summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--abbenay/configuration.nix3
-rw-r--r--chaski/configuration.nix63
-rw-r--r--chaski/services/chat.nix43
-rw-r--r--common/headless.nix23
-rw-r--r--flora/configuration.nix21
-rw-r--r--flora/services/nginx.nix4
6 files changed, 89 insertions, 68 deletions
diff --git a/abbenay/configuration.nix b/abbenay/configuration.nix
index ec4c08d..62a4a58 100644
--- a/abbenay/configuration.nix
+++ b/abbenay/configuration.nix
@@ -9,9 +9,6 @@
services.avahi.enable = true;
services.avahi.nssmdns = true;
- enable = true;
- };
-
environment.systemPackages = with pkgs; [
gnome3.gnome-tweaks
flatpak
diff --git a/chaski/configuration.nix b/chaski/configuration.nix
index 2ecfe4c..658f55a 100644
--- a/chaski/configuration.nix
+++ b/chaski/configuration.nix
@@ -10,58 +10,39 @@
./hardware-configuration.nix
./services/uplcg.nix
./services/tracktrain.nix
+ ./services/chat.nix
];
- networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-
- users.users.chat = {
- isNormalUser = true;
- home = "/home/chat";
- shell = pkgs.fish;
- packages = with pkgs; [
- fish tmux weechat
- ];
- };
- services.openssh = {
- extraConfig = ''
- Match user chat
- ForceCommand tmux attach || tmux
- '';
- };
- programs.mosh.enable = true;
- users.users.chat.openssh.authorizedKeys.keys = [
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCTeuG1alKNNqoT2d5nUAlH0Otsk0NHM7nmkYC5Yfk8qcLsgY4v2dXlyrMzieajYgDjndEApgO3/S/V0EQGhvHc0UugC6LU84jHPwsgYVABRmFS74v/ww8NigaNIAevwWl+DxlnK4nnWdB1lo4xS69ooQdvoAjbubk16dP04LsAbH8Z+3cPB5WKAaayNx62DUwObzDSpztqCagCZzlqpwKG1UGJngrqEhk7B5Q0v9iCk91gqVkLSPllsB00+bqIimgkMVIZnoLLh7pcEgOvbG0yP2EG3ttDNN3jPpqE6mu+znfLq+ua/MwJy5hjmY5R54yPlcvFdsIU34jrdMCDvWqpV49VrLwVvkFN3lRZln/9eifkXXJciP4Ber3xEl8JltysV1PE5iJunWfbcOy0fwsYvBChDeyR5G3CLG2c25jKL9f1Iq95QBBMVYgIxq/dpGy0tjB+24w1JzsorvElsmz5etXLXCydLP07ic9PfSu1Wmwu7F0tweIk52x97sra6ePhtY+TTRffjjDz0DEho1bWDfrPV0xfPPAWXWTKYisVO4VVmMQsJbtXrfxUJbappM5vIXcJ+2JpT2Oh7Kiy3rjm+pd7rukgoCp7yN5z8v+2vuOfHqBuKUwlaRg/XNMyPrbnGGzVR1xzUuhwdOnjAyMmAr95Ne9hRBPwfVo2NR/ZZw=="
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpWMKJrYaI9BRFCeVimQfHkg0THZJwLqh+z2fFxLU7q stuebinm@pixelimn"
- ];
services.nginx.enable = true;
- services.nginx.appendHttpConfig = ''
- access_log off;
- add_header Permissions-Policy "interest-cohort=()";
- '';
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
+ boot.loader.grub.devices = [ "/dev/sda" ];
- networking.hostName = "chaski"; # Define your hostname.
+ networking = {
+ hostName = "chaski";
- # The global useDHCP flag is deprecated, therefore explicitly set to false here.
- # Per-interface useDHCP will be mandatory in the future, so this generated config
- # replicates the default behaviour.
- networking.useDHCP = false;
- networking.interfaces.ens10.useDHCP = true;
- networking.interfaces.ens3.useDHCP = true;
+ enableIPv6 = true;
+ defaultGateway6 = {
+ address = "fe80::1";
+ interface = "ens3";
+ };
- # This value determines the NixOS release from which the default
- # settings for stateful data, like file locations and database versions
- # on your system were taken. It‘s perfectly fine and recommended to leave
- # this value at the release version of the first install of this system.
- # Before changing this value read the documentation for this option
- # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
- system.stateVersion = "20.09"; # Did you read the comment?
+ interfaces.ens3.ipv6.addresses = [ {
+ address = "2a01:4f9:c010:69ed::1";
+ prefixLength = 64;
+ } ];
+
+ useDHCP = false;
+ interfaces.ens10.useDHCP = true;
+ interfaces.ens3.useDHCP = true;
+
+ firewall.logRefusedConnections = false;
+ firewall.allowedTCPPorts = [ 80 443 ];
+ };
- boot.loader.grub.devices = [ "/dev/sda" ];
+ system.stateVersion = "20.09"; # Did you read the comment?
