From 69daaa8f3477cdfbe8d0b508c12ee5d976586e11 Mon Sep 17 00:00:00 2001 From: makefu Date: Sat, 23 Jan 2016 00:22:56 +0100 Subject: ma 2 urlwatch: add acng --- makefu/2configs/urlwatch.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/makefu/2configs/urlwatch.nix b/makefu/2configs/urlwatch.nix index a83279ba2..f869f5a78 100644 --- a/makefu/2configs/urlwatch.nix +++ b/makefu/2configs/urlwatch.nix @@ -29,6 +29,7 @@ https://pypi.python.org/simple/bepasty/ https://pypi.python.org/simple/xstatic/ http://guest:derpi@cvs2svn.tigris.org/svn/cvs2svn/tags/ + http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/ ]; }; } -- cgit v1.2.3 From 43751d79e81ac6b6e75da3f449ed7e71254286ad Mon Sep 17 00:00:00 2001 From: makefu Date: Sat, 23 Jan 2016 00:27:33 +0100 Subject: s 1 wolf: add grafana service --- shared/1systems/wolf.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index f05356f0f..8cf5be71c 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -12,10 +12,21 @@ in ../2configs/shack-nix-cacher.nix ../2configs/shack-drivedroid.nix ../2configs/buildbot-standalone.nix - ../2configs/graphite.nix + # ../2configs/graphite.nix ]; # use your own binary cache, fallback use cache.nixos.org (which is used by # apt-cacher-ng in first place) + + services.grafana = { + enable = true; + addr = "0.0.0.0"; + extraOptions = { "AUTH_ANONYMOUS_ENABLED" = "true"; }; + users.allowSignUp = true; + users.allowOrgCreate = true; + users.autoAssignOrg = true; + security = import ; + }; + nix.binaryCaches = [ "http://localhost:3142/nixos" "https://cache.nixos.org" ]; networking = { -- cgit v1.2.3 From d1a371f48b95140279528c2a2ff619d39c177a7c Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 27 Jan 2016 22:00:50 +0100 Subject: ma 1 omo: add samba share --- makefu/1systems/omo.nix | 49 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 5 deletions(-) diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 552af4e4f..9162f2ed4 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -32,9 +32,35 @@ in { ../3modules ]; # services.openssh.allowSFTP = false; - krebs.build.host = config.krebs.hosts.omo; krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce"; + # samba share /media/crypt1/share + users.extraUsers.smbguest = { + name = "smbguest"; + uid = config.ids.uids.smbguest; + description = "smb guest user"; + home = "/var/empty"; + }; + services.samba = { + enable = true; + shares = { + winshare = { + path = "/media/crypt1/share"; + "read only" = "no"; + browseable = "yes"; + "guest ok" = "yes"; + }; + }; + extraConfig = '' + guest account = smbguest + map to guest = bad user + # disable printing + load printers = no + printing = bsd + printcap name = /dev/null + disable spoolss = yes + ''; + }; # copy config from to /var/lib/sabnzbd/ services.sabnzbd.enable = true; systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; @@ -97,9 +123,22 @@ in { extraModulePackages = [ ]; }; - networking.firewall.allowedUDPPorts = [ 655 ]; - # 8080: sabnzbd - networking.firewall.allowedTCPPorts = [ 80 655 8080 ]; + networking.firewall.allowedUDPPorts = [ + # tinc + 655 + # samba + 137 138 + ]; + networking.firewall.allowedTCPPorts = [ + # nginx + 80 + # tinc + 655 + # samba + 445 139 + # sabnzbd + 8080 + ]; hardware.enableAllFirmware = true; hardware.cpu.amd.updateMicrocode = true; @@ -107,5 +146,5 @@ in { zramSwap.enable = true; zramSwap.numDevices = 2; - + krebs.build.host = config.krebs.hosts.omo; } -- cgit v1.2.3 From f6a3c1f3d6b013641b077baf8ddb3a78e75d8b95 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 27 Jan 2016 22:20:32 +0100 Subject: ma 1 omo: cleanup, fix firewalling --- makefu/1systems/omo.nix | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-) diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 9162f2ed4..19183fea8 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -31,11 +31,19 @@ in { ../2configs/nginx/omo-share.nix ../3modules ]; + networking.firewall.trustedInterfaces = [ "enp3s0" ]; + # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net + # tcp:80 - nginx for sharing files + # tcp:655 udp:655 - tinc + # tcp:8080 - sabnzbd + networking.firewall.allowedUDPPorts = [ 655 ]; + networking.firewall.allowedTCPPorts = [ 80 655 8080 ]; + # services.openssh.allowSFTP = false; krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce"; # samba share /media/crypt1/share - users.extraUsers.smbguest = { + users.users.smbguest = { name = "smbguest"; uid = config.ids.uids.smbguest; description = "smb guest user"; @@ -61,6 +69,7 @@ in { disable spoolss = yes ''; }; + # copy config from to /var/lib/sabnzbd/ services.sabnzbd.enable = true; systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; @@ -93,6 +102,7 @@ in { ${pkgs.hdparm}/sbin/hdparm -y ${disk} '') allDisks); + # crypto unlocking boot = { initrd.luks = { devices = let @@ -123,23 +133,6 @@ in { extraModulePackages = [ ]; }; - networking.firewall.allowedUDPPorts = [ - # tinc - 655 - # samba - 137 138 - ]; - networking.firewall.allowedTCPPorts = [ - # nginx - 80 - # tinc - 655 - # samba - 445 139 - # sabnzbd - 8080 - ]; - hardware.enableAllFirmware = true; hardware.cpu.amd.updateMicrocode = true; -- cgit v1.2.3