this repo has no description
style: format
+285
-211
-1
hosts/dzwonek/default.nix
-1
hosts/dzwonek/default.nix
+17
-5
hosts/dzwonek/modules/hardware-configuration.nix
+17
-5
hosts/dzwonek/modules/hardware-configuration.nix
···
1
1
# Do not modify this file! It was generated by ‘nixos-generate-config’
2
2
# and may be overwritten by future invocations. Please make changes
3
3
# to /etc/nixos/configuration.nix instead.
4
-
{ config, lib, pkgs, modulesPath, ... }:
4
+
{
5
+
config,
6
+
lib,
7
+
pkgs,
8
+
modulesPath,
9
+
...
10
+
}:
5
11
6
12
{
7
-
imports =
8
-
[ (modulesPath + "/profiles/qemu-guest.nix")
9
-
];
13
+
imports = [
14
+
(modulesPath + "/profiles/qemu-guest.nix")
15
+
];
10
16
11
-
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
17
+
boot.initrd.availableKernelModules = [
18
+
"ata_piix"
19
+
"uhci_hcd"
20
+
"virtio_pci"
21
+
"sr_mod"
22
+
"virtio_blk"
23
+
];
12
24
boot.initrd.kernelModules = [ ];
13
25
boot.kernelModules = [ ];
14
26
boot.extraModulePackages = [ ];
+30
-25
hosts/dzwonek/modules/headscale.nix/acl.nix
+30
-25
hosts/dzwonek/modules/headscale.nix/acl.nix
···
1
-
{config, lib, ...}: let
1
+
{ config, lib, ... }:
2
+
let
2
3
l = lib // builtins;
3
4
t = l.types;
4
5
···
10
11
default = "accept";
11
12
};
12
13
proto = l.mkOption {
13
-
type = t.nullOr (t.enum ["tcp" "udp"]);
14
+
type = t.nullOr (
15
+
t.enum [
16
+
"tcp"
17
+
"udp"
18
+
]
19
+
);
14
20
default = null;
15
21
};
16
22
src = l.mkOption {
···
21
27
};
22
28
};
23
29
};
24
-
in {
30
+
in
31
+
{
25
32
options = {
26
33
services.headscale.acl = {
27
34
groups = l.mkOption {
28
35
type = t.attrsOf (t.listOf t.str);
29
-
default = [];
36
+
default = [ ];
30
37
};
31
38
tagOwners = l.mkOption {
32
39
type = t.attrsOf (t.listOf t.str);
33
-
default = [];
40
+
default = [ ];
34
41
};
35
42
hosts = l.mkOption {
36
43
type = t.attrsOf t.str;
37
-
default = [];
44
+
default = [ ];
38
45
};
39
46
rules = l.mkOption {
40
47
type = t.listOf ruleType;
41
-
default = [];
48
+
default = [ ];
42
49
};
43
50
};
44
51
};
45
52
46
-
config = let
47
-
generated = l.toFile "policy.hujson" (l.toJSON {
48
-
groups = l.mapAttrs' (k: v: l.nameValuePair "group:${k}" v) cfg.groups;
49
-
tagOwners = l.mapAttrs' (k: v: l.nameValuePair "tag:${k}" v) cfg.tagOwners;
50
-
hosts = cfg.hosts;
51
-
acls = l.map
52
-
(rule:
53
-
if rule.proto == null
54
-
then l.removeAttrs rule ["proto"]
55
-
else rule
56
-
)
57
-
cfg.rules;
58
-
});
59
-
in {
60
-
services.headscale.settings.policy = {
61
-
mode = "file";
62
-
path = generated;
53
+
config =
54
+
let
55
+
generated = l.toFile "policy.hujson" (
56
+
l.toJSON {
57
+
groups = l.mapAttrs' (k: v: l.nameValuePair "group:${k}" v) cfg.groups;
58
+
tagOwners = l.mapAttrs' (k: v: l.nameValuePair "tag:${k}" v) cfg.tagOwners;
59
+
hosts = cfg.hosts;
60
+
acls = l.map (rule: if rule.proto == null then l.removeAttrs rule [ "proto" ] else rule) cfg.rules;
61
+
}
62
+
);
63
+
in
64
+
{
65
+
services.headscale.settings.policy = {
