Compare commits

..

49 commits

Author SHA1 Message Date
Bruno BELANYI 5563a1718f WIP: add notes for missing persistence/backup
Some checks failed
ci/woodpecker/push/check Pipeline failed
TODO:
* Look at for more inspiration https://github.com/nix-community/impermanence/pull/108
* Do home-manager
* Common files https://github.com/nix-community/impermanence/issues/10
2024-11-28 20:19:49 +00:00
Bruno BELANYI 8147670f48 nixos: services: quassel: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 5d60031018 nixos: services: pirate: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 235b7b7a02 nixos: services: monitoring: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI b5cb3ccbb7 nixos: services: nginx: persist SSL certificates 2024-11-28 20:19:49 +00:00
Bruno BELANYI 6ad3677621 nixos: services: transmission: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI dff50c1b56 nixos: services: sabnzbd: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI f5169f5fae nixos: services: rss-bridge: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 66c05a1388 nixos: services: podgrab: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 192482d816 nixos: services: nextcloud: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 28e9efd254 nixos: services: navidrome: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 88bb795cc5 nixos: services: lohr: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 7ce456d603 nixos: services: jellyfin: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 7a2c1eb473 nixos: services: indexers: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 1320cfbcb0 nixos: services: postgresql: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI d0da754a65 nixos: services: postgresql-backup: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 2fe4dc1c80 nixos: services: paperless: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI b891b6c131 nixos: services: matrix: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 04a6af9a89 nixos: services: forgejo: persist repositories 2024-11-28 20:19:49 +00:00
Bruno BELANYI d37139ee0f nixos: services: gitea: persist repositories 2024-11-28 20:19:49 +00:00
Bruno BELANYI 1510142e29 nixos: services: calibre-web: persist library 2024-11-28 20:19:49 +00:00
Bruno BELANYI 0013102716 nixos: services: blog: persist website data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 990ff82250 nixos: services: ssh-server: persist host keys 2024-11-28 20:19:49 +00:00
Bruno BELANYI b2190162c4 nixos: hardware: networking persist connections 2024-11-28 20:19:49 +00:00
Bruno BELANYI 7e568c29ce nixos: hardware: bluetooth: persist connections 2024-11-28 20:19:49 +00:00
Bruno BELANYI d0a7ec4d81 nixos: system: podman: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 828621041a nixos: system: docker: persist data 2024-11-28 20:19:49 +00:00
Bruno BELANYI 0f2109c4b0 WIP: nixos: system: add persist
This is the module that takes care of configuring impermanence at the
system level.

WIP:
    * address FIXMEs
    * activate home-manager persistence?
        * set `programs.fuse.userAllowOther = true;` ?
    * point `age` to persisted paths [1] ?
    * make sure all services and modules are persisted correctly...

[1]: b1d18d25b8
2024-11-28 20:19:22 +00:00
Bruno BELANYI 05fdbcdb76 flake: add 'impermanence' 2024-11-28 19:59:41 +00:00
Bruno BELANYI e03db8642a nixos: system: packages: remove 'wget'
All checks were successful
ci/woodpecker/push/check Pipeline was successful
2024-11-28 19:59:41 +00:00
Bruno BELANYI 9fc7d32481 home: tmux: add sloppy window switching bindings
All checks were successful
ci/woodpecker/push/check Pipeline was successful
Another set of bindings which were setup by `tmux-sensible`, that I want
to enable explicitly to avoid issues when it is disabled by default.
2024-11-28 18:39:10 +00:00
Bruno BELANYI b38658405a home: tmux: add binding to refresh configuration
Don't rely on `tmux-sensible` to set it up.
2024-11-28 18:39:09 +00:00
Bruno BELANYI da3c29bbaf home: xdg: add comment about 'tig'
To explain why I didn't modify it as part of my `$XDG_STATE_HOME`
migration in fbd3b70d61.
2024-11-28 12:07:52 +00:00
Bruno BELANYI 8b61af1ac3 home: xdg: remove 'gdb' directory
I have an actual module to configure `gdb`, and it uses
`$XDG_STATE_HOME` anyway...
2024-11-28 12:07:12 +00:00
Bruno BELANYI e8a41187e7 home: xdg: create 'HISTFILE' parent directory
In fbd3b70d61, I forgot to modify the
`.keep` file to be created in `$XDG_STATE_HOME/bash/`.
2024-11-28 12:06:03 +00:00
Bruno BELANYI 83da7ba9c8 home: tmux: explicitly disable mouse support
All checks were successful
ci/woodpecker/push/check Pipeline was successful
It's disabled by default, but make it explicit :-).
2024-11-28 11:24:34 +00:00
Bruno BELANYI f2168378fc home: direnv: lib: also watch '.python-version'
All checks were successful
ci/woodpecker/push/check Pipeline was successful
It's used by `uv` as a kind of configuration file, so watch it as well.
2024-11-27 15:12:10 +00:00
Bruno BELANYI e39fef275c nixos: services: paperless: use 'environmentFile'
All checks were successful
ci/woodpecker/push/check Pipeline was successful
That way I don't have to configure all services to make use of it.

