makefu/stockholm
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'lass/master'

Browse source
This commit is contained in:
makefu 2018-12-19 14:10:21 +01:00
parent 5299bd93a0 dc79107558
commit b7529f97e1
No known key found for this signature in database
GPG key ID: 36F7711F3FC0F225
31 changed files with 156 additions and 86 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
krebs/3modules/external/default.nix vendored
View file

@ -289,6 +289,31 @@ in {
};
};
};
qubasa = {
owner = config.krebs.users.qubasa;
nets = {
retiolum = {
ip4.addr = "10.243.29.175";
aliases = [ "qubasa.r" ];
tinc.pubkey = ''
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA6ioASTOx6Vndp316u89Z
f+9WgfyVGw9deP2pQjoHnsPjBqRrsDCQGFO/U1ILQn0AWskQpHWHRir7Q6cI90jm
8MqqGVymVFbeYbrOLHLjp+2fle9iU9DfST4O76TQwF/3elLf3tpGFS8EB+qF3Ig7
aVOf5TuHPWWj6VtGTuWW9I8MsPnNykyRstlWXEztIs2zQrc0cO1IGd1QVarDGqTs
KR4Zm7PvF7U193NzPLaH6jcdjF37FETLrNxAu88M+YnvXBp4oRHeJmvBloazpH0v
aSb3+vNRlViMSlf9ImpAHlFRyvYYDAWlIY0nyeNUJna1ImGloSStLtBAhFAwc65j
kmrXeK3TVAoGZQOvSbjFmI/nBgfHEOnz/9aRVHGUNoQ/nAM6UhALFEZV6sdjX6W4
3p670DEO5fiI3fqqErkscbv8zSEjfmxV4YGMXVMw8Ub87fGwQEF17uDLeqD0k9AB
7umwrWP53YffauAqinma0I6RcLRVRfJ2vhyBH1mKwAAW55WU6DpBTydy46kxy/Oz
k9Cnxw7oMydUAAdnf5Axgs+dcx43lnXvGsoHi4lZycYhqtPe2YI152HAbGfmrixV
Slzh8aiinBkLYW2VzJNTRmHvB3njjeua4/guXwe00G7MIs3UDMIieJNcVxb+E07v
vF2rqhqU9b+1MQRhIPsBf4cCAwEAAQ==
-----END PUBLIC KEY-----
'';
};
};
};
};
users = {
Mic92 = {
@ -301,6 +326,9 @@ in {
};
sokratess = {
};
qubasa = {
mail = "luis.nixos@gmail.com";
};
};
}

24
krebs/3modules/lass/default.nix
View file

@ -8,7 +8,7 @@ with import <stockholm/lib>;
};
r6 = ip: (krebs.genipv6 "retiolum" "lass" ip).address;
w6 = ip: (krebs.genipv6 "wirelum" "lass" ip).address;
w6 = ip: (krebs.genipv6 "wiregrill" "lass" ip).address;
in {
dns.providers = {
@ -89,7 +89,7 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
via = internet;
ip4.addr = "10.244.1.1";
ip6.addr = w6 "1";
@ -98,7 +98,11 @@ in {
];
wireguard = {
pubkey = "oKJotppdEJqQBjrqrommEUPw+VFryvEvNJr/WikXohk=";
subnets = [ "10.244.1.0/24" "42:1::/32" ];
subnets = [
"10.244.1.0/24"
(krebs.genipv6 "wiregrill" "external" 0).subnetCIDR
(krebs.genipv6 "wiregrill" "lass" 0).subnetCIDR
];
};
};
};
@ -191,7 +195,7 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
ip6.addr = w6 "dea7";
aliases = [
"mors.w"
@ -224,7 +228,7 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
ip6.addr = w6 "50da";
aliases = [
"shodan.w"
@ -257,7 +261,7 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
ip6.addr = w6 "1205";
aliases = [
"icarus.w"
@ -419,7 +423,7 @@ in {
-----END PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
ip6.addr = w6 "3110";
aliases = [
"yellow.w"
@ -456,7 +460,7 @@ in {
-----END PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
ip6.addr = w6 "b1ce";
aliases = [
"blue.w"
@ -469,7 +473,7 @@ in {
};
phone = {
nets = {
wirelum = {
wiregrill = {
ip4.addr = "10.244.1.2";
ip6.addr = w6 "a";
aliases = [
@ -506,7 +510,7 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
wirelum = {
wiregrill = {
ip6.addr = w6 "012f";
aliases = [
"morpheus.w"