66
+
mode = "file";
67
+
path = generated;
68
+
};
63
69
};
64
-
};
65
70
}
+22
-17
hosts/dzwonek/modules/headscale.nix/default.nix
+22
-17
hosts/dzwonek/modules/headscale.nix/default.nix
···
4
4
domain = "vpn.${rootDomain}";
5
5
in
6
6
{
7
-
imports = [./acl.nix];
7
+
imports = [ ./acl.nix ];
8
8
9
9
age.secrets.headscaleOidcSecret = {
10
10
file = ../../../../secrets/headscaleOidcSecret.age;
···
18
18
address = "0.0.0.0";
19
19
port = 1111;
20
20
acl = {
21
-
groups.admin = ["90008@gaze.systems"];
21
+
groups.admin = [ "90008@gaze.systems" ];
22
22
tagOwners = {
23
-
private-infra = ["group:admin"];
24
-
other-infra = ["group:admin"];
23
+
private-infra = [ "group:admin" ];
24
+
other-infra = [ "group:admin" ];
25
25
};
26
26
hosts = {
27
27
chernobog = "100.64.0.9";
···
30
30
};
31
31
rules = lib.mkBefore [
32
32
{
33
-
src = ["group:admin"];
34
-
dst = ["tag:private-infra:*" "tag:other-infra:*"];
33
+
src = [ "group:admin" ];
34
+
dst = [
35
+
"tag:private-infra:*"
36
+
"tag:other-infra:*"
37
+
];
35
38
}
36
39
{
37
-
src = ["tag:private-infra"];
38
-
dst = ["tag:other-infra:*"];
40
+
src = [ "tag:private-infra" ];
41
+
dst = [ "tag:other-infra:*" ];
39
42
}
40
43
{
41
-
src = ["wolumonde"];
42
-
dst = ["chernobog:*"];
44
+
src = [ "wolumonde" ];
45
+
dst = [ "chernobog:*" ];
43
46
}
44
47
{
45
-
src = ["90008@gaze.systems"];
46
-
dst = ["90008@gaze.systems:*"];
48
+
src = [ "90008@gaze.systems" ];
49
+
dst = [ "90008@gaze.systems:*" ];
47
50
}
48
51
{
49
-
src = ["90008@gaze.systems" "tag:private-infra"];
50
-
dst = ["autogroup:internet:*"];
52
+
src = [
53
+
"90008@gaze.systems"
54
+
"tag:private-infra"
55
+
];
56
+
dst = [ "autogroup:internet:*" ];
51
57
}
52
58
{
53
-
src = ["ellite@ellite.dev"];
54
-
dst = ["chernobog:8463"];
59
+
src = [ "ellite@ellite.dev" ];
60
+
dst = [ "chernobog:8463" ];
55
61
}
56
62
];
57
63
};
···
76
82
};
77
83
};
78
84
79
-
80
85
# security.acme.certs.${rootDomain}.extraDomainNames = [domain];
81
86
services.nginx.virtualHosts.${domain} = {
82
87
useACMEHost = domain;
+4
-1
hosts/dzwonek/modules/nginx.nix
+4
-1
hosts/dzwonek/modules/nginx.nix
+4
-3
hosts/dzwonek/modules/tailscale.nix
+4
-3
hosts/dzwonek/modules/tailscale.nix
···
1
-
{config, ...}: {
2
-
imports = [../../../modules/network/tailscale.nix];
3
-
1
+
{ config, ... }:
2
+
{
3
+
imports = [ ../../../modules/network/tailscale.nix ];
4
+
4
5
# age.secrets.tailscaleAuthKey.file = ../../../secrets/tailscaleAuthKey.age;
5
6
# services.tailscale.authKeyFile = config.age.secrets.tailscaleAuthKey.path;
6
7
}
+17
-6
hosts/volsinii/modules/hardware-configuration.nix
+17
-6
hosts/volsinii/modules/hardware-configuration.nix
···
1
1
# Do not modify this file! It was generated by ‘nixos-generate-config’
2
2
# and may be overwritten by future invocations. Please make changes
3
3
# to /etc/nixos/configuration.nix instead.
4
-
{ config, lib, pkgs, modulesPath, ... }:
4
+
{
5
+
config,
6
+
lib,
7
+
pkgs,
8
+
modulesPath,
9
+
...
