swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2025-12-06 17:17:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat[client,server]: add remote builds, confLib

Browse source
This commit is contained in:
Leon Schwarzäugl 2025-12-02 00:57:35 +01:00
parent 626d990b4a
commit f2674bee48
Signed by: swarsel
GPG key ID: 26A54C31F2A4FD84
133 changed files with 4297 additions and 3249 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/nixos/server/ankisync.nix
View file

@ -9,7 +9,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/attic.nix
View file

@ -10,7 +10,7 @@ in
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/atuin.nix
View file

@ -6,7 +6,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

67
modules/nixos/server/bastion.nix Normal file
View file

@ -0,0 +1,67 @@
{ self, lib, config, ... }:
{
options.swarselmodules.server.bastion = lib.mkEnableOption "enable bastion on server";
config = lib.mkIf config.swarselmodules.server.bastion {
users = {
groups = {
jump = { };
};
users = {
"jump" = {
isNormalUser = true;
useDefaultShell = true;
group = lib.mkForce "jump";
createHome = lib.mkForce true;
openssh.authorizedKeys.keyFiles = [
(self + /secrets/keys/ssh/yubikey.pub)
(self + /secrets/keys/ssh/magicant.pub)
(self + /secrets/keys/ssh/builder.pub)
];
};
};
};
services.openssh = {
enable = true;
startWhenNeeded = lib.mkForce false;
authorizedKeysInHomedir = false;
extraConfig = ''
Match User jump
PermitTTY no
X11Forwarding no
PermitTunnel no
GatewayPorts no
AllowAgentForwarding no
'';
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = lib.mkDefault "no";
AllowUsers = [
"jump"
];
};
hostKeys = lib.mkIf (!config.swarselmodules.server.ssh) [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
home-manager.users.jump.config = {
home.stateVersion = lib.mkDefault "23.05";
programs.ssh = {
enable = true;
enableDefaultConfig = false;
matchBlocks = {
"*" = {
forwardAgent = false;
};
} // config.repo.secrets.local.ssh.hosts;
};
};
};
}

9
modules/nixos/server/btrfs.nix Normal file
View file

@ -0,0 +1,9 @@
{ lib, config, ... }:
{
options.swarselmodules.btrfs = lib.mkEnableOption "optional btrfs settings";
config = lib.mkIf config.swarselmodules.btrfs {
boot = {
supportedFilesystems = lib.mkIf config.swarselsystems.isBtrfs [ "btrfs" ];
};
};
}

2
modules/nixos/server/croc.nix
View file

@ -17,7 +17,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

6
modules/nixos/server/disk-encrypt.nix
View file

@ -1,7 +1,7 @@
{ self, pkgs, lib, config, globals, minimal, ... }:
let
localIp = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4;
subnetMask = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".subnetMask4;
localIp = globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4;
subnetMask = globals.networks.${config.swarselsystems.server.netConfigName}.subnetMask4;
gatewayIp = globals.hosts.${config.node.name}.defaultGateway4;
hostKeyPathBase = "/etc/secrets/initrd/ssh_host_ed25519_key";
@ -36,7 +36,7 @@ in
files = [ hostKeyPathBase ];
};
boot = lib.mkIf (!config.swarselsystems.isLaptop) {
boot = lib.mkIf (!config.swarselsystems.isClient) {
kernelParams = lib.mkIf (!config.swarselsystems.isCloud) [
"ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
];

2
modules/nixos/server/firefly-iii.nix
View file

@ -11,7 +11,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/forgejo.nix
View file

@ -9,7 +9,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/freshrss.nix
View file

@ -8,7 +8,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

8
modules/nixos/server/garage.nix
View file

@ -54,11 +54,11 @@ in
assertions = [
{
assertion = config.swarselsystems.server.${serviceName}.buckets != [ ];
message = "If Garage is enabled, at least one bucket must be specified in atro.garage.buckets";
message = "If Garage is enabled, at least one bucket must be specified in swarselsystems.server.${serviceName}.buckets";
}
{
assertion = builtins.length (lib.attrsToList config.swarselsystems.server.${serviceName}.keys) > 0;
message = "If Garage is enabled, at least one key must be specified in atro.garage.keys";
message = "If Garage is enabled, at least one key must be specified in swarselsystems.server.${serviceName}.keys";
}
{
assertion =
@ -71,7 +71,7 @@ in
}
];
swarselsystems.server.dns.${baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${baseDomain}.subdomainRecords = {
"${subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
"${subDomain}admin" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
"${subDomain}web" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
@ -121,7 +121,7 @@ in
rpc_bind_addr = "[::]:${builtins.toString garageRpcPort}";
# we are not joining our nodes, just use the private ipv4
rpc_public_addr = "${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4}:${builtins.toString garageRpcPort}";
rpc_public_addr = "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4}:${builtins.toString garageRpcPort}";
rpc_secret_file = config.sops.secrets.garage-rpc-secret.path;