29
krebs/3modules/tv/default.nix
View file

@ -1,12 +1,30 @@
with import <stockholm/lib>;
{ config, ... }: let
hostDefaults = hostName: host: flip recursiveUpdate host ({
hostDefaults = hostName: host: foldl' recursiveUpdate {} [
{
owner = config.krebs.users.tv;
} // optionalAttrs (host.nets?retiolum) {
nets.retiolum.ip6.addr =
}
(optionalAttrs (host.nets?retiolum) {
nets.retiolum = {
ip6.addr =
(krebs.genipv6 "retiolum" "tv" { inherit hostName; }).address;
});
};
})
(let
pubkey-path = ./wiregrill + "/${hostName}.pub";
in optionalAttrs (pathExists pubkey-path) {
nets.wiregrill = {
aliases = [
"${hostName}.w"
];
ip6.addr =
(krebs.genipv6 "wiregrill" "tv" { inherit hostName; }).address;
wireguard.pubkey = readFile pubkey-path;
};
})
host
];
in {
dns.providers = {
@ -103,6 +121,9 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
wiregrill.wireguard.subnets = [
(krebs.genipv6 "wiregrill" "tv" 0).subnetCIDR
];
};
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILGDdcKwFm6udU0/x6XGGb87k9py0VlrxF54HeYu9Izb";
};

1
krebs/3modules/tv/wiregrill/alnus.pub Normal file
View file

@ -0,0 +1 @@
w7+6kMf1P3Ka0kXXY4CCbr80TrWPYpe/zd13yuvz9SE=

1
krebs/3modules/tv/wiregrill/mu.pub Normal file
View file

@ -0,0 +1 @@
4bboT+cZM1BYvNho9oKbO0MFnPFTvmASR+1IdV4/fwQ=

1
krebs/3modules/tv/wiregrill/ni.pub Normal file
View file

@ -0,0 +1 @@
KiIiwkuin+E4FXqFajJjnoGKkHW3H3FzIx5EQrF1+lw=

1
krebs/3modules/tv/wiregrill/nomic.pub Normal file
View file

@ -0,0 +1 @@
UgvgarDtuSvbciNx5SU2NDbctb9/OTQ9Kr8H/O3931A=

1
krebs/3modules/tv/wiregrill/querel.pub Normal file
View file

@ -0,0 +1 @@
sxaqrsqcDgdM3+QH6mxzqDs3SLWgm7J8AytpIbRZ2n0=

1
krebs/3modules/tv/wiregrill/wu.pub Normal file
View file

@ -0,0 +1 @@
68bL6l3/sjbirva80tm0Dw6/PJu1S95nJC58gWCh42E=

1
krebs/3modules/tv/wiregrill/xu.pub Normal file
View file

@ -0,0 +1 @@
XU76RFN0jG/YjffAPg3e3VuHF/iKMvVoRhHmixvLL1s=

1
krebs/3modules/tv/wiregrill/zu.pub Normal file
View file

@ -0,0 +1 @@
WrILdnsketejrJuYM/sLEh89GdSVbddv8BG/D3sW7kw=

1
lass/1systems/littleT/config.nix
View file

@ -6,6 +6,7 @@ with import <stockholm/lib>;
<stockholm/lass>
<stockholm/lass/2configs/retiolum.nix>
<stockholm/lass/2configs/blue-host.nix>
];
networking.networkmanager.enable = true;

6
lass/1systems/prism/config.nix
View file

@ -298,15 +298,15 @@ with import <stockholm/lib>;
}
{
imports = [
<stockholm/lass/2configs/wirelum.nix>
<stockholm/lass/2configs/wiregrill.nix>
];
krebs.iptables.tables.nat.PREROUTING.rules = [
{ v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
{ v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
];
krebs.iptables.tables.filter.FORWARD.rules = [
{ precedence = 1000; predicate = "-i wirelum -o retiolum"; target = "ACCEPT"; }
{ precedence = 1000; predicate = "-i retiolum -o wirelum"; target = "ACCEPT"; }
{ precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
{ precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
];
krebs.iptables.tables.nat.POSTROUTING.rules = [
{ v4 = false; predicate = "-s 42:1:ce16::/48 ! -d 42:1:ce16::48"; target = "MASQUERADE"; }

1
lass/1systems/skynet/config.nix
View file

@ -5,7 +5,6 @@ with import <stockholm/lib>;
<stockholm/lass>
<stockholm/lass/2configs/retiolum.nix>
<stockholm/lass/2configs/fetchWallpaper.nix>
<stockholm/lass/2configs/blue-host.nix>
<stockholm/lass/2configs/power-action.nix>
{

1
lass/2configs/baseX.nix
View file

@ -64,6 +64,7 @@ in {
dic
dmenu
font-size
fzfmenu
gitAndTools.qgit
git-preview
gnome3.dconf

1
lass/2configs/blue-host.nix
View file

@ -7,6 +7,7 @@ let
"daedalus"
"skynet"
"prism"
"littleT"
];
remote_hosts = filter (h: h != config.networking.hostName) all_hosts;