10
+
}:
5
11
6
12
{
7
13
imports = [ ];
8
14
9
-
boot.initrd.availableKernelModules = [ "ata_piix" "sr_mod" "xen_blkfront" ];
15
+
boot.initrd.availableKernelModules = [
16
+
"ata_piix"
17
+
"sr_mod"
18
+
"xen_blkfront"
19
+
];
10
20
boot.initrd.kernelModules = [ ];
11
21
boot.kernelModules = [ ];
12
22
boot.extraModulePackages = [ ];
···
16
26
systemd.network.enable = true;
17
27
systemd.network.wait-online.enable = false;
18
28
systemd.network.networks."enX0" = {
19
-
matchConfig = { Name = "enX0"; };
20
-
address = ["199.71.188.53/29"];
21
-
gateway = ["199.71.188.49"];
29
+
matchConfig = {
30
+
Name = "enX0";
31
+
};
32
+
address = [ "199.71.188.53/29" ];
33
+
gateway = [ "199.71.188.49" ];
22
34
};
23
-
24
35
25
36
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
26
37
}
+4
-3
hosts/volsinii/modules/tailscale.nix
+4
-3
hosts/volsinii/modules/tailscale.nix
···
1
-
{config, ...}: {
2
-
imports = [../../../modules/network/tailscale.nix];
3
-
1
+
{ config, ... }:
2
+
{
3
+
imports = [ ../../../modules/network/tailscale.nix ];
4
+
4
5
# age.secrets.tailscaleAuthKey.file = ../../../secrets/tailscaleAuthKey.age;
5
6
# services.tailscale.authKeyFile = config.age.secrets.tailscaleAuthKey.path;
6
7
}
+15
-10
hosts/wolumonde/modules/atproto.nix
+15
-10
hosts/wolumonde/modules/atproto.nix
···
17
17
}) files
18
18
);
19
19
};
20
-
mkHandleCfg = rootDomain: did: (mkWellKnownCfg {
21
-
"atproto-did" = pkgs.writeText "server" did;
22
-
})
23
-
// {
24
-
useACMEHost = rootDomain;
25
-
forceSSL = true;
26
-
quic = true;
27
-
kTLS = true;
28
-
};
20
+
mkHandleCfg =
21
+
rootDomain: did:
22
+
(mkWellKnownCfg {
23
+
"atproto-did" = pkgs.writeText "server" did;
24
+
})
25
+
// {
26
+
useACMEHost = rootDomain;
27
+
forceSSL = true;
28
+
quic = true;
29
+
kTLS = true;
30
+
};
29
31
mkDidWebCfg = domain: {
30
32
"${domain}" =
31
33
(mkWellKnownCfg {
···
44
46
in
45
47
{
46
48
security.acme.certs."gaze.systems".extraDomainNames = [
47
-
dawnDid guestbookDid "drew.gaze.systems" "test.gaze.systems"
49
+
dawnDid
50
+
guestbookDid
51
+
"drew.gaze.systems"
52
+
"test.gaze.systems"
48
53
];
49
54
services.nginx.virtualHosts = {
50
55
"test.gaze.systems" = mkHandleCfg "gaze.systems" "did:web:dawn.gaze.systems";
+4
-2
hosts/wolumonde/modules/clickee-proxy.nix
+4
-2
hosts/wolumonde/modules/clickee-proxy.nix
+59
-56
hosts/wolumonde/modules/email.nix
+59
-56
hosts/wolumonde/modules/email.nix
···
1
-
{pkgs, ...}: {
2
-
security.acme.certs."ptr.pet".extraDomainNames = [
3
-
"mta-sts.ptr.pet"
4
-
"autoconfig.ptr.pet"
5
-
"autodiscover.ptr.pet"
6
-
"test.ptr.pet"
7
-
];
8
-
services.nginx.virtualHosts."test.ptr.pet" = {
9
-
useACMEHost = "ptr.pet";
10
-
quic = true;
11
-
kTLS = true;
12
-
forceSSL = true;
1
+
{ pkgs, ... }:
2
+
{
3
+
security.acme.certs."ptr.pet".extraDomainNames = [
4
+
"mta-sts.ptr.pet"
5
+
"autoconfig.ptr.pet"
6
+
"autodiscover.ptr.pet"
7
+
"test.ptr.pet"
8
+
];
9
+
services.nginx.virtualHosts."test.ptr.pet" = {
10
+
useACMEHost = "ptr.pet";
11
+
quic = true;
12
+
kTLS = true;
13
+
forceSSL = true;
14
+
};