2
modules/nixos/server/homebox.nix
View file

@ -6,7 +6,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/immich.nix
View file

@ -6,7 +6,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/jellyfin.nix
View file

@ -6,7 +6,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/jenkins.nix
View file

@ -6,7 +6,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/kanidm.nix
View file

@ -31,7 +31,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/kavita.nix
View file

@ -11,7 +11,7 @@ in
calibre
];
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/koillection.nix
View file

@ -14,7 +14,7 @@ in
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};
sops.secrets = {

2
modules/nixos/server/mailserver.nix
View file

@ -11,7 +11,7 @@ in
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/matrix.nix
View file

@ -20,7 +20,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/microbin.nix
View file

@ -10,7 +10,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/minecraft/default.nix
View file

@ -8,7 +8,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/monitoring.nix
View file

@ -16,7 +16,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/navidrome.nix
View file

@ -6,7 +6,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

34
modules/nixos/server/network.nix
View file

@ -1,28 +1,40 @@
{ lib, config, ... }:
let
inherit (config.swarselsystems.server) localNetwork;
netConfig = config.repo.secrets.local.networking;
netName = "${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}";
in
{
options.swarselmodules.server.network = lib.mkEnableOption "enable server network config";
options.swarselsystems.server.localNetwork = lib.mkOption {
type = lib.types.str;
default = "home";
options = {
swarselmodules.server.network = lib.mkEnableOption "enable server network config";
swarselsystems.server = {
localNetwork = lib.mkOption {
type = lib.types.str;
default = "";
};
netConfigName = lib.mkOption {
type = lib.types.str;
default = netName;
readOnly = true;
};
};
};
config = lib.mkIf config.swarselmodules.server.network {
globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${localNetwork}".hosts.${config.node.name} = {
inherit (config.repo.secrets.local.networking.networks.${localNetwork}) id;
mac = config.repo.secrets.local.networking.networks.${localNetwork}.mac or null;
swarselsystems.server.localNetwork = netConfig.localNetwork or "";
globals.networks.${netName}.hosts.${config.node.name} = {
inherit (netConfig.networks.${netConfig.localNetwork}) id;
mac = netConfig.networks.${netConfig.localNetwork}.mac or null;
};
globals.hosts.${config.node.name} = {
inherit (config.repo.secrets.local.networking) defaultGateway4;
wanAddress4 = config.repo.secrets.local.networking.wanAddress4 or null;
wanAddress6 = config.repo.secrets.local.networking.wanAddress6 or null;
wanAddress4 = netConfig.wanAddress4 or null;
wanAddress6 = netConfig.wanAddress6 or null;
};
networking = {
inherit (config.repo.secrets.local.networking) hostId;
inherit (netConfig) hostId;
hostName = config.node.name;
nftables.enable = lib.mkDefault false;
enableIPv6 = lib.mkDefault true;

2
modules/nixos/server/nextcloud.nix
View file

@ -10,7 +10,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

9
modules/nixos/server/nginx.nix
View file

@ -1,6 +1,6 @@
{ pkgs, lib, config, ... }:
let
inherit (config.repo.secrets.common) dnsProvider;
inherit (config.repo.secrets.common) dnsProvider dnsBase;
inherit (config.repo.secrets.common.mail) address3;
serviceUser = "nginx";
@ -63,9 +63,12 @@ in
];
sops = {
secrets.acme-dns-token = { inherit (config.swarselsystems) sopsFile; };
secrets = {
acme-dns-token = { inherit (config.swarselsystems) sopsFile; };
};
templates."certs.secret".content = ''
CF_DNS_API_TOKEN=${config.sops.placeholder.acme-dns-token}
ACME_DNS_API_BASE=${dnsBase}
ACME_DNS_STORAGE_PATH=${config.sops.placeholder.acme-dns-token}
'';
};

76
modules/nixos/server/nsd/default.nix
View file

@ -1,10 +1,7 @@
{ inputs, lib, config, globals, dns, confLib, ... }:
{ lib, config, globals, dns, confLib, ... }:
let
inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName;
# servicePort = 53;
# serviceDomain = config.repo.secrets.common.services.domains."${serviceName}";
# serviceAddress = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4;
inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName servicePort proxyAddress4 proxyAddress6;
inherit (config.swarselsystems) sopsFile;
in
{
options = {
@ -14,7 +11,7 @@ in
lib.types.submodule {
options = {
subdomainRecords = lib.mkOption {
type = lib.types.attrsOf inputs.dns.subzone;
type = lib.types.attrsOf dns.lib.types.subzone;
default = { };
};
};
@ -23,14 +20,69 @@ in
};
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
sops.secrets = {
tsig-key = { inherit sopsFile; };
};
# services.resolved.enable = false;
networking = {
# nameservers = [ "1.1.1.1" "8.8.8.8" ];
firewall = {
allowedUDPPorts = [ servicePort ];
allowedTCPPorts = [ servicePort ];
};
};
services.nsd = {
enable = true;
zones = {
"${globals.domains.main}" = {
# provideXFR = [ ... ];
# notify = [ ... ];
data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns; });
keys = {
"${globals.domains.main}.${proxyAddress4}" = {
algorithm = "hmac-sha256";
keyFile = config.sops.secrets.tsig-key.path;
};
"${globals.domains.main}.${proxyAddress6}" = {
algorithm = "hmac-sha256";
keyFile = config.sops.secrets.tsig-key.path;
};
"${globals.domains.main}" = {
algorithm = "hmac-sha256";
keyFile = config.sops.secrets.tsig-key.path;
};
};
interfaces = [
"10.1.2.157"
"2603:c020:801f:a0cc::9d"
];
zones = {
"${globals.domains.main}" =
let
keyName4 = "${globals.domains.main}.${proxyAddress4}";
keyName6 = "${globals.domains.main}.${proxyAddress6}";
keyName = "${globals.domains.main}";
transferList = [
"213.239.242.238 ${keyName4}"
"2a01:4f8:0:a101::a:1 ${keyName6}"
"213.133.100.103 ${keyName4}"
"2a01:4f8:0:1::5ddc:2 ${keyName6}"
"193.47.99.3 ${keyName4}"
"2001:67c:192c::add:a3 ${keyName6}"
];
in
{
outgoingInterface = "2603:c020:801f:a0cc::9d";
notify = transferList ++ [
"216.218.130.2 ${keyName}"
];
provideXFR = transferList ++ [
"216.218.133.2 ${keyName}"
"2001:470:600::2 ${keyName}"
];
# dnssec = true;
data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns proxyAddress4 proxyAddress6; });
};
};
};

59
modules/nixos/server/nsd/site1.nix
View file

@ -1,40 +1,35 @@
{ config, globals, dns, ... }:
{ config, globals, dns, proxyAddress4, proxyAddress6, ... }:
with dns.lib.combinators; {
SOA = {
nameServer = "soa";
adminEmail = "admin@${globals.domains.main}";
serial = 2025112101;
adminEmail = "admin@${globals.domains.main}"; # this option is not parsed as domain (we cannot just write "admin")
serial = 2025120201; # update this on changes for secondary dns
};
useOrigin = false;
NS = [
"soa.${globals.domains.name}."
"ns1.he.net"
"ns2.he.net"
"ns3.he.net"
"ns4.he.net"
"ns5.he.net"
"oxygen.ns.hetzner.com"
"pola.ns.cloudflare.com"
];
"soa"
"srv"
] ++ globals.domains.externalDns;
A = [ "75.2.60.5" ];
A = [ config.repo.secrets.local.dns.homepage-ip ];
SRV = [
{
service = "_matrix";
proto = "_tcp";
port = 443;
target = "${globals.services.matrix.baseDomain}.${globals.domains.main}";
target = "${globals.services.matrix.subDomain}";
priority = 10;
wweight = 5;
weight = 5;
}
{
service = "_submissions";
proto = "_tcp";
port = 465;
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
target = "${globals.services.mailserver.subDomain}";
priority = 5;
weight = 0;
ttl = 3600;
@ -43,7 +38,7 @@ with dns.lib.combinators; {
service = "_submission";
proto = "_tcp";
port = 587;
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
target = "${globals.services.mailserver.subDomain}";
priority = 5;
weight = 0;
ttl = 3600;
@ -52,7 +47,7 @@ with dns.lib.combinators; {
service = "_imap";
proto = "_tcp";
port = 143;
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
target = "${globals.services.mailserver.subDomain}";
priority = 5;
weight = 0;
ttl = 3600;
@ -61,7 +56,7 @@ with dns.lib.combinators; {
service = "_imaps";
proto = "_tcp";
port = 993;
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
target = "${globals.services.mailserver.subDomain}";
priority = 5;
weight = 0;
ttl = 3600;
@ -71,13 +66,7 @@ with dns.lib.combinators; {
MX = [
{
preference = 10;
exchange = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
}
];
CNAME = [
{
cname = "www.${glovals.domains.main}";
exchange = "${globals.services.mailserver.subDomain}";
}
];
@ -90,28 +79,22 @@ with dns.lib.combinators; {
}
];
DMARC = [
{
p = "none";
ttl = 10800;
}
];
TXT = [
(with spf; strict [ "a:${globals.services.mailserver.baseDomain}.${globals.domains.main}" ])
(with spf; strict [ "a:${globals.services.mailserver.subDomain}.${globals.domains.main}" ])
"google-site-verification=${config.repo.secrets.local.dns.google-site-verification}"
];
DMARC = [
{
selector = "mail";
k = "rsa";
p = "none";
ttl = 10800;
}
];
subdomains = config.swarselsystems.server.dns.${globals.domain.main}.subdomainRecords // {
"minecraft" = host "130.61.119.12" null;
subdomains = config.swarselsystems.server.dns.${globals.domains.main}.subdomainRecords // {
"www".CNAME = [ "${globals.domains.main}." ];
"_acme-challenge".CNAME = [ "${config.repo.secrets.local.dns.acme-challenge-domain}." ];
"soa" = host proxyAddress4 proxyAddress6;
"srv" = host proxyAddress4 proxyAddress6;
};
}

2
modules/nixos/server/oauth2-proxy.nix
View file

@ -119,7 +119,7 @@ in
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/paperless.nix
View file

@ -11,7 +11,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/radicale.nix
View file

@ -9,7 +9,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/shlink.nix
View file

@ -12,7 +12,7 @@ in
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/slink.nix
View file

@ -10,7 +10,7 @@ in
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

2
modules/nixos/server/snipe-it.nix
View file

@ -11,7 +11,7 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};

35
modules/nixos/server/ssh-builder.nix Normal file
View file

@ -0,0 +1,35 @@
{ self, pkgs, lib, config, ... }:
let
ssh-restrict = "restrict,pty,command=\"${wrapper-dispatch-ssh-nix}/bin/wrapper-dispatch-ssh-nix\" ";
wrapper-dispatch-ssh-nix = pkgs.writeShellScriptBin "wrapper-dispatch-ssh-nix" ''
case $SSH_ORIGINAL_COMMAND in
"nix-daemon --stdio")
exec env NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${config.nix.package}/bin/nix-daemon --stdio
;;
"nix-store --serve --write")
exec env NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${config.nix.package}/bin/nix-store --serve --write
;;
*)
echo "Access only allowed for using the nix remote builder" 1>&2
exit
esac
'';
in
{
options.swarselmodules.server.ssh-builder = lib.mkEnableOption "enable ssh-builder config on server";
config = lib.mkIf config.swarselmodules.server.ssh-builder {
users = {
groups.builder = { };
users.builder = {
useDefaultShell = true;
isSystemUser = true;
group = "builder";
openssh.authorizedKeys.keys = [
''${ssh-restrict} ${builtins.readFile "${self}/secrets/keys/ssh/builder.pub"}''
];
};
};
};
}

6
modules/nixos/server/ssh.nix
View file

@ -9,6 +9,10 @@
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "yes";
AllowUsers = [
"root"
config.swarselsystems.mainUser
];
};
hostKeys = [
{
@ -20,10 +24,12 @@
users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
(self + /secrets/keys/ssh/yubikey.pub)
(self + /secrets/keys/ssh/magicant.pub)
# (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/keys/ssh/jump.pub))
];
users.users.root.openssh.authorizedKeys.keyFiles = [
(self + /secrets/keys/ssh/yubikey.pub)
(self + /secrets/keys/ssh/magicant.pub)
# (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/keys/ssh/jump.pub))
];
security.sudo.extraConfig = ''
Defaults env_keep+=SSH_AUTH_SOCK

2
modules/nixos/server/syncthing.nix
View file

@ -42,7 +42,7 @@ in
};
config = lib.mkIf config.swarselmodules.server.${serviceName} {
swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
"${globals.services.${specificServiceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
};