From 8a04a15a7b812ad8c7aac1ae987ac2e970f4c0ae Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 30 Dec 2022 23:36:50 +0100 Subject: [PATCH 01/18] l sync-containers3: use networkd --- lass/3modules/sync-containers3.nix | 66 +++++++++++++----------------- 1 file changed, 29 insertions(+), 37 deletions(-) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 1371d5233..c04a7758b 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -64,7 +64,6 @@ in { privateNetwork = true; hostBridge = "ctr0"; bindMounts = { - "/etc/resolv.conf".hostPath = "/etc/resolv.conf"; "/var/lib/self/disk" = { hostPath = "/var/lib/sync-containers3/${ctr.name}/disk"; isReadOnly = false; @@ -257,44 +256,26 @@ in { }) (lib.mkIf (cfg.containers != {}) { # networking - networking.networkmanager.unmanaged = [ "ctr0" ]; - networking.interfaces.dummy0.virtual = true; - networking.bridges.ctr0.interfaces = [ "dummy0" ]; - networking.interfaces.ctr0.ipv4.addresses = [{ - address = "10.233.0.1"; - prefixLength = 24; - }]; - systemd.services."dhcpd-ctr0" = { - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - serviceConfig = { - Type = "forking"; - Restart = "always"; - DynamicUser = true; - StateDirectory = "dhcpd-ctr0"; - User = "dhcpd-ctr0"; - Group = "dhcpd-ctr0"; - AmbientCapabilities = [ - "CAP_NET_RAW" # to send ICMP messages - "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67) - ]; - ExecStartPre = "${pkgs.coreutils}/bin/touch /var/lib/dhcpd-ctr0/dhcpd.leases"; - ExecStart = "${pkgs.dhcp}/bin/dhcpd -4 -lf /var/lib/dhcpd-ctr0/dhcpd.leases -cf ${pkgs.writeText "dhpd.conf" '' - default-lease-time 600; - max-lease-time 7200; - authoritative; - ddns-update-style interim; - log-facility local1; # see dhcpd.nix - - option subnet-mask 255.255.255.0; - option routers 10.233.0.1; - # option domain-name-servers 8.8.8.8; # TODO configure dns server - subnet 10.233.0.0 netmask 255.255.255.0 { - range 10.233.0.10 10.233.0.250; - } - ''} ctr0"; + systemd.network.networks.ctr0 = { + name = "ctr0"; + address = [ + "10.233.0.1/24" + ]; + networkConfig = { + IPForward = "yes"; + IPMasquerade = "both"; + ConfigureWithoutCarrier = true; + DHCPServer = "yes"; }; }; + systemd.network.netdevs.ctr0.netdevConfig = { + Kind = "bridge"; + Name = "ctr0"; + }; + networking.networkmanager.unmanaged = [ "ctr0" ]; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-i ctr0"; target = "ACCEPT"; } + ]; }) (lib.mkIf cfg.inContainer.enable { users.groups.container_sync = {}; @@ -308,6 +289,17 @@ in { cfg.inContainer.pubkey ]; }; + + networking.useHostResolvConf = false; + networking.useNetworkd = true; + systemd.network = { + enable = true; + networks.eth0 = { + matchConfig.Name = "eth0"; + DHCP = "yes"; + dhcpV4Config.UseDNS = true; + }; + }; }) ]; } From 3918ad6cf863646d4f27aabfa9e1cd28a612df47 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 30 Dec 2022 23:37:04 +0100 Subject: [PATCH 02/18] l sync-containers3: add rsync timeout --- lass/3modules/sync-containers3.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index c04a7758b..16e04d743 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -100,7 +100,7 @@ in { set -efux if /run/wrappers/bin/ping -c 1 ${ctr.name}.r; then touch "$HOME"/incomplete - rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --inplace container_sync@${ctr.name}.r:disk "$HOME"/disk + rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --timeout=30 --inplace container_sync@${ctr.name}.r:disk "$HOME"/disk rm "$HOME"/incomplete fi ''} From 4591d70e1c4478325f41c57bad8f2eeed4e1d722 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 30 Dec 2022 23:37:46 +0100 Subject: [PATCH 03/18] l sync-containers3: don't start if consul fails --- lass/3modules/sync-containers3.