stockholm/krebs/3modules/makefu/default.nix

390 lines
10 KiB
Nix
Raw Normal View History

2018-09-15 22:32:35 +00:00
## generate keys with:
# tinc generate-keys
# ssh-keygen -f ssh.id_ed25519 -t ed25519 -C host
with import <stockholm/lib>;
{ config, ... }: let
hostDefaults = hostName: host: foldl' recursiveUpdate {} [
{
owner = config.krebs.users.makefu;
}
# Retiolum defaults
(let
pubkey-path = ./retiolum + "/${hostName}.pub";
in optionalAttrs (pathExists pubkey-path) {
nets.retiolum = {
tinc.pubkey = readFile pubkey-path;
aliases = [
"${hostName}.r"
];
ip6.addr =
(krebs.genipv6 "retiolum" "makefu" { inherit hostName; }).address;
};
})
# Retiolum ed25519 keys
(let
pubkey-path = ./retiolum + "/${hostName}_ed25519.pub";
in optionalAttrs (pathExists pubkey-path) {
nets.retiolum.tinc.pubkey_ed25519 = readFile pubkey-path;
})
# Wiregrill defaults
(let
pubkey-path = ./wiregrill + "/${hostName}.pub";
in optionalAttrs (pathExists pubkey-path) {
nets.wiregrill = {
aliases = [
"${hostName}.w"
];
ip6.addr =
(krebs.genipv6 "wiregrill" "makefu" { inherit hostName; }).address;
wireguard.pubkey = readFile pubkey-path;
};
})
# SSHD defaults
(let
pubkey-path = ./sshd + "/${hostName}.pub";
in optionalAttrs (pathExists pubkey-path) {
ssh.pubkey = readFile pubkey-path;
# We assume that if the sshd pubkey exits then there must be a privkey in
# the screts store as well
ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
})
host
];
2018-09-24 21:33:42 +00:00
pub-for = name: builtins.readFile (./ssh + "/${name}.pub");
w6 = ip: (krebs.genipv6 "wiregrill" "makefu" ip).address;
2018-09-24 21:33:42 +00:00
in {
hosts = mapAttrs hostDefaults {
2017-10-01 12:01:48 +00:00
cake = rec {
2017-11-14 09:18:20 +00:00
cores = 4;
2017-10-01 12:01:48 +00:00
ci = false;
nets = {
retiolum.ip4.addr = "10.243.136.236";
2017-10-01 12:01:48 +00:00
};
};
2018-09-15 22:32:35 +00:00
crapi = rec { # raspi1
cores = 1;
ci = false;
nets = {
retiolum.ip4.addr = "10.243.136.237";
2018-09-15 22:32:35 +00:00
};
};
firecracker = {
cores = 4;
2017-02-12 19:13:45 +00:00
nets = {
retiolum.ip4.addr = "10.243.12.12";
2017-02-12 19:13:45 +00:00
};
2016-08-20 23:24:50 +00:00
};
2017-05-12 09:30:26 +00:00
studio = rec {
2018-11-10 20:11:23 +00:00
ci = false;
2017-05-12 09:30:26 +00:00
cores = 4;
nets = {
retiolum.ip4.addr = "10.243.227.163";
2017-05-12 09:30:26 +00:00
};
};
2016-12-22 13:12:24 +00:00
fileleech = rec {
2018-11-10 20:11:23 +00:00
ci = false;
2017-02-12 19:13:45 +00:00
cores = 4;
nets = {
retiolum.ip4.addr = "10.243.113.98";
2016-07-11 18:44:16 +00:00
};
};
tsp = {
2017-08-31 17:15:09 +00:00
ci = true;
cores = 1;
nets = {
retiolum.ip4.addr = "10.243.0.212";
};
};
2016-07-28 10:58:54 +00:00
x = {
2017-08-31 17:15:09 +00:00
ci = true;
2017-04-24 21:21:07 +00:00
cores = 4;
2022-01-28 22:48:57 +00:00
syncthing.id = "OA36OF6-JEFCUJQ-OEYVTMH-DPCACQI-3AJRE5G-BFVMOUG-RPYJQE3-4ZCUWA5";
nets = {
retiolum.ip4.addr = "10.243.0.91";
wiregrill = {
# defaults
2016-06-23 14:45:44 +00:00
};
};
2015-12-14 13:33:06 +00:00
};
2015-11-06 09:59:40 +00:00
filepimp = rec {
2018-11-10 20:11:23 +00:00
ci = false;
2015-11-06 09:59:40 +00:00
cores = 1;
nets = {
retiolum.ip4.addr = "10.243.153.102";
2015-11-06 09:59:40 +00:00
};
};
2015-12-16 11:06:44 +00:00
omo = rec {
2017-08-31 17:15:09 +00:00
ci = true;
2015-12-16 11:06:44 +00:00
cores = 2;
2022-01-28 22:48:57 +00:00
syncthing.id = "Y5OTK3S-JOJLAUU-KTBXKUW-M7S5UEQ-MMQPUK2-7CXO5V6-NOUDLKP-PRGAFAK";
2015-12-16 11:06:44 +00:00
nets = {
retiolum = {
ip4.addr = "10.243.0.89";
2015-12-16 11:06:44 +00:00
aliases = [
"omo.r"
2018-11-05 15:22:39 +00:00
"dcpp.omo.r"
"torrent.omo.r"
2015-12-16 11:06:44 +00:00
];
};
};
};
2016-01-19 19:26:38 +00:00
wbob = rec {
2017-08-31 17:15:09 +00:00
ci = true;