4
lass/2configs/blue.nix
View file

@ -22,9 +22,9 @@ with (import <stockholm/lib>);
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
{ predicate = "-i wirelum -p udp --dport 60000:61000"; target = "ACCEPT";}
{ predicate = "-i wiregrill -p udp --dport 60000:61000"; target = "ACCEPT";}
{ predicate = "-i retiolum -p tcp --dport 9999"; target = "ACCEPT";}
{ predicate = "-i wirelum -p tcp --dport 9999"; target = "ACCEPT";}
{ predicate = "-i wiregrill -p tcp --dport 9999"; target = "ACCEPT";}
];
systemd.services.chat = let

2
lass/2configs/default.nix
View file

@ -10,7 +10,7 @@ with import <stockholm/lib>;
./zsh.nix
./htop.nix
./security-workarounds.nix
./wirelum.nix
./wiregrill.nix
{
users.extraUsers =
mapAttrs (_: h: { hashedPassword = h; })

9
lass/2configs/websites/domsen.nix
View file

@ -126,6 +126,7 @@ in {
{ from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
{ from = "akayguen@freemonkey.art"; to ="akayguen"; }
{ from = "bui@freemonkey.art"; to ="bui"; }
{ from = "kontakt@alewis.de"; to ="klabusterbeere"; }
{ from = "testuser@lassul.us"; to = "testuser"; }
{ from = "testuser@ubikmedia.eu"; to = "testuser"; }
@ -134,6 +135,7 @@ in {
"jla-trading.com"
"ubikmedia.eu"
"ubikmedia.de"
"alewis.de"
];
ssl_cert = "/var/lib/acme/lassul.us/fullchain.pem";
ssl_key = "/var/lib/acme/lassul.us/key.pem";
@ -204,5 +206,12 @@ in {
createHome = true;
};
users.users.klabusterbeere = {
uid = genid_uint31 "klabusterbeere";
home = "/home/klabusterbeere";
useDefaultShell = true;
createHome = true;
};
}

44
lass/2configs/wiregrill.nix Normal file
View file

@ -0,0 +1,44 @@
with import <stockholm/lib>;
{ config, pkgs, ... }: let
self = config.krebs.build.host.nets.wiregrill;
isRouter = !isNull self.via;
in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
#hack for modprobe inside containers
systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
(pkgs.writeDashBin "modprobe" ":")
]);
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
};
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
];
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [
{ precedence = 1000; predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
];
networking.wireguard.interfaces.wiregrill = {
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);
listenPort = 51820;
privateKeyFile = (toString <secrets>) + "/wiregrill.key";
allowedIPsAsRoutes = true;
peers = mapAttrsToList
(_: host: {
allowedIPs = if isRouter then
(optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) ++
(optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
else
host.nets.wiregrill.wireguard.subnets
;
endpoint = mkIf (!isNull host.nets.wiregrill.via) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}");
persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
publicKey = (replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey);
})
(filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
};
}

44
lass/2configs/wirelum.nix
View file

@ -1,44 +0,0 @@
with import <stockholm/lib>;
{ config, pkgs, ... }: let
self = config.krebs.build.host.nets.wirelum;
isRouter = !isNull self.via;
in mkIf (hasAttr "wirelum" config.krebs.build.host.nets) {
#hack for modprobe inside containers
systemd.services."wireguard-wirelum".path = mkIf config.boot.isContainer (mkBefore [
(pkgs.writeDashBin "modprobe" ":")
]);
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
};
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
];
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [
{ precedence = 1000; predicate = "-i wirelum -o wirelum"; target = "ACCEPT"; }
];
networking.wireguard.interfaces.wirelum = {
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);
listenPort = 51820;
privateKeyFile = (toString <secrets>) + "/wirelum.key";
allowedIPsAsRoutes = true;
peers = mapAttrsToList
(_: host: {
allowedIPs = if isRouter then
(optional (!isNull host.nets.wirelum.ip4) host.nets.wirelum.ip4.addr) ++
(optional (!isNull host.nets.wirelum.ip6) host.nets.wirelum.ip6.addr)
else
host.nets.wirelum.wireguard.subnets
;
endpoint = mkIf (!isNull host.nets.wirelum.via) (host.nets.wirelum.via.ip4.addr + ":${toString host.nets.wirelum.wireguard.port}");
persistentKeepalive = mkIf (!isNull host.nets.wirelum.via) 61;
publicKey = host.nets.wirelum.wireguard.pubkey;
})
(filterAttrs (_: h: hasAttr "wirelum" h.nets) config.krebs.hosts);
};
}

