diff options
Diffstat (limited to '')
16 files changed, 269 insertions, 27 deletions
diff --git a/hosts/by-name/server2/configuration.nix b/hosts/by-name/server2/configuration.nix index de9fc4d..c26b896 100644 --- a/hosts/by-name/server2/configuration.nix +++ b/hosts/by-name/server2/configuration.nix @@ -1,4 +1,8 @@ -{config, ...}: { +{ + lib, + pkgs, + ... +}: { imports = [ ./networking.nix # network configuration that just works ./hardware.nix @@ -12,21 +16,40 @@ }; vhack = { - back = { + atuin-sync = { enable = true; - repositories = { - "${config.services.gitolite.dataDir}/repositories/vhack.eu/nixos-server.git" = { - domain = "issues.foss-syndicate.org"; - port = 9220; - }; - }; + fqdn = "atuin-sync.vhack.eu"; }; backup = { enable = true; - privateSshKey = ./secrets/backupssh.age; - privatePassword = ./secrets/backuppass.age; + privateSshKey = ./secrets/backup/backupssh.age; + privatePassword = ./secrets/backup/backuppass.age; user = "u384702-sub3"; }; + + monitoring = { + enable = true; + prometheus = { + remoteWriteReceiver = "prometheus-server2.vhack.eu"; + }; + grafana = { + fqdn = "grafana.vhack.eu"; + + contactPoints = ["admin@vhack.eu"]; + adminPassword = ./secrets/grafana/adminPassword.age; + secretKey = ./secrets/grafana/secretKey.age; + }; + }; + + dns = { + enable = true; + openFirewall = true; + interfaces = [ + "185.16.61.132" + "2a03:4000:a:106::1" + ]; + zones = import ../../../zones {inherit lib;}; + }; etesync = { enable = true; secretFile = ./secrets/etesync/secret_file.age; @@ -49,10 +72,18 @@ enable = true; fqdn = "mail.foss-syndicate.org"; }; + nextcloud = { + enable = true; + package = pkgs.nextcloud33; + hostname = "nextcloud.vhack.eu"; + adminpassFile = ./secrets/nextcloud/adminpassFile.age; + }; + nginx = { enable = true; redirects = { "source.foss-syndicate.org" = "https://git.foss-syndicate.org/vhack.eu/nixos-server"; + "source.vhack.eu" = "https://source.foss-syndicate.org"; }; }; nixconfig.enable = true; @@ -65,6 +96,30 @@ }; redlib.enable = true; rust-motd.enable = true; + sharkey = { + enable = true; + fqdn = "sharkey.vhack.eu"; + settings = { + id = "aidx"; + + maxNoteLength = 8192; + maxFileSize = 1024 * 1024 * 1024; + proxyRemoteFiles = true; + + # > At the suggestion of Sharkey maintainers, + # > this allows the server to run multiple workers + # > and without this (and postgres tuning), the instance runs slowly. + # Copied from: https://github.com/sodiboo/system/blob/b63c7b27f49043e8701b3ff5e1441cd27d5a2fff/sharkey.mod.nix#L21-L23 + clusterLimit = 3; + + signToActivityPubGet = true; + CheckActivityPubGetSigned = false; + }; + }; + taskchampion-sync = { + enable = true; + fqdn = "taskchampion.vhack.eu"; + }; users.enable = true; }; diff --git a/hosts/by-name/server2/secrets/backuppass.age b/hosts/by-name/server2/secrets/backup/backuppass.age index 5fd5568..5fd5568 100644 --- a/hosts/by-name/server2/secrets/backuppass.age +++ b/hosts/by-name/server2/secrets/backup/backuppass.age diff --git