2017-07-16 21:29:03 +00:00
cores = 4;
2016-01-19 19:26:38 +00:00
nets = {
2016-02-17 09:51:26 +00:00
retiolum = {
ip4.addr = "10.243.214.15";
2016-01-19 19:26:38 +00:00
aliases = [
"wbob.r"
2018-02-26 17:59:43 +00:00
"hydra.wbob.r"
2019-06-14 23:05:01 +00:00
"log.wbob.r"
2016-01-19 19:26:38 +00:00
];
};
};
};
2022-02-15 21:29:33 +00:00
latte = rec {
ci = true;
extraZones = {
"krebsco.de" = ''
latte.euer IN A ${nets.internet.ip4.addr}
'';
};
cores = 4;
nets = rec {
internet = {
ip4.addr = "178.254.30.202";
ip6.addr = "2a00:6800:3:18c::2";
aliases = [
"latte.i"
];
};
#wiregrill = {
# via = internet;
# ip4.addr = "10.244.245.1";
# ip6.addr = w6 "1";
# wireguard.port = 51821;
# wireguard.subnets = [
# (krebs.genipv6 "wiregrill" "makefu" 0).subnetCIDR
# "10.244.245.0/24" # required for routing directly to gum via rockit
# ];
#};
retiolum = {
via = internet;
ip4.addr = "10.243.0.214";
# never connect via gum (he eats your packets!)
#tinc.weight = 9001;
aliases = [
"latte.r"
];
};
};
};
2018-11-05 15:22:39 +00:00
gum = rec {
2018-06-24 21:41:27 +00:00
ci = true;
extraZones = {
"krebsco.de" = ''
2020-02-12 06:55:39 +00:00
bookmark.euer IN A ${nets.internet.ip4.addr}
boot IN A ${nets.internet.ip4.addr}
boot.euer IN A ${nets.internet.ip4.addr}
cache.euer IN A ${nets.internet.ip4.addr}
cache.gum IN A ${nets.internet.ip4.addr}
cgit.euer IN A ${nets.internet.ip4.addr}
dl.euer IN A ${nets.internet.ip4.addr}
dns.euer IN A ${nets.internet.ip4.addr}
2020-02-12 06:55:39 +00:00
dockerhub IN A ${nets.internet.ip4.addr}
euer IN A ${nets.internet.ip4.addr}
euer IN MX 1 aspmx.l.google.com.
ghook IN A ${nets.internet.ip4.addr}
git.euer IN A ${nets.internet.ip4.addr}
gold IN A ${nets.internet.ip4.addr}
graph IN A ${nets.internet.ip4.addr}
gum IN A ${nets.internet.ip4.addr}
2020-02-12 06:55:39 +00:00
io IN NS gum.krebsco.de.
2018-09-15 22:32:35 +00:00
iso.euer IN A ${nets.internet.ip4.addr}
feed.euer IN A ${nets.internet.ip4.addr}
2020-03-13 09:51:34 +00:00
board.euer IN A ${nets.internet.ip4.addr}
etherpad.euer IN A ${nets.internet.ip4.addr}
2020-03-13 09:51:34 +00:00
rss.euer IN A ${nets.internet.ip4.addr}
2020-02-12 06:55:39 +00:00
mediengewitter IN CNAME over.dose.io.
2018-11-05 15:22:39 +00:00
mon.euer IN A ${nets.internet.ip4.addr}
netdata.euer IN A ${nets.internet.ip4.addr}
nixos.unstable IN CNAME krebscode.github.io.
o.euer IN A ${nets.internet.ip4.addr}
photostore IN A ${nets.internet.ip4.addr}
pigstarter IN CNAME makefu.github.io.
2018-11-05 15:22:39 +00:00
share.euer IN A ${nets.internet.ip4.addr}
wg.euer IN A ${nets.internet.ip4.addr}
wiki.euer IN A ${nets.internet.ip4.addr}
2018-11-05 15:22:39 +00:00
wikisearch IN A ${nets.internet.ip4.addr}
2021-01-08 18:18:37 +00:00
meet.euer IN A ${nets.internet.ip4.addr}
work.euer IN A ${nets.internet.ip4.addr}
admin.work.euer IN A ${nets.internet.ip4.addr}
push.work.euer IN A ${nets.internet.ip4.addr}
api.work.euer IN A ${nets.internet.ip4.addr}
maps.work.euer IN A ${nets.internet.ip4.addr}
play.work.euer IN A ${nets.internet.ip4.addr}
ul.work.euer IN A ${nets.internet.ip4.addr}
2021-03-23 10:35:23 +00:00
bw.euer IN A ${nets.internet.ip4.addr}
'';
};
2018-06-24 21:41:27 +00:00
cores = 8;
nets = rec {
internet = {
ip4.addr = "144.76.26.247";
ip6.addr = "2a01:4f8:191:12f6::2";
aliases = [
2018-11-05 15:22:39 +00:00
"gum.i"
2018-06-24 21:41:27 +00:00
];
};
wiregrill = {
via = internet;
2019-06-14 23:25:27 +00:00
ip4.addr = "10.244.245.1";
ip6.addr = w6 "1";
2019-06-14 23:05:01 +00:00
wireguard.port = 51821;
2019-06-14 23:25:27 +00:00
wireguard.subnets = [
(krebs.genipv6 "wiregrill" "makefu" 0).subnetCIDR
"10.244.245.0/24" # required for routing directly to gum via rockit
];
};
2018-06-24 21:41:27 +00:00
retiolum = {
via = internet;
ip4.addr = "10.243.0.213";
