Cleanup baldur config
This commit is contained in:
parent
cec023839e
commit
ef6405ef14
GPG key ID:
9DBF7E6A1D2CE9ED
20 changed files with 208 additions and 254 deletions
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, config, ... }: {
|
||||
{ pkgs, ... }: {
|
||||
|
||||
age.secrets = {
|
||||
garage_bertof_baldur_key = { file = ../../secrets/garage_bertof_baldur_key.age; owner = "bertof"; };
|
||||
|
|
@ -24,17 +24,13 @@
|
|||
|
||||
environment = {
|
||||
pathsToLink = [ "/share/zsh" ];
|
||||
systemPackages =
|
||||
builtins.attrValues { inherit (pkgs) helix kitty tmux vim; };
|
||||
systemPackages = with pkgs; [ helix zellij kitty.terminfo ];
|
||||
};
|
||||
|
||||
i18n.defaultLocale = "it_IT.UTF-8";
|
||||
|
||||
programs = {
|
||||
gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
gnupg.agent = { enable = true; enableSSHSupport = true; };
|
||||
zsh.enable = true;
|
||||
};
|
||||
|
||||
|
|
@ -43,22 +39,6 @@
|
|||
time.timeZone = "Europe/Rome";
|
||||
|
||||
services = {
|
||||
avahi = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
allowInterfaces = [ "ztmjfdwjkp" ];
|
||||
nssmdns = true;
|
||||
publish = {
|
||||
enable = true;
|
||||
addresses = true;
|
||||
domain = true;
|
||||
userServices = true;
|
||||
workstation = true;
|
||||
};
|
||||
extraServiceFiles = {
|
||||
ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
|
||||
};
|
||||
};
|
||||
fail2ban = {
|
||||
enable = true;
|
||||
bantime-increment.enable = true;
|
||||
|
|
@ -85,12 +65,7 @@
|
|||
recommendedTlsSettings = true;
|
||||
virtualHosts =
|
||||
let
|
||||
ssl = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
loki_ipv4 = "172.23.254.55";
|
||||
# freya_ipv4 = "172.23.18.147";
|
||||
ssl = { enableACME = true; forceSSL = true; };
|
||||
in
|
||||
{
|
||||
"unimi.bertof.net" = ssl // {
|
||||
|
|
@ -98,45 +73,17 @@
|
|||
"rewrite ^/(.*)$ https://homes.di.unimi.it/berto/$1 redirect ;";
|
||||
};
|
||||
"home-assistant.bertof.net" = ssl // {
|
||||
locations."/" = {
|
||||
proxyPass = "http://${loki_ipv4}:8123/";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
locations."/" = { proxyPass = "http://loki.zto:8123/"; proxyWebsockets = true; };
|
||||
extraConfig = ''
|
||||
proxy_pass_header Authorization;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
};
|
||||
"radarr.bertof.net" = ssl // {
|
||||
locations."/" = {
|
||||
proxyPass = "http://${loki_ipv4}:7878/";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
"sonarr.bertof.net" = ssl // {
|
||||
locations."/" = {
|
||||
proxyPass = "http://${loki_ipv4}:8989/";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
# "jellyfin.bertof.net" = ssl // {
|
||||
# locations."/" = {
|
||||
# proxyPass = "http://${loki_ipv4}:8096/";
|
||||
# proxyWebsockets = true;
|
||||
# };
|
||||
# };
|
||||
# "my-nextcloud.bertof.net" = ssl // {
|
||||
# locations."/" = {
|
||||
# proxyPass = "http://${freya_ipv4}:80/";
|
||||
# proxyWebsockets = true;
|
||||
# };
|
||||
# };
|
||||
"radarr.bertof.net" = ssl // { locations."/" = { proxyPass = "http://loki.zto:7878/"; proxyWebsockets = true; }; };
|
||||
"sonarr.bertof.net" = ssl // { locations."/" = { proxyPass = "http://loki.zto:8989/"; proxyWebsockets = true; }; };
|
||||
};
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
openssh = { enable = true; openFirewall = true; };
|
||||
# wgautomesh = {
|
||||
# enable = true;
|
||||
# settings = {
|
||||
|
|
@ -145,10 +92,7 @@
|
|||
# };
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "filippo.berto95@gmail.com";
|
||||
};
|
||||
security.acme = { acceptTerms = true; defaults.email = "filippo.berto95@gmail.com"; };
|
||||
|
||||
users.users.bertof = {
|
||||
isNormalUser = true;
|
||||
|
|
@ -171,17 +115,16 @@
|
|||
"net.ipv4.conf.default.forwarding" = true;
|
||||
};
|
||||
|
||||