a/hosts/by-name/server2/secrets/backupssh.age b/hosts/by-name/server2/secrets/backup/backupssh.age index c2d3abb..c2d3abb 100644 --- a/hosts/by-name/server2/secrets/backupssh.age +++ b/hosts/by-name/server2/secrets/backup/backupssh.age diff --git a/hosts/by-name/server2/secrets/grafana/adminPassword.age b/hosts/by-name/server2/secrets/grafana/adminPassword.age new file mode 100644 index 0000000..ff072fc --- /dev/null +++ b/hosts/by-name/server2/secrets/grafana/adminPassword.age @@ -0,0 +1,17 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bi9zRm5RRmU0YjJ4N3pi +S2lNNGZRNUpycnUrZ3VRdFBsdkdIRjVTakRFCkxtVG1VbUFTbHpBZlYxV2pMSU5p +a0lRcGVPWUUwMWpKdm5oYktWRklyWEUKLT4gWDI1NTE5IHNzN2NXRWYxdjladFF6 +ejk4eW43eUFsSStIV3FpWVJZREhLVEpjRkkvWFkKdlZtOG5pbDVvd0hwUEdMZnVn +WFAvYWJDUEVBckc3M3NVQUdvdFVqNDB0QQotPiBzc2gtZWQyNTUxOSBYUG94RFEg +RkpweWRJQklNUHVRWUhicXdDUVc3cXhyRi9KOS9wYWxDYnNNcjIzWmhERQpZZnpr +eHRWbnI0cFd1T3h3TTVGZ1JiUzUrNUpSNkUwM2UyWTVYZ2VHVHBnCi0+IC5eKT0+ +eS1ncmVhc2Ugc0YvI25zZyAub3YgPDNtbmsKejExd2NBV0E2Q1pLSVhyQTRLaWZ6 +dmZSZHhidjBqeW10RnIxNStVTGIyY1RMS25xaUlxRDVxMlpKQQotLS0gc3BER0to +dGdicEd3d1QzWWdoTmpkM1V5L0VvVG82cnNGY0hJTWUwVVBmTQpRQwKmFmQj10Z1 +AXllRSWcTSCzcM7fCVjCRcTF2lsxtXiXUkTS59yfNih02myuYCFIUG/MDl3A3pur +WckFpQVHTdvQ9ilYORI/zi9LTmPy8TZYYcdmXnNRelfZ3fAqiR8ScIEG3P0smNyP +9h6BcfiWYG2ppANLOeZxHz/UoG/LORXJyXoTCuiG8KJ714jX8f3CMX3+m9q/GmAX +VZiYvvbGgrN5T5QrZE+8quRM1laAXmnmbDynODfhNFNw4/I0Opi0CF5MSObmvzKN +z6vsc/kTGMqbip6k/LKvzea+jXMc8b8BeO0Y +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server2/secrets/grafana/secretKey.age b/hosts/by-name/server2/secrets/grafana/secretKey.age new file mode 100644 index 0000000..bfe4afe --- /dev/null +++ b/hosts/by-name/server2/secrets/grafana/secretKey.age @@ -0,0 +1,18 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsYlhkcFdwL2NDUllGVko3 +bTEwVE00MjRoZUpXMGFWZFFSMXNBUkpFRVU4CkJwSU5RUnlITnRSZklVZjNBN3Ix +NDdUS0ZpWVNBWEY3MVZYVlBkZkM3VlUKLT4gWDI1NTE5IHdsSm55NCtIT0Z4cUhx +dE9pM0RmSHUrUGZTYXhuQlM4TGVKcm5MWGZNekkKQXZmZ05JVmZYdzJIYlN5WmxV +Zlh0TWlxWWZucldweHpjdFM5TGJKZnprOAotPiBzc2gtZWQyNTUxOSBYUG94RFEg +SjVTVXVJRjQrc0RIenVIVmNmZEtQS1lWbVNhSzY5QjJXRUxNY1JvVGdIOAo5V0Y5 +SGhTRlZUcFE3eU1iazBwYzh0Q2UxTnA2UTJQQ2VhaW1INnBGTTQwCi0+IGdeazN5 +ZmstZ3JlYXNlIGpZSGUgTUYja2N5RCAhICNaeT8KVnFRWjJXQ1lMekJQZG5jbGk4 +KzB5YVVmMGRFT1pUZzF3dkJBby94NXZjbkFOYlQ1dy9VWUFnaVRlTHpkUXdZaQox +R1BMN3RjVXFwbitqU1pETzdlc0VqOFZhbVBrRlFiOWl3TWZkNzlCSS9kNkhBVUcw +Zk5UbFRrZXhWQ2QrZwotLS0gbFV3MXRoYjZ4QVo0UU9iMmpGVllNcDdJZFQvUEFR +UXpWYmptWmdWSllLVQrTggsrW+giXmbRL6Jq3VqT8uXhqHs5ZTCnPQSpKth04fzr +mNLKMIi2kRJm3hJCaSPBrLpDuop+08hjGe0l0CxvuRlnFUOZkh+C/kFWOI3ecaWt +TYVDkKNLXjrhyfw/rVHy03czluQncFYHFKib8djDqYTUa0ORj+M5cIgAzWODyCWB +IGftRRjhDMHhQzq0GRwwu6jNA+ovT1cN1aMmafQFmqTR7BqO18HqKsGdtirFLV3o +qrvHjqz1cJNKYEU89ogLJydTJHyuPhuPeHBl +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age b/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age new file mode 100644 index 0000000..2b831f3 --- /dev/null +++ b/hosts/by-name/server2/secrets/nextcloud/adminpassFile.age @@ -0,0 +1,14 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxanRqM3pOT29DWitxUERF +RjRURVZUWGpOSzFoZVpCSzJIN0RGZDAzWEZzCkczaExmOGgxQUQwV2NleUdHMXBB +eTZLZXpGZE1hcXBhWWhVcEQ5OFBQWUkKLT4gWDI1NTE5IG5DVmlEaDhTWk9xaWs2 +TnF1K1ZtK2UyeDgvOEFlbVUzc0V1VnZoSmFobEkKczNrSGdwZEVxVFNES3dzcVgy +SmRYNS9WR29mNGNCQW84bHZsZzNTRGZCQQotPiBzc2gtZWQyNTUxOSBYUG94RFEg +Y2ZQd25odWRRbUdqM3gxMzBrQ1Y3UjRwQ0JsRldtblRaYnVKWHZud2p5awpZdkNm +bk82RVVId2tsOXlKb2psa25pNFpManN4bjQwblBWUWdGaWxxQ1B3Ci0+ICNqaTBs +KE8tZ3JlYXNlIE1KZGEgNzAKSGNMSlRGTzN5d3ZXcFZNTkxlZHprVlVQTzJ4K2Vp +MG1YMTFHRmV6L2tMMGUKLS0tIE44WHBBZk1qcmRnK2lPczdiQ294SW50UFdrUHUw +d0EreHNod29LL2pjd2cKw1rpd83gONZaOiV5lQ+QOtIZzoIkaOvRD/8avsbeFsP7 +AB/jiOfOwYJ0DVbNMjopwnzpcAFsLWs6Gg0wQhjNsl349TIcTAS0xLTJYTm8DwQy +FmzftPMHAuJ/IPGzb3hQOFqpuFAPkunfiOgZ/N7N/+LLNMC5NxkkSH8m8gDBCCk= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server3/configuration.nix b/hosts/by-name/server3/configuration.nix index 2afc79f..f7ee7d3 100644 --- a/hosts/by-name/server3/configuration.nix +++ b/hosts/by-name/server3/configuration.nix @@ -1,4 +1,4 @@ -{config, ...}: { +{lib, ...}: { imports = [ ./networking.nix # network configuration that just works ./hardware.nix @@ -7,11 +7,40 @@ vhack = { backup = { enable = true; - privateSshKey = ./secrets/backupssh.age; - privatePassword = ./secrets/backuppass.age; + privateSshKey = ./secrets/backup/backupssh.age; + privatePassword = ./secrets/backup/backuppass.age; user = "u384702-sub4"; }; + dns = { + enable = true; + openFirewall = true; + interfaces = [ + "92.60.38.179" + "2a03:4000:33:25b::4f4e" + ]; + zones = import ../../../zones {inherit lib;}; + }; + + monitoring = { + prometheus = { + enable = true; + remoteWriteTo = { + url = "https://prometheus-server2.vhack.eu"; + }; + }; + # TODO: Also provide something for Loki <2026-07-19> + }; + fail2ban.enable = true; + rocie = { + enable = true; + domain = "rocie.vhack.eu"; + loginSecret = ./secrets/rocie/login.age; + }; + nix-sync = { + enable = true; + domains = import ./websites.nix {}; + }; mastodon = { enable = true; domain = "mastodon.vhack.eu"; @@ -23,6 +52,7 @@ enable = true; fqdn = "matrix.vhack.eu"; url = "vhack.eu"; + sharedSecretFile = ./secrets/matrix/passwd.age; }; miniflux = { enable = true; @@ -53,6 +83,25 @@ "/var/log" ]; }; + stalwart-mail = { + # enable = false; + # fqdn = "mail.vhack.eu"; + # admin = "admin@vhack.eu"; + # security = { + # dkimKeys = let + # loadKey = name: { + # dkimPublicKey = builtins.readFile (./secrets/dkim + "/${name}-public"); + # dkimPrivateKeyPath = ./secrets/dkim + "/${name}-private.age"; + # keyAlgorithm = "ed25519-sha256"; + # }; + # in { + # "mail.vhack.eu" = loadKey "mail.vhack.eu"; + # }; + # verificationMode = "strict"; + # }; + # openFirewall = true; + # principals = null; + }; postgresql.enable = true; rust-motd.enable = true; users.enable = true; diff --git a/hosts/by-name/server3/secrets/backuppass.age b/hosts/by-name/server3/secrets/backup/backuppass.age index e7eea19..e7eea19 100644 --- a/hosts/by-name/server3/secrets/backuppass.age +++ b/hosts/by-name/server3/secrets/backup/backuppass.age diff --git a/hosts/by-name/server3/secrets/backupssh.age b/hosts/by-name/server3/secrets/backup/backupssh.age index ae8c5ec..ae8c5ec 100644 --- a/hosts/by-name/server3/secrets/backupssh.age +++ b/hosts/by-name/server3/secrets/backup/backupssh.age diff --git a/hosts/by-name/server3/secrets/dkim/gen_key.sh b/hosts/by-name/server3/secrets/dkim/gen_key.sh new file mode 100755 index 0000000..61da156 --- /dev/null +++ b/hosts/by-name/server3/secrets/dkim/gen_key.sh @@ -0,0 +1,33 @@ +#! /usr/bin/env nix-shell +#! nix-shell -p rage -p openssl -p bash -i bash --impure + +# shellcheck shell=bash + +cd "$(dirname "$0")" || { + echo "No basedir?!" + exit 1 +} + +key_name="$1" +[ -z "$key_name" ] && { + echo "Usage: $0 KEY_NAME IDENTITY" + exit 2 +} + +openssl genpkey \ + -algorithm ed25519 \ + -out - | + tee >(openssl pkey \ + -pubout \ + -out - | + openssl asn1parse \ + -offset 12 \ + -noout \ + -out - | + base64 --wrap 0 >"$key_name-public") | + rage --encrypt \ + --armor \ + --recipient "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn" \ + >"$key_name-private.age" + +# vim: ft=sh diff --git a/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-private.age b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-private.age new file mode 100644 index 0000000..8d66808 --- /dev/null +++ b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-private.age @@ -0,0 +1,16 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdEtVSWhiOVR1N1Q5bTBV +NXRMMm42VlR5NitSWlhiSFpUZDZQSlloWlJ3ClA3ZEJSU2dDbmRVL0NMZlFOVU5J +V1lEbDM0MlN3S3dZMUkyc1pQZVVpdDAKLT4gWDI1NTE5IFk4YnFFZmFLTlA0WENY +K3FGME1CbUV4b0Z4V1FIRFBmNVphYmhCMG1QVkkKOGhFcnl3Y2hZQU8rY0ROMTlq +d0lUVG8rRWpPNm4vWkw2WFROU3NJalgzWQotPiBzc2gtZWQyNTUxOSBweXU5Ymcg +UDV4YUdZRWZieHN4RVU1WWEvdlFRVHpTL1V5Q3Nya1kvNjFxVytpS1NGawpUWnlR +RmtQL1Z1ZFkwTC9ua3VVb05VQVlLemtuOCtLSkdxbFE5U2wyM0xZCi0+IFktZ3Jl +YXNlCk56M0t2NXB3QVpjYTNFdkEvMmpDZXBPcWlLNXNWL2tPalNMM1g0KzBJL2xz +T1gvTldRLzNxM25BOUhFZml3dFQKSnNMeHBXK3BrS2pWVU1uTkNKZ3BnaGt2Ci0t +LSBuWURsUEYxRkx3bVQzU3JTcGlwUTFCZ09IRWIrNExUclhPSmdGdUtNOFlFCuKw +PBh8U5VmweDGoY+xFXw/nqTqrKw9gZyUR2vbnHdnN9y8BToht7prsEaAn//DVivI +GMFGMhbPYTumWnEiTho8ZqQv5tKiDdIGV/9YghzUdHtMnzfO7q5ztrFYx19qjgi/ +lW17WyY8Jk2DZIH3icYweTICx9IU5K11DNj6WgNGDe8/fAyfuHTekE8sZtHPDw76 +M3wkUZM= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-public b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-public new file mode 100644 index 0000000..fa5d243 --- /dev/null +++ b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-public @@ -0,0 +1 @@ +U0eOxgLD3yK7PKzQRSZdJ3EH/UwVxPeYmfm42gYXsDg= diff --git a/modules/by-name/ma/matrix/passwd.age b/hosts/by-name/server3/secrets/matrix/passwd.age index 6386ed6..6386ed6 100644 --- a/modules/by-name/ma/matrix/passwd.age +++ b/hosts/by-name/server3/secrets/matrix/passwd.age diff --git a/hosts/by-name/server3/secrets/rocie/login.age b/hosts/by-name/server3/secrets/rocie/login.age new file