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 16e04d743..1a006835d 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -135,7 +135,8 @@ in { ;; 200) # echo 'got 200 from kv, will check payload' - export payload=$(consul kv get containers/${ctr.name}) + payload=$(consul kv get containers/${ctr.name}) || continue + export payload if [ "$(jq -rn 'env.payload | fromjson.host')" = '${config.networking.hostName}' ]; then # echo 'we are the host, trying to reach container' if $(retry -t 10 -d 10 -- /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null); then From b9eb88b3f9b1645e8858f771c6ed25f8e25cde94 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 31 Dec 2022 00:19:10 +0100 Subject: [PATCH 04/18] krebs: add kmein to all root users --- krebs/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix index fffe128e6..eda03cc10 100644 --- a/krebs/2configs/default.nix +++ b/krebs/2configs/default.nix @@ -53,6 +53,7 @@ with import ; config.krebs.users.lass-mors.pubkey config.krebs.users.makefu.pubkey config.krebs.users.tv.pubkey + config.krebs.users.kmein.pubkey ]; # The NixOS release to be compatible with for stateful data such as databases. From 767c6fbd14fc8e5eb73cea2f738af88083fcea32 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 01:23:42 +0100 Subject: [PATCH 05/18] l yellow.r: move to neoprism, refactor --- kartei/lass/prism.nix | 1 - kartei/lass/yellow.nix | 1 + lass/1systems/neoprism/config.nix | 3 +- lass/1systems/yellow/config.nix | 105 ++++++++++++++++++++++++++---- lass/2configs/yellow-host.nix | 14 ++++ 5 files changed, 108 insertions(+), 16 deletions(-) create mode 100644 lass/2configs/yellow-host.nix diff --git a/kartei/lass/prism.nix b/kartei/lass/prism.nix index c7965debf..029216f88 100644 --- a/kartei/lass/prism.nix +++ b/kartei/lass/prism.nix @@ -66,7 +66,6 @@ rec { "cgit.prism.r" "bota.r" "flix.r" - "jelly.r" "paste.r" "c.r" "p.r" diff --git a/kartei/lass/yellow.nix b/kartei/lass/yellow.nix index ebf824950..a62c6167c 100644 --- a/kartei/lass/yellow.nix +++ b/kartei/lass/yellow.nix @@ -6,6 +6,7 @@ ip6.addr = r6 "3110"; aliases = [ "yellow.r" + "jelly.r" ]; tinc = { pubkey = '' diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index 89ad8cfdc..b7bf7afb2 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -4,7 +4,8 @@ imports = [ - + + { # TODO make new hfos.nix out of this vv users.users.riot = { uid = pkgs.stockholm.lib.genid_uint31 "riot"; diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index ecf0337ed..552dd7f00 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,20 +9,23 @@ in { krebs.build.host = config.krebs.hosts.yellow; + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; + }; + users.groups.download.members = [ "transmission" ]; networking.useHostResolvConf = false; networking.useNetworkd = true; - systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; - systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { enable = true; + home = "/var/state/transmission"; group = "download"; downloadDirPermissions = "775"; settings = { - download-dir = "/var/download/finished"; - incomplete-dir = "/var/download/incoming"; - incomplete-dir-enable = true; + download-dir = "/var/download/transmission"; + incomplete-dir-enabled = false; rpc-bind-address = "::"; message-level = 1; umask = 18; @@ -40,11 +43,8 @@ in { }; virtualHosts.default = { default = true; - locations."