From 767c6fbd14fc8e5eb73cea2f738af88083fcea32 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 01:23:42 +0100 Subject: l yellow.r: move to neoprism, refactor --- lass/1systems/neoprism/config.nix | 3 +- lass/1systems/yellow/config.nix | 105 +++++++++++++++++++++++++++++++++----- 2 files changed, 93 insertions(+), 15 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index 89ad8cfdc..b7bf7afb2 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,7 +4,8 @@ imports = [ - + + { # TODO make new hfos.nix out of this vv users.users.riot = { uid = pkgs.stockholm.lib.genid_uint31 "riot"; diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ecf0337ed..552dd7f00 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,20 +9,23 @@ in { krebs.build.host = config.krebs.hosts.yellow; + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; + }; + users.groups.download.members = [ "transmission" ]; networking.useHostResolvConf = false; networking.useNetworkd = true; - systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; - systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { enable = true; + home = "/var/state/transmission"; group = "download"; downloadDirPermissions = "775"; settings = { - download-dir = "/var/download/finished"; - incomplete-dir = "/var/download/incoming"; - incomplete-dir-enable = true; + download-dir = "/var/download/transmission"; + incomplete-dir-enabled = false; rpc-bind-address = "::"; message-level = 1; umask = 18; @@ -40,11 +43,8 @@ in { }; virtualHosts.default = { default = true; - locations."/dl".extraConfig = '' - return 301 /; - ''; locations."/" = { - root = "/var/download/finished"; + root = "/var/download"; extraConfig = '' fancyindex on; fancyindex_footer "/fancy.html"; @@ -136,6 +136,58 @@ in { ''}; ''; }; + virtualHosts."jelly.r" = { + locations."/".extraConfig = '' + proxy_pass http://localhost:8096/; + proxy_set_header Accept-Encoding ""; + ''; + }; + }; + + services.samba = { + enable = true; + enableNmbd = false; + extraConfig = '' + workgroup = WORKGROUP + server string = ${config.networking.hostName} + # only allow retiolum addresses + hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 + + # Use sendfile() for performance gain + use sendfile = true + + # No NetBIOS is needed + disable netbios = true + + # Only mangle non-valid NTFS names, don't care about DOS support + mangled names = illegal + + # Performance optimizations + socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 + + # Disable all printing + load printers = false + disable spoolss = true + printcap name = /dev/null + + map to guest = Bad User + max log size = 50 + dns proxy = no + security = user + + [global] + syslog only = yes + ''; + shares.public = { + comment = "Warez"; + path = "/var/download"; + public = "yes"; + "only guest" = "yes"; + "create mask" = "0644"; + "directory mask" = "2777"; + writable = "no"; + printable = "no"; + }; }; systemd.services.bruellwuerfel = @@ -164,14 +216,33 @@ in { tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web - { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin + { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr + { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr + { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + + # smbd + { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; } ]; tables.filter.OUTPUT = { policy = "DROP"; rules = [ + { predicate = "-o lo"; target = "ACCEPT"; } { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } @@ -279,7 +350,7 @@ in { ExecStart = pkgs.writers.writeDash "flix-index" '' set -efu - DIR=/var/download/finished + DIR=/var/download cd "$DIR" while inotifywait -rq -e create -e move -e delete "$DIR"; do find . -type f > "$DIR"/index.tmp @@ -294,9 +365,15 @@ in { group = "download"; }; - services.magnetico = { + services.radarr = { + enable = true; + }; + + services.sonarr = { + enable = true; + }; + + services.prowlarr = { enable = true; - web.address = "0.0.0.0"; - web.port = 9092; }; } -- cgit v1.2.3 From 7cb49c556efce96b15b28807464b8d5cdf1ea999 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 18:33:44 +0100 Subject: l neoprism.r: add riot container --- lass/1systems/neoprism/config.nix | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index b7bf7afb2..f203abc07 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -6,20 +6,7 @@ - { # TODO make new hfos.nix out of this vv - users.users.riot = { - uid = pkgs.stockholm.lib.genid_uint31 "riot"; - isNormalUser = true; - extraGroups = [ "libvirtd" ]; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" - ]; - }; - # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } - # ]; - } + ]; krebs.build.host = config.krebs.hosts.neoprism; -- cgit v1.2.3 From 6f0cd02c8c78545899fa4afeeeacd68a365349de Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 21:00:29 +0100 Subject: l: prism-mount -> yellow-mount --- lass/1systems/coaxmetal/config.nix | 2 +- lass/1systems/shodan/config.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'lass/1systems') diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix index dd8308bbd..2c88b68cc 100644 --- a/lass/1systems/coaxmetal/config.nix +++ b/lass/1systems/coaxmetal/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix index ef538f339..5e48c216a 100644 --- a/lass/1systems/shodan/config.nix +++ b/lass/1systems/shodan/config.nix @@ -16,7 +16,7 @@ - + -- cgit v1.2.3 From 0b2952f4ed9572521f7c4a21904943ac33c602b0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 6 Jan 2023 12:17:04 +0100 Subject: l radio.r: init --- lass/1systems/radio/config.nix | 24 ++++++++++++++++++++++++ lass/1systems/radio/physical.nix | 7 +++++++ 2 files changed, 31 insertions(+) create mode 100644 lass/1systems/radio/config.nix create mode 100644 lass/1systems/radio/physical.nix (limited to 'lass/1systems') diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix new file mode 100644 index 000000000..2fd23a448 --- /dev/null +++ b/lass/1systems/radio/config.nix @@ -0,0 +1,24 @@ +with import ; +{ config, lib, pkgs, ... }: +{ + imports = [ + + + + + + + ]; + + krebs.build.host = config.krebs.hosts.radio; + + security.acme = { + acceptTerms = true; + defaults.email = "acme@lassul.us"; + }; + + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt"; + }; +} diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/radio/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +} -- cgit v1.2.3 [cgit] Unable to lock slot /tmp/cgit/7d000000.lock: No such file or directory (2)