peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

removed giugl.io name from services. added encryption to telegram, support for proxy

Browse Source
This commit is contained in:
Giulio De Pasquale 2021-10-11 11:31:21 +02:00
parent d4844525c5
commit bdebb2c35a
16 changed files with 43 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/architect/bazarr.nix
View File

@ -18,7 +18,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${bazarrdomain}
${architect-lan} ${bazarrdomain}
${architect-wg} ${bazarrdomain}
'';

14
hosts/architect/default.nix
View File

@ -27,7 +27,7 @@ in
./fail2ban.nix
./dns.nix
./minecraft.nix
./prowlarr.nix
# ./prowlarr.nix
./plex.nix
];
@ -87,18 +87,17 @@ in
wlp4s0.useDHCP = false;
};
extraHosts = ''
127.0.0.1 ${hostname}.devs.giugl.io giugl.io localhost
127.0.0.1 ${hostname}.devs.giugl.io localhost
# LAN
${architect-lan} ${hostname}.devs.giugl.io giugl.io
${architect-lan} ${hostname}.devs.giugl.io
10.0.0.1 router.devs.giugl.io
${dvr-lan} dvr.devs.giugl.io
${nas-lan} nas.devs.giugl.io
${giupi-lan} giupi.devs.giugl.io
# Wireguard hosts
${architect-wg} ${hostname}.devs.giugl.io giugl.io
${architect-wg} ${hostname}.devs.giugl.io
${galuminum-wg} galuminum.devs.giugl.io
${oneplus-wg} oneplus.devs.giugl.io
${ipad-wg} ipad.devs.giugl.io
@ -143,11 +142,6 @@ in
0.0.0.0 analytics.oneplus.cn
0.0.0.0 click.oneplus.cn
0.0.0.0 analytics-api.samsunghealthcn.com
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
'';
};

1
hosts/architect/dns.nix
View File

@ -16,6 +16,7 @@
enable= true;
port = 3031;
};
dnscrypt-proxy2 = {
enable = true;
settings = {

2
hosts/architect/firewall.nix
View File

@ -61,6 +61,7 @@ in {
iifname ${wan-if} ip saddr ${vpn-net} drop comment "bind any ip to intf ${wan-if}"
iifname ${wan-if} ip saddr 127.0.0.0/8 drop comment "bind any ip to intf ${wan-if}"
iifname ${wan-if} accept comment "bind any ip to intf ${wan-if}"
iifname ${proxy-if} ip saddr ${proxy-net} accept comment "bind ip ${proxy-net} to intf ${proxy-if}"
iifname ${vpn-if} ip saddr ${vpn-net} accept comment "bind ip ${vpn-net} to intf ${vpn-if}"
iifname "lo" accept comment "bind any ip to intf lo"
jump mangle_drop
@ -115,6 +116,7 @@ in {
ip daddr 255.255.255.255 accept comment "allow broadcast traffic"
ip daddr 224.0.0.0/4 accept comment "allow multicast traffic"
ip saddr ${lan-net} accept comment "lan > local"
ip saddr ${proxy-wg} accept comment "proxy > local"
iifname ${wan-if} tcp dport {${open_tcp_ports}} accept
iifname ${wan-if} udp dport {${open_udp_ports}} accept

2
hosts/architect/gitea.nix
View File

@ -20,13 +20,13 @@ with import ./network.nix;
allow 127.0.0.1;
allow 10.0.0.0/24;
allow 10.3.0.0/24;
allow 10.4.0.0/24;
deny all;
'';
};
};
networking.extraHosts = ''
127.0.0.1 ${gitdomain}
${architect-lan} ${gitdomain}
${architect-wg} ${gitdomain}
'';

6
hosts/architect/jellyfin.nix
View File

@ -8,7 +8,10 @@ with import ./network.nix;
];
services = {
jellyfin.enable = true;
jellyfin = {
enable = true;
package = pkgs.unstable.jellyfin;
};
nginx.virtualHosts.${mediadomain} = {
forceSSL = true;
@ -25,7 +28,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${mediadomain}
${architect-lan} ${mediadomain}
${architect-wg} ${mediadomain}
'';