Someday I'll find the will to add the `postgresql.service` dependency
upstream, truly removing the need to configure any service at all.
2024-11-27 12:05:41 +00:00
Bruno BELANYI fe49e47026 flake: bump inputs 2024-11-27 12:02:29 +00:00
Bruno BELANYI 6a5c4a627a nixos: services: pyload: add fail2ban jail
All checks were successful
ci/woodpecker/push/check Pipeline was successful
2024-11-20 21:06:17 +01:00
Bruno BELANYI 7f0cd6612e nixos: services: paperless: remove MKL work-around
Instead, rely on the upstream service's work-around [1].

This will reduce the amount of package builds I need to do when updating
my server...

[1]: https://github.com/NixOS/nixpkgs/pull/299008

This reverts commit e2ec4d3032.
2024-11-20 21:06:17 +01:00
Bruno BELANYI 2ffbc13513 flake: bump inputs 2024-11-20 21:06:17 +01:00
Bruno BELANYI 60050113bc nixos: services: nginx: modify example
All checks were successful
ci/woodpecker/push/check Pipeline was successful
Now that `websocketLocations` exists, it makes little sense to use
`proxyWebsockets` in an example, so use a different one.
2024-11-19 16:03:38 +00:00
Bruno BELANYI 6a1a35a384 nixos: services: migrate to 'websocketsLocations' 2024-11-19 16:03:38 +00:00
Bruno BELANYI e9d96138d5 nixos: services: nginx: add 'websocketsLocations'
This accounts for the overwhelming majority of my usage of
`extraConfig`.
2024-11-19 16:03:38 +00:00
Bruno BELANYI ae230b5df7 hosts: porthos: services: enable collabora
All checks were successful
ci/woodpecker/push/check Pipeline was successful
2024-11-19 15:58:48 +01:00
Bruno BELANYI 138d4d2bd9 nixos: services: nextcloud: add collabora
This needs to be configured through the "Nextcloud Office" app,
specifically the WOPI setting is important for security (I put both the
external IP, as well as `::1` and `127.0.0.1`).
2024-11-19 15:58:48 +01:00
Bruno BELANYI ab8a5daefe hosts: porthos: secrets: acme: use OVH API
All checks were successful
ci/woodpecker/push/check Pipeline was successful
I switched registrar, as OVH was ~4x cheaper.

This needs a small change to the module to both refer to OVH instead of
Gandi in the documentation, and make use of the correct API.

I also needed to disable the propagation check, as it looks like OVH is
slower than Gandi, and leads to spurious errors...
2024-11-14 22:19:35 +01:00
Bruno BELANYI 7b42368e2f hosts: nixos: porthos: services: remove tandoor
All checks were successful
ci/woodpecker/push/check Pipeline was successful
I fully transitioned to using Mealie instead.

