2015-10-30 15:05:51 +00:00
{ config , lib , pkgs , . . . }:
2016-07-07 21:07:22 +00:00
with config . krebs . lib ;
2015-10-30 15:05:51 +00:00
let
2016-04-08 01:53:34 +00:00
ip = config . krebs . build . host . nets . internet . ip4 . addr ;
2016-05-19 22:02:29 +00:00
2016-05-31 21:26:35 +00:00
inherit ( import <stockholm/lass/2configs/websites/util.nix> { inherit lib pkgs ; } )
manageCerts
;
2016-05-19 22:02:29 +00:00
2015-10-30 15:05:51 +00:00
in {
imports = [
2016-02-15 15:27:11 +00:00
../.
2016-08-23 22:03:38 +00:00
../2configs/retiolum.nix
2016-04-12 13:17:42 +00:00
../2configs/exim-smarthost.nix
2015-10-30 15:05:51 +00:00
../2configs/downloading.nix
2015-11-01 18:58:59 +00:00
../2configs/ts3.nix
2015-11-09 01:27:22 +00:00
../2configs/bitlbee.nix
2015-11-13 13:57:51 +00:00
../2configs/weechat.nix
2016-04-15 14:15:22 +00:00
../2configs/privoxy-retiolum.nix
2016-05-21 11:49:31 +00:00
../2configs/radio.nix
2016-05-31 21:34:06 +00:00
../2configs/buildbot-standalone.nix
2016-06-24 13:35:47 +00:00
../2configs/repo-sync.nix
2016-06-25 16:56:39 +00:00
../2configs/binary-cache/server.nix
2016-09-12 22:04:48 +00:00
../2configs/iodined.nix
2016-05-31 22:06:49 +00:00
{
imports = [
../2configs/git.nix
] ;
2016-07-07 21:07:22 +00:00
krebs . nginx . servers . cgit = {
server-names = [
" c g i t . l a s s u l . u s "
] ;
locations = [
( nameValuePair " / . w e l l - k n o w n / a c m e - c h a l l e n g e " ''
root /var/lib/acme/challenges/cgit.lassul.us / ;
'' )
] ;
ssl = {
enable = true ;
certificate = " / v a r / l i b / a c m e / c g i t . l a s s u l . u s / f u l l c h a i n . p e m " ;
certificate_key = " / v a r / l i b / a c m e / c g i t . l a s s u l . u s / k e y . p e m " ;
} ;
} ;
2016-05-31 22:06:49 +00:00
}
2015-10-30 15:05:51 +00:00
{
users . extraGroups = {
# ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
# Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
# Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
# Docs: man:tmpfiles.d(5)
# man:systemd-tmpfiles(8)
# Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
# Main PID: 19272 (code=exited, status=1/FAILURE)
#
# Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
# Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
# Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
# Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
# Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
# Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
# Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
# warning: error(s) occured while switching to the new configuration
lock . gid = 10001 ;
} ;
}
{
networking . interfaces . et0 . ip4 = [
{
address = ip ;
prefixLength = 24 ;
}
] ;
networking . defaultGateway = " 2 1 3 . 2 3 9 . 2 0 5 . 2 2 5 " ;
networking . nameservers = [
" 8 . 8 . 8 . 8 "
] ;
services . udev . extraRules = ''
SUBSYSTEM == " n e t " , ATTR { address } == " 5 4 : 0 4 : a 6 : 7 e : f 4 : 0 6 " , NAME = " e t 0 "
'' ;
}
{
boot . loader . grub = {
devices = [
" / d e v / s d a "
" / d e v / s d b "
] ;
splashImage = null ;
} ;
boot . initrd . availableKernelModules = [
" a t a _ p i i x "
" v m w _ p v s c s i "
] ;
fileSystems . " / " = {
device = " / d e v / p o o l / n i x " ;
fsType = " e x t 4 " ;
} ;
fileSystems . " / b o o t " = {
device = " / d e v / d i s k / b y - u u i d / 7 c a 1 2 d 8 c - 6 0 6 d - 4 1 c e - b 1 0 d - 6 2 b 6 5 4 e 5 0 e 3 6 " ;
} ;
fileSystems . " / v a r / d o w n l o a d " = {
device = " / d e v / p o o l / d o w n l o a d " ;
} ;
2016-04-11 14:43:52 +00:00
fileSystems . " / s r v / h t t p " = {
device = " / d e v / p o o l / h t t p " ;
} ;
