Lilac/Chickadee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

finally works again

Browse Source
This commit is contained in:
Lilac
2026-08-03 13:22:28 -04:00
parent 4d72aa979a
commit a7f8971df1
16 changed files with 128 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+28 -15
View File
@@ -9,11 +9,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1781627888,
"narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
"lastModified": 1785518313,
"narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
"rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
"type": "github"
},
"original": {
@@ -79,11 +79,11 @@
]
},
"locked": {
"lastModified": 1783740085,
"narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
"lastModified": 1785119570,
"narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
"rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
"type": "github"
},
"original": {
@@ -111,11 +111,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1783703440,
"narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
"lastModified": 1785599192,
"narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
"rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
"type": "github"
},
"original": {
@@ -125,6 +125,22 @@
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1782175435,
"narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"deploy-rs": "deploy-rs",
@@ -137,9 +153,7 @@
},
"sops-nix": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1783174389,
@@ -150,9 +164,8 @@
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
"id": "sops-nix",
"type": "indirect"
}
},
"systems": {
flake.nix
+1 -5
View File
@@ -8,9 +8,6 @@
home-manager.url = "github:nix-community/home-manager/release-26.05";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
grasswren.flake = false;
};
@@ -23,8 +20,6 @@
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
sops-nix.nixosModules.sops
./hosts/desktop/default.nix
];
};
@@ -33,6 +28,7 @@
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
./hosts/vps/default.nix
];
};
hosts/desktop/default.nix
+29 -9
View File
@@ -4,18 +4,15 @@
imports = [
./hardware-configuration.nix
../../modules/network.nix
../../modules/ssh.nix
../../modules/wireguard.nix
../../modules/tailscale.nix
../../modules/site/blog.nix
../../modules/site/code.nix
../../modules/site/mail.nix
../../modules/site/music.nix
../../modules/site/photo.nix
../../modules/site.nix
../../modules/gitea.nix
../../modules/navidrome.nix
../../modules/immich.nix
../../modules/ssh.nix
];
network.node = "desktop";
networking.hostName = "desktop";
users.users.lilac = {
@@ -105,8 +102,31 @@
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
];
programs.steam.enable = true;
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.2/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
hosts/vps/default.nix
+60 -6
View File
@@ -4,17 +4,71 @@
imports = [
./hardware-configuration.nix
../../modules/network.nix
../../modules/ssh.nix
../../modules/wireguard.nix
../../modules/headscale.nix
../../modules/http-forwarding.nix
];
network.node = "vps";
networking.hostName = "vps";
users.users.lilac = {
isNormalUser = true;
group = "lilac";
extraGroups = [ "wheel" ];
};
users.groups.lilac = {};
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
users.lilac = import ../../home/lilac.nix;
};
programs.zsh.enable = true;
users.users.lilac.shell = pkgs.zsh;
security.sudo.wheelNeedsPassword = false;
# forwarding inbound network traffic over wireguard
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.3/24" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [
{
allowedIPs = [ "10.0.0.1/32" ];
publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
}
{
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
}
];
};
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
}
hosts/vps/hardware-configuration.nix
+2 -2
View File
@@ -7,11 +7,11 @@
extraModulePackages = [ ];
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot";
loader.efi.efiSysMountPoint = "/boot/efi";
};
fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
modules/http-forwarding.nix
-28
View File
@@ -1,28 +0,0 @@
{ config, lib, pkgs, ... }:
{
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.nftables.enable = true;
networking.nftables.tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
}
modules/network.nix
-41
View File
@@ -1,41 +0,0 @@
{ config, lib, pkgs, ... }:
{
options.network = {
nodes = lib.mkOption { type = lib.types.attrsOf
(lib.types.submodule ({ name, config, ... }: {
options = {
id = lib.mkOption { type = lib.types.int; };
ssh = lib.mkOption { type = lib.types.str; };
vpn = lib.mkOption { type = lib.types.str; };
address-vpn = lib.mkOption { type = lib.types.str; };
address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
};
config = {
address-vpn = "10.0.0.${toString config.id}";
};
}));
};
node = lib.mkOption { type = lib.types.str; };
};
config.network = {
nodes = {
laptop = {
id = 1;
ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
};
desktop = {
id = 2;
ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
};
vps = {
id = 3;
ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
address-pub = "216.128.177.13";
};
};
};
}
modules/site.nix → modules/site/blog.nix
-6
View File
@@ -23,11 +23,5 @@ in
root * ${website}/blog
file_server
'';
virtualHosts."birds.grasswren.net".extraConfig = ''
encode
root * ${website}/birds
file_server
'';
};
}
modules/gitea.nix → modules/site/code.nix
View File
modules/email.nix → modules/site/mail.nix
View File
modules/navidrome.nix → modules/site/music.nix
View File
modules/immich.nix → modules/site/photo.nix
+1 -1
View File
@@ -10,7 +10,7 @@
services.caddy = {
enable = true;
virtualHosts."image.grasswren.net".extraConfig = ''
virtualHosts."photo.grasswren.net".extraConfig = ''
reverse_proxy localhost:2283
'';
};
modules/headscale.nix → modules/site/vpn.nix
+1
View File
@@ -17,6 +17,7 @@
dns = {
magic_domain = true;
base_domain = "vpn.grasswren.net";
nameservers.global = [ "1.1.1.1" ];
};
};
};
modules/ssh.nix
+6 -12
View File
@@ -1,8 +1,5 @@
{ config, lib, pkgs, ... }:
let
me = config.network.nodes.${config.network.node};
in
{
networking.firewall = {
enable = true;
@@ -16,19 +13,16 @@ in
KbdInteractiveAuthentication = false;
};
listenAddresses = [{
addr = me.address-vpn;
addr = "0.0.0.0";
port = 22;
}];
};
users.users.lilac.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
];
users.users.root.openssh.authorizedKeys.keys = [
config.network.nodes.laptop.ssh
config.network.nodes.desktop.ssh
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
];
users.users.lilac = lib.mkIf (config.network.node != "vps") {
openssh.authorizedKeys.keys = [
config.network.nodes.laptop.ssh
config.network.nodes.desktop.ssh
];
};
}
modules/tailscale.nix
-5
View File
@@ -1,5 +0,0 @@
{ config, lib, pkgs, ... }:
{
services.tailscale.enable = true;
}
modules/wireguard.nix
-38
View File
@@ -1,38 +0,0 @@
{ config, lib, pkgs, ... }:
let
me = config.network.nodes.${config.network.node};
in
{
networking = {
firewall = {
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "${me.address-vpn}/24" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = lib.mapAttrsToList (name: peer: {
publicKey = peer.vpn;
allowedIPs =
if config.network.node == "vps"
then [ "${peer.address-vpn}/32" ]
else [ "10.0.0.0/24" ];
endpoint =
if peer.address-pub != null
then "${peer.address-pub}:51820"
else null;
persistentKeepalive =
if peer.address-pub != null
then 25
else null;
}) (lib.filterAttrs (name: _:
if config.network.node == "vps"
then name != "vps"
else name == "vps"
) config.network.nodes);
};
};
}