/dl".extraConfig = '' - return 301 /; - ''; locations."/" = { - root = "/var/download/finished"; + root = "/var/download"; extraConfig = '' fancyindex on; fancyindex_footer "/fancy.html"; @@ -136,6 +136,58 @@ in { ''}; ''; }; + virtualHosts."jelly.r" = { + locations."/".extraConfig = '' + proxy_pass http://localhost:8096/; + proxy_set_header Accept-Encoding ""; + ''; + }; + }; + + services.samba = { + enable = true; + enableNmbd = false; + extraConfig = '' + workgroup = WORKGROUP + server string = ${config.networking.hostName} + # only allow retiolum addresses + hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16 + + # Use sendfile() for performance gain + use sendfile = true + + # No NetBIOS is needed + disable netbios = true + + # Only mangle non-valid NTFS names, don't care about DOS support + mangled names = illegal + + # Performance optimizations + socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536 + + # Disable all printing + load printers = false + disable spoolss = true + printcap name = /dev/null + + map to guest = Bad User + max log size = 50 + dns proxy = no + security = user + + [global] + syslog only = yes + ''; + shares.public = { + comment = "Warez"; + path = "/var/download"; + public = "yes"; + "only guest" = "yes"; + "create mask" = "0644"; + "directory mask" = "2777"; + writable = "no"; + printable = "no"; + }; }; systemd.services.bruellwuerfel = @@ -164,14 +216,33 @@ in { tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web - { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin + { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr + { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr + { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr + + # smbd + { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; } + { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; } ]; tables.filter.OUTPUT = { policy = "DROP"; rules = [ + { predicate = "-o lo"; target = "ACCEPT"; } { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } @@ -279,7 +350,7 @@ in { ExecStart = pkgs.writers.writeDash "flix-index" '' set -efu - DIR=/var/download/finished + DIR=/var/download cd "$DIR" while inotifywait -rq -e create -e move -e delete "$DIR"; do find . -type f > "$DIR"/index.tmp @@ -294,9 +365,15 @@ in { group = "download"; }; - services.magnetico = { + services.radarr = { + enable = true; + }; + + services.sonarr = { + enable = true; + }; + + services.prowlarr = { enable = true; - web.address = "0.0.0.0"; - web.port = 9092; }; } diff --git a/lass/2configs/yellow-host.nix b/lass/2configs/yellow-host.nix new file mode 100644 index 000000000..d07c222c6 --- /dev/null +++ b/lass/2configs/yellow-host.nix @@ -0,0 +1,14 @@ +{ config, pkgs, ... }: +{ + lass.sync-containers3.containers.yellow = { + sshKey = "${toString }/yellow.sync.key"; + }; + containers.yellow.bindMounts."/var/lib" = { + hostPath = "/var/lib/sync-containers3/yellow/state"; + isReadOnly = false; + }; + containers.yellow.bindMounts."/var/download" = { + hostPath = "/var/download"; + isReadOnly = false; + }; +} From d5a4c2181dcbd12fbb94d5bd7dcbf7f4f89763a8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:47:14 +0100 Subject: [PATCH 06/18] l sync-containers3: create dir, fix symlink --- lass/3modules/sync-containers3.