fileSystems . " / s r v / o . u b i k m e d i a . d e - d a t a " = {
device = " / d e v / p o o l / o w n c l o u d - u b i k - d a t a " ;
} ;
fileSystems . " / b k u " = {
device = " / d e v / p o o l / b k u " ;
2016-04-08 22:18:51 +00:00
} ;
2016-10-11 15:35:53 +00:00
fileSystems . " / t m p " = {
device = " t m p f s " ;
fsType = " t m p f s " ;
options = [ " n o s u i d " " n o d e v " " n o a t i m e " ] ;
} ;
2015-10-30 15:05:51 +00:00
}
{
sound . enable = false ;
}
2015-11-01 19:00:43 +00:00
{
nixpkgs . config . allowUnfree = true ;
}
2015-11-09 01:33:30 +00:00
{
#stuff for juhulian
users . extraUsers . juhulian = {
name = " j u h u l i a n " ;
uid = 1339 ;
home = " / h o m e / j u h u l i a n " ;
group = " u s e r s " ;
createHome = true ;
useDefaultShell = true ;
extraGroups = [
] ;
openssh . authorizedKeys . keys = [
" s s h - r s a A A A A B 3 N z a C 1 y c 2 E A A A A D A Q A B A A A B A Q D B Q h L G v f v 4 h y Q / n q J G y 1 Y g H X P S V l 6 i g e W T r o J S v A h U F g o h + r G + z v q Y 0 E a h K X N b 3 s q 0 / O Y D C T J V u u c c 0 h g C g 7 T 2 K q T q M t T b 9 E E k R m C F b D 7 F 7 D W Z o j C r h / a n 6 s H n e q T 5 e F v z A P Z 8 E 5 h u p 7 o V Q n j 5 P 5 M 3 I 9 k e R H B W t 1 r q 6 q 0 I c O E h s F v n e 4 q J c 7 3 a L A S T J k x z l o 5 U 8 j u 3 J Q O l 6 4 7 4 E C u S n 0 l b 1 f T r Q / S R 1 N g F 7 j V 1 1 e B l d k S 8 S H E B + 2 G X j n 4 Y r n + Q U K O n D p + B 8 5 v Z m V l J S I + 7 X R 1 / U / x I b t A j G T E m N w B 6 c T b B v 9 N C G 9 j l o D D O Z G 4 Z v z z H Y r l B X j a i g t Q h 2 / 4 m r H o K a 5 e V j u h u l i a n @ j u h u l i a n "
] ;
} ;
krebs . iptables . tables . filter . INPUT . rules = [
{ predicate = " - p u d p - - d p o r t 6 0 0 0 0 : 6 1 0 0 0 " ; target = " A C C E P T " ; }
] ;
}
2015-11-13 00:06:16 +00:00
{
environment . systemPackages = [
pkgs . perlPackages . Plack
] ;
krebs . iptables . tables . filter . INPUT . rules = [
{ predicate = " - p t c p - - d p o r t 8 0 8 0 " ; target = " A C C E P T " ; }
] ;
}
2015-12-12 16:58:21 +00:00
{
users . users . chat . openssh . authorizedKeys . keys = [
2016-08-10 20:14:26 +00:00
" e c d s a - s h a 2 - n i s t p 5 2 1 A A A A E 2 V j Z H N h L X N o Y T I t b m l z d H A 1 M j E A A A A I b m l z d H A 1 M j E A A A C F B A H F 9 t i j l M o E e v R Z C G 1 A g g u k x W g g f x P H U w g 6 Y e 1 1 3 O D G 6 P Z 2 m 9 8 o S m n s j i x D y 4 G f I J j y + 8 H B b k w S 6 i H + f s N k 8 6 Q t A g F N M j B l + 9 Y v E z N R B z c y C q d O k Z F v v Z v V 2 o Y A 7 I 1 5 i l 4 l n 6 2 P D P K j E I S 3 Y P h Z P S w c 6 G h r l s F T n I G 5 6 N F / 9 3 I h F 7 R / F A = = J u i c e S S H "
2016-02-21 13:26:21 +00:00
config . krebs . users . lass-uriel . pubkey
2016-08-24 06:38:07 +00:00
" s s h - r s a A A A A B 3 N z a C 1 y c 2 E A A A A D A Q A B A A A C A Q D Q 8 D J h H A q m d r B 2 + q k V / O u K j R 4 Q D X U w w 2 T W I t y D r s + / 6 F 5 8 W a c M o z g a Z r 2 g o A 5 J Q J 5 d 1 9 n C 3 L z Y b 4 y L G g u A D s p 9 8 7 I 6 c A u 5 i X P T 5 P H K c 0 e R W D N + A G l p T g U t N 1 B v V r n J Z a U J r R 9 W l H h F Y l k O k z A s B 1 5 f K Y c i V W s y x B C V Z + 3 o i T E j s 2 L / s f b r g a i l W q H I U W D f t U n J x 8 E F m S U V Z 2 G Z W k l M c g B o 0 F J D 1 i 0 x 5 u 2 d Q G g u N Y + 2 8 D z Q m K g U M S + x D / u U Z v r F I W r 9 I 6 C B q h s u H J o 8 n 8 5 B T 3 B 3 Q d G 8 A R L t 5 F K P r 5 L 3 M y 6 U j l x O k K r D N L j J F j E R F C s u I x n r O 3 t Q h v K X Q Y l O y s k H o k o c Y S d c I q 8 s v g h J L A 3 k m R Y I j H j Z 4 y 1 B N E N s k 7 9 W y Y N M A i 5 y + A 0 E v m u + g 3 k s / D i W 3 v I / S w / D 3 U c 7 i