15
+
services.nginx.virtualHosts."ptr.pet" = {
16
+
useACMEHost = "ptr.pet";
17
+
quic = true;
18
+
kTLS = true;
19
+
forceSSL = true;
20
+
locations."/mail/config-v1.1.xml" = {
21
+
return = "301 https://autoconfig.migadu.com/mail/config-v1.1.xml";
13
22
};
14
-
services.nginx.virtualHosts."ptr.pet" = {
15
-
useACMEHost = "ptr.pet";
16
-
quic = true;
17
-
kTLS = true;
18
-
forceSSL = true;
19
-
locations."/mail/config-v1.1.xml" = {
20
-
return = "301 https://autoconfig.migadu.com/mail/config-v1.1.xml";
21
-
};
22
-
locations."/Autodiscover/Autodiscover.xml" = {
23
-
return = "301 https://autodiscover.migadu.com/Autodiscover/Autodiscover.xml";
24
-
};
23
+
locations."/Autodiscover/Autodiscover.xml" = {
24
+
return = "301 https://autodiscover.migadu.com/Autodiscover/Autodiscover.xml";
25
25
};
26
-
services.nginx.virtualHosts."mta-sts.ptr.pet" = let
27
-
file = pkgs.writeText "mta-sts.txt" ''
28
-
version: STSv1
29
-
mode: enforce
30
-
mx: aspmx1.migadu.com
31
-
mx: aspmx2.migadu.com
32
-
max_age: 31557600
33
-
'';
34
-
in {
35
-
useACMEHost = "ptr.pet";
36
-
quic = true;
37
-
kTLS = true;
38
-
forceSSL = true;
39
-
locations."=/.well-known/mta-sts.txt".extraConfig = ''
40
-
alias ${file};
41
-
default_type text/plain;
42
-
'';
26
+
};
27
+
services.nginx.virtualHosts."mta-sts.ptr.pet" =
28
+
let
29
+
file = pkgs.writeText "mta-sts.txt" ''
30
+
version: STSv1
31
+
mode: enforce
32
+
mx: aspmx1.migadu.com
33
+
mx: aspmx2.migadu.com
34
+
max_age: 31557600
35
+
'';
36
+
in
37
+
{
38
+
useACMEHost = "ptr.pet";
39
+
quic = true;
40
+
kTLS = true;
41
+
forceSSL = true;
42
+
locations."=/.well-known/mta-sts.txt".extraConfig = ''
43
+
alias ${file};
44
+
default_type text/plain;
45
+
'';
43
46
};
44
-
services.nginx.virtualHosts."autoconfig.ptr.pet" = {
45
-
useACMEHost = "ptr.pet";
46
-
quic = true;
47
-
kTLS = true;
48
-
forceSSL = true;
49
-
locations."/" = {
50
-
return = "301 https://autoconfig.migadu.com$request_uri";
51
-
};
47
+
services.nginx.virtualHosts."autoconfig.ptr.pet" = {
48
+
useACMEHost = "ptr.pet";
49
+
quic = true;
50
+
kTLS = true;
51
+
forceSSL = true;
52
+
locations."/" = {
53
+
return = "301 https://autoconfig.migadu.com$request_uri";
52
54
};
53
-
services.nginx.virtualHosts."autodiscover.ptr.pet" = {
54
-
useACMEHost = "ptr.pet";
55
-
quic = true;
56
-
kTLS = true;
57
-
forceSSL = true;
58
-
locations."/" = {
59
-
return = "301 https://autodiscover.migadu.com$request_uri";
60
-
};
55
+
};
56
+
services.nginx.virtualHosts."autodiscover.ptr.pet" = {
57
+
useACMEHost = "ptr.pet";
58
+
quic = true;
59
+
kTLS = true;
60
+
forceSSL = true;
61
+
locations."/" = {
62
+
return = "301 https://autodiscover.migadu.com$request_uri";
61
63
};
64
+
};
62
65
}
+1
-1
hosts/wolumonde/modules/forgejo.nix/default.nix
+1
-1
hosts/wolumonde/modules/forgejo.nix/default.nix
···
54
54
"public"
55
55
];
56
56
57
-
security.acme.certs."gaze.systems".extraDomainNames = [forgejoCfg.server.DOMAIN];
57
+
security.acme.certs."gaze.systems".extraDomainNames = [ forgejoCfg.server.DOMAIN ];
58
58
services.nginx.virtualHosts.${forgejoCfg.server.DOMAIN} = {
59
59
useACMEHost = "gaze.systems";
60
60
forceSSL = true;
+4
-4
hosts/wolumonde/modules/hedgedoc.nix
+4
-4
hosts/wolumonde/modules/hedgedoc.nix
···
1
-
{ config, ... }: let
1
+
{ config, ... }:
2
+
let
2
3
cfg = config.services.hedgedoc.settings;
3
4
in
4
5
{
···
16
17
};
17
18
};
18
19
19
-
security.acme.certs."gaze.systems".extraDomainNames = [cfg.domain];
20
+
security.acme.certs."gaze.systems".extraDomainNames = [ cfg.domain ];
20
21
services.nginx.virtualHosts.${cfg.domain} = {
21
22
useACMEHost = "gaze.systems";
22
23
forceSSL = true;
23
24
quic = true;
24
25
kTLS = true;
25
-
locations."/".proxyPass =
26
-
"http://${cfg.host}:${toString cfg.port}";
26
+
locations."/".proxyPass = "http://${cfg.host}:${toString cfg.port}";
27
27
};
28
28
}
+5
-3
hosts/wolumonde/modules/openbao.disabled/default.nix
+5
-3
hosts/wolumonde/modules/openbao.disabled/default.nix
···
1
-
{lib, config, ...}: let
1
+
{ lib, config, ... }:
2
+
let
2
3
port = 5394;
3
4
domain = "bao.${config.services.headscale.settings.dns.base_domain}";
4
5
cfg = config.services.openbao.settings;
5
6
apiAddress = "127.0.0.1:${toString port}";
6
-
in {
7
-
imports = [./spindle-proxy];
7
+
in
8
+
{
9
+
imports = [ ./spindle-proxy ];
8
10
9
11
services.openbao = {
10
12
enable = true;
+48
-35
hosts/wolumonde/modules/openbao.disabled/spindle-proxy/default.nix
+48
-35
hosts/wolumonde/modules/openbao.disabled/spindle-proxy/default.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
let
3
8
port = 8945;
4
9
secrets = config.age.secrets;
5
10
cfgFile = pkgs.writeText "openbao-proxy-spindle-config.hcl" (
6
11
lib.replaceStrings
7
-
[
8
-
"%role_id%"
9
-
"%secret_id%"
10
-
"%vault_address%"
11
-
"%listener_port%"
12
-
"%name%"
13
-
]
14
-
[
15
-
secrets.spindleOpenbaoRoleId.path
16
-
secrets.spindleOpenbaoSecretId.path
17
-
config.services.openbao.settings.api_addr
18
-
(toString port)
19
-
name
20
-
]
21
-
(lib.fileContents ./config.hcl)
12
+
[
13
+
"%role_id%"
14
+
"%secret_id%"
15
+
"%vault_address%"
16
+
"%listener_port%"
17
+
"%name%"
18
+
]
19
+
[
20
+
secrets.spindleOpenbaoRoleId.path
21
+
secrets.spindleOpenbaoSecretId.path
22
+
config.services.openbao.settings.api_addr
23
+
(toString port)
24
+
name
25
+
]
26
+
(lib.fileContents ./config.hcl)
22
27
);
23
28
domain = "spindle.bao.lan.gaze.systems";
24
29
name = "openbao-proxy-spindle";
···
42
47
group = name;
43
48
};
44
49
users.groups.${name} = {
45
-
members = [name];
50
+
members = [ name ];
46
51
};
47
52
48
53
systemd.services.${name} = {
···
58
63
LimitNOFILE = "65536";
59
64
User = name;
60
65
Group = name;
61
-
RuntimeDirectory=name;
62
-
RuntimeDirectoryMode=0700;
63
-
StateDirectory=name;
64
-
StateDirectoryMode=0700;
65
-
ProcSubset="pid";
66
-
ProtectClock=true;
67
-
ProtectControlGroups=true;
68
-
ProtectHome=true;
69
-
ProtectHostname=true;
70
-
ProtectKernelLogs=true;
71
-
ProtectKernelModules=true;
72
-
ProtectKernelTunables=true;
73
-
ProtectProc="invisible";
74
-
RestrictNamespaces=true;
75
-
RestrictRealtime=true;
76
-
RestrictAddressFamilies=["AF_INET" "AF_INET6" "AF_UNIX"];
77
-
SystemCallArchitectures="native";
78
-
SystemCallFilter=["@system-service" "@resources" "~@privileged"];
66
+
RuntimeDirectory = name;
67
+
RuntimeDirectoryMode = 0700;
68
+
StateDirectory = name;
69
+
StateDirectoryMode = 0700;
70
+
ProcSubset = "pid";
71
+
ProtectClock = true;
72
+
ProtectControlGroups = true;
73
+
ProtectHome = true;
74
+
ProtectHostname = true;
75
+
ProtectKernelLogs = true;
76
+
ProtectKernelModules = true;
77
+
ProtectKernelTunables = true;
78
+
ProtectProc = "invisible";
79
+
RestrictNamespaces = true;
80
+
RestrictRealtime = true;
81
+
RestrictAddressFamilies = [
82
+
"AF_INET"
83
+
"AF_INET6"
84
+
"AF_UNIX"
85
+
];
86
+
SystemCallArchitectures = "native";
87
+
SystemCallFilter = [
88
+
"@system-service"
89
+
"@resources"
90
+
"~@privileged"
91
+
];
79
92
};
80
93
};
81
94
+6
-3
hosts/wolumonde/modules/perses.nix/default.nix
+6
-3
hosts/wolumonde/modules/perses.nix/default.nix
···
66
66
67
67
systemd.services.perses = {
68
68
description = "perses";
69
-
after = ["network.target" "pocket-id.service"];
70
-
requires = ["pocket-id.service"];
69
+
after = [
70
+
"network.target"
71
+
"pocket-id.service"
72
+
];
73
+
requires = [ "pocket-id.service" ];
71
74
serviceConfig = {
72
75
ExecStart = "${pkgs.perses}/bin/perses --config=${persesConfigYaml} --web.listen-address=:${toString port} --log.level=info";
73
76
EnvironmentFile = secrets.persesSecret.path;
···
79
82
cp -f ${./provision}/* ${provisioningFolder}
80
83
'';
81
84
82
-
security.acme.certs."gaze.systems".extraDomainNames = [domain];
85
+
security.acme.certs."gaze.systems".extraDomainNames = [ domain ];
83
86
services.nginx.virtualHosts.${domain} = {
84
87
useACMEHost = "gaze.systems"; # TODO: write a module to define vhosts for subdomains
85
88
quic = true;
+1
-1
hosts/wolumonde/modules/pocket-id.nix
+1
-1
hosts/wolumonde/modules/pocket-id.nix
+2
-2
hosts/wolumonde/modules/tailscale.nix
+2
-2
hosts/wolumonde/modules/tailscale.nix
···
1
1
{ config, ... }:
2
2
{
3
-
imports = [../../../modules/network/tailscale.nix];
4
-
3
+
imports = [ ../../../modules/network/tailscale.nix ];
4
+
5
5
# age.secrets.tailscaleAuthKey.file = ../../../secrets/tailscaleAuthKey.age;
6
6
# services.tailscale.authKeyFile = config.age.secrets.tailscaleAuthKey.path;
7
7
+4
-1
hosts/wolumonde/modules/tangled.nix/default.nix
+4
-1
hosts/wolumonde/modules/tangled.nix/default.nix
+1
-1
hosts/wolumonde/modules/tangled.nix/knot.nix
+1
-1
hosts/wolumonde/modules/tangled.nix/knot.nix
···
24
24
};
25
25
};
26
26
27
-
security.acme.certs."gaze.systems".extraDomainNames = [knotCfg.server.hostname];
27
+
security.acme.certs."gaze.systems".extraDomainNames = [ knotCfg.server.hostname ];
28
28
29
29
services.nginx.virtualHosts.${knotCfg.server.hostname} = {
30
30
useACMEHost = "gaze.systems";
+1
-1
hosts/wolumonde/modules/tangled.nix/spindle.nix
+1
-1
hosts/wolumonde/modules/tangled.nix/spindle.nix
···
41
41
};
42
42
};
43
43
44
-
security.acme.certs."gaze.systems".extraDomainNames = [spindleCfg.server.hostname];
44
+
security.acme.certs."gaze.systems".extraDomainNames = [ spindleCfg.server.hostname ];
45
45
46
46
services.nginx.virtualHosts.${spindleCfg.server.hostname} = {
47
47
useACMEHost = "gaze.systems";
+5
-3
hosts/wolumonde/modules/webhook.disabled/default.nix
+5
-3
hosts/wolumonde/modules/webhook.disabled/default.nix
···
1
-
{ config, tlib, ... }: let
1
+
{ config, tlib, ... }:
2
+
let
2
3
domain = "webhook.gaze.systems";
3
-
in {
4
+
in
5
+
{
4
6
imports = tlib.importFolder ./.;
5
7
6
8
services.webhook = {
···
15
17
group = "nginx";
16
18
};
17
19
18
-
security.acme.certs."gaze.systems".extraDomainNames = [domain];
20
+
security.acme.certs."gaze.systems".extraDomainNames = [ domain ];
19
21
services.nginx.virtualHosts.${domain} = {
20
22
useACMEHost = "gaze.systems";
21
23
forceSSL = true;
+15
-14
hosts/wolumonde/modules/webhook.disabled/deploy-wolumonde.nix
+15
-14
hosts/wolumonde/modules/webhook.disabled/deploy-wolumonde.nix
···
1
-
{ pkgs, ... }: let
1
+
{ pkgs, ... }:
2
+
let
2
3
port = toString 9000;
3
-
in {
4
+
in
5
+
{
4
6
services.webhook.hooks."deploy-wolumonde" = {
5
7
execute-command = "${pkgs.curl}/bin/curl";
6
-
pass-arguments-to-command =
7
-
builtins.map
8
-
(n: {
9
-
source = "string";
10
-
name = n;
11
-
})
12
-
[ "http://higashi:${port}/hooks/deploy-wolumonde" ];
8
+
pass-arguments-to-command = builtins.map (n: {
9
+
source = "string";
10
+
name = n;
11
+
}) [ "http://higashi:${port}/hooks/deploy-wolumonde" ];
13
12
};
14
13
15
-
services.headscale.acl.rules = [{
16
-
proto = "tcp";
17
-
src = ["wolumonde"];
18
-
dst = ["higashi:${port}"];
19
-
}];
14
+
services.headscale.acl.rules = [
15
+
{
16
+
proto = "tcp";
17
+
src = [ "wolumonde" ];
18
+
dst = [ "higashi:${port}" ];
19
+
}
20
+
];
20
21
}
+4
-1
users/dusk@devel.mobi/default.nix
+4
-1
users/dusk@devel.mobi/default.nix
···
70
70
enable = true;
71
71
controlServer = "https://vpn.gaze.systems";
72
72
authKeyFile = config.age.secrets.tailscaleAuthKey.path;
73
-
extraUpFlags = [ "--advertise-exit-node=true" "--hostname=dusk-devel-mobi" ];
73
+
extraUpFlags = [
74
+
"--advertise-exit-node=true"
75
+
"--hostname=dusk-devel-mobi"
76
+
];
74
77
};
75
78
76
79
programs = {
+10
-10
users/modules/ssh/default.nix
+10
-10
users/modules/ssh/default.nix
···
3
3
enable = true;
4
4
enableDefaultConfig = false;
5
5
matchBlocks."*" = {
6
-
forwardAgent = false;
7
-
serverAliveInterval = 0;
8
-
serverAliveCountMax = 3;
9
-
compression = true;
10
-
hashKnownHosts = true;
11
-
addKeysToAgent = "yes";
12
-
userKnownHostsFile = "~/.ssh/known_hosts";
13
-
controlMaster = "no";
14
-
controlPath = "~/.ssh/master-%r@%n:%p";
15
-
controlPersist = "no";
6
+
forwardAgent = false;
7
+
serverAliveInterval = 0;
8
+
serverAliveCountMax = 3;
9
+
compression = true;
10
+
hashKnownHosts = true;
11
+
addKeysToAgent = "yes";
12
+
userKnownHostsFile = "~/.ssh/known_hosts";
13
+
controlMaster = "no";
14
+
controlPath = "~/.ssh/master-%r@%n:%p";
15
+
controlPersist = "no";
16
16
};
17
17
# Only needed for darcs hub
18
18
# extraConfig = ''