This reverts commit 493636decb.
2024-11-11 11:45:11 +00:00
26 changed files with 191 additions and 101 deletions

View file

@ -94,11 +94,11 @@
]
},
"locked": {
"lastModified": 1726560853,
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
@ -136,11 +136,11 @@
]
},
"locked": {
"lastModified": 1730837930,
"narHash": "sha256-0kZL4m+bKBJUBQse0HanewWO0g8hDdCvBhudzxgehqc=",
"lastModified": 1732482255,
"narHash": "sha256-GUffLwzawz5WRVfWaWCg78n/HrBJrOG7QadFY6rtV8A=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "2f607e07f3ac7e53541120536708e824acccfaa8",
"rev": "a9953635d7f34e7358d5189751110f87e3ac17da",
"type": "github"
},
"original": {
@ -168,11 +168,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1730785428,
"narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
"lastModified": 1732521221,
"narHash": "sha256-2ThgXBUXAE1oFsVATK1ZX9IjPcS4nKFOAjhPNKuiMn0=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
"rev": "4633a7c72337ea8fd23a4f2ba3972865e3ec685d",
"type": "github"
},
"original": {
@ -184,11 +184,11 @@
},
"nur": {
"locked": {
"lastModified": 1730885145,
"narHash": "sha256-UPrBEY0No1O3ULb67xYjRh2r3u7MnZovfo1oYSPCIxI=",
"lastModified": 1732704680,
"narHash": "sha256-x3NlO2qzuobU9BrynzydX7X9oskJpysv7BI7DJ5cVSE=",
"owner": "nix-community",
"repo": "NUR",
"rev": "c0d8828600ef47d475e6ec33513bf9af6eb6b991",
"rev": "31a30f0862fd8b5f88a6597382bb09197356b19e",
"type": "github"
},
"original": {
@ -210,11 +210,11 @@
]
},
"locked": {
"lastModified": 1730814269,
"narHash": "sha256-fWPHyhYE6xvMI1eGY3pwBTq85wcy1YXqdzTZF+06nOg=",
"lastModified": 1732021966,
"narHash": "sha256-mnTbjpdqF0luOkou8ZFi2asa1N3AA2CchR/RqCNmsGE=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "d70155fdc00df4628446352fc58adc640cd705c2",
"rev": "3308484d1a443fc5bc92012435d79e80458fe43c",
"type": "github"
},
"original": {

View file

@ -1,8 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 cKojmg bQFr9oAnbo1rI/MpUV8wQz/Xj7iZY4ZU+Swf0nSIQFw
zama2XJ0gdvUlD2GHMhmZqHSxHe+dKSfXnHoWDcSw7Y
-> ssh-ed25519 jPowng gitUwSKTNKWLSxnwa185O7x/u0ul93g8wPESdZaKRk8
uvBIfAUkZp5sg6rfeEGvL5ZDV8m2uSEotW02kjPN3Hw
--- SZxe5f/CUZBvPQa2Sz/UBY3L68rMkIGGRuZPk7YE+Vg
¾r ú&…¥‹{~v?¨}=Ä
}+ ¿SQM[²]Œ±k MÒAàtŒÃmMë/£µLsü|Þ…m©CÀñiYC}ƒŽ‡çxŽ€
-> ssh-ed25519 cKojmg Ec0xt1uJTva8MxUdoTVX5m3uWaIiRlodf345FEM7Uzs
aJIneWFJPB5HVeoUGp57agXih9YeZ6xMEbyQ+zJtWQY
-> ssh-ed25519 jPowng B5XotRgv7s/FUegGhceBj7EoukewNUOIFl4TFRQf1EQ
PgGCBd/Pqwp7ayqi7okHBGF1SfFpwT4KlHJ/np6p2uQ
--- AeLgwGz6k3OABb53cXNaCU/sgI4FlU1s6p8PhAaFOlg
1ÌÉCÔ¹ð¤ŽULfI1¸Hm»Ûòb}m” ÁÅ¡ìg•ß0¦¢–¤`X<16>G>\>¹8rŽz+ŠY ™¼`—Ê¢.JBUÏ!z¸Z50ú*õ¡ÙŸ¤×ÖÇ®I<C2AE>ôÔ]¹Ïå I
ĵ<18>¿oÒÛ°…g„®„ÒêÁ³Â¿Ÿt©nƒºãcz[»{
jçå&ÁõõNæ°Nÿo{õš½‚ -eP¾=L‰™ 6¦.SP:»e¶

View file

@ -95,6 +95,9 @@ in
nextcloud = {
enable = true;
passwordFile = secrets."nextcloud/password".path;
collabora = {
enable = true;
};
};
nix-cache = {
enable = true;
@ -149,11 +152,6 @@ in
};
# Because I still need to play sysadmin
ssh-server.enable = true;
# Recipe manager
tandoor-recipes = {
enable = true;
secretKeyFile = secrets."tandoor-recipes/secret-key".path;
};
# Torrent client and webui
transmission = {
enable = true;

View file

@ -53,4 +53,5 @@ layout_uv() {
PATH_add "$VIRTUAL_ENV/bin"
watch_file pyproject.toml
watch_file uv.lock
watch_file .python-version
}

View file

@ -47,6 +47,7 @@ in
clock24 = true; # I'm one of those heathens
escapeTime = 0; # Let vim do its thing instead
historyLimit = 100000; # Bigger buffer
mouse = false; # I dislike mouse support
terminal = "tmux-256color"; # I want accurate termcap info
plugins = with pkgs.tmuxPlugins; [
@ -80,6 +81,13 @@ in
];
extraConfig = ''
# Refresh configuration
bind-key -N "Source tmux.conf" R source-file ${config.xdg.configHome}/tmux/tmux.conf \; display-message "Sourced tmux.conf!"
# Accept sloppy Ctrl key when switching windows, on top of default mapping
bind-key -N "Select the previous window" C-p previous-window
bind-key -N "Select the next window" C-n next -window
# Better vim mode
bind-key -T copy-mode-vi 'v' send -X begin-selection
${

View file

@ -30,11 +30,10 @@ in
};
# A tidy home is a tidy mind
dataFile = {
"bash/.keep".text = "";
"gdb/.keep".text = "";
"tig/.keep".text = "";
"tig/.keep".text = ""; # `tig` uses `XDG_DATA_HOME` specifically...
};
stateFile = {
"bash/.keep".text = "";
"python/.keep".text = "";
};
};

View file

@ -65,9 +65,7 @@ in
aria-rpc = {
port = cfg.rpcPort;
# Proxy websockets for RPC
extraConfig = {
locations."/".proxyWebsockets = true;
};
websocketsLocations = [ "/" ];
};
};

View file

@ -30,9 +30,7 @@ in
audiobookshelf = {
inherit (cfg) port;
# Proxy websockets for RPC
extraConfig = {
locations."/".proxyWebsockets = true;
};
websocketsLocations = [ "/" ];
};
};

View file

@ -39,5 +39,7 @@ in
extraGroups = [ "docker" ]; # Give access to the daemon
};
users.groups.drone-runner-docker = { };
# FIXME: persistence?
};
}

View file

@ -63,5 +63,7 @@ in
group = "drone-runner-exec";
};
users.groups.drone-runner-exec = { };
# FIXME: persistence?
};
}

View file

@ -50,5 +50,7 @@ in
inherit (cfg) port;
};
};
# FIXME: persistence?
};
}

View file

@ -33,5 +33,7 @@ in
bantime = "10m";
};
};
# FIXME: persistence?
};
}

View file

@ -148,8 +148,8 @@ in
};
my.system.persist.directories = [
config.services.gitea.lfs.contentDir
config.services.gitea.repositoryRoot
config.services.forgejo.lfs.contentDir
config.services.forgejo.repositoryRoot
];
services.fail2ban.jails = {

View file

@ -27,17 +27,13 @@ in
my.services.nginx.virtualHosts = {
jellyfin = {
port = 8096;
websocketsLocations = [ "/socket" ];
extraConfig = {
locations."/" = {
extraConfig = ''
proxy_buffering off;
'';
};
# Too bad for the repetition...
locations."/socket" = {
proxyPass = "http://127.0.0.1:8096/";
proxyWebsockets = true;
};
};
};
};

View file

@ -36,6 +36,8 @@ in
};
};
# FIXME: persistence?
services.fail2ban.jails = {
komga = ''
enabled = true

View file

@ -0,0 +1,52 @@
# Document editor with Nextcloud
{ config, lib, ... }:
let
cfg = config.my.services.nextcloud.collabora;
in
{
options.my.services.nextcloud.collabora = with lib; {
enable = mkEnableOption "Collabora integration";
port = mkOption {
type = types.port;
default = 9980;
example = 8080;
description = "Internal port for API";
};
};
config = lib.mkIf cfg.enable {
services.collabora-online = {
enable = true;
inherit (cfg) port;
aliasGroups = [
{
host = "https://collabora.${config.networking.domain}";
# Allow using from nextcloud
aliases = [ "https://${config.services.nextcloud.hostName}" ];
}
];
settings = {
# Rely on reverse proxy for SSL
ssl = {
enable = false;
termination = true;
};
};
};
my.services.nginx.virtualHosts = {
collabora = {
inherit (cfg) port;
websocketsLocations = [
"~ ^/cool/(.*)/ws$"
"^~ /cool/adminws"
];
};
};
# FIXME: persistence?
};
}

View file

@ -4,6 +4,10 @@ let
cfg = config.my.services.nextcloud;
in
{
imports = [
./collabora.nix
];
options.my.services.nextcloud = with lib; {
enable = mkEnableOption "Nextcloud";
maxSize = mkOption {

View file

@ -17,6 +17,16 @@ let
'';
};
websocketsLocations = mkOption {
type = with types; listOf str;
default = [ ];
example = [ "/socket" ];
description = ''
Which locations on this virtual host should be configured for
websockets.
'';
};
port = mkOption {
type = with types; nullOr port;
default = null;
@ -60,10 +70,13 @@ let
extraConfig = mkOption {
type = types.attrs; # FIXME: forward type of virtualHosts
example = {
locations."/socket" = {
proxyPass = "http://127.0.0.1:8096/";
proxyWebsockets = true;
};
extraConfig = ''
add_header X-Clacks-Overhead "GNU Terry Pratchett";
'';
locations."/".extraConfig = ''
client_max_body_size 1G;
'';
};
default = { };
description = ''
@ -86,7 +99,7 @@ in
type = types.str;
example = "/var/lib/acme/creds.env";
description = ''
Gandi API key file as an 'EnvironmentFile' (see `systemd.exec(5)`)
OVH API key file as an 'EnvironmentFile' (see `systemd.exec(5)`)
'';
};
};
@ -108,12 +121,7 @@ in
};
jellyfin = {
port = 8096;
extraConfig = {
locations."/socket" = {
proxyPass = "http://127.0.0.1:8096/";
proxyWebsockets = true;
};
};
websocketsLocations = [ "/socket" ];
};
};
description = ''
@ -195,6 +203,19 @@ in
} configured.
'';
}))
++ (lib.flip lib.mapAttrsToList cfg.virtualHosts (_: { subdomain, ... } @ args:
let
proxyPass = [ "port" "socket" ];
proxyPassUsed = lib.any (v: args.${v} != null) proxyPass;
in
{
assertion = args.websocketsLocations != [ ] -> proxyPassUsed;
message = ''
Subdomain '${subdomain}' can only use 'websocketsLocations' with one of ${
lib.concatStringsSep ", " (builtins.map (v: "'${v}'") proxyPass)
}.
'';
}))
++ (
let
ports = lib.my.mapFilter
@ -241,6 +262,14 @@ in
virtualHosts =
let
domain = config.networking.domain;
mkProxyPass = { websocketsLocations, ... }: proxyPass:
let
websockets = lib.genAttrs websocketsLocations (_: {
inherit proxyPass;
proxyWebsockets = true;
});
in
{ "/" = { inherit proxyPass; }; } // websockets;
mkVHost = ({ subdomain, ... } @ args: lib.nameValuePair
"${subdomain}.${domain}"
(lib.my.recursiveMerge [
@ -251,8 +280,7 @@ in
}
# Proxy to port
(lib.optionalAttrs (args.port != null) {
locations."/".proxyPass =
"http://127.0.0.1:${toString args.port}";
locations = mkProxyPass args "http://127.0.0.1:${toString args.port}";
})
# Serve filesystem content
(lib.optionalAttrs (args.root != null) {
@ -260,8 +288,7 @@ in
})
# Serve to UNIX socket
(lib.optionalAttrs (args.socket != null) {
locations."/".proxyPass =
"http://unix:${args.socket}";
locations = mkProxyPass args "http://unix:${args.socket}";
})
# Redirect to a different domain
(lib.optionalAttrs (args.redirect != null) {
@ -281,6 +308,7 @@ in
locations."/" = {
extraConfig =
# FIXME: check that X-User is dropped otherwise
(args.extraConfig.locations."/".extraConfig or "") + ''
# Use SSO
auth_request /sso-auth;
@ -414,7 +442,8 @@ in
{
"${domain}" = {
extraDomainNames = [ "*.${domain}" ];
dnsProvider = "gandiv5";
dnsProvider = "ovh";
dnsPropagationCheck = false; # OVH is slow
inherit (cfg.acme) credentialsFile;
};
};

View file

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }:
{ config, lib, ... }:
let
cfg = config.my.services.paperless;
in
@ -80,50 +80,34 @@ in
# Misc
PAPERLESS_TIME_ZONE = config.time.timeZone;
PAPERLESS_ADMIN_USER = cfg.username;
# Fix classifier hangs
LD_LIBRARY_PATH = "${lib.getLib pkgs.mkl}/lib";
};
# Admin password
passwordFile = cfg.passwordFile;
# Secret key
environmentFile = cfg.secretKeyFile;
};
systemd.services = {
paperless-scheduler = {
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
serviceConfig = {
EnvironmentFile = cfg.secretKeyFile;
};
};
paperless-consumer = {
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
serviceConfig = {
EnvironmentFile = cfg.secretKeyFile;
};
};
paperless-web = {
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
serviceConfig = {
EnvironmentFile = cfg.secretKeyFile;
};
};
paperless-task-queue = {
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
serviceConfig = {
EnvironmentFile = cfg.secretKeyFile;
};
};
};
@ -152,11 +136,7 @@ in
sso = {
enable = true;
};
# Enable websockets on root
extraConfig = {
locations."/".proxyWebsockets = true;
};
websocketsLocations = [ "/" ];
};
};

View file

@ -54,6 +54,8 @@ in
};
};
# FIXME: persistence?
services.fail2ban.jails = {
stirling-pdf = ''
enabled = true

View file

@ -56,6 +56,20 @@ in
# FIXME: backup
# FIXME: persistence
# FIXME: fail2ban
services.fail2ban.jails = {
pyload = ''
enabled = true
filter = pyload
port = http,https
'';
};
environment.etc = {
"fail2ban/filter.d/pyload.conf".text = ''
[Definition]
failregex = ^.*Login failed for user '<F-USER>.*</F-USER>' \[CLIENT: <HOST>\]$
journalmatch = _SYSTEMD_UNIT=pyload.service
'';
};
};
}

View file

@ -21,12 +21,11 @@ in
};
# Persist SSH keys
my.system.persist.files = [
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/ssh/ssh_host_rsa_key"
"/etc/ssh/ssh_host_rsa_key.pub"
];
my.system.persist.files =
let
pubAndPrivKey = key: [ key.path "${key.path}.pub" ];
in
lib.concatMap pubAndPrivKey systemConfig.services.openssh.hostKeys;
# Opens the relevant UDP ports.
programs.mosh.enable = true;

View file

@ -38,5 +38,7 @@ in
];
};
};
# FIXME: persistence?
};
}

View file

@ -62,5 +62,7 @@ in
];
};
};
# FIXME: persistence?
};
}

View file

@ -1,5 +1,5 @@
# Common packages
{ config, lib, pkgs, ... }:
{ config, lib, ... }:
let
cfg = config.my.system.packages;
in
@ -13,10 +13,6 @@ in
};
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; [
wget
];
programs = {
vim = {
enable = true;

View file

@ -47,16 +47,17 @@ in
config = lib.mkIf cfg.enable {
environment.persistence."${cfg.mountPoint}" = {
files = [
"/etc/machine-id"
"/etc/machine-id" # Machine-specific ID
"/etc/adjtime" # Clock drift factor and offsets
]
++ cfg.files
;
directories = [
"/etc/nixos"
"/var/log"
"/var/lib/nixos"
"/var/lib/systemd/coredump"
"/etc/nixos" # In case it's storage directory of our configuration
"/var/log" # Logs
"/var/lib/nixos" # UID/GID maps
"/var/lib/systemd/coredump" # Coredumps
]
++ cfg.directories
;