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 1a006835d..e9f708690 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -50,7 +50,8 @@ in { wantedBy = [ "multi-user.target" ]; serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" '' set -efu - ln -frs /var/state/var_src /var/src + mkdir -p /var/state/var_src + ln -Tfrs /var/state/var_src /var/src if test -e /var/src/nixos-config; then /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || : fi From 5415114141754e6e1382e8e6841b902717c6de1f Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:47:26 +0100 Subject: [PATCH 07/18] l sync-containers3: fix group --- lass/3modules/sync-containers3.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index e9f708690..645809da5 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -247,7 +247,7 @@ in { users.groups = lib.mapAttrs' (_: ctr: lib.nameValuePair "${ctr.name}_container" { }) cfg.containers; users.users = lib.mapAttrs' (_: ctr: lib.nameValuePair "${ctr.name}_container" ({ - group = "container_${ctr.name}"; + group = "${ctr.name}_container"; isNormalUser = true; uid = slib.genid_uint31 "container_${ctr.name}"; home = "/var/lib/sync-containers3/${ctr.name}"; From 7bbcac3e5ee3ad65762e54d85a1786d077cca699 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:47:49 +0100 Subject: [PATCH 08/18] l sync-containers3: add init script --- lass/3modules/sync-containers3.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 645809da5..053175565 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -255,6 +255,24 @@ in { homeMode = "705"; })) cfg.containers; + environment.systemPackages = lib.mapAttrsToList (_: ctr: (pkgs.writers.writeDashBin "${ctr.name}_init" '' + set -efux + export PATH=${lib.makeBinPath [ + pkgs.coreutils + pkgs.cryptsetup + pkgs.libxfs.bin + ]}:$PATH + truncate -s 5G /var/lib/sync-containers3/${ctr.name}/disk + cryptsetup luksFormat /var/lib/sync-containers3/${ctr.name}/disk ${ctr.luksKey} + cryptsetup luksOpen --key-file ${ctr.luksKey} /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name} + mkfs.xfs /dev/mapper/${ctr.name} + mkdir -p /var/lib/sync-containers3/${ctr.name}/state + mountpoint /var/lib/sync-containers3/${ctr.name}/state || mount /dev/mapper/${ctr.name} /var/lib/sync-containers3/${ctr.name}/state + /run/current-system/sw/bin/nixos-container start ${ctr.name} + /run/current-system/sw/bin/nixos-container run ${ctr.name} -- ${pkgs.writeDash "init" '' + mkdir -p /var/state + ''} + '')) cfg.containers; }) (lib.mkIf (cfg.containers != {}) { # networking From a38c39424f29bbdfe1493061da05326f9d05d4a0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 18:48:12 +0100 Subject: [PATCH 09/18] l sync-containers3: allow ctr0 in FORWARD --- lass/3modules/sync-containers3.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 053175565..02ba0a5ff 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -296,6 +296,10 @@ in { krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-i ctr0"; target = "ACCEPT"; } ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { predicate = "-i ctr0"; target = "ACCEPT"; } + { predicate = "-o ctr0"; target = "ACCEPT"; } + ]; }) (lib.mkIf cfg.inContainer.enable { users.groups.container_sync = {}; From 32966b38aed6f495e425bc5f1d54761534bc019b Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 2 Jan 2023 23:31:53 +0100 Subject: [PATCH 10/18] l sync-containers3: add runContainer option --- lass/3modules/sync-containers3.