bertof/nix-dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cleanup baldur + reverse proxy

Browse source
This commit is contained in:
Filippo Berto 2022-12-19 19:28:09 +01:00
parent 2c485ff6a5
commit 351538a33d
Signed by: bertof
GPG key ID: 9DBF7E6A1D2CE9ED
2 changed files with 20 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

28
baldur/configuration.nix
View file

@ -35,6 +35,7 @@ with lib; {
avahi = { avahi = {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
interfaces = [ "ztmjfdwjkp" ];
nssmdns = true; nssmdns = true;
publish = { publish = {
enable = true; enable = true;
@ -47,16 +48,25 @@ with lib; {
ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service"; ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
}; };
}; };
fail2ban = { fail2ban = { enable = true; bantime-increment.enable = true; };
nginx = {
enable = true; enable = true;
bantime-increment.enable = true; recommendedProxySettings = true;
}; recommendedOptimisation = true;
openssh = { recommendedGzipSettings = true;
enable = true; recommendedTlsSettings = true;
openFirewall = true; virtualHosts = let ssl = { enableACME = true; forceSSL = true; }; in
permitRootLogin = "prohibit-password"; {
passwordAuthentication = false; "unimi.bertof.net" = ssl // { locations."/".extraConfig = "rewrite ^/(.*)$ https://homes.di.unimi.it/berto/$1 redirect ;"; };
"home-manager.bertof.net" = ssl // { locations."/".proxyPass = "http://loki.local:8123/"; };
};
}; };
openssh = { enable = true; openFirewall = true; };
};
security.acme = {
acceptTerms = true;
defaults.email = "filippo.berto95@gmail.com";
}; };
users.users.bertof = { users.users.bertof = {
@ -78,7 +88,7 @@ with lib; {
networking.firewall = { networking.firewall = {
enable = true; enable = true;
allowPing = true; allowPing = true;
allowedTCPPorts = [ 8000 ]; allowedTCPPorts = [ 8000 80 443 ];
# allowedUDPPorts = [ ]; # allowedUDPPorts = [ ];
# extraCommands = ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns''; # extraCommands = ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns'';
}; };

2
flake.nix
View file

@ -242,7 +242,7 @@
}; };
baldur = { baldur = {
hostname = "baldur.local"; hostname = "baldur.bertof.net";
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.baldur; path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.baldur;