8
lass/5pkgs/l-gen-secrets/default.nix
View file

@ -8,8 +8,8 @@ pkgs.writeDashBin "l-gen-secrets" ''
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null
${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null
${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null
${pkgs.wireguard}/bin/wg genkey > $TMPDIR/wirelum.key
${pkgs.coreutils}/bin/cat $TMPDIR/wirelum.key | ${pkgs.wireguard}/bin/wg pubkey > $TMPDIR/wirelum.pub
${pkgs.wireguard}/bin/wg genkey > $TMPDIR/wiregrill.key
${pkgs.coreutils}/bin/cat $TMPDIR/wiregrill.key | ${pkgs.wireguard}/bin/wg pubkey > $TMPDIR/wiregrill.pub
cat <<EOF > $TMPDIR/hashedPasswords.nix
{
root = "$HASHED_PASSWORD";
@ -37,13 +37,13 @@ pkgs.writeDashBin "l-gen-secrets" ''
$(cat $TMPDIR/retiolum.rsa_key.pub)
${"''"};
};
wirelum = {
wiregrill = {
ip6.addr = (wip6 "changeme").address;
aliases = [
"$HOSTNAME.w"
];
wireguard.pubkey = ${"''"}
$(cat $TMPDIR/wirelum.pub)
$(cat $TMPDIR/wiregrill.pub)
${"''"};
};
};

4
lib/krebs/genipv6.nix
View file

@ -16,12 +16,12 @@ let {
normalize-ip6-addr (appendZeros addressLength netPrefix);
netHash = toString {
retiolum = 0;
wirelum = 1;
wiregrill = 1;
}.${netname};
netPrefix = "42:${netHash}";
netPrefixLength = {
retiolum = 32;
wirelum = 32;
wiregrill = 32;
}.${netname};
inherit subnetname;

4
tv/1systems/alnus/config.nix
View file

@ -8,10 +8,6 @@ with import <stockholm/lib>;
<stockholm/tv/2configs/retiolum.nix>
];
# TODO remove non-hardware stuff from ../2configs/hw/x220.nix
# networking.wireless.enable collides with networkmanager
networking.wireless.enable = mkForce false;
boot = {
initrd = {
availableKernelModules = [ "ahci" ];

8
tv/1systems/mu/config.nix
View file

@ -5,6 +5,7 @@ with import <stockholm/lib>;
<stockholm/tv>
<stockholm/tv/2configs/br.nix>
<stockholm/tv/2configs/exim-retiolum.nix>
<stockholm/tv/2configs/hw/x220.nix>
<stockholm/tv/2configs/retiolum.nix>
];
@ -13,10 +14,7 @@ with import <stockholm/lib>;
tv.x0vncserver.enable = true;
# hardware configuration
boot.initrd.luks.devices.muca = {
device = "/dev/disk/by-uuid/7b24a931-40b6-44a6-ba22-c805cf164e91";
};
boot.initrd.luks.devices.muca.device = "/dev/sda2";
boot.initrd.luks.cryptoModules = [ "aes" "sha512" "xts" ];
boot.initrd.availableKernelModules = [ "ahci" ];
boot.kernelModules = [ "fbcon" "kvm-intel" ];
@ -34,7 +32,7 @@ with import <stockholm/lib>;
options = [ "defaults" "discard" ];
};
"/boot" = {
device = "/dev/disk/by-uuid/CEB1-9743";
device = "/dev/sda1";
fsType = "vfat";
};
};

2
tv/1systems/nomic/config.nix
View file

@ -64,4 +64,6 @@ with import <stockholm/lib>;
gnupg
tmux
];
networking.wireless.enable = true;
}

2
tv/1systems/wu/config.nix
View file

@ -41,6 +41,8 @@ with import <stockholm/lib>;
};
};
networking.wireless.enable = true;
services.printing.enable = true;
services.udev.extraRules = ''

2
tv/1systems/xu/config.nix
View file

@ -147,6 +147,8 @@ with import <stockholm/lib>;
gptfdisk
];
networking.wireless.enable = true;
#services.bitlbee.enable = true;
#services.tor.client.enable = true;
#services.tor.enable = true;

2
tv/1systems/zu/config.nix
View file

@ -44,6 +44,8 @@ with import <stockholm/lib>;
};
};
networking.wireless.enable = true;
services.printing.enable = true;
#services.bitlbee.enable = true;

2
tv/2configs/hw/AO753.nix
View file

@ -25,8 +25,6 @@ with import <stockholm/lib>;
config.boot.kernelPackages.broadcom_sta
];
networking.wireless.enable = true;
nix = {
buildCores = 2;
maxJobs = 2;

2
tv/2configs/hw/x220.nix
View file

@ -26,8 +26,6 @@
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.wireless.enable = true;
# Required for Centrino.
hardware.enableRedistributableFirmware = true;