Compare commits

...

8 Commits

Author SHA1 Message Date
Giulio De Pasquale
34b49b03ec Merge branch 'master' of https://git.giugl.io/peperunas/nixos 2021-08-23 20:03:32 +02:00
Giulio De Pasquale
6ad76759e5 minecraft 2021-08-23 20:02:45 +02:00
Giulio De Pasquale
1fa35228b0 default rooms for matrix, fixed dns entries 2021-08-23 20:02:08 +02:00
Giulio De Pasquale
e250f4a1e1 adblocking 2021-08-23 20:01:35 +02:00
Giulio De Pasquale
3b740547c4 tab to 2 spaces 2021-08-23 20:00:19 +02:00
Giulio De Pasquale
8597d6445f 404 page 2021-08-09 17:39:45 +02:00
Giulio De Pasquale
b857aac01a added plex 2021-08-09 17:39:27 +02:00
Giulio De Pasquale
d6ea108e93 added dodino and tommy to wg 2021-08-09 17:39:16 +02:00
10 changed files with 225 additions and 39 deletions

View File

@ -64,7 +64,7 @@
" Fix for code not being aligned if between comment blocks " Fix for code not being aligned if between comment blocks
set cindent cinkeys-=0# set cindent cinkeys-=0#
set expandtab shiftwidth=4 tabstop=4 softtabstop=4 set expandtab shiftwidth=2 tabstop=2 softtabstop=2
''; '';
viAlias = true; viAlias = true;

View File

@ -26,6 +26,8 @@ in
./matrix.nix ./matrix.nix
./fail2ban.nix ./fail2ban.nix
./plex.nix ./plex.nix
./dns.nix
./minecraft.nix
]; ];
time.timeZone = "Europe/Rome"; time.timeZone = "Europe/Rome";
@ -117,6 +119,8 @@ in
${papa-wg} papa.devs.giugl.io ${papa-wg} papa.devs.giugl.io
${defy-wg} defy.devs.giugl.io ${defy-wg} defy.devs.giugl.io
${germano-wg} germano.devs.giugl.io ${germano-wg} germano.devs.giugl.io
${dodino-wg} dodino.devs.giugl.io
${tommy-wg} tommy.devs.giugl.io
# Blacklist # Blacklist
0.0.0.0 metrics.plex.tv 0.0.0.0 metrics.plex.tv
@ -145,7 +149,6 @@ in
environment.systemPackages = with pkgs; environment.systemPackages = with pkgs;
[ [
openiscsi
wireguard wireguard
cudatoolkit cudatoolkit
]; ];
@ -161,37 +164,6 @@ in
zfs.autoScrub.enable = true; zfs.autoScrub.enable = true;
xserver.videoDrivers = [ "nvidia" ]; xserver.videoDrivers = [ "nvidia" ];
openssh.enable = true; openssh.enable = true;
dnsmasq = {
enable = true;
servers = ["127.0.0.1#5353"];
extraConfig = ''
localise-queries
min-cache-ttl=120
max-cache-ttl=2400
'';
};
dnscrypt-proxy2 = {
enable = true;
settings = {
listen_addresses = ["127.0.0.1:5353"];
ipv4_servers = true;
ipv6_servers = false;
block_ipv6 = true;
dnscrypt_servers = true;
doh_servers = true;
require_nolog = true;
require_nofilter = true;
timeout = 350;
lb_strategy = "p4";
lb_estimator = true;
ignore_system_dns = true;
fallback_resolvers = ["1.1.1.1:53" "9.9.9.9:53"];
cache_min_ttl = 450;
cache_max_ttl = 2400;
};
};
}; };
environment.variables = { environment.variables = {

106
hosts/architect/dns.nix Normal file
View File

@ -0,0 +1,106 @@
{ config, pkgs, lib, ... }:
{
services = {
dnsmasq = {
enable = true;
servers = ["127.0.0.1#5353"];
extraConfig = ''
localise-queries
min-cache-ttl=120
max-cache-ttl=2400
addn-hosts=/etc/adblock_hosts
'';
};
dnscrypt-proxy2 = {
enable = true;
settings = {
listen_addresses = ["127.0.0.1:5353"];
ipv4_servers = true;
ipv6_servers = false;
block_ipv6 = true;
dnscrypt_servers = true;
doh_servers = true;
require_nolog = true;
require_nofilter = true;
timeout = 350;
lb_strategy = "p4";
lb_estimator = true;
ignore_system_dns = true;
fallback_resolvers = ["1.1.1.1:53" "9.9.9.9:53"];
cache_min_ttl = 450;
cache_max_ttl = 2400;
};
};
};
systemd = {
timers.update-adblock = {
wantedBy = [ "timers.target" ];
partOf = [ "update-adblock.service" ];
timerConfig.OnCalendar = "daily";
};
services.update-adblock = {
serviceConfig.Type = "oneshot";
requiredBy = [ "dnsmasq.service" ];
postStop = "systemctl restart dnsmasq";
script = ''
#!/bin/sh
EASYLIST_HOSTSNAME="easylist_hosts.txt"
EASYPRIVACY_HOSTSNAME="easyprivacy_hosts.txt"
STEVENBLACK_HOSTSNAME="stevenblack_hosts.txt"
get_easylist() {
EASYLIST_URL="https://raw.githubusercontent.com/easylist/easylist/master/easylist/easylist_adservers.txt"
tmpfile=`mktemp`
# download easylist
${pkgs.wget}/bin/wget $EASYLIST_URL -O $tmpfile
# remove IP addresses and prepend 0.0.0.0 to create hosts file
cat $tmpfile | egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -oP "^\|\|(\K[a-zA-Z0-9\.\-]+)" | ${pkgs.gawk}/bin/gawk '{print "0.0.0.0 " $0}' > $EASYLIST_HOSTSNAME
rm $tmpfile
}
get_easyprivacy() {
EASYLIST_URL="https://raw.githubusercontent.com/easylist/easylist/master/easyprivacy/easyprivacy_trackingservers.txt"
tmpfile=`mktemp`
# download easylist
${pkgs.wget}/bin/wget $EASYLIST_URL -O $tmpfile
# remove IP addresses and prepend 0.0.0.0 to create hosts file
cat $tmpfile | egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -oP "^\|\|(\K[a-zA-Z0-9\.\-]+)" | ${pkgs.gawk}/bin/gawk '{print "0.0.0.0 " $0}' > $EASYPRIVACY_HOSTSNAME
rm $tmpfile
}
get_stevenblack() {
STEVENBLACK_URL="https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews/hosts"
${pkgs.wget}/bin/wget $STEVENBLACK_URL -O $STEVENBLACK_HOSTSNAME
}
get_easylist
get_easyprivacy
get_stevenblack
# create unified file
cat *hosts.txt | sort | uniq | grep "^0" > /etc/adblock_hosts
rm $EASYLIST_HOSTSNAME $STEVENBLACK_HOSTSNAME $EASYPRIVACY_HOSTSNAME
'';
};
};
}

View File

@ -14,8 +14,10 @@ with import ./network.nix;
app_service_config_files = [ "/var/lib/matrix-synapse/discord-registration.yaml" ]; app_service_config_files = [ "/var/lib/matrix-synapse/discord-registration.yaml" ];
extraConfig = '' extraConfig = ''
auto_join_rooms: auto_join_rooms:
- "#infrastruttura:matrix.giugl.io" - "#infra:matrix.giugl.io"
- "#general:matrix.giugl.io" - "#general:matrix.giugl.io"
- "#gaming:matrix.giugl.io"
- "#movies:matrix.giugl.io"
''; '';
listeners = [ listeners = [
{ {
@ -104,11 +106,10 @@ with import ./network.nix;
}; };
networking.extraHosts = '' networking.extraHosts = ''
127.0.0.1 ${matrixdomain} 127.0.0.1 ${matrixdomain} ${matrixwebdomain}
${architect-lan} ${matrixdomain} ${architect-lan} ${matrixdomain} ${matrixwebdomain}
${architect-wg} ${matrixdomain} ${architect-wg} ${matrixdomain} ${matrixwebdomain}
''; '';
users.groups.acme.members = [ "turnserver" ]; users.groups.acme.members = [ "turnserver" ];
} }

View File

@ -0,0 +1,18 @@
{config, pkgs, ...}:
with import ./network.nix;
{
services.minecraft-server = {
enable = true;
eula = true;
declarative = true;
serverProperties = {
motd = "Welcome on the RuNas server!";
};
};
networking.extraHosts = ''
${architect-lan} minecraft.giugl.io
${architect-wg} minecraft.giugl.io
'';
}

View File

@ -34,13 +34,15 @@ rec {
defy-wg = "10.3.0.18"; defy-wg = "10.3.0.18";
germano-wg = "10.3.0.19"; germano-wg = "10.3.0.19";
flavio-wg = "10.3.0.20"; flavio-wg = "10.3.0.20";
tommy-wg = "10.3.0.21";
eleonora-wg = "10.3.0.100"; eleonora-wg = "10.3.0.100";
broccolino-wg = "10.3.0.200"; broccolino-wg = "10.3.0.200";
hotpottino-wg = "10.3.0.201"; hotpottino-wg = "10.3.0.201";
dodino-wg = "10.3.0.202";
# groups # groups
gdevices-wg = [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg angelino-wg ]; gdevices-wg = [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg angelino-wg ];
routers-wg = [ hotpottino-wg broccolino-wg ]; routers-wg = [ hotpottino-wg broccolino-wg dodino-wg ];
c2c-wg = [ ] ++ gdevices-wg; c2c-wg = [ ] ++ gdevices-wg;
towan-wg = [ shield-wg parisaphone-wg parisapc-wg ] ++ gdevices-wg ++ routers-wg; towan-wg = [ shield-wg parisaphone-wg parisapc-wg ] ++ gdevices-wg ++ routers-wg;

View File

@ -10,6 +10,29 @@
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
virtualHosts."giugl.io" = {
default = true;
enableACME = true;
addSSL = true;
root = "/var/lib/nginx/error_pages";
extraConfig = "error_page 404 /index.htm;";
locations = {
"/" = {
return = "404";
};
"/index.htm" = {
};
"/style.css" = {
};
"/wat.jpg" = {
};
};
};
}; };
users.groups.acme.members = [ "nginx" ]; users.groups.acme.members = [ "nginx" ];

View File

@ -11,6 +11,9 @@ with import ./network.nix;
http2 = true; http2 = true;
extraConfig = '' extraConfig = ''
allow 10.0.0.0/24;
allow 10.3.0.0/24;
deny all;
#Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
send_timeout 100m; send_timeout 100m;

View File

@ -0,0 +1,49 @@
#!/bin/sh
EASYLIST_HOSTSNAME="easylist_hosts.txt"
EASYPRIVACY_HOSTSNAME="easyprivacy_hosts.txt"
STEVENBLACK_HOSTSNAME="stevenblack_hosts.txt"
get_easylist() {
EASYLIST_URL="https://raw.githubusercontent.com/easylist/easylist/master/easylist/easylist_adservers.txt"
tmpfile=`mktemp`
# download easylist
${pkgs.wget}/bin/wget $EASYLIST_URL -O $tmpfile
# remove IP addresses and prepend 0.0.0.0 to create hosts file
cat $tmpfile | egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -oP "^\|\|(\K[a-zA-Z0-9\.\-]+)" | ${pkgs.gawk}/bin/gawk '{print "0.0.0.0 " $0}' > $EASYLIST_HOSTSNAME
}
get_easyprivacy() {
EASYLIST_URL="https://raw.githubusercontent.com/easylist/easylist/master/easyprivacy/easyprivacy_trackingservers.txt"
tmpfile=`mktemp`
# download easylist
${pkgs.wget}/bin/wget $EASYLIST_URL -O $tmpfile
# remove IP addresses and prepend 0.0.0.0 to create hosts file
cat $tmpfile | egrep -v "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -oP "^\|\|(\K[a-zA-Z0-9\.\-]+)" | ${pkgs.gawk}/bin/gawk '{print "0.0.0.0 " $0}' > $EASYPRIVACY_HOSTSNAME
}
get_stevenblack() {
STEVENBLACK_URL="https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews/hosts"
${pkgs.wget}/bin/wget $STEVENBLACK_URL -O $STEVENBLACK_HOSTSNAME
}
get_easylist
get_easyprivacy
get_stevenblack
# create unified file
cat *hosts.txt | sort | uniq | grep "^0" > /etc/adblock_hosts
rm $EASYLIST_HOSTSNAME $STEVENBLACK_HOSTSNAME

View File

@ -153,6 +153,18 @@ with import ./network.nix;
allowedIPs = [flavio-wg]; allowedIPs = [flavio-wg];
publicKey = "Yg0P+yHi/9SZHyoel8jT9fmmu+irLYmT8yMp/CZoaSg="; publicKey = "Yg0P+yHi/9SZHyoel8jT9fmmu+irLYmT8yMp/CZoaSg=";
} }
{
# dodino
allowedIPs = [dodino-wg];
publicKey = "JHkqlADQpY1CUcivraG9i6rIzCzLVFcl8HP5uIk35lk=";
}
{
# tommy
allowedIPs = [tommy-wg];
publicKey = "tytknU7wql1d0A2provX3RP7CNcEIajfgBJKoSyVLgo=";
}
]; ];
}; };
}; };