Merge pull request 'server1_develop' (#22) from server1_develop into server1

Reviewed-on: https://git.sils.li/vhack.eu/nixos-server/pulls/22
Reviewed-by: sils <sils@sils.li>

9 files changed, 250 insertions, 0 deletions

diff --git a/system/services/acme/default.nix b/system/services/acme/default.nix
new file mode 100644
index 0000000..a163e77
--- /dev/null
+++ b/system/services/acme/default.nix
@@ -0,0 +1,30 @@
+{...}: {
+  users.users.nginx.extraGroups = ["acme"];
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "acmechallenge.vhack.eu" = {
+        serverAliases = ["*.vhack.eu"];
+        locations."/.well-known/acme-challenge" = {
+          root = "/var/lib/acme/.challenges";
+        };
+        locations."/" = {
+          return = "301 https://$host$request_uri";
+        };
+      };
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@vhack.eu";
+    certs = {
+      "server1.vhack.eu" = {
+        webroot = "/var/lib/acme/.challenges";
+        group = "nginx";
+        extraDomainNames = ["imap.vhack.eu" "smtp.vhack.eu"];
+      };
+    };
+  };
+}
diff --git a/system/services/default.nix b/system/services/default.nix
new file mode 100644
index 0000000..6e5cb3c
--- /dev/null
+++ b/system/services/default.nix
@@ -0,0 +1,12 @@
+{config, ...}: {
+  imports = [
+    ./acme
+#  ./firewall
+    #./minecraft
+    ./nginx
+    ./nix
+    ./opensshd
+    ./rust-motd
+    ./fail2ban
+  ];
+}
diff --git a/system/services/fail2ban/default.nix b/system/services/fail2ban/default.nix
new file mode 100644
index 0000000..5aee097
--- /dev/null
+++ b/system/services/fail2ban/default.nix
@@ -0,0 +1,30 @@
+# vim: ts=2
+{...}: {
+  services.fail2ban = {
+    enable = true;
+    maxretry = 2; # ban after 2 failures
+    daemonConfig = ''
+      [Definition]
+      logtarget = SYSLOG
+      socket    = /run/fail2ban/fail2ban.sock
+      pidfile   = /run/fail2ban/fail2ban.pid
+      dbfile    = /srv/fail2ban/fail2ban.sqlite3
+    '';
+    bantime-increment = {
+      enable = true;
+      rndtime = "8m";
+      overalljails = true;
+      multipliers = "2 4 16 128 256";
+      maxtime = "72h";
+    };
+    jails = {
+      dovecot = ''
+        # block IPs which failed to log-in
+        # aggressive mode add blocking for aborted connections
+        enabled = true
+        filter = dovecot[mode=aggressive]
+        maxretry = 2
+      '';
+    };
+  };
+}
diff --git a/system/services/firewall/default.nix b/system/services/firewall/default.nix
new file mode 100644
index 0000000..23dbcc4
--- /dev/null
+++ b/system/services/firewall/default.nix
@@ -0,0 +1,11 @@
+# vim: ts=2
+{...}: {
+  networking.firewall = {
+    allowedTCPPorts = [
+      # for mail protocols:
+      465 # SMTP SSL
+      995 # POP3 SSL
+      993 # IMAP SSL
+    ];
+  };
+}
diff --git a/system/services/minecraft/default.nix b/system/services/minecraft/default.nix
new file mode 100644
index 0000000..754c974
--- /dev/null
+++ b/system/services/minecraft/default.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  users = {
+    groups.minecraft = {};
+    users.minecraft = {
+      isSystemUser = true;
+      group = "minecraft";
+    };
+  };
+  systemd.services.minecraft = {
+    wantedBy = ["multi-user.target"];
+    after = "network.target";
+    description = "Minecraft Server";
+    serviceConfig = {
+      WorkingDirectory = "/srv/minecraft";
+      User = "minecraft";
+      Group = "minecraft";
+      Restart = "always";
+      ExecStart = "${pkgs.openjdk}/bin/java -Xms10G -Xmx10G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true -jar paper.jar --nogui";
+      SyslogIdentifier = "minecraft-server";
+    };
+  };
+}
diff --git a/system/services/nginx/default.nix b/system/services/nginx/default.nix
new file mode 100644
