motiejus/config
1
Fork 0
Code Packages Releases Activity

cleanup ips; nix fmt

Browse Source
This commit is contained in:
Motiejus Jakštys 2023-07-24 12:31:06 +03:00
parent c2249cebb1
commit 4611c08d4f
5 changed files with 68 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
data.nix
View File

@ -1,9 +1,4 @@
rec { rec {
ips = {
vno1 = "88.223.107.21";
hel1a = "65.21.7.119";
};
people_pubkeys = { people_pubkeys = {
motiejus = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+qpaaD+FCYPcUU1ONbw/ff5j0xXu5DNvp/4qZH/vOYwG13uDdfI5ISYPs8zNaVcFuEDgNxWorVPwDw4p6+1JwRLlhO4J/5tE1w8Gt6C7y76LRWnp0rCdva5vL3xMozxYIWVOAiN131eyirV2FdOaqTwPy4ouNMmBFbibLQwBna89tbFMG/jwR7Cxt1I6UiYOuCXIocI5YUbXlsXoK9gr5yBRoTjl2OfH2itGYHz9xQCswvatmqrnteubAbkb6IUFYz184rnlVntuZLwzM99ezcG4v8/485gWkotTkOgQIrGNKgOA7UNKpQNbrwdPAMugqfSTo6g8fEvy0Q+6OXdxw5X7en2TJE+BLVaXp4pVMdOAzKF0nnssn64sRhsrUtFIjNGmOWBOR2gGokaJcM6x9R72qxucuG5054pSibs32BkPEg6Qzp+Bh77C3vUmC94YLVg6pazHhLroYSP1xQjfOvXyLxXB1s9rwJcO+s4kqmInft2weyhfaFE0Bjcoc+1/dKuQYfPCPSB//4zvktxTXud80zwWzMy91Q4ucRrHTBz3PrhO8ys74aSGnKOiG3ccD3HbaT0Ff4qmtIwHcAjrnNlINAcH/A2mpi0/2xA7T8WpFnvgtkQbcMF0kEKGnNS5ULZXP/LC8BlLXxwPdqTzvKikkTb661j4PhJhinhVwnQ=="; motiejus = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+qpaaD+FCYPcUU1ONbw/ff5j0xXu5DNvp/4qZH/vOYwG13uDdfI5ISYPs8zNaVcFuEDgNxWorVPwDw4p6+1JwRLlhO4J/5tE1w8Gt6C7y76LRWnp0rCdva5vL3xMozxYIWVOAiN131eyirV2FdOaqTwPy4ouNMmBFbibLQwBna89tbFMG/jwR7Cxt1I6UiYOuCXIocI5YUbXlsXoK9gr5yBRoTjl2OfH2itGYHz9xQCswvatmqrnteubAbkb6IUFYz184rnlVntuZLwzM99ezcG4v8/485gWkotTkOgQIrGNKgOA7UNKpQNbrwdPAMugqfSTo6g8fEvy0Q+6OXdxw5X7en2TJE+BLVaXp4pVMdOAzKF0nnssn64sRhsrUtFIjNGmOWBOR2gGokaJcM6x9R72qxucuG5054pSibs32BkPEg6Qzp+Bh77C3vUmC94YLVg6pazHhLroYSP1xQjfOvXyLxXB1s9rwJcO+s4kqmInft2weyhfaFE0Bjcoc+1/dKuQYfPCPSB//4zvktxTXud80zwWzMy91Q4ucRrHTBz3PrhO8ys74aSGnKOiG3ccD3HbaT0Ff4qmtIwHcAjrnNlINAcH/A2mpi0/2xA7T8WpFnvgtkQbcMF0kEKGnNS5ULZXP/LC8BlLXxwPdqTzvKikkTb661j4PhJhinhVwnQ==";
}; };
@ -12,10 +7,13 @@ rec {
"vno1-oh2.servers.jakst" = { "vno1-oh2.servers.jakst" = {
extraHostNames = ["dl.jakstys.lt" "vno1-oh2.jakstys.lt"]; extraHostNames = ["dl.jakstys.lt" "vno1-oh2.jakstys.lt"];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtYsaht57g2sp6UmLHqsCK+fHjiiZ0rmGceFmFt88pY"; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtYsaht57g2sp6UmLHqsCK+fHjiiZ0rmGceFmFt88pY";
publicIP = "88.223.107.21";
}; };
"hel1-a.servers.jakst" = { "hel1-a.servers.jakst" = {
extraHostNames = ["hel1-a.jakstys.lt" "git.jakstys.lt" "vpn.jakstys.lt" "jakstys.lt" "www.jakstys.lt"]; extraHostNames = ["hel1-a.jakstys.lt" "git.jakstys.lt" "vpn.jakstys.lt" "jakstys.lt" "www.jakstys.lt"];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6Wd2lKrpP2Gqul10obMo2dc1xKaaLv0I4FAnfIaFKu"; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6Wd2lKrpP2Gqul10obMo2dc1xKaaLv0I4FAnfIaFKu";
initrdPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEzt0eaSRTAfM2295x4vACEd5VFqVeYJPV/N9ZUq+voP";
publicIP = "65.21.7.119";
}; };
"zh2769.rsync.net" = { "zh2769.rsync.net" = {
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtclizeBy1Uo3D86HpgD3LONGVH0CJ0NT+YfZlldAJd"; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtclizeBy1Uo3D86HpgD3LONGVH0CJ0NT+YfZlldAJd";
@ -33,24 +31,27 @@ rec {
range = "100.89.176.0-100.89.191.255"; range = "100.89.176.0-100.89.191.255";
}; };
jakstysLTZone = '' jakstysLTZone = let
hel1a = hosts."hel1-a.servers.jakst".publicIP;
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
in ''
$ORIGIN jakstys.lt. $ORIGIN jakstys.lt.
$TTL 86400 $TTL 86400
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023032100 86400 86400 86400 86400) @ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023032100 86400 86400 86400 86400)
@ NS ns1.jakstys.lt. @ NS ns1.jakstys.lt.
@ NS ns2.jakstys.lt. @ NS ns2.jakstys.lt.
@ 600 A ${ips.hel1a} @ 600 A ${hel1a}
www 600 A ${ips.hel1a} www 600 A ${hel1a}
ns1 A ${ips.vno1} ns1 A ${vno1}
ns2 A ${ips.hel1a} ns2 A ${hel1a}
turn A ${ips.hel1a} turn A ${hel1a}
vpn A ${ips.hel1a} vpn A ${hel1a}
git A ${ips.hel1a} git A ${hel1a}
auth A ${ips.hel1a} auth A ${hel1a}
dl A ${ips.vno1} dl A ${vno1}
fwmine A ${ips.hel1a} fwmine A ${hel1a}
hel1-a A ${ips.hel1a} hel1-a A ${hel1a}
vno1 A ${ips.vno1} vno1 A ${vno1}
@ MX 10 aspmx.l.google.com. @ MX 10 aspmx.l.google.com.
@ MX 20 alt1.aspmx.l.google.com. @ MX 20 alt1.aspmx.l.google.com.
@ MX 20 alt2.aspmx.l.google.com. @ MX 20 alt2.aspmx.l.google.com.

2
hosts/hel1-a/configuration.nix
View File

@ -402,7 +402,7 @@ in {
whitelist = [ whitelist = [
"192.168.0.0/16" "192.168.0.0/16"
myData.tailscale_subnet.cidr myData.tailscale_subnet.cidr
myData.ips.vno1 myData.hosts."vno1-oh2.servers.jakst".publicIP
]; ];
}; };
}; };

4
hosts/vno1-oh2/configuration.nix
View File

@ -38,9 +38,9 @@
services.zfsunlock = { services.zfsunlock = {
enable = true; enable = true;
targets."hel1-a.servers.jakst" = { targets."hel1-a.servers.jakst" = {
sshEndpoint = myData.ips.hel1a; sshEndpoint = myData.hosts."hel1-a.servers.jakst".publicIP;
pingEndpoint = "hel1-a.servers.jakst"; pingEndpoint = "hel1-a.servers.jakst";
remotePubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEzt0eaSRTAfM2295x4vACEd5VFqVeYJPV/N9ZUq+voP"; remotePubkey = myData.hosts."hel1-a.servers.jakst".initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-hel1-a.path; pwFile = config.age.secrets.zfs-passphrase-hel1-a.path;
startAt = "*-*-* *:00/5:00"; startAt = "*-*-* *:00/5:00";
}; };

5
modules/base/sshd/default.nix
View File

@ -13,6 +13,9 @@
}; };
}; };
programs.mosh.enable = true; programs.mosh.enable = true;
programs.ssh.knownHosts = myData.hosts; programs.ssh.knownHosts = let
sshAttrs = lib.genAttrs ["extraHostNames" "publicKey"] (name: null);
in
lib.mapAttrs (name: cfg: builtins.intersectAttrs sshAttrs cfg) myData.hosts;
}; };
} }

32
modules/services/zfsunlock/default.nix
View File

@ -4,7 +4,13 @@
pkgs, pkgs,
... ...
}: let }: let
unlock = { sshEndpoint, pingEndpoint, remotePubkey, pwFile, pingTimeoutSec}: let unlock = {
sshEndpoint,
pingEndpoint,
remotePubkey,
pwFile,
pingTimeoutSec,
}: let
timeoutStr = builtins.toString pingTimeoutSec; timeoutStr = builtins.toString pingTimeoutSec;
in '' in ''
# if host is reachable via "pingEndpoint", which, we presume is # if host is reachable via "pingEndpoint", which, we presume is
@ -31,7 +37,10 @@ in {
options = { options = {
sshEndpoint = lib.mkOption {type = str;}; sshEndpoint = lib.mkOption {type = str;};
pingEndpoint = lib.mkOption {type = str;}; pingEndpoint = lib.mkOption {type = str;};
pingTimeoutSec = lib.mkOption {type = int; default = 20;}; pingTimeoutSec = lib.mkOption {
type = int;
default = 20;
};
remotePubkey = lib.mkOption {type = str;}; remotePubkey = lib.mkOption {type = str;};
pwFile = lib.mkOption {type = path;}; pwFile = lib.mkOption {type = path;};
startAt = lib.mkOption {type = either str (listOf str);}; startAt = lib.mkOption {type = either str (listOf str);};
@ -42,8 +51,10 @@ in {
}; };
config = lib.mkIf config.mj.services.zfsunlock.enable { config = lib.mkIf config.mj.services.zfsunlock.enable {
systemd.services = lib.mapAttrs' systemd.services =
(name: cfg: lib.mapAttrs'
(
name: cfg:
lib.nameValuePair "zfsunlock-${name}" { lib.nameValuePair "zfsunlock-${name}" {
description = "zfsunlock service for ${name}"; description = "zfsunlock service for ${name}";
script = unlock (builtins.removeAttrs cfg ["startAt"]); script = unlock (builtins.removeAttrs cfg ["startAt"]);
@ -52,10 +63,13 @@ in {
ProtectSystem = "strict"; ProtectSystem = "strict";
}; };
} }
) config.mj.services.zfsunlock.targets; )
config.mj.services.zfsunlock.targets;
systemd.timers = lib.mapAttrs' systemd.timers =
(name: cfg: lib.mapAttrs'
(
name: cfg:
lib.nameValuePair "zfsunlock-${name}" { lib.nameValuePair "zfsunlock-${name}" {
description = "zfsunlock timer for ${name}"; description = "zfsunlock timer for ${name}";
wantedBy = ["timers.target"]; wantedBy = ["timers.target"];
@ -64,7 +78,7 @@ in {
}; };
after = ["network-online.target"]; after = ["network-online.target"];
} }
) config.mj.services.zfsunlock.targets; )
config.mj.services.zfsunlock.targets;
}; };
} }