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix index 02ba0a5ff..86aa40f03 100644 --- a/lass/3modules/sync-containers3.nix +++ b/lass/3modules/sync-containers3.nix @@ -28,6 +28,10 @@ in { type = lib.types.bool; default = false; }; + runContainer = lib.mkOption { + type = lib.types.bool; + default = true; + }; }; })); }; @@ -74,7 +78,7 @@ in { isReadOnly = false; }; }; - }) cfg.containers; + }) (lib.filterAttrs (_: ctr: ctr.runContainer) cfg.containers); systemd.services = lib.foldr lib.recursiveUpdate {} (lib.flatten (map (ctr: [ { "${ctr.name}_syncer" = { @@ -108,7 +112,7 @@ in { ''; }; }; } - { "${ctr.name}_watcher" = { + { "${ctr.name}_watcher" = lib.mkIf ctr.runContainer { path = with pkgs; [ coreutils consul @@ -164,7 +168,7 @@ in { ''; }; }; } - { "${ctr.name}_scheduler" = { + { "${ctr.name}_scheduler" = lib.mkIf ctr.runContainer { wantedBy = [ "multi-user.target" ]; path = with pkgs; [ coreutils From 4555a8858d652ce713afcf415b56bd0d82ca2d49 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 3 Jan 2023 14:04:21 +0100 Subject: [PATCH 11/18] l radio: add c-base weather --- lass/2configs/radio/weather_for_ips.py | 49 ++++++++++++++++---------- 1 file changed, 30 insertions(+), 19 deletions(-) diff --git a/lass/2configs/radio/weather_for_ips.py b/lass/2configs/radio/weather_for_ips.py index 1f8489bd1..447c6389b 100644 --- a/lass/2configs/radio/weather_for_ips.py +++ b/lass/2configs/radio/weather_for_ips.py @@ -3,32 +3,43 @@ import fileinput import json import requests import os +import random geoip = geoip2.database.Reader(os.environ['MAXMIND_GEOIP_DB']) seen = {} output = [] for ip in fileinput.input(): - location = geoip.city(ip.strip()) - if location.city.geoname_id not in seen: - seen[location.city.geoname_id] = True - weather_api_key = os.environ['OPENWEATHER_API_KEY'] - url = ( - f'https://api.openweathermap.org/data/2.5/onecall' - f'?lat={location.location.latitude}' - f'&lon={location.location.longitude}' - f'&appid={weather_api_key}' - f'&units=metric' - ) - resp = requests.get(url) - weather = json.loads(resp.text) + if "80.147.140.51" in ip: output.append( - f'Weather report for {location.city.name}, {location.country.name}. ' - f'It is {weather["current"]["weather"][0]["description"]} outside ' - f'with a temperature of {weather["current"]["temp"]:.1f} degrees, ' - f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second ' - f'and a humidity of {weather["current"]["humidity"]} percent. ' - f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. ' + 'Weather report for c-base, space.' + 'It is empty space outside ' + 'with a temperature of -270 degrees, ' + 'a lightspeed of 299792 kilometers per second ' + 'and a humidity of Not a Number percent. ' + f'The probability of reincarnation is {random.randrange(0, 100)} percent.' ) + else: + location = geoip.city(ip.strip()) + if location.city.geoname_id not in seen: + seen[location.city.geoname_id] = True + weather_api_key = os.environ['OPENWEATHER_API_KEY'] + url = ( + f'https://api.openweathermap.org/data/2.5/onecall' + f'?lat={location.location.latitude}' + f'&lon={location.location.longitude}' + f'&appid={weather_api_key}' + f'&units=metric' + ) + resp = requests.get(url) + weather = json.loads(resp.text) + output.append( + f'Weather report for {location.city.name}, {location.country.name}. ' + f'It is {weather["current"]["weather"][0]["description"]} outside ' + f'with a temperature of {weather["current"]["temp"]:.1f} degrees, ' + f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second ' + f'and a humidity of {weather["current"]["humidity"]} percent. ' + f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. ' + ) print('\n'.join(output)) From 7cb49c556efce96b15b28807464b8d5cdf1ea999 