update backups

flake.lock

@@ -9,11 +9,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1781627888,
-        "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
+        "lastModified": 1785518313,
+        "narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
+        "rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783740085,
-        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "lastModified": 1785119570,
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1783703440,
-        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
+        "lastModified": 1785599192,
+        "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
+        "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
         "type": "github"
       },
       "original": {
@@ -125,6 +125,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1782175435,
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
@@ -137,9 +153,7 @@
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
         "lastModified": 1783174389,
@@ -150,9 +164,8 @@
         "type": "github"
       },
       "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
+        "id": "sops-nix",
+        "type": "indirect"
       }
     },
     "systems": {

flake.nix

@@ -8,9 +8,6 @@
     home-manager.url = "github:nix-community/home-manager/release-26.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-
     grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
     grasswren.flake = false;
   };
@@ -23,8 +20,6 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          sops-nix.nixosModules.sops
-
           ./hosts/desktop/default.nix
         ];
       };
@@ -33,9 +28,18 @@
         system = "x86_64-linux";
         specialArgs = { inherit inputs; };
         modules = [
+          home-manager.nixosModules.home-manager
           ./hosts/vps/default.nix
         ];
      };
+       backup = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
+        modules = [
+          home-manager.nixosModules.home-manager
+          ./hosts/backup/default.nix
+        ];
+      };
     };
 
     homeConfigurations.lilac = home-manager.lib.homeManagerConfiguration {
@@ -49,7 +53,7 @@
     # nix run github:serokell/deploy-rs
     deploy.nodes = {
       vps = {
-        hostname = "vps.vpn";
+        hostname = "10.0.0.3";
         sshUser = "root";
         magicRollbackTimeout = 120;
         profiles.system = {
@@ -60,7 +64,7 @@
       };
 
       desktop = {
-        hostname = "desktop.vpn";
+        hostname = "10.0.0.2";
         sshUser = "root";
         magicRollbackTimeout = 120;
         profiles.system = {
@@ -68,6 +72,16 @@
           remoteBuild = false;
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
         };
+      };
+       backup = {
+        hostname = "10.0.0.4";
+        sshUser = "root";
+        magicRollbackTimeout = 120