lbailly/config-perso
1
0
Fork 0
Code Pull requests Projects Releases Packages Activity

not oob anymore

Browse source
This commit is contained in:
catvayor 2024-06-27 18:39:21 +02:00
parent fb8f156a81
commit b4afbf74e5
5 changed files with 102 additions and 187 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

155
machines/kat-manah/default.nix
View file

@ -1,5 +1,3 @@
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{
config,
lib,
@ -10,7 +8,6 @@
{
imports = [
./hardware-configuration.nix
./router.nix
];
boot.loader.systemd-boot.enable = true;
@ -18,62 +15,18 @@
boot.supportedFilesystems = [ "bcachefs" ];
boot.kernelPackages = pkgs.linuxPackages_latest;
# networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
time.timeZone = "Europe/Paris";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "fr";
};
# Enable the X11 windowing system.
# services.xserver.enable = true;
# security.polkit.enable = true;
# programs.light.enable = true;
services.dbus.packages = with pkgs; [ dconf ];
nixpkgs.config.allowUnfree = true;
# Configure keymap in X11
# services.xserver.xkb.layout = "us";
# services.xserver.xkb.options = "eurosign:e,caps:escape";
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable touchpad support (enabled default in most desktopManager).
# services.xserver.libinput.enable = true;
# Define a user account. Don't forget to set a password with ‘passwd’.
programs.zsh.enable = true;
users.users.guest = {
isNormalUser = true;
# extraGroups = [ "wheel" ];
packages = with pkgs; [ ];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor"
# maurice
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris"
# raito
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU"
# tomate
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn"
];
};
environment.systemPackages = with pkgs; [
wget
@ -86,17 +39,11 @@
screen
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
};
# List services that you want to enable:
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.netbird.enable = true;
@ -138,27 +85,66 @@
in
{
enable = true;
virtualHosts = builtins.mapAttrs (
_:
{ vm, ... }:
virtualHosts =
let
manah-webroot = pkgs.runCommand "manah" { } ''
mkdir -p $out/.kat-manah/
ln -nsf ${./error} $out/.kat-manah/error
'';
in
{
enableACME = true;
addSSL = true;
acmeFallbackHost = vm;
acmeFallbackRecommendedProxySettings = true;
locations."/" = {
recommendedProxySettings = true;
proxyPass = "https://${vm}/";
extraConfig = ''
proxy_set_header Connection ''';
proxy_http_version 1.1;
chunked_transfer_encoding off;
proxy_buffering off;
proxy_cache off;
'';
"manah.katvayor.net" = {
default = true;
enableACME = true;
addSSL = true;
locations = {
"/.kat-manah" = {
extraConfig = ''
internal;
error_page 404 =418 /.kat-manah/error/418.html;
'';
root = manah-webroot;
};
"/" = {
extraConfig = ''
return 418;
error_page 418 =418 /.kat-manah/error/418.html;
'';
};
};
};
}
) vhosts;
// builtins.mapAttrs (
_:
{ vm, ... }:
{
enableACME = true;
addSSL = true;
acmeFallbackHost = vm;
acmeFallbackRecommendedProxySettings = true;
locations = {
"/.kat-manah" = {
extraConfig = ''
internal;
error_page 404 =418 /.kat-manah/error/418.html;
'';
root = manah-webroot;
};
"/" = {
recommendedProxySettings = true;
proxyPass = "https://${vm}/";
extraConfig = ''
proxy_set_header Connection ''';
proxy_http_version 1.1;
chunked_transfer_encoding off;
proxy_buffering off;
proxy_cache off;
error_page 502 =599 "/.kat-manah/error/599.html";
'';
};
};
}
) vhosts;
streamConfig =
builtins.concatStringsSep "\n" (
lib.mapAttrsToList (
@ -184,7 +170,6 @@
'';
};
# Open ports in the firewall.
networking.firewall = {
allowedTCPPorts = [
22
@ -202,29 +187,5 @@
];
allowedUDPPorts = [ 67 ];
};
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "23.11"; # Did you read the comment?
system.stateVersion = "23.11";
}

20
machines/kat-manah/error/418.html Normal file
View file

@ -0,0 +1,20 @@
<!DOCTYPE html>
<html lang="fr">
<head>
<meta charset="utf-8">
<meta name="color-scheme" content="light dark">
<title>418 I’m a teapot</title>
</head>
<body align="center">
<div role="main" align="center">
<h1>418 I’m a teapot</h1>
<img src="https://http.cat/418.jpg"/>
<hr />
</div>
<div role="contentinfo" align="center">
<small>Crédit à <a href="https://http.cat">http.cat</a> pour l'image.</small>
<br/>
<small>Error in manah.</small>
</div>
</body>
</html>

21
machines/kat-manah/error/599.html Normal file
View file

@ -0,0 +1,21 @@
<!DOCTYPE html>
<html lang="fr">
<head>
<meta charset="utf-8">
<meta name="color-scheme" content="light dark">
<title>599 Network Connect Timeout Error</title>
</head>
<body align="center">
<div role="main" align="center">
<h1>599 Network Connect Timeout Error</h1>
<img src="https://http.cat/599.jpg"/>
<p>Le contact avec la vm n'a pas pu se faire.</p>
<hr />
</div>
<div role="contentinfo" align="center">
<small>Crédit à <a href="https://http.cat">http.cat</a> pour l'image.</small>
<br/>
<small>Error in manah.</small>
</div>
</body>
</html>

89
machines/kat-manah/router.nix
View file

@ -1,89 +0,0 @@
{
config,
lib,
pkgs,
...
}:
{
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
# networking.nat = {
# enable = true;
# internalInterfaces = [ "vlan-thurne" ];
# externalInterface = "enp1s0";
# };
# networking.interfaces.enp2s0 = {
# useDHCP = false;
# ipv4.addresses = [
# {
# address = "192.168.42.1";
# prefixLength = 24;
# }
# ];
# };
# networking.useDHCP = false;
networking.interfaces.enp3s0.useDHCP = lib.mkForce false;
networking.interfaces.enp2s0.useDHCP = lib.mkForce false;
networking.interfaces.enp1s0.useDHCP = lib.mkForce true;
networking.useNetworkd = true;
# services.dnsmasq = {
# enable = true;
# settings = {
# interface = [ "vlan-admin" ];
# bind-dynamic = true;
# dhcp-option = "3,0.0.0.0";
# dhcp-range = "192.168.222.100,192.168.222.254,255.255.255.0,infinite";
# };
# };
systemd.network = {
enable = true;
networks = {
"10-enp3s0" = {
name = "enp3s0";
networkConfig = {
VLAN = [
"vlan-admin"
"vlan-user-test"
];
LinkLocalAddressing = false;
LLDP = false;
EmitLLDP = false;
IPv6AcceptRA = false;
IPv6SendRA = false;
};
};
"10-vlan-admin" = {
name = "vlan-admin";
address = [
"fd26:baf9:d250:8000::ffff/64"
"192.168.222.1/24"
];
};
"10-vlan-user-test" = {
name = "vlan-user-test";
networkConfig.DHCP = "ipv4";
dhcpV4Config.RouteMetric = 10000;
};
};
netdevs = {
"10-vlan-admin" = {
netdevConfig = {
Name = "vlan-admin";
Kind = "vlan";
};
vlanConfig.Id = 3000;
};
"10-vlan-user-test" = {
netdevConfig = {
Name = "vlan-user-test";
Kind = "vlan";
};
vlanConfig.Id = 4000;
};
};
};
}

4
machines/kat-watcher/default.nix
View file

@ -62,6 +62,7 @@
let
kat-r86s = "100.102.49.84";
vhosts = {
"manah.katvayor.net" = null;
"degette.katvayor.net" = 22000;
"traque.katvayor.net" = 22001;
"betamail.katvayor.net" = 22002;
@ -80,8 +81,9 @@
in
{
"watcher.katvayor.net" = {
default = true;
enableACME = true;
forceSSL = true;
addSSL = true;
locations = {
"/.kat-watcher" = {
extraConfig = ''