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 18:33:44 +0100 Subject: [PATCH 12/18] l neoprism.r: add riot container --- lass/1systems/neoprism/config.nix | 15 +-------- lass/2configs/riot.nix | 56 +++++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 14 deletions(-) create mode 100644 lass/2configs/riot.nix diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index b7bf7afb2..f203abc07 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -6,20 +6,7 @@ - { # TODO make new hfos.nix out of this vv - users.users.riot = { - uid = pkgs.stockholm.lib.genid_uint31 "riot"; - isNormalUser = true; - extraGroups = [ "libvirtd" ]; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" - ]; - }; - # krebs.iptables.tables.filter.FORWARD.rules = [ - # { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; } - # { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; } - # ]; - } + ]; krebs.build.host = config.krebs.hosts.neoprism; diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix new file mode 100644 index 000000000..37a6298ca --- /dev/null +++ b/lass/2configs/riot.nix @@ -0,0 +1,56 @@ +{ config, lib, pkgs, ... }: +{ + containers.riot = { + config = { + environment.systemPackages = [ + pkgs.dhcpcd + pkgs.git + pkgs.jq + ]; + networking.useDHCP = lib.mkForce true; + networking.firewall.enable = false; + systemd.services.autoswitch = { + environment = { + NIX_REMOTE = "daemon"; + }; + wantedBy = [ "multi-user.target" ]; + serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" '' + set -efu + if test -e /var/src/nixos-config; then + /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || : + fi + ''; + unitConfig.X-StopOnRemoval = false; + }; + }; + autoStart = true; + enableTun = true; + privateNetwork = true; + hostAddress = "10.233.1.1"; + localAddress = "10.233.1.2"; + forwardPorts = [ + { hostPort = 45622; containerPort = 22; } + ]; + }; + + systemd.network.networks."50-ve-riot" = { + matchConfig.Name = "ve-riot"; + + networkConfig = { + IPForward = "yes"; + # weirdly we have to use POSTROUTING MASQUERADE here + # IPMasquerade = "both"; + LinkLocalAddressing = "no"; + KeepConfiguration = "static"; + }; + }; + + # networking.nat can be used instead of this + krebs.iptables.tables.nat.POSTROUTING.rules = [ + { v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; } + ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { predicate = "-i ve-riot"; target = "ACCEPT"; } + { predicate = "-o ve-riot"; target = "ACCEPT"; } + ]; +} From 7d244baf9e05e73a11eec9e429b71734f354f486 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 19:02:33 +0100 Subject: [PATCH 13/18] l riot: add ssh key, add default route --- lass/2configs/riot.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix index 37a6298ca..559e7b20d 100644 --- a/lass/2configs/riot.nix +++ b/lass/2configs/riot.nix @@ -7,8 +7,11 @@ pkgs.git pkgs.jq ]; - networking.useDHCP = lib.mkForce true; - networking.firewall.enable = false; + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange" + ]; + networking.defaultGateway = "10.233.1.1"; systemd.services.autoswitch = { environment = { NIX_REMOTE = "daemon"; From 6f0cd02c8c78545899fa4afeeeacd68a365349de Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 Jan 2023 21:00:29 +0100 Subject: [PATCH 14/18] l: prism-mount -> yellow-mount --- lass/1systems/coaxmetal/config.nix | 2 +- lass/1systems/shodan/config.nix | 2 +- lass/2configs/{prism-mounts => yellow-mounts}/samba.nix | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) rename