15
hosts/architect/matrix.nix
View File

@ -10,7 +10,7 @@ with import ./network.nix;
public_baseurl = "https://${matrixdomain}";
registration_shared_secret = "runas!";
dynamic_thumbnails = true;
#enable_registration = true;
# enable_registration = true;
app_service_config_files = [
"/var/lib/matrix-synapse/discord-registration.yaml"
"/var/lib/matrix-synapse/telegram-registration.yaml"
@ -37,6 +37,12 @@ with import ./network.nix;
];
}
];
turn_uris = [
"turns:turn.giugl.io:5349?transport=udp"
"turns:turn.giugl.io:5349?transport=tcp"
];
turn_shared_secret = "69duck duck fuck420";
turn_user_lifetime = "1h";
};
postgresql = {
@ -159,6 +165,11 @@ with import ./network.nix;
background = "020202"; # only for gif, transparency not supported
};
};
encryption = {
allow = true;
default = true;
};
};
};
};
@ -171,10 +182,8 @@ systemd.services.mautrix-telegram.path = with pkgs; [
];
networking.extraHosts = ''
127.0.0.1 ${matrixdomain} ${matrixwebdomain}
${architect-lan} ${matrixdomain} ${matrixwebdomain}
${architect-wg} ${matrixdomain} ${matrixwebdomain}
'';
users.groups.acme.members = [ "turnserver" ];
}

1
hosts/architect/minio.nix
View File

@ -18,7 +18,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${miniodomain}
${architect-lan} ${miniodomain}
${architect-wg} ${miniodomain}
'';

6
hosts/architect/network.nix
View File

@ -2,10 +2,12 @@ rec {
# interfaces
wan-if = "enp5s0";
vpn-if = "wg0";
proxy-if = "proxy";
# nets
lan-net = "10.0.0.0/24";
vpn-net = "10.3.0.0/24";
proxy-net = "10.4.0.0/24";
external_lan-net = "192.168.1.0/24";
# ips
@ -13,7 +15,8 @@ rec {
nas-lan = "10.0.0.3";
architect-lan = "10.0.0.250";
giupi-lan = "10.0.0.251";
proxy-wg = "10.4.0.1";
architect-wg = "10.3.0.1";
galuminum-wg = "10.3.0.2";
oneplus-wg = "10.3.0.3";
@ -63,4 +66,5 @@ rec {
matrixdomain = "matrix.giugl.io";
matrixwebdomain = "chat.giugl.io";
prowlarrdomain = "htpro.giugl.io";
jupyterdomain = "labs.giugl.io";
}

1
hosts/architect/nextcloud.nix
View File

@ -40,7 +40,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${clouddomain}
${architect-lan} ${clouddomain}
${architect-wg} ${clouddomain}
'';

1
hosts/architect/nzbget.nix
View File

@ -18,7 +18,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${nzbgetdomain}
${architect-lan} ${nzbgetdomain}
${architect-wg} ${nzbgetdomain}
'';

1
hosts/architect/plex.nix
View File

@ -78,7 +78,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${mediadomain}
${architect-lan} ${mediadomain}
${architect-wg} ${mediadomain}
'';

1
hosts/architect/prowlarr.nix
View File

@ -26,7 +26,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${prowlarrdomain}
${architect-lan} ${prowlarrdomain}
${architect-wg} ${prowlarrdomain}
'';

1
hosts/architect/radarr.nix
View File

@ -18,7 +18,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${radarrdomain}
${architect-lan} ${radarrdomain}
${architect-wg} ${radarrdomain}
'';

1
hosts/architect/sonarr.nix
View File

@ -18,7 +18,6 @@ with import ./network.nix;
};
networking.extraHosts = ''
127.0.0.1 ${sonarrdomain}
${architect-lan} ${sonarrdomain}
${architect-wg} ${sonarrdomain}
'';

15
hosts/architect/wireguard.nix
View File

@ -1,6 +1,19 @@
with import ./network.nix;
{
networking.wireguard = {
interfaces.${proxy-if} = {
ips = ["10.4.0.2/32"];
privateKeyFile = "/secrets/wireguard/proxy.key";
peers = [
{
publicKey = "WmJBpXpYebcmJEF8nVTKMqQK01KyBe42vzc38K66rVs=";
allowedIPs = ["10.4.0.1/32"];
endpoint = "giugl.io:1195";
persistentKeepalive = 21;
}
];
};
interfaces.${vpn-if} = {
listenPort = 1194;
ips = ["10.3.0.1/24"];
@ -140,7 +153,7 @@ with import ./network.nix;
{
# defy
allowedIPs = [defy-wg];
publicKey = "wEkDNap9/qmkGd0a0PN8ANHgXgxwp+ZdmDW1CmIl4kM=";
publicKey = "Cvi/eto7E6Ef+aiL81ou7x12fJCeuXrf/go9fxEqXG4=";
}
{