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server = [ "1.1.1.1" "8.8.8.8" ];
|
||||
interface = "wg0";
|
||||
};
|
||||
# extraConfig = ''
|
||||
# interface=wg0
|
||||
# '';
|
||||
};
|
||||
# services.dnsmasq = {
|
||||
# enable = true;
|
||||
# settings = {
|
||||
# server = [ "1.1.1.1" "8.8.8.8" ];
|
||||
# interface = "wg0";
|
||||
# };
|
||||
# # extraConfig = ''
|
||||
# # interface=wg0
|
||||
# # '';
|
||||
# };
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
|
|
@ -240,48 +183,48 @@
|
|||
# ];
|
||||
# };
|
||||
# };
|
||||
wg-quick.interfaces.wg0 = {
|
||||
address = [ "10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64" ];
|
||||
listenPort = 51820;
|
||||
privateKeyFile = config.age.secrets.baldur_wg_priv.path;
|
||||
# wg-quick.interfaces.wg0 = {
|
||||
# address = [ "10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64" ];
|
||||
# listenPort = 51820;
|
||||
# privateKeyFile = config.age.secrets.baldur_wg_priv.path;
|
||||
|
||||
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
|
||||
postUp = ''
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o ens3 -j MASQUERADE
|
||||
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o ens3 -j MASQUERADE
|
||||
'';
|
||||
# # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
|
||||
# postUp = ''
|
||||
# ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
|
||||
# ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o ens3 -j MASQUERADE
|
||||
# ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
|
||||
# ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o ens3 -j MASQUERADE
|
||||
# '';
|
||||
|
||||
# Undo the above
|
||||
preDown = ''
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.1/24 -o ens3 -j MASQUERADE
|
||||
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o ens3 -j MASQUERADE
|
||||
'';
|
||||
# # Undo the above
|
||||
# preDown = ''
|
||||
# ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
|
||||
# ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.1/24 -o ens3 -j MASQUERADE
|
||||
# ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
|
||||
# ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o ens3 -j MASQUERADE
|
||||
# '';
|
||||
|
||||
peers = [
|
||||
{
|
||||
# odin
|
||||
publicKey = "LDBhvzeYmHJ0z5ch+N559GWjT3It1gZvGR/9WtCfURw=";
|
||||
presharedKeyFile = config.age.secrets.wg_psk.path;
|
||||
allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ];
|
||||
}
|
||||
{
|
||||
# oppo
|
||||
publicKey = "OBk6bHKuIYLwD7cwjmAuMn57jXqbDwCL52jhQxiHnnA=";
|
||||
presharedKeyFile = config.age.secrets.wg_psk.path;
|
||||
allowedIPs = [ "10.0.0.3/32" "fdc9:281f:04d7:9ee9::3/128" ];
|
||||
}
|
||||
{
|
||||
# thor
|
||||
publicKey = "rpwR6n4IE96VZAmQDBufsWE/a9G7d8fpkvY1OwsbOhk=";
|
||||
presharedKeyFile = config.age.secrets.wg_psk.path;
|
||||
allowedIPs = [ "10.0.0.4/32" "fdc9:281f:04d7:9ee9::4/128" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
# peers = [
|
||||
# {
|
||||
# # odin
|
||||
# publicKey = "LDBhvzeYmHJ0z5ch+N559GWjT3It1gZvGR/9WtCfURw=";
|
||||
# presharedKeyFile = config.age.secrets.wg_psk.path;
|
||||
# allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ];
|
||||
# }
|
||||
# {
|
||||
# # oppo
|
||||
# publicKey = "OBk6bHKuIYLwD7cwjmAuMn57jXqbDwCL52jhQxiHnnA=";
|
||||
# presharedKeyFile = config.age.secrets.wg_psk.path;
|
||||
# allowedIPs = [ "10.0.0.3/32" "fdc9:281f:04d7:9ee9::3/128" ];
|
||||
# }
|
||||
# {
|
||||
# # thor
|
||||
# publicKey = "rpwR6n4IE96VZAmQDBufsWE/a9G7d8fpkvY1OwsbOhk=";
|
||||
# presharedKeyFile = config.age.secrets.wg_psk.path;
|
||||
# allowedIPs = [ "10.0.0.4/32" "fdc9:281f:04d7:9ee9::4/128" ];
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
};
|
||||
|
||||
system.stateVersion = "23.05";
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue