos" "/home/gunalx/.ssh/nixos" ];
|
||||
# This is using an age key that is expected to already be in the filesystem
|
||||
# sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
# This will generate a new key if the key specified above does not exist
|
||||
sops.age.generateKey = true
|
||||
|
||||
# This is the actual specification of the secrets.
|
||||
#sops.secrets."myservice/my_subdir/my_secret" = {};
|
||||
sops.secrets."acme/creds/domeneshop" = {
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEj+Y0RUrSaF8gUW8m2BY6i8e7/0bUWhu8u8KW+AoHDh gunalx@nixos
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
#ENC[AES256_GCM,data:D56rhkcdzYvGA391Yd/xtA==,iv:7a7XGF/5Am07S6GIH97dae8bZ14kBN/hST1DK2QkVbc=,tag:cAFYNF6AScu2SCECMiNpaw==,type:comment]
|
||||
#ENC[AES256_GCM,data:whBqc+AeZpCDo/caKJQm3Wan3RiAvQwQ0v4fgmdZhMTu+5QeTTqb1L1M6ZUnNnQS1tc9wjaWfXby/2T0zLDM+Yl3yuHSfK1rkBbC4GwL83tSM4lbDE7+spSKxb2VrOZqozKpL6zQnWJB0COJfC5KqlHJCiM=,iv:M1KPhEQS/l4OFwAClqr7L2Jf73/tkpBBmXEPjGI7faU=,tag:A5x4nCDbnOLplGh7xqdN2Q==,type:comment]
|
||||
acme:
|
||||
certs: ENC[AES256_GCM,data:glU5Kl4wiChxuQJq2ppCP4sJlutJkK1RgV0FloMNe/W8rV/mHcg8FcffotNYVZw87mqWz3N4jMgMVwnmXU0uObhV+W6L0mMb9U7akhXIuJQfiwaTeHZV48DPzDBzIDHUrsPZfxm6vfBlJltk9dH/43lytyMJqSeV3nWW4rA=,iv:Nz2pDdPdVbZK6BuYJrPcZ/LnnruvuMlhMJeowUPADj0=,tag:YNtlgq04iJxnZL76ESsQaQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age14cpm59h7hx8gr54hrn4uxu4xnrp9wy3f2kdxvy6xwuyxsfg8g9zs8z5e77
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxczVMVEROU0k1TFAwcDhZ
|
||||
YlVwOVpSYVhjT0oveGlLMUhJak40Q3E0UzFRCjFlV1h4ektaSTdvdnBLTjdYQ0pz
|
||||
VVFWbFFYODVBNzdCRkw4Q3pKYzZ6RjAKLS0tIGxtbWR6MnFVZUNyWHl3T0lBSXQz
|
||||
Vmg2SkZBdjFYM1MzdVhmRVVNYjg3MlkKPbXkDdChq+GqqZuwQ2rj5LIP1gA44Qxn
|
||||
gI66sDKkBwkAx7EkvUejGXK4pqPPvRwDUZFoSowIOSGaxF7CKdayBA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-09-24T01:30:23Z"
|
||||
mac: ENC[AES256_GCM,data:4ji9jVU4oILYTr3Hfd3Ic1XsxFrOnKTyTY88p9WCO8SaWDqzu2e/W3O8tiMgeZChTLLi0pK6t2hUgLI9XAQFQswMi56Ues1XdR+a8SsQmsMb0oGDzd6/Nhe39G0Q9raAy0XC+j9lBapOgKPKLGlDXRlllA050nFkTWEhKCQJmg8=,iv:FPYTaoDZjsbu6Oc0qu35jHq/AUhbfbnirutmcKDuUG8=,tag:JeQB+Fs2WOdlV7XoBFi3ag==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.0
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
basicAuthUser = "guest";
|
||||
basicAuthPass = "12345678";
|
||||
in
|
||||
{
|
||||
|
||||
#acme and certs helpful blog https://carjorvaz.com/posts/
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "adrian+acme@lauterer.it";
|
||||
|
||||
certs."${config.networking.domain}" = {
|
||||
domain = "${config.networking.domain}";
|
||||
extraDomainNames = [ "*.${config.networking.domain}" "lauterer.it" "*.lauterer.it" "*.256.no" "*.256.no"];
|
||||
dnsProvider = "domeneshop"; # from here according to privider https://go-acme.github.io/lego/dns/
|
||||
dnsPropagationCheck = true;
|
||||
credentialsFile = config.sops.secrets."acme/creds/domeneshop".path; #need to manually create this file according to dnsprovider secrets, and format of key according to lego in privider and add to secrets.yaml
|
||||
};
|
||||
};
|
||||
|
||||
#add proxyserver to acme
|
||||
users.users.nginx.extraGroups = [ "acme" ];
|
||||
users.users.root.extraGroups = [ "acme" ];
|
||||
|
||||
#TODO add oauth2 proxy to auth
|
||||
# services.oauth2_proxy = {
|
||||
# enable = true;
|
||||
# }
|
||||
|
||||
|
||||
#proxy stuff
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
statusPage = true;
|
||||
enableReload = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
|
||||
virtualHosts.${"vpn."+config.networking.domain} = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "${config.networking.domain}";
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://localhost:${toString config.services.headscale.port}";
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts.${config.services.kanidm.serverSettings.domain} = { # (auth.)
|
||||
forceSSL = true;
|
||||
useACMEHost = "${config.networking.domain}";
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "${"https://"+config.services.kanidm.serverSettings.bindaddress}";
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts.${"jellyfin."+config.networking.domain} = {
|
||||
forceSSL = true;
|
||||
#enableACME = true;
|
||||
useACMEHost = "${config.networking.domain}";
|
||||
locations."/" = {
|
||||
proxyPass = "http://jellyfin.galadriel";
|
||||
proxyWebsockets = true;
|
||||
basicAuth = {
|
||||
guest = basicAuthPass;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.openssh
|
||||
pkgs.endlessh
|
||||
pkgs.sshguard
|
||||
];
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.UseDns = true;
|
||||
settings.PermitRootLogin = "prohibit-password";
|
||||
startWhenNeeded = true;
|
||||
UseDns = true;
|
||||
ports = [ 25264 ];
|
||||
openFirewall = true;
|
||||
Ciphers = [
|
||||
"chacha20-poly1305@openssh.com"
|
||||
"aes256-gcm@openssh.com"
|
||||
"aes128-gcm@openssh.com"
|
||||
"aes256-ctr"
|
||||
# remove some weaker ciphers
|
||||
]
|
||||
}
|
||||
endlessh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
openFirewall = true;
|
||||
};
|
||||
sshguard.enable = true; #protection against brute force attacks like fail2ban
|
||||
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue