3 files changed, 30 insertions, 1 deletions
diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 02749dafe..9849937d5 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -14,6 +14,7 @@
     <stockholm/krebs/2configs/mud.nix>
 
     <stockholm/krebs/2configs/cal.nix>
+    <stockholm/krebs/2configs/mastodon.nix>
 
     ## shackie irc bot
     <stockholm/krebs/2configs/shack/reaktor.nix>
@@ -21,6 +22,7 @@
 
   krebs.build.host = config.krebs.hosts.hotdog;
   krebs.github-hosts-sync.enable = true;
+  krebs.pages.enable = true;
 
   boot.isContainer = true;
   networking.useDHCP = false;
diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index 8250ebad9..2f55995cf 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -7,5 +7,31 @@
     <stockholm/krebs/2configs/matterbridge.nix>
   ];
 
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.logRefusedConnections = false;
+  networking.firewall.logRefusedUnicastsOnly = false;
+
+  # Move Internet-facing SSH port to reduce logspam.
+  networking.firewall.extraCommands = let
+    host = config.krebs.build.host;
+  in /* sh */ ''
+    iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
+    iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+
+    ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
+    ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+  '';
+
   krebs.build.host = config.krebs.hosts.ponte;
+
+  krebs.pages.enable = true;
+  krebs.pages.nginx.addSSL = true;
+  krebs.pages.nginx.enableACME = true;
+
+  security.acme.acceptTerms = true;
+  security.acme.certs.${config.krebs.pages.domain}.email = "spam@krebsco.de";
 }
diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index f4bd472a4..033cb94d1 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -110,7 +110,8 @@
     <stockholm/krebs/2configs/shack/prometheus/server.nix>
     <stockholm/krebs/2configs/shack/prometheus/blackbox.nix>
     #<stockholm/krebs/2configs/shack/prometheus/unifi.nix>
-    <stockholm/krebs/2configs/shack/prometheus/alertmanager-telegram.nix>
+    # TODO: alertmanager 0.24+ supports telegram
+    # <stockholm/krebs/2configs/shack/prometheus/alertmanager-telegram.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.puyak;