Compare commits

...

5 commits

17 changed files with 128 additions and 65 deletions

View file

@ -159,21 +159,6 @@
"type": "github"
}
},
"impermanence": {
"locked": {
"lastModified": 1724489415,
"narHash": "sha256-ey8vhwY/6XCKoh7fyTn3aIQs7WeYSYtLbYEG87VCzX4=",
"owner": "nix-community",
"repo": "impermanence",
"rev": "c7f5b394397398c023000cf843986ee2571a1fd7",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "impermanence",
"type": "github"
}
},
"lanzaboote": {
"inputs": {
"crane": [
@ -298,6 +283,21 @@
"type": "github"
}
},
"preservation": {
"locked": {
"lastModified": 1725460242,
"narHash": "sha256-9n9Ygta1MCfpbF9D88tG2B4EL5nuSz4eIOAofGSlxoE=",
"owner": "WilliButz",
"repo": "preservation",
"rev": "02e731a820d05107bc648460f8630d0d80a5ffd4",
"type": "github"
},
"original": {
"owner": "WilliButz",
"repo": "preservation",
"type": "github"
}
},
"root": {
"inputs": {
"colmena": "colmena",
@ -308,12 +308,12 @@
"flake-utils": "flake-utils",
"gitignore": "gitignore",
"home-manager": "home-manager",
"impermanence": "impermanence",
"lanzaboote": "lanzaboote",
"neovim": "neovim",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs",
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
"preservation": "preservation",
"rust-overlay": "rust-overlay",
"sops-nix": "sops-nix",
"systems": "systems",

View file

@ -28,9 +28,6 @@
url = "github:nix-community/home-manager";
inputs.nixpkgs.follows = "nixpkgs";
};
impermanence = {
url = "github:nix-community/impermanence";
};
lanzaboote = {
url = "github:nix-community/lanzaboote";
inputs.nixpkgs.follows = "nixpkgs";
@ -50,6 +47,9 @@
nixos-hardware = {
url = "github:NixOS/nixos-hardware";
};
preservation = {
url = "github:WilliButz/preservation";
};
sops-nix = {
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";

View file

@ -6,16 +6,23 @@
...
}:
{
imports = [
imports =
[
../../nixos/profiles/sing-box
../../nixos/profiles/wireless
./anti-feature.nix
./disko.nix
./hardware-configuration.nix
./impermanence.nix
./lanzaboote.nix
];
./preservation.nix
]
++ (with inputs; [
disko.nixosModules.disko
home-manager.nixosModules.home-manager
lanzaboote.nixosModules.lanzaboote
preservation.nixosModules.preservation
]);
networking.hostName = "dust";
time.timeZone = "Asia/Shanghai";

View file

@ -2,8 +2,8 @@
{
sops.age.sshKeyPaths = lib.mkForce [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
fileSystems."/persist".neededForBoot = true;
environment.persistence."/persist" = {
hideMounts = true;
preservation.enable = true;
preservation.preserveAt."/persist" = {
directories = [
"/var/log"
"/var/lib"
@ -15,6 +15,7 @@
"/etc/ssh/ssh_host_rsa_key"
"/etc/ssh/ssh_host_rsa_key.pub"
];
users.guanranwang = {
directories = [
"Desktop"
@ -43,4 +44,19 @@
];
};
};
systemd.tmpfiles.settings.preservation =
let
mkTmpfile = {
user = "guanranwang";
group = "users";
mode = "0755";
};
in
{
"/home/guanranwang/.config".d = mkTmpfile;
"/home/guanranwang/.mozilla".d = mkTmpfile;
"/home/guanranwang/.local/share".d = mkTmpfile;
"/home/guanranwang/.local/state".d = mkTmpfile;
};
}

View file

@ -9,6 +9,7 @@
imports = [
"${modulesPath}/virtualisation/amazon-image.nix"
./anti-feature.nix
./ports.nix
./services/forgejo.nix
./services/keycloak.nix

13
hosts/tyo0/ports.nix Normal file
View file

@ -0,0 +1,13 @@
{
lib.ports = {
keycloak = 8010;
miniflux = 8020;
redlib = 8030;
vaultwarden = 8040;
wastebin = 8050;
prometheus = 9010;
blackbox = 9020;
alertmanager = 9030;
};
}

View file

@ -1,5 +1,5 @@
sing-box:
auth: ENC[AES256_GCM,data:szsNEmPyKZZJXxZ/1CCVNNocNp2dkUNT8n/Evf61J8LnBZGiUNKZek7ecdvU6VVsszOYD4uv6F3WmulmUqSRff2fI8pn3/if5cNSMOT9KUQpJMwnYMVIWGI+Epmr76rQUuf766yMA3UEloSuwOvpWjUmfdonfr2jKocMJRDgDoI4tWRHpRmjcF7mRt5x12FFgAhDmlNZOSyRxx6R5opfL0ZEU3MPi6El+dokkUcq/frp/ZgjadTyVQMJc5E41QMYbAcqJmAIN8lCVnUbshwxDRGYcpkH66KLOf6NYo0Z4dbnK6bgUozHLpI=,iv:sgEAZOTk5zylOU1SeHCGIjMkmZ8KKhSRIW7UHXH4u/8=,tag:KwI5w2OSmhB3PjCKPgoSjQ==,type:str]
auth: ENC[AES256_GCM,data:gzoeMI/8A6e6HBbE2VofGJB1/sIq+b7MrkFoTp4zvRT1gLHVfP1B6XT+srJCOgUFNWL++JU1ShPYqgH61cl77WtJjzy+LJxb3oYnW3u/EzJJMpBHggstVQpaWfiGb16lhCq+Figsxk0G8BUFI/PPR/KmBZzLOw+/I/z8Dqf66dQh9BIhEOY0pJknZ4El2Ml5oGvYxdpjQ9rESfegwTz5wrha77V1mi733jrPFDuWLDkgNDf5nKRfCkpfLrdzyU7OX4qcj81qIpHsRBZ25Lib0IwDGurC7njKdbs8S0bprqZlK9sW34Dmx3s=,iv:XgXX2LaLgyyRuI04/RzgnfTAXUW3e9F0cdw6l6koVgc=,tag:9hDiGVADrBgpc0G+UFjM3g==,type:str]
miniflux:
environment: ENC[AES256_GCM,data:eT1rVeXbDANk/+9xmxmTHvMNofyplNGvVFgTj4lFQlJSHTi+br1qfg0tddf5aCtE8cNGt0fNm63qguI2Df/+KWENhb0vCpjRG7zryfBhEwMP5jkVgDnaHYolS1z3OmhlEpE=,iv:tWAUCtlk8wDGWGmn7j00QOVwjPYDkTPDGpyxd1pP6ig=,tag:gLNdzK9GZ/m5mWL5YNrzyQ==,type:str]
vaultwarden:
@ -30,8 +30,8 @@ sops:
UkYrb3JpZDBzOUgzWXFQbUZnWjNUUjAKKuJmaJ6kV5ITsCMXEOzv9ym3L9VQKoB4
n/SE4eCXeaoE/1UCdw4VlpyuUuouHh2pgLWJF49dHhY/zhv84sURtA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-08-29T16:26:25Z"
mac: ENC[AES256_GCM,data:jpm+TBCtdFcgfRvzg+mTgWtu20/rm6nF/OdxUGbufkC1Y0Z8+eb8nIBe1TJhodt6kT/NdPRVI0N1JLD5XOwduvqL/QoZGzGkBfEVqFvnTxQYVVXp4sWdqji26XPb1sn+gbmobR4qlZPxdmvKZWEQxO2VJpKA3Bfalwa9fy0ajHE=,iv:XDRDEP/+rs2DLLkrftSxlxDMbdz7W9nHBEs0QWIDK88=,tag:UVmyD5FOev9LPRBvMcmJyw==,type:str]
lastmodified: "2024-09-07T05:32:46Z"
mac: ENC[AES256_GCM,data:K+J0o/hlOHociZO8Fd08/ixr21ZGCM9yK6M87ylSbRNb8rwwS+IAsumvMMa8/R79ay66T0VWlTjBY2ywlrNLiz11n1Qx2j97L1MrCy4VWy3LmJEFhbGuUBbZLIp53OK7brSC/6XN3lB6K5KsiZ4vLCyGu/6hRpxcHg5Iada5h+8=,iv:JT9Xl9JQWYpacWz+ymwoZfOSeMqtrsmxhNu6hCBxUEQ=,tag:wRPCTHyL2iupmvnMJOx30g==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0

View file

@ -1,4 +1,12 @@
{ lib, pkgs, ... }:
{
lib,
config,
pkgs,
...
}:
let
port = config.lib.ports.keycloak;
in
{
services.keycloak = {
enable = true;
@ -6,7 +14,7 @@
cache = "local";
hostname = "id.ny4.dev";
http-host = "127.0.0.1";
http-port = 8800;
http-port = port;
proxy = "edge";
};
database.passwordFile = toString (pkgs.writeText "password" "keycloak");
@ -18,7 +26,7 @@
};
handle = lib.singleton {
handler = "reverse_proxy";
upstreams = [ { dial = "localhost:8800"; } ];
upstreams = [ { dial = "localhost:${toString port}"; } ];
};
};
}

View file

@ -1,10 +1,13 @@
{ lib, config, ... }:
let
port = config.lib.ports.miniflux;
in
{
services.miniflux = {
enable = true;
adminCredentialsFile = config.sops.secrets."miniflux/environment".path;
config = {
LISTEN_ADDR = "127.0.0.1:9300";
LISTEN_ADDR = "127.0.0.1:${toString port}";
BASE_URL = "https://rss.ny4.dev";
OAUTH2_PROVIDER = "oidc";
@ -21,7 +24,7 @@
};
handle = lib.singleton {
handler = "reverse_proxy";
upstreams = [ { dial = "localhost:9300"; } ];
upstreams = [ { dial = "localhost:${toString port}"; } ];
};
};
}

View file

@ -4,17 +4,20 @@
config,
...
}:
let
inherit (config.lib) ports;
in
{
services.prometheus = {
enable = true;
listenAddress = "127.0.0.1";
port = 9090;
port = ports.prometheus;
webExternalUrl = "https://prom.ny4.dev";
exporters.blackbox = {
enable = true;
listenAddress = "127.0.0.1";
port = 9093;
port = ports.blackbox;
configFile = (pkgs.formats.yaml { }).generate "config.yaml" {
modules = {
http_2xx = {
@ -73,7 +76,7 @@
}
{
target_label = "__address__";
replacement = "127.0.0.1:9093";
replacement = "127.0.0.1:${toString ports.blackbox}";
}
];
}
@ -116,7 +119,7 @@
alertmanagers = lib.singleton {
static_configs = lib.singleton {
targets = [
"127.0.0.1:9092"
"127.0.0.1:${toString ports.alertmanager}"
];
};
};
@ -124,7 +127,7 @@
alertmanager = {
enable = true;
listenAddress = "127.0.0.1";
port = 9092;
port = ports.alertmanager;
configuration = {
receivers = lib.singleton {
@ -146,7 +149,7 @@
};
handle = lib.singleton {
handler = "reverse_proxy";
upstreams = [ { dial = "127.0.0.1:9090"; } ];
upstreams = [ { dial = "127.0.0.1:${toString ports.prometheus}"; } ];
};
};
}

View file

@ -1,18 +1,29 @@
{ lib, ... }:
{ lib, config, ... }:
let
port = config.lib.ports.redlib;
in
{
services.redlib = {
inherit port;
enable = true;
address = "127.0.0.1";
port = 9400;
};
services.caddy.settings.apps.http.servers.srv0.routes = lib.singleton {
match = lib.singleton {
host = [ "reddit.ny4.dev" ];
};
handle = lib.singleton {
handle = [
{
# Google's indexing caused a DoS with 800k requests...
# https://developers.google.com/search/docs/crawling-indexing/block-indexing
handler = "headers";
response.set."X-Robots-Tag" = [ "noindex" ];
}
{
handler = "reverse_proxy";
upstreams = [ { dial = "localhost:9400"; } ];
};
upstreams = [ { dial = "localhost:${toString port}"; } ];
}
];
};
}

View file

@ -18,7 +18,7 @@
listen = "0.0.0.0";
listen_port = 27253;
users = {
_secret = "/run/credentials/sing-box.service/auth";
_secret = config.sops.secrets."sing-box/auth".path;
quote = false;
};
tls = {
@ -47,7 +47,6 @@
path = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev";
in
[
"auth:${config.sops.secrets."sing-box/auth".path}"
"cert:${path}/tyo0.ny4.dev.crt"
"key:${path}/tyo0.ny4.dev.key"
];

View file

@ -1,4 +1,7 @@
{ lib, config, ... }:
let
port = config.lib.ports.vaultwarden;
in
{
services.vaultwarden = {
enable = true;
@ -7,7 +10,7 @@
DOMAIN = "https://vault.ny4.dev";
IP_HEADER = "X-Forwarded-For";
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 9500;
ROCKET_PORT = port;
EMERGENCY_ACCESS_ALLOWED = false;
SENDS_ALLOWED = false;
@ -22,7 +25,7 @@
};
handle = lib.singleton {
handler = "reverse_proxy";
upstreams = [ { dial = "localhost:9500"; } ];
upstreams = [ { dial = "localhost:${toString port}"; } ];
};
};
}

View file

@ -1,8 +1,11 @@
{ lib, ... }:
{ lib, config, ... }:
let
port = config.lib.ports.wastebin;
in
{
services.wastebin = {
enable = true;
settings.WASTEBIN_ADDRESS_PORT = "127.0.0.1:8200";
settings.WASTEBIN_ADDRESS_PORT = "127.0.0.1:${toString port}";
};
services.caddy.settings.apps.http.servers.srv0.routes = lib.singleton {
@ -11,7 +14,7 @@
};
handle = lib.singleton {
handler = "reverse_proxy";
upstreams = [ { dial = "localhost:8200"; } ];
upstreams = [ { dial = "localhost:${toString port}"; } ];
};
};
}

View file

@ -12,10 +12,6 @@
./zram.nix
]
++ (with inputs; [
disko.nixosModules.disko
home-manager.nixosModules.home-manager
impermanence.nixosModules.impermanence
lanzaboote.nixosModules.lanzaboote
self.nixosModules.default
sops-nix.nixosModules.sops
]);

View file

@ -27,7 +27,7 @@
tag = "tyo0";
server = "tyo0.ny4.dev";
server_port = 27253;
uuid = "29e54ee5-43f5-4891-b750-ca73c7e3b2b3";
uuid._secret = config.sops.secrets."sing-box/tyo0".path;
flow = "xtls-rprx-vision";
tls.enabled = true;
}

View file

@ -1,5 +1,5 @@
sing-box:
tyo0: ENC[AES256_GCM,data:IIUqglE+FqlD1LlRkpCuRqaOysEe4BxUIlGBEhUwgw/dDGBK,iv:ojryKlJgA9R7dTlcqKZ9BmGSHdZQ4BDMYRYLlJwbCXc=,tag:MDhlfxgQQ84UUdZ+ZWvaWQ==,type:str]
tyo0: ENC[AES256_GCM,data:GDMc7U+e60UzGkkl2uvRfhyAdGKE4WCrcQSvwENXjV0yKhVa,iv:uobBavFcQZ/8JmJrZHtL11Tjhs2Aaq/ZBBhrW+o97JQ=,tag:/qME2YQCw6Lrt47gu7UAgg==,type:str]
sops:
kms: []
gcp_kms: []
@ -33,8 +33,8 @@ sops:
NTdHRTVNeUxYUHYzQzIvMlZlTFhoVkEKcjzpxTP25gadACwH6g9SZCsw2KPoNiQ6
JsMOOy+JUrIzGDftkDYzQhxg+fDWPMnRVzk5EMEw5AU2RghrrJzTWA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-08-27T20:29:35Z"
mac: ENC[AES256_GCM,data:RA8pX6oMrKz4f7aX0UwTAa3P/QYt1IX8FO9yl/ViaUoPYQ5WD3o5Zh7FX40QDUdLZkfFJqO+P+gr5ZqRJ+lZRSNRXmO0vx9C7KMPEMweNz+0hmE15OKXcfEjTbEu+GW9vgoj6TyQ8OahJZ4pF7DNtg0+/B7LzmhgrRaKq7zLdng=,iv:x1zD7US6VmLfeY1tH3/+fHL4ECM4UyYCzv5qxD1ikEw=,tag:kA+AFntpC+sKpCa9/Q1Bjw==,type:str]
lastmodified: "2024-09-07T05:32:11Z"
mac: ENC[AES256_GCM,data:wWWjkP5ADCStznOy+REs4ZqjTXVW6BW3Xl2o+OU8PtgBrZWHLJ2eVumVlf3aHZWXlCFOZQ7C8e/bmdSdHJh3vTeZ8tgT54+4d5aXgMc+stj2Cz3EHjAON0nnvO5EeFUsFvdSbQfTz871Wyl9BUlJsDnf+4m3Rl/kUanidOioqxM=,iv:L5vHKzWJ+MVNLsUiJsNh1d6X+It3MkIETi6gqyieYQE=,tag:wJqm4cr2G4j26BDlXnHOUg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0