# never connect via gum (he eats your packets!)
2022-02-15 21:29:33 +00:00
#tinc.weight = 9001;
2018-06-24 21:41:27 +00:00
aliases = [
"gum.r"
"backup.makefu.r"
"blog.gum.r"
"blog.makefu.r"
"cache.gum.r"
"cgit.gum.r"
"dcpp.gum.r"
2018-09-24 21:33:42 +00:00
"dcpp.nextgum.r"
2021-11-30 21:00:34 +00:00
"graph.makefu.r"
"logs.makefu.r"
"netdata.makefu.r"
"nextgum.r"
2017-01-09 14:56:44 +00:00
"o.gum.r"
"search.makefu.r"
"stats.makefu.r"
"torrent.gum.r"
"tracker.makefu.r"
"wiki.gum.r"
"wiki.makefu.r"
2020-03-13 09:51:34 +00:00
"warrior.gum.r"
2021-09-05 19:15:06 +00:00
"rss.makefu.r"
2019-06-17 05:51:41 +00:00
"sick.makefu.r"
"dl.gum.r"
"dl.makefu.r"
];
};
};
};
2018-11-10 20:11:23 +00:00
2016-10-19 10:33:56 +00:00
sdev = rec {
2017-08-31 17:15:09 +00:00
ci = true;
2016-10-19 10:33:56 +00:00
cores = 1;
nets = {
retiolum.ip4.addr = "10.243.83.237";
2016-10-19 10:33:56 +00:00
};
};
2017-02-12 19:13:45 +00:00
# non-stockholm
flap = rec {
cores = 1;
extraZones = {
"krebsco.de" = ''
flap IN A ${nets.internet.ip4.addr}
'';
};
nets = {
internet = {
ip4.addr = "162.248.11.162";
aliases = [
"flap.i"
];
};
retiolum = {
ip4.addr = "10.243.211.172";
};
};
};
nukular = rec {
cores = 1;
nets = {
retiolum = {
ip4.addr = "10.243.231.219";
};
};
};
2019-06-17 05:51:41 +00:00
shackdev = rec { # router@shack
cores = 1;
nets.wiregrill.ip4.addr = "10.244.245.2";
};
2019-06-17 05:51:41 +00:00
2019-06-14 23:05:01 +00:00
rockit = rec { # router@home
cores = 1;
2019-06-17 05:51:41 +00:00
nets.wiregrill.ip4.addr = "10.244.245.3";
2019-06-14 23:05:01 +00:00
};
2016-04-07 17:54:17 +00:00
senderechner = rec {
cores = 2;
nets = {
retiolum = {
ip4.addr = "10.243.0.163";
2016-08-22 16:41:07 +00:00
};
2017-02-12 19:13:45 +00:00
};
2016-08-22 16:41:07 +00:00
};
};
users = rec {
makefu = {
mail = "makefu@x.r";
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.x";
pgp.pubkeys.default = builtins.readFile ./pgp/default.asc;
pgp.pubkeys.brain = builtins.readFile ./pgp/brain.asc;
2015-12-14 16:04:16 +00:00
};
2015-12-14 16:12:51 +00:00
makefu-omo = {
2016-03-16 07:35:06 +00:00
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.omo";
2015-12-14 16:04:16 +00:00
};
2015-12-14 16:12:51 +00:00
makefu-tsp = {
2016-03-16 07:35:06 +00:00
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.tsp";
2015-12-14 16:04:16 +00:00
};
2015-12-14 16:12:51 +00:00
makefu-vbob = {
2016-03-16 07:35:06 +00:00
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.vbob";
2015-12-14 16:12:51 +00:00
};
2017-02-04 13:35:29 +00:00
makefu-tempx = {
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.tempx";
2017-02-04 13:35:29 +00:00
};
2017-10-08 20:20:46 +00:00
makefu-android = {
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.android";
2017-10-08 20:20:46 +00:00
};
2018-02-14 00:33:05 +00:00
makefu-remote-builder = {
2018-02-14 07:12:06 +00:00
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.remote-builder";
2018-02-14 00:33:05 +00:00
};
makefu-bob = {
inherit (makefu) mail pgp;
2018-09-24 21:33:42 +00:00
pubkey = pub-for "makefu.bob";
};
};
}