mode 100644 index 0000000..0a6b8d3 --- /dev/null +++ b/hosts/by-name/server3/secrets/rocie/login.age @@ -0,0 +1,16 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWN3ZFdjMyNjBvQXQ1YVYz +OTBHMWYvbk5xK1ArVDYvMmZEUFF5dHRSajFNCkFXSCtPV2VVdW50amVVMVYxYXBK +SHd4bXRXSEw0ZnJ3TTMvbmZGTStFbEUKLT4gWDI1NTE5IDZYMFJKWVBPVmc5QmFK +M0xGNGNJZHNnRWxBcytaZXU3VWlqMzQvdDdhbm8KcVlIZTlRYVBZNEx1djZJbURD +Qy9NUTEwYVN0VjhZbkc3TTNuUWd0QTFjcwotPiBzc2gtZWQyNTUxOSBweXU5Ymcg +SnZ0czg2OUszeFJIbmNpU2RDV2tnMVRlUUVvMk5BTWcwbFFibDVzQXZUbwpJbkVC +bFFqYzJZQTFQWDM4Zk42ZzE4Q2kzQlh4aTRtMHUyRlgrWlc1WUtjCi0+IFFELWdy +ZWFzZQpCMDVUczNTa01KS2hFREhpM0k5L3ZHT0NDUEtVck1iZE13cnVkSi9Kdk80 +WXU1M3A0V1pZbGxZaVNGanZRUnE4CmYwUlo4QlVFTjc4YlFaQjZyU3BybTAwaTVP +WHc2K1FyYzduT0RBYWtEa0xSREEKLS0tIExFSThrd2xGT3lEU1p6VXE0eWpZUG5z +ZlVXMWJFS0NxczhycXl1VWc1bmsK4Dq740IgQP9CnGtkUrwWxM4QUOnQTgWe1YbI +LtC471ykB4YlPIbMiqUdnBuFZQ9cBAOT2YuicxbI+/2Rb/mSRV0l8dGKpc2fqOVy +zLLcX8A48NfmcbPeUtlv/HnVfu6Fe7X91V0bw6eMjWSvvcpQXsaIAd7TEPTpexCs +gfAWd+brZMq6VzwslklxO4S5ZIu0jUSz4q6covAuxfEW3hdSbIg= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/by-name/server3/websites.nix b/hosts/by-name/server3/websites.nix new file mode 100644 index 0000000..ece6247 --- /dev/null +++ b/hosts/by-name/server3/websites.nix @@ -0,0 +1,36 @@ +{...}: let + mkWkd = domain: { + domain = "openpgpkey.${domain}"; + repositoryUrl = "https://git.foss-syndicate.org/vhack.eu/pgp-wkd"; + extraSettings = { + locations."/.well-known/openpgpkey/".extraConfig = '' + default_type application/octet-stream; + + # Came from: https://www.uriports.com/blog/setting-up-openpgp-web-key-directory/ + # No idea if it is actually necessary + # add_header Access-Control-Allow-Origin * always; + ''; + }; + }; +in [ + { + domain = "vhack.eu"; + repositoryUrl = "https://codeberg.org/vhack.eu/website"; + } + { + domain = "b-peetz.de"; + repositoryUrl = "https://git.foss-syndicate.org/bpeetz/b-peetz.de"; + } + + # Trinitrix + { + domain = "trinitrix.vhack.eu"; + repositoryUrl = "https://codeberg.org/trinitrix/website"; + } + + # WKD + (mkWkd "b-peetz.de") + (mkWkd "s-schoeffel.de") + (mkWkd "sils.li") + (mkWkd "vhack.eu") +] diff --git a/hosts/default.nix b/hosts/default.nix index f53ee35..651569d 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -4,15 +4,11 @@ nixpkgs, specialArgs, extraModules, - deployPackage, }: let - hostnames = builtins.fromTOML (builtins.readFile ./host-names.toml); - hosts = nixLib.mkByName { useShards = false; baseDirectory = ./by-name; fileName = "configuration.nix"; - finalizeFunction = name: value: value; }; mkNixosConfiguration = _: value: @@ -27,15 +23,6 @@ ]; }; nixosConfigurations = builtins.mapAttrs mkNixosConfiguration hosts; - - mkDeploy = name: _: { - hostname = hostnames."${name}"; - profiles.system = { - user = "root"; - path = deployPackage.lib.activate.nixos nixosConfigurations."${name}"; - }; - }; - deploy = {nodes = builtins.mapAttrs mkDeploy hosts;}; in { - inherit nixosConfigurations deploy; + inherit nixosConfigurations; } |