l b I m p a o L 5 q U C 4 + W Z M 3 J 2 b 3 Z 1 A U 5 D 1 Q i o j p K k B 9 Q t 1 b o k C m 8 h r R C G 9 Z D K q A D 6 I q m I 1 A R R j f g A 4 z K w K U h m M q G 4 p 5 5 Y G G V f 9 O e K 0 r X g X 0 Z 2 I n y F X e B a U 2 a B c D f d K D / 6 5 w 5 M n C 9 C s J n j E L d d 4 r 9 u 2 u g T P E x z O o 3 W U l N u O T B 1 W o Z 8 C i Y 2 O V G l e / E / M z K U D f G u I F h U s F e X 0 Y c L H P b o + m e s I S N U P a e a d S u M u H E 8 W 4 F O e E q 5 1 t o B o / g k x g j t q q W M O d 9 S x n D Q T M B K q 3 L / w 7 n E Q = = l a s s @ m o r s "
2015-12-12 16:58:21 +00:00
] ;
}
2015-12-12 16:58:58 +00:00
{
time . timeZone = " E u r o p e / B e r l i n " ;
}
2015-12-12 17:22:47 +00:00
{
imports = [
../2configs/websites/wohnprojekt-rhh.de.nix
../2configs/websites/domsen.nix
] ;
krebs . iptables . tables . filter . INPUT . rules = [
2016-04-08 22:36:38 +00:00
{ predicate = " - p t c p - - d p o r t h t t p " ; target = " A C C E P T " ; }
{ predicate = " - p t c p - - d p o r t h t t p s " ; target = " A C C E P T " ; }
2015-12-12 17:22:47 +00:00
] ;
}
2016-03-06 00:45:57 +00:00
{
services . tor = {
enable = true ;
} ;
}
2016-05-19 22:02:29 +00:00
{
security . acme = {
certs . " l a s s u l . u s " = {
email = " l a s s @ l a s s u l . u s " ;
webroot = " / v a r / l i b / a c m e / c h a l l e n g e s / l a s s u l . u s " ;
plugins = [
" a c c o u n t _ k e y . j s o n "
" k e y . p e m "
" f u l l c h a i n . p e m "
" f u l l . p e m "
] ;
2016-08-08 08:53:48 +00:00
allowKeysForGroup = true ;
group = " l a s s c e r t " ;
2016-05-19 22:02:29 +00:00
} ;
} ;
2016-08-08 08:53:48 +00:00
users . groups . lasscert . members = [
" d o v e c o t 2 "
" e j a b b e r d "
" e x i m "
" n g i n x "
] ;
2016-05-19 22:02:29 +00:00
krebs . nginx . servers . " l a s s u l . u s " = {
server-names = [ " l a s s u l . u s " ] ;
locations = [
( lib . nameValuePair " / . w e l l - k n o w n / a c m e - c h a l l e n g e " ''
root /var/lib/acme/challenges/lassul.us / ;
'' )
] ;
} ;
lass . ejabberd = {
enable = true ;
hosts = [ " l a s s u l . u s " ] ;
} ;
krebs . iptables . tables . filter . INPUT . rules = [
{ predicate = " - p t c p - - d p o r t x m p p - c l i e n t " ; target = " A C C E P T " ; }
{ predicate = " - p t c p - - d p o r t x m p p - s e r v e r " ; target = " A C C E P T " ; }
] ;
}
2016-05-24 21:55:11 +00:00
{
imports = [
2016-06-25 16:38:30 +00:00
../2configs/realwallpaper.nix
2016-05-24 21:55:11 +00:00
] ;
krebs . nginx . servers . " l a s s u l . u s " . locations = [
( lib . nameValuePair " / w a l l p a p e r . p n g " ''
alias /tmp/wallpaper.png ;
'' )
] ;
}
2016-07-08 11:42:12 +00:00
{
environment . systemPackages = with pkgs ; [
mk_sql_pair
] ;
}
2016-07-10 16:06:50 +00:00
{
users . users . tv = {
uid = genid " t v " ;
2016-07-18 22:01:17 +00:00
inherit ( config . krebs . users . tv ) home ;
2016-07-10 16:06:50 +00:00
group = " u s e r s " ;
createHome = true ;
useDefaultShell = true ;
openssh . authorizedKeys . keys = [
config . krebs . users . tv . pubkey
] ;
} ;
}
2016-08-31 06:44:43 +00:00
{
krebs . nginx = {
enable = true ;
servers . public = {
listen = [ " 8 0 8 8 " ] ;
server-names = [ " d e f a u l t " ] ;
locations = [
( nameValuePair " ~ ^ / ~ ( . + ? ) ( / . * ) ? \$ " ''
alias /home / $ 1/public_html $ 2 ;
'' )
] ;
} ;
} ;
krebs . iptables . tables . filter . INPUT . rules = [
{ predicate = " - p t c p - - d p o r t 8 0 8 8 " ; target = " A C C E P T " ; }
] ;
}
2016-09-08 19:01:55 +00:00
{
krebs . repo-sync . timerConfig = {
OnCalendar = " * : 0 / 5 " ;
} ;
}
2015-10-30 15:05:51 +00:00
] ;
krebs . build . host = config . krebs . hosts . prism ;
}
