diff --git a/flake.lock b/flake.lock index 75414dd..032f81d 100644 --- a/flake.lock +++ b/flake.lock @@ -9,11 +9,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1781627888, - "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=", + "lastModified": 1785518313, + "narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=", "owner": "serokell", "repo": "deploy-rs", - "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28", + "rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d", "type": "github" }, "original": { @@ -79,11 +79,11 @@ ] }, "locked": { - "lastModified": 1783740085, - "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=", + "lastModified": 1785119570, + "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=", "owner": "nix-community", "repo": "home-manager", - "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb", + "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d", "type": "github" }, "original": { @@ -111,11 +111,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1783703440, - "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=", + "lastModified": 1785599192, + "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283", + "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07", "type": "github" }, "original": { @@ -125,6 +125,22 @@ "type": "github" } }, + "nixpkgs_3": { + "locked": { + "lastModified": 1782175435, + "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, "root": { "inputs": { "deploy-rs": "deploy-rs", @@ -137,9 +153,7 @@ }, "sops-nix": { "inputs": { - "nixpkgs": [ - "nixpkgs" - ] + "nixpkgs": "nixpkgs_3" }, "locked": { "lastModified": 1783174389, @@ -150,9 +164,8 @@ "type": "github" }, "original": { - "owner": "Mic92", - "repo": "sops-nix", - "type": "github" + "id": "sops-nix", + "type": "indirect" } }, "systems": { diff --git a/flake.nix b/flake.nix index a14936d..51d1310 100644 --- a/flake.nix +++ b/flake.nix @@ -8,9 +8,6 @@ home-manager.url = "github:nix-community/home-manager/release-26.05"; home-manager.inputs.nixpkgs.follows = "nixpkgs"; - sops-nix.url = "github:Mic92/sops-nix"; - sops-nix.inputs.nixpkgs.follows = "nixpkgs"; - grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main"; grasswren.flake = false; }; @@ -23,8 +20,6 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager - sops-nix.nixosModules.sops - ./hosts/desktop/default.nix ]; }; @@ -33,6 +28,7 @@ system = "x86_64-linux"; specialArgs = { inherit inputs; }; modules = [ + home-manager.nixosModules.home-manager ./hosts/vps/default.nix ]; }; diff --git a/hosts/desktop/default.nix b/hosts/desktop/default.nix index 3304844..c2b8296 100644 --- a/hosts/desktop/default.nix +++ b/hosts/desktop/default.nix @@ -4,18 +4,15 @@ imports = [ ./hardware-configuration.nix - ../../modules/network.nix - ../../modules/ssh.nix - ../../modules/wireguard.nix - ../../modules/tailscale.nix + ../../modules/site/blog.nix + ../../modules/site/code.nix + ../../modules/site/mail.nix + ../../modules/site/music.nix + ../../modules/site/photo.nix - ../../modules/site.nix - ../../modules/gitea.nix - ../../modules/navidrome.nix - ../../modules/immich.nix + ../../modules/ssh.nix ]; - network.node = "desktop"; networking.hostName = "desktop"; users.users.lilac = { @@ -105,8 +102,31 @@ environment.systemPackages = with pkgs; [ whipper flac + tor-browser ]; + programs.steam.enable = true; + + networking = { + firewall = { + enable = true; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; + + wireguard.interfaces."wg0" = { + ips = [ "10.0.0.2/24" ]; + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [{ + publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; + allowedIPs = [ "10.0.0.0/24" ]; + endpoint = "216.128.177.13:51820"; + persistentKeepalive = 25; + }]; + }; + }; + nixpkgs.config.allowUnfree = true; nix.settings.experimental-features = [ "nix-command" "flakes" ]; system.stateVersion = "26.05"; diff --git a/hosts/vps/default.nix b/hosts/vps/default.nix index 8d5b61a..ae17a83 100644 --- a/hosts/vps/default.nix +++ b/hosts/vps/default.nix @@ -4,17 +4,71 @@ imports = [ ./hardware-configuration.nix - ../../modules/network.nix ../../modules/ssh.nix - ../../modules/wireguard.nix - ../../modules/headscale.nix - - ../../modules/http-forwarding.nix ]; - network.node = "vps"; networking.hostName = "vps"; + users.users.lilac = { + isNormalUser = true; + group = "lilac"; + extraGroups = [ "wheel" ]; + }; + users.groups.lilac = {}; + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + users.lilac = import ../../home/lilac.nix; + }; + programs.zsh.enable = true; + users.users.lilac.shell = pkgs.zsh; + security.sudo.wheelNeedsPassword = false; + + # forwarding inbound network traffic over wireguard + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; + wireguard.interfaces."wg0" = { + ips = [ "10.0.0.3/24" ]; + listenPort = 51820; + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [ + { + allowedIPs = [ "10.0.0.1/32" ]; + publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU="; + } + { + allowedIPs = [ "10.0.0.2/32" ]; + publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; + } + ]; + }; + nftables = { + enable = true; + tables.nat = { + family = "ip"; + content = '' + chain prerouting { + type nat hook prerouting priority dstnat; policy accept; + iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2 + } + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + oifname "wg0" masquerade + } + ''; + }; + }; + }; + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + }; + nix.settings.experimental-features = [ "nix-command" "flakes" ]; system.stateVersion = "26.05"; } diff --git a/hosts/vps/hardware-configuration.nix b/hosts/vps/hardware-configuration.nix index 95f2a28..a1f04c4 100644 --- a/hosts/vps/hardware-configuration.nix +++ b/hosts/vps/hardware-configuration.nix @@ -7,11 +7,11 @@ extraModulePackages = [ ]; loader.systemd-boot.enable = true; loader.efi.canTouchEfiVariables = true; - loader.efi.efiSysMountPoint = "/boot"; + loader.efi.efiSysMountPoint = "/boot/efi"; }; fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; }; - fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; }; + fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; }; swapDevices = [ ]; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; diff --git a/modules/http-forwarding.nix b/modules/http-forwarding.nix deleted file mode 100644 index 684ab47..0000000 --- a/modules/http-forwarding.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - networking.firewall.enable = true; - networking.firewall.allowedTCPPorts = [ 80 443 ]; - - networking.nftables.enable = true; - networking.nftables.tables.nat = { - family = "ip"; - content = '' - chain prerouting { - type nat hook prerouting priority dstnat; policy accept; - - iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80 - iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443 - } - chain postrouting { - type nat hook postrouting priority srcnat; policy accept; - - oifname "wg0" masquerade - } - ''; - }; - - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = 1; - }; -} diff --git a/modules/network.nix b/modules/network.nix deleted file mode 100644 index 19fe41b..0000000 --- a/modules/network.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - options.network = { - nodes = lib.mkOption { type = lib.types.attrsOf - (lib.types.submodule ({ name, config, ... }: { - options = { - id = lib.mkOption { type = lib.types.int; }; - ssh = lib.mkOption { type = lib.types.str; }; - vpn = lib.mkOption { type = lib.types.str; }; - address-vpn = lib.mkOption { type = lib.types.str; }; - address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; }; - }; - config = { - address-vpn = "10.0.0.${toString config.id}"; - }; - })); - }; - node = lib.mkOption { type = lib.types.str; }; - }; - config.network = { - nodes = { - laptop = { - id = 1; - ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"; - vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU="; - }; - desktop = { - id = 2; - ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu"; - vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; - }; - vps = { - id = 3; - ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp"; - vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU="; - address-pub = "216.128.177.13"; - }; - }; - }; -} diff --git a/modules/site.nix b/modules/site/blog.nix similarity index 81% rename from modules/site.nix rename to modules/site/blog.nix index b6bb67f..2029760 100644 --- a/modules/site.nix +++ b/modules/site/blog.nix @@ -23,11 +23,5 @@ in root * ${website}/blog file_server ''; - - virtualHosts."birds.grasswren.net".extraConfig = '' - encode - root * ${website}/birds - file_server - ''; }; } diff --git a/modules/gitea.nix b/modules/site/code.nix similarity index 100% rename from modules/gitea.nix rename to modules/site/code.nix diff --git a/modules/email.nix b/modules/site/mail.nix similarity index 100% rename from modules/email.nix rename to modules/site/mail.nix diff --git a/modules/navidrome.nix b/modules/site/music.nix similarity index 100% rename from modules/navidrome.nix rename to modules/site/music.nix diff --git a/modules/immich.nix b/modules/site/photo.nix similarity index 81% rename from modules/immich.nix rename to modules/site/photo.nix index cb438e8..0b2498d 100644 --- a/modules/immich.nix +++ b/modules/site/photo.nix @@ -10,7 +10,7 @@ services.caddy = { enable = true; - virtualHosts."image.grasswren.net".extraConfig = '' + virtualHosts."photo.grasswren.net".extraConfig = '' reverse_proxy localhost:2283 ''; }; diff --git a/modules/headscale.nix b/modules/site/vpn.nix similarity index 93% rename from modules/headscale.nix rename to modules/site/vpn.nix index 4cc456d..a53e51b 100644 --- a/modules/headscale.nix +++ b/modules/site/vpn.nix @@ -17,6 +17,7 @@ dns = { magic_domain = true; base_domain = "vpn.grasswren.net"; + nameservers.global = [ "1.1.1.1" ]; }; }; }; diff --git a/modules/ssh.nix b/modules/ssh.nix index 9c8e9d2..ff41c43 100644 --- a/modules/ssh.nix +++ b/modules/ssh.nix @@ -1,8 +1,5 @@ { config, lib, pkgs, ... }: -let - me = config.network.nodes.${config.network.node}; -in { networking.firewall = { enable = true; @@ -16,19 +13,16 @@ in KbdInteractiveAuthentication = false; }; listenAddresses = [{ - addr = me.address-vpn; + addr = "0.0.0.0"; port = 22; }]; }; + users.users.lilac.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg" + ]; + users.users.root.openssh.authorizedKeys.keys = [ - config.network.nodes.laptop.ssh - config.network.nodes.desktop.ssh + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg" ]; - users.users.lilac = lib.mkIf (config.network.node != "vps") { - openssh.authorizedKeys.keys = [ - config.network.nodes.laptop.ssh - config.network.nodes.desktop.ssh - ]; - }; } diff --git a/modules/tailscale.nix b/modules/tailscale.nix deleted file mode 100644 index 578e7ab..0000000 --- a/modules/tailscale.nix +++ /dev/null @@ -1,5 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - services.tailscale.enable = true; -} diff --git a/modules/wireguard.nix b/modules/wireguard.nix deleted file mode 100644 index f1bd786..0000000 --- a/modules/wireguard.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ config, lib, pkgs, ... }: - -let - me = config.network.nodes.${config.network.node}; -in -{ - networking = { - firewall = { - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; - wireguard.interfaces."wg0" = { - ips = [ "${me.address-vpn}/24" ]; - listenPort = 51820; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = lib.mapAttrsToList (name: peer: { - publicKey = peer.vpn; - allowedIPs = - if config.network.node == "vps" - then [ "${peer.address-vpn}/32" ] - else [ "10.0.0.0/24" ]; - endpoint = - if peer.address-pub != null - then "${peer.address-pub}:51820" - else null; - persistentKeepalive = - if peer.address-pub != null - then 25 - else null; - }) (lib.filterAttrs (name: _: - if config.network.node == "vps" - then name != "vps" - else name == "vps" - ) config.network.nodes); - }; - }; -}