}
diff --git a/chaski/services/chat.nix b/chaski/services/chat.nix
new file mode 100644
index 0000000..0771e19
--- /dev/null
+++ b/chaski/services/chat.nix
@@ -0,0 +1,43 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# this defines an extra user, so i can run weechat in tmux
+# (and not deal with having an irc relay)
+{
+
+ imports = [ inputs.home-manager.nixosModule ];
+
+ programs.mosh.enable = true;
+ users.users.chat = {
+ isNormalUser = true;
+ home = "/home/chat";
+ shell = pkgs.fish;
+ packages = with pkgs; [
+ fish tmux weechat
+ ];
+ };
+ home-manager.users.chat = _: {
+ programs.tmux = {
+ enable = true;
+ terminal = "screen-256color";
+ };
+ home.stateVersion = "22.11";
+ };
+ services.openssh = {
+ extraConfig = ''
+ Match user chat
+ ForceCommand ${pkgs.writeScript "logon-weechat" ''
+ #!${pkgs.fish}/bin/fish
+ if test -n "$SSH_ORIGINAL_COMMAND"
+ # allow mosh to start its server
+ exec fish -c "$SSH_ORIGINAL_COMMAND"
+ else
+ tmux attach || tmux -c weechat
+ end
+ ''}
+ '';
+ };
+ users.users.chat.openssh.authorizedKeys.keys = [
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCTeuG1alKNNqoT2d5nUAlH0Otsk0NHM7nmkYC5Yfk8qcLsgY4v2dXlyrMzieajYgDjndEApgO3/S/V0EQGhvHc0UugC6LU84jHPwsgYVABRmFS74v/ww8NigaNIAevwWl+DxlnK4nnWdB1lo4xS69ooQdvoAjbubk16dP04LsAbH8Z+3cPB5WKAaayNx62DUwObzDSpztqCagCZzlqpwKG1UGJngrqEhk7B5Q0v9iCk91gqVkLSPllsB00+bqIimgkMVIZnoLLh7pcEgOvbG0yP2EG3ttDNN3jPpqE6mu+znfLq+ua/MwJy5hjmY5R54yPlcvFdsIU34jrdMCDvWqpV49VrLwVvkFN3lRZln/9eifkXXJciP4Ber3xEl8JltysV1PE5iJunWfbcOy0fwsYvBChDeyR5G3CLG2c25jKL9f1Iq95QBBMVYgIxq/dpGy0tjB+24w1JzsorvElsmz5etXLXCydLP07ic9PfSu1Wmwu7F0tweIk52x97sra6ePhtY+TTRffjjDz0DEho1bWDfrPV0xfPPAWXWTKYisVO4VVmMQsJbtXrfxUJbappM5vIXcJ+2JpT2Oh7Kiy3rjm+pd7rukgoCp7yN5z8v+2vuOfHqBuKUwlaRg/XNMyPrbnGGzVR1xzUuhwdOnjAyMmAr95Ne9hRBPwfVo2NR/ZZw=="
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpWMKJrYaI9BRFCeVimQfHkg0THZJwLqh+z2fFxLU7q stuebinm@pixelimn"
+ ];
+}
diff --git a/common/headless.nix b/common/headless.nix
index d3a7c22..0689e6a 100644
--- a/common/headless.nix
+++ b/common/headless.nix
@@ -28,4 +28,27 @@
defaults.email = "stuebinm@disroot.org";
};
+ services.fail2ban = {
+ enable = true;
+ bantime-increment.enable = true;
+ bantime-increment.overalljails = true;
+ bantime-increment.maxtime = "1312m";
+ ignoreIP = [ "185.39.64.13" ];
+ };
+
+ services.logrotate = {
+ enable = true;
+ # the nginx module does stuff here, which apparently no one tells anyone about
+ settings.nginx = {
+ rotate = 2;
+ nocompress = true;
+ compress = false;
+ };
+ };
+
+ services.nginx.appendHttpConfig = ''
+ access_log off;
+ add_header Permissions-Policy "interest-cohort=()";
+ '';
+ programs.mosh.enable = true;
}
diff --git a/flora/configuration.nix b/flora/configuration.nix
index 750268e..c04f240 100644
--- a/flora/configuration.nix
+++ b/flora/configuration.nix
@@ -35,31 +35,12 @@
useDHCP = false;
interfaces.ens3.useDHCP = true;
+ interfaces.ens10.useDHCP = true;
firewall.logRefusedConnections = false;
-
-
};
- services.fail2ban = {
- enable = true;
- bantime-increment.enable = true;
- bantime-increment.overalljails = true;
- bantime-increment.maxtime = "1312m";
- ignoreIP = [ "88.133.194.232" ];
- };
-
- services.logrotate = {
- enable = true;
- # the nginx module does stuff here, which apparently no one tells anyone about
- settings.nginx = {
- rotate = 2;
- nocompress = true;
- compress = false;
- };
- };
-
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
diff --git a/flora/services/nginx.nix b/flora/services/nginx.nix
index bbcacb7..fbbff73 100644
--- a/flora/services/nginx.nix
+++ b/flora/services/nginx.nix
@@ -9,9 +9,5 @@
recommendedOptimisation = true;
recommendedTlsSettings = true;
recommendedProxySettings = true;
-
- appendHttpConfig = ''
- add_header Permissions-Policy "interest-cohort=()";
- '';
};
}