summaryrefslogtreecommitdiffstats
path: root/krebs/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'krebs/3modules')
-rw-r--r--krebs/3modules/default.nix1
-rw-r--r--krebs/3modules/makefu/default.nix4
-rw-r--r--krebs/3modules/retiolum-bootstrap.nix58
3 files changed, 61 insertions, 2 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index ff0cc8346..756245c0b 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -14,6 +14,7 @@ let
./iptables.nix
./nginx.nix
./Reaktor.nix
+ ./retiolum-bootstrap.nix
./realwallpaper.nix
./retiolum.nix
./urlwatch.nix
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 4628b2acc..acc5d7dd2 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -127,10 +127,8 @@ with import ../../4lib { inherit lib; };
"krebsco.de" = ''
IN MX 10 mx42
euer IN MX 1 aspmx.l.google.com.
- io IN NS pigstarter.krebsco.de.
pigstarter IN A ${head nets.internet.addrs4}
gold IN A ${head nets.internet.addrs4}
- tinc IN A ${head nets.internet.addrs4}
boot IN A ${head nets.internet.addrs4}'';
};
nets = {
@@ -166,7 +164,9 @@ with import ../../4lib { inherit lib; };
extraZones = {
"krebsco.de" = ''
wry IN A ${head nets.internet.addrs4}
+ io IN NS wry.krebsco.de.
graphs IN A ${head nets.internet.addrs4}
+ tinc IN A ${head nets.internet.addrs4}
'';
};
nets = rec {
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
new file mode 100644
index 000000000..eed11642f
--- /dev/null
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+ cfg = config.krebs.retiolum-bootstrap;
+
+ out = {
+ options.krebs.retiolum-bootstrap = api;
+ config = mkIf cfg.enable imp ;
+ };
+
+ api = {
+ enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de";
+ hostname = mkOption {
+ type = types.str;
+ description = "hostname which serves tinc boot";
+ default = "tinc.krebsco.de" ;
+ };
+ ssl_certificate_key = mkOption {
+ type = types.str;
+ description = "Certificate key to use for ssl";
+ default = "/root/secrets/tinc.krebsco.de.key";
+ };
+ ssl_certificate = mkOption {
+ type = types.str;
+ description = "Certificate file to use for ssl";
+ default = "/root/secrets/tinc.krebsco.de.crt" ;
+ };
+ # in use:
+ # <secrets/tinc.krebsco.de.crt>
+ # <secrets/tinc.krebsco.de.key>
+ };
+
+ imp = {
+ krebs.nginx.servers = assert config.krebs.nginx.enable; {
+ retiolum-boot-redir = {
+ server-names = singleton cfg.hostname;
+ extraConfig = ''
+ return 301 https://$server_name$request_uri;
+ '';
+ locations = [];
+ };
+ retiolum-boot-ssl = {
+ server-names = singleton cfg.hostname;
+ listen = "443 ssl";
+ extraConfig = ''
+ ssl_certificate ${cfg.ssl_certificate};
+ ssl_certificate_key ${cfg.ssl_certificate_key};
+ root ${pkgs.retiolum-bootstrap};
+ try_files $uri $uri/retiolum.sh;
+ '';
+ locations = [];
+ };
+ };
+ };
+
+in
+out