index 0000000..204783b
--- /dev/null
+++ b/system/services/nginx/default.nix
@@ -0,0 +1,15 @@
+{...}: {
+  networking.firewall = {
+    allowedTCPPorts = [80 443];
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "vhack.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/srv/www/vhack.eu";
+      };
+    };
+  };
+}
diff --git a/system/services/nix/default.nix b/system/services/nix/default.nix
new file mode 100644
index 0000000..bd562ec
--- /dev/null
+++ b/system/services/nix/default.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  nix = {
+    #    gc = {
+    #      automatic = true;
+    #      dates = "daily";
+    #      options = "--delete-older-than 3";
+    #    };
+    settings = {
+      auto-optimise-store = true;
+      experimental-features = ["nix-command" "flakes"];
+    };
+  };
+}
diff --git a/system/services/opensshd/default.nix b/system/services/opensshd/default.nix
new file mode 100644
index 0000000..75c5aef
--- /dev/null
+++ b/system/services/opensshd/default.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  pkg,
+  ...
+}: {
+  services.openssh = {
+    enable = true;
+    passwordAuthentication = false;
+    hostKeys = [
+      {
+        path = "/srv/sshd/ssh_host_ed25519_key";
+        rounds = 1000;
+        type = "ed25519";
+      }
+    ];
+  };
+}
diff --git a/system/services/rust-motd/default.nix b/system/services/rust-motd/default.nix
new file mode 100644
index 0000000..1a41b32
--- /dev/null
+++ b/system/services/rust-motd/default.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  systemd.services.rust-motd = {
+    path = builtins.attrValues {
+      inherit
+        (pkgs)
+        bash
+        fail2ban # Needed for rust-motd fail2ban integration
+        ;
+    };
+  };
+  programs.rust-motd = {
+    enable = true;
+    enableMotdInSSHD = true;
+    refreshInterval = "*:0/5"; # 0/5 means: hour 0 AND all hour wich match (0 + 5 * x) (is the same as: 0, 5, 10, 15, 20)
+    settings = {
+      global = {
+        progress_full_character = "=";
+        progress_empty_character = "-";
+        progress_prefix = "[";
+        progress_suffix = "]";
+        time_format = "%Y-%m-%d %H:%M:%S";
+      };
+
+      banner = {
+        color = "red";
+        command = "${pkgs.hostname}/bin/hostname | ${pkgs.figlet}/bin/figlet -f slant";
+        # if you don't want a dependency on figlet, you can generate your
+        # banner however you want, put it in a file, and then use something like:
+        # command = "cat banner.txt"
+      };
+
+      # [weather]
+      # url = "https://wttr.in/New+York,New+York?0"
+      # proxy = "http://proxy:8080"
+
+      # [service_status]
+      # Accounts = "accounts-daemon"
+      # Cron = "cron"
+
+      # [docker_status]
+      # Local containers MUST start with a slash
+      # https://github.com/moby/moby/issues/6705
+      #"/nextcloud-nextcloud-1" = "Nextcloud"
+      #"/nextcloud-nextcloud-mariadb-1" = "Nextcloud Database"
+
+      uptime = {
+        prefix = "Uptime:";
+      };
+
+      # [user_service_status]
+      # gpg-agent = "gpg-agent"
+
+      s_s_l_certs = {
+        sort_method = "manual";
+
+        certs = {
+          "server1.vhack.eu" = "/var/lib/acme/server1.vhack.eu/cert.pem";
+          "vhack.eu" = "/var/lib/acme/vhack.eu/cert.pem";
+        };
+      };
+
+      filesystems = {
+        root = "/";
+        persistent = "/srv";
+        store = "/nix";
+        boot = "/boot";
+      };
+
+      memory = {
+        swap_pos = "beside"; # or "below" or "none"
+      };
+
+      fail2_ban = {
+        jails = ["sshd"]; #, "anotherjail"]
+      };
+
+      last_login = {
+        sils = 2;
+        soispha = 2;
+        nightingale = 2;
+      };
+
+      last_run = {
+      };
+    };
+  };
+}