lass/2configs/{prism-mounts => yellow-mounts}/samba.nix (75%) diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix index dd8308bbd..2c88b68cc 100644 --- a/lass/1systems/coaxmetal/config.nix +++ b/lass/1systems/coaxmetal/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix index ef538f339..5e48c216a 100644 --- a/lass/1systems/shodan/config.nix +++ b/lass/1systems/shodan/config.nix @@ -16,7 +16,7 @@ - + diff --git a/lass/2configs/prism-mounts/samba.nix b/lass/2configs/yellow-mounts/samba.nix similarity index 75% rename from lass/2configs/prism-mounts/samba.nix rename to lass/2configs/yellow-mounts/samba.nix index 4b1475ef3..e16f1cc47 100644 --- a/lass/2configs/prism-mounts/samba.nix +++ b/lass/2configs/yellow-mounts/samba.nix @@ -1,6 +1,6 @@ { - fileSystems."/mnt/prism" = { - device = "//prism.r/public"; + fileSystems."/mnt/yellow" = { + device = "//yellow.r/public"; fsType = "cifs"; options = [ "guest" From 00226d6e2ae44dbbca0555f10ecb52acb56e6704 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 5 Jan 2023 01:18:06 +0100 Subject: [PATCH 15/18] l radio: move music to /var/music --- lass/2configs/radio/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix index dfb3d7e0b..46540969b 100644 --- a/lass/2configs/radio/default.nix +++ b/lass/2configs/radio/default.nix @@ -3,7 +3,7 @@ let name = "radio"; - music_dir = "/home/radio/music"; + music_dir = "/var/music"; skip_track = pkgs.writers.writeBashBin "skip_track" '' set -eu @@ -303,10 +303,10 @@ in { ''; }; services.syncthing.declarative.folders."the_playlist" = { - path = "/home/radio/music/the_playlist"; + path = "/var/music/the_playlist"; devices = [ "mors" "phone" "prism" "omo" ]; }; - krebs.acl."/home/radio/music/the_playlist"."u:syncthing:X".parents = true; - krebs.acl."/home/radio/music/the_playlist"."u:syncthing:rwX" = {}; - krebs.acl."/home/radio/music/the_playlist"."u:radio:rwX" = {}; + krebs.acl."/var/music/the_playlist"."u:syncthing:X".parents = true; + krebs.acl."/var/music/the_playlist"."u:syncthing:rwX" = {}; + krebs.acl."/var/music/the_playlist"."u:radio:rwX" = {}; } From 0bbbfe153a0752bbe337bef1bac8c52aa285d4da Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 5 Jan 2023 01:19:01 +0100 Subject: [PATCH 16/18] l radio: set timeout for hooks, rename filter --- lass/2configs/radio/radio.liq | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lass/2configs/radio/radio.liq b/lass/2configs/radio/radio.liq index 70d316043..1366287a7 100644 --- a/lass/2configs/radio/radio.liq +++ b/lass/2configs/radio/radio.liq @@ -10,7 +10,7 @@ def stringify_attrs(attrs) = out end -def filter_graveyard(req) = +def filter_music(req) = filename = request.filename(req) if string.match(pattern = '.*/\\.graveyard/.*', filename) then false @@ -27,7 +27,7 @@ end env = environment() port = string.to_int(env["RADIO_PORT"], default = 8000) -all_music = playlist(env["MUSIC"], check_next = filter_graveyard) +all_music = playlist(env["MUSIC"], check_next = filter_music) wishlist = request.queue() tracks = fallback(track_sensitive = true, [wishlist, all_music]) tracks = blank.eat(tracks) @@ -36,7 +36,7 @@ last_metadata = ref([]) def on_metadata(m) = last_metadata := m print("changing tracks") - out = process.read(env["HOOK_TRACK_CHANGE"], env = m) + out = process.read(env["HOOK_TRACK_CHANGE"], env = m, timeout = 5.0) print(out) end tracks.on_metadata(on_metadata) From 727ef7fa8e4581ebf3c792b6f9ff7fba6c8504dd Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 5 Jan 2023 01:19:27 +0100 Subject: [PATCH 17/18] l radio weather: unique ips --- lass/2configs/radio/weather.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/lass/2configs/radio/weather.nix b/lass/2configs/radio/weather.nix index 704bf7218..ad96d8ec0 100644 --- a/lass/2configs/radio/weather.nix +++ b/lass/2configs/radio/weather.nix @@ -18,11 +18,14 @@ let MAXMIND_GEOIP_DB="/tmp/GeoLite2-City.mmdb"; export MAXMIND_GEOIP_DB OPENWEATHER_API_KEY=$(cat "$CREDENTIALS_DIRECTORY/openweather_api"); export OPENWEATHER_API_KEY ss -no 'sport = :8000' | - jc --ss | jq -r '.[] | - select( - .local_address != "[::ffff:127.0.0.1]" - and .local_address != "[::1]" - ) | .peer_address | gsub("[\\[\\]]"; "") + jc --ss | jq -r ' + [ + .[] | + select( + .local_address != "[::ffff:127.0.0.1]" + and .local_address != "[::1]" + ) | .peer_address | gsub("[\\[\\]]"; "") + ] | unique[] ' | ${weather_for_ips}/bin/weather_for_ips ''; From 0b2952f4ed9572521f7c4a21904943ac33c602b0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 6 Jan 2023 12:17:04 +0100 Subject: [PATCH 18/18] l radio.r: init --- kartei/lass/radio.nix | 39 ++++++++++++++++++++++++++++++++ lass/1systems/radio/config.nix | 24 ++++++++++++++++++++ lass/1systems/radio/physical.nix | 7 ++++++ 3 files changed, 70 insertions(+) create mode 100644 kartei/lass/radio.nix create mode 100644 lass/1systems/radio/config.nix create mode 100644 lass/1systems/radio/physical.nix diff --git a/kartei/lass/radio.nix b/kartei/lass/radio.nix new file mode 100644 index 000000000..bfb177e19 --- /dev/null +++ b/kartei/lass/radio.nix @@ -0,0 +1,39 @@ +{ r6, w6, ... }: +{ + nets = { + retiolum = { + ip4.addr = "10.243.0.11"; + ip6.addr = r6 "4d10"; + aliases = [ + "radio.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAx08urv4sl22+pLchD6W6kprJ1JZBiG9/MVA50PqYAJmvTpYyDUCR + Dwgt7pR8n/zbbof98QS5D67J5rZPcrLI6PY2bBzlXFFKHZEj2AVwUjUbyvEvQqtf + yJM+AxFy1/CaXmDvYM9UF/Wh6rb/ZeUxFtbaIVfMPox0Zln0THEsOmCWvNzxMvjZ + rjouZGzrH+er3yxJVovxD/JT32COmK0R20DLDoofBdtBkFlB/VkrbxYfX/cWXX1K + WQVJuQ/H1xP9m4c4S8g/nM63rLUBOIkn06TcXyI/mEgRecEUDgC02PNXc5BDgB4A + seXx+BiLC/f6+64KOWODHEEm/iHjCyrOSZtdA2EbPCATfOHrj0EG5Y4V6d1Iw4WP + kiOIQByHMbOzRwm91yd/gM1DTxdy3j5nqaMhCzrM/QeOhSf5FXkWpARawUsChwh+ + eCuSZDg218u/NkzCrTvCPTdY1q+MZ5d5qgID4VQrenjBJq4AZxsw74Zd2G2uRWlF + paZ2pSCyAey19A/or2iG10tqNpXJzZy0HNhh7q/gKhQKKTh+ggzgOrRe2ZaxlbEy + P45JQKcR9/WJAohnYQ8uZJ6oin5EsEdVkapdYu60aReRGeyTmq3RLnu3Zn5MR5RH + 1r+W03KQcQzmmpE5YrxKSZL6OriXQYEPTa9/mSZT6TEUIvRT8W5jGQ0CAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + tinc.pubkey_ed25519 = "DmiyfmRsWd8Qg6M/ZsAd5lFM+vnkwRTfnMH/jCFwWFF"; + }; + wiregrill = { + ip6.addr = w6 "4d10"; + aliases = [ + "radio.w" + ]; + wireguard.pubkey = '' + iCe1O9qeziw18AlGuFt5tIxm6SIBtNpwO/6OZm9Bn30= + ''; + }; + }; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHsvyWrMN2lupBmjI8nW+NUSJIDPkr8c90Z4BcuZ7Myi"; + syncthing.id = "KMDPLE5-7FBYYXH-PF5LEET-G2AWR33-7XAPZJU-5S3VOB7-ZX5Q74V-PZKI6QN"; +} diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix new file mode 100644 index 000000000..2fd23a448 --- /dev/null +++ b/lass/1systems/radio/config.nix @@ -0,0 +1,24 @@ +with import ; +{ config, lib, pkgs, ... }: +{ + imports = [ + + + + + + + ]; + + krebs.build.host = config.krebs.hosts.radio; + + security.acme = { + acceptTerms = true; + defaults.email = "acme@lassul.us"; + }; + + lass.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt"; + }; +} diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/radio/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +}