stockholm/krebs/1systems/ponte/config.nix

54 lines
1.8 KiB
Nix
Raw Normal View History

2022-05-03 20:55:35 +00:00
{ config, pkgs, ... }:
{
imports = [
./hw.nix
<stockholm/krebs>
<stockholm/krebs/2configs>
2022-05-17 20:36:07 +00:00
<stockholm/krebs/2configs/matterbridge.nix>
2023-08-01 15:27:59 +00:00
<stockholm/krebs/2configs/nameserver.nix>
2022-05-03 20:55:35 +00:00
];
2022-12-09 16:11:30 +00:00
networking.firewall.allowedTCPPorts = [ 80 443 ];
2022-12-09 16:42:52 +00:00
networking.firewall.logRefusedConnections = false;
networking.firewall.logRefusedUnicastsOnly = false;
2022-12-09 16:11:30 +00:00
2022-12-09 17:07:20 +00:00
# Move Internet-facing SSH port to reduce logspam.
networking.firewall.extraCommands = let
host = config.krebs.build.host;
in /* sh */ ''
iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
'';
2022-05-03 20:55:35 +00:00
krebs.build.host = config.krebs.hosts.ponte;
2022-12-09 16:00:03 +00:00
krebs.pages.enable = true;
krebs.pages.nginx.addSSL = true;
2023-08-01 15:29:42 +00:00
krebs.pages.nginx.useACMEHost = "krebsco.de";
2022-12-09 16:00:03 +00:00
security.acme.acceptTerms = true;
2023-08-01 15:29:42 +00:00
security.acme.certs."krebsco.de" = {
domain = "krebsco.de";
extraDomainNames = [
"*.krebsco.de"
];
email = "spam@krebsco.de";
reloadServices = [
"knsupdate-krebsco.de.service"
"nginx.service"
];
keyType = "ec384";
dnsProvider = "rfc2136";
credentialsFile = "/var/src/secrets/acme-credentials";
};
users.users.nginx.extraGroups = [ "acme" ];
2022-05-03 20:55:35 +00:00
}