Skip to content

Commit e4b9380

Browse files
TchekdaTchekda
committed
deploy: mross
1 parent b26adc1 commit e4b9380

27 files changed

+495
-318
lines changed

‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,5 @@ ssl/*pem
99
**/**.key
1010
hgunderson/qrcode.config
1111
kbennett/fider/secrets.nix
12-
kbennett/cf-apikey
12+
kbennett/cf-apikey
13+
mross/client_id

‎home-manager/hspecter/ssh.nix

+3-3
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@
1010
user = "root";
1111
port = 22101;
1212
};
13-
pve = {
14-
hostname = "proxmox.tchekda.fr";
15-
user = "tchekda";
13+
mross = {
14+
hostname = "mross.tchekda.fr";
15+
user = "root";
1616
port = 9137;
1717
};
1818
llitt = {

‎iso.nix

+2
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@
3737
shell = pkgs.fish;
3838
openssh.authorizedKeys.keys = [
3939
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAavYBAIwKDDixRTBJbSHMpkCeN6OMfAMoypSVdYAgpY3OILAUj/HoIJp1uIiKlxJ+v4gLDPjaPWmPPiOW2O4EEiCTEV22DlhcFQZs7DY1Pf7WQnUW1g4PI35LUEWlBOghnB+D11ltU5odTBPVgu1HxNX6pbE1r2MLvox8xt+PHkqXvaPDX7QGPBuAAusK8trEUROObc6+umHPH1VeTK7H810kSGDy1JVPQgK28byh/yJcoHL53XGZ+nCYiuZVFfPmLofPP+LGzulGT2TwNcUiAA8Wv7skSNUdjzXJ4KRZlqIsYiey1vx0hq3+whfC3vLwMBvz90v0HTW+xtEnX4vqR4SeFfRaLpUXpY8rceICgo3XnBQyn/2NNpmbRIJWowK0ENA58psbxo4Z+2qa0is3XLvVc2yqcdd2dLRr+gk3qwEIRcY1m+oGw2u4kv4RkTvboVPTdQozUcTB5EfLKRPB3DnVwULIYbt3QJ5CnW+v+PqinHc2vmAeUaKOEwfufdE= tchekda@hspecter"
40+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGY/SVAkoinPz2YLLKMb29Qgv2dqSgU/dFnaxHaMPaG/SH6wzw3+mcS11flaU1ZJa3Q46fVEqOfAxu/VzXSx64ZQDKWWf7LQ+D5xSsaYPUSAqLQZ3OwATd6ZK+AOXVDStiB6JiWf0A0gaYWVfeZn7cH13WL8Px6kKmMCXrsHbo84dKuFeTDTafizH2nMC12jnf8vm/lSCc/Q7SNyqu3sXE8iU7/s2inG9s4GH5R3Ait9AoX50JHDQo2268NyjfWp8EQcLpUVRj4ujtqMtKHFzVKQacBTdzjfFJTIDSZhzF2+Dik1ZfmOjCsX2zzpIk5yZ02bBjZAzrVPwh4YwZRwwGsspx0yAdlrWaMEYc2YjY+TmVJfvZU6dz92oR4dNms7iTSHOIMu9eyhsIWR7+fOpm5mMPd6FvTMeNsip9iQPbG4rLQscN+vWNOXt+BY18MFIRJfjVM7XckGtHyjvl8lsGXWA7v5v+Wf7IuPIYERXHuNt5Ryd2SDsYaqlf4XZHy1hw3A4YQrVyiwmPhRKIf1ko9tsmT0/S/0eCr7EorbZnSAHvpDIlJVZ4hyyMe86qroO+rX8U0LXYXovZIYfFSn9CKEuEPGtI+/pJLrlHe5E49j6Jgmog+4Zc35dpOX5QH7rLxPydRMRPCW6+Iu4tsJ6sO2tfZDOeK/j9fTZXxK2C3Q== tchekda@termius"
41+
"[email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBb+pk3fohcBQEldw9/bGZe6Q8SVdJ54Sy0E+I6juVyrAAAABHNzaDo= tchekda@hspecter"
4042
];
4143
};
4244
};

‎llitt/dn42/bird2.nix

+1-3
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ let
1212
in
1313
{
1414

15-
imports = [ /home/tchekda/Prog/NixOS/nixpkgs/nixos/modules/services/networking/bird-lg.nix ];
16-
1715
systemd.timers.dn42-roa = {
1816
description = "Trigger a ROA table update";
1917

@@ -46,7 +44,7 @@ in
4644
proxy = {
4745
enable = true;
4846
listenAddress = "0.0.0.0:8000";
49-
allowedIPs = [ "172.20.4.97" "172.20.4.98" ];
47+
allowedIPs = [ "172.20.4.97" "172.20.4.98" "fd54:fe4b:9ed1:1::1" "fd54:fe4b:9ed1:2::1" ];
5048
birdSocket = "/var/run/bird/bird.ctl";
5149
};
5250
# frontend = {

‎mross/configuration.nix

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{ pkgs, ... }:
2+
let client_id = builtins.readFile ./client_id;
3+
in {
4+
imports = [
5+
./hardware-configuration.nix
6+
../tchekda_user.nix
7+
<home-manager/nixos>
8+
(fetchTarball "https://github.com/msteen/nixos-vscode-server/tarball/master")
9+
./seedbox.nix
10+
./nginx.nix
11+
./containers.nix
12+
./wireguard.nix
13+
./dn42
14+
];
15+
16+
boot = {
17+
cleanTmpDir = true;
18+
kernelPackages = pkgs.linuxPackages_latest;
19+
loader = {
20+
grub = {
21+
enable = true;
22+
splashImage = null;
23+
version = 2;
24+
};
25+
};
26+
};
27+
28+
documentation.enable = false;
29+
30+
environment = {
31+
etc."dhcpcd.duid".text = client_id;
32+
systemPackages = with pkgs; [
33+
dig
34+
git
35+
htop
36+
iotop
37+
lnav
38+
nano
39+
wget
40+
];
41+
};
42+
43+
home-manager.users.tchekda = {
44+
imports = [ ../home-manager/mross/default.nix ];
45+
};
46+
47+
nix.gc = {
48+
automatic = true;
49+
dates = "daily";
50+
options = "--delete-older-than 10d";
51+
};
52+
53+
networking = {
54+
dhcpcd = {
55+
extraConfig = ''
56+
allowinterfaces enp0s20f*
57+
noarp
58+
option rapid_commit
59+
option host_name, routers
60+
option interface_mtu
61+
require dhcp_server_identifier
62+
debug
63+
clientid "${client_id}"
64+
noipv6rs
65+
interface enp0s20f0
66+
ipv6rs
67+
ia_pd 1/48 enp0s20f0
68+
static ip6_address=2001:bc8:2e2a::1/48
69+
'';
70+
persistent = true;
71+
};
72+
73+
firewall = {
74+
logRefusedConnections = false;
75+
};
76+
77+
hostName = "mross";
78+
79+
nameservers = [ "51.159.69.156" "51.159.69.162" "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ];
80+
81+
tempAddresses = "disabled";
82+
83+
useDHCP = true;
84+
};
85+
86+
services = {
87+
endlessh-go = {
88+
enable = true;
89+
openFirewall = true;
90+
port = 22;
91+
};
92+
openssh = {
93+
enable = true;
94+
ports = [ 9137 ];
95+
};
96+
qemuGuest.enable = true;
97+
vscode-server.enable = true;
98+
};
99+
100+
system.stateVersion = "22.11"; # Did you read the comment?
101+
102+
systemd.services.dhcpcd.preStart = ''
103+
cp ${pkgs.writeText "duid" client_id} /var/db/dhcpcd/duid
104+
'';
105+
106+
time.timeZone = "Europe/Paris";
107+
108+
users.users = {
109+
tchekda.extraGroups = [ "docker" ];
110+
root = {
111+
shell = pkgs.fish;
112+
openssh.authorizedKeys.keys = [
113+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGY/SVAkoinPz2YLLKMb29Qgv2dqSgU/dFnaxHaMPaG/SH6wzw3+mcS11flaU1ZJa3Q46fVEqOfAxu/VzXSx64ZQDKWWf7LQ+D5xSsaYPUSAqLQZ3OwATd6ZK+AOXVDStiB6JiWf0A0gaYWVfeZn7cH13WL8Px6kKmMCXrsHbo84dKuFeTDTafizH2nMC12jnf8vm/lSCc/Q7SNyqu3sXE8iU7/s2inG9s4GH5R3Ait9AoX50JHDQo2268NyjfWp8EQcLpUVRj4ujtqMtKHFzVKQacBTdzjfFJTIDSZhzF2+Dik1ZfmOjCsX2zzpIk5yZ02bBjZAzrVPwh4YwZRwwGsspx0yAdlrWaMEYc2YjY+TmVJfvZU6dz92oR4dNms7iTSHOIMu9eyhsIWR7+fOpm5mMPd6FvTMeNsip9iQPbG4rLQscN+vWNOXt+BY18MFIRJfjVM7XckGtHyjvl8lsGXWA7v5v+Wf7IuPIYERXHuNt5Ryd2SDsYaqlf4XZHy1hw3A4YQrVyiwmPhRKIf1ko9tsmT0/S/0eCr7EorbZnSAHvpDIlJVZ4hyyMe86qroO+rX8U0LXYXovZIYfFSn9CKEuEPGtI+/pJLrlHe5E49j6Jgmog+4Zc35dpOX5QH7rLxPydRMRPCW6+Iu4tsJ6sO2tfZDOeK/j9fTZXxK2C3Q== tchekda@termius"
114+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAavYBAIwKDDixRTBJbSHMpkCeN6OMfAMoypSVdYAgpY3OILAUj/HoIJp1uIiKlxJ+v4gLDPjaPWmPPiOW2O4EEiCTEV22DlhcFQZs7DY1Pf7WQnUW1g4PI35LUEWlBOghnB+D11ltU5odTBPVgu1HxNX6pbE1r2MLvox8xt+PHkqXvaPDX7QGPBuAAusK8trEUROObc6+umHPH1VeTK7H810kSGDy1JVPQgK28byh/yJcoHL53XGZ+nCYiuZVFfPmLofPP+LGzulGT2TwNcUiAA8Wv7skSNUdjzXJ4KRZlqIsYiey1vx0hq3+whfC3vLwMBvz90v0HTW+xtEnX4vqR4SeFfRaLpUXpY8rceICgo3XnBQyn/2NNpmbRIJWowK0ENA58psbxo4Z+2qa0is3XLvVc2yqcdd2dLRr+gk3qwEIRcY1m+oGw2u4kv4RkTvboVPTdQozUcTB5EfLKRPB3DnVwULIYbt3QJ5CnW+v+PqinHc2vmAeUaKOEwfufdE= tchekda@hspecter"
115+
"[email protected] AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBLM62vg0tFzObsAm+dojYFqX2yOizoprSIhoMNLJe37QV8XI8BexoYr6W3FgPEtiI5U5U1nCFtt9Pyzmjwcole0AAAAEc3NoOg== [email protected]"
116+
];
117+
};
118+
};
119+
120+
zramSwap.enable = true;
121+
}

‎mross/containers.nix

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{ pkgs, config, ... }:
2+
{
3+
users.users.tchekda.extraGroups = [ "docker" ];
4+
virtualisation = {
5+
docker = {
6+
enable = true;
7+
extraOptions = "--ipv6 --fixed-cidr-v6 2001:bc8:2e2a:1::/64";
8+
};
9+
oci-containers = {
10+
backend = "docker";
11+
containers = {
12+
flood = {
13+
image = "jesec/flood";
14+
cmd = [ "--allowedpath /srv" ];
15+
user = "995:994"; #rtorrent:media
16+
ports = [
17+
"127.0.0.1:3000:3000"
18+
];
19+
volumes = [
20+
# Do not forget to chown rtorrent:media /etc/flood
21+
"/etc/flood/config:/config"
22+
"/srv:/srv"
23+
"/run/rtorrent/rpc.sock:/run/rtorrent/rpc.sock"
24+
];
25+
environment = {
26+
HOME = "/config";
27+
};
28+
};
29+
};
30+
};
31+
};
32+
}

‎mross/ct/dn42/gre.nix

-17
This file was deleted.

‎mross/ct/dn42/peers/gre.nix

-44
This file was deleted.

‎mross/vm/deluge-auth ‎mross/deluge-auth

File renamed without changes.

‎mross/ct/dn42/bind.nix ‎mross/dn42/bind.nix

+16-16
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,13 @@
22

33
{
44
services.bind = {
5-
enable = true;
65
cacheNetworks = [
76
"127.0.0.1/32"
87
"172.20.0.0/14"
98
"fd00::/8"
109
"::1/128"
1110
];
12-
zones = {
13-
"tchekda.dn42" = {
14-
file = "/etc/zones/tchekda.dn42";
15-
master = true;
16-
};
17-
"96/29.4.20.172.in-addr.arpa" = {
18-
file = "/etc/zones/ipv4.reverse";
19-
master = true;
20-
};
21-
"1.d.e.9.b.4.e.f.4.5.d.f.ip6.arpa" = {
22-
file = "/etc/zones/ipv6.reverse";
23-
master = true;
24-
};
25-
};
11+
enable = true;
2612
extraOptions = ''
2713
empty-zones-enable no;
2814
recursion yes;
@@ -59,6 +45,20 @@
5945
forwarders { 172.20.0.53; fd42:d42:d42:54::1; };
6046
};
6147
'';
62-
48+
forward = "only";
49+
zones = {
50+
"tchekda.dn42" = {
51+
file = "/etc/zones/tchekda.dn42";
52+
master = true;
53+
};
54+
"96/29.4.20.172.in-addr.arpa" = {
55+
file = "/etc/zones/ipv4.reverse";
56+
master = true;
57+
};
58+
"1.d.e.9.b.4.e.f.4.5.d.f.ip6.arpa" = {
59+
file = "/etc/zones/ipv6.reverse";
60+
master = true;
61+
};
62+
};
6363
};
6464
}

‎mross/ct/dn42/bird.conf ‎mross/dn42/bird.conf

File renamed without changes.

‎mross/ct/dn42/bird2.nix ‎mross/dn42/bird2.nix

+3-4
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ let
1212
in
1313
{
1414

15-
imports = [ <nixos-unstable/nixos/modules/services/networking/bird-lg.nix> ];
16-
1715
systemd.timers.dn42-roa = {
1816
description = "Trigger a ROA table update";
1917

@@ -42,11 +40,12 @@ in
4240

4341
services = {
4442
bird-lg = {
45-
package = unstable.bird-lg;
43+
package = pkgs.bird-lg;
4644
proxy = {
47-
enable = true;
4845
allowedIPs = [ "172.20.4.97" "172.20.4.98" "fd54:fe4b:9ed1:1::1" "fd54:fe4b:9ed1:2::1" ];
4946
birdSocket = "/var/run/bird/bird.ctl";
47+
enable = true;
48+
listenAddress = "[fd54:fe4b:9ed1:1::1]:8000";
5049
};
5150
frontend = {
5251
enable = true;

‎mross/ct/dn42/default.nix ‎mross/dn42/default.nix

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
22
imports = [
3-
# ./wireguard.nix
3+
./wireguard.nix
44
./bird2.nix
55
./bind.nix
6-
# ./gre.nix
6+
# ./gre.nix # Doesn't work
77
];
88

99
boot.kernel.sysctl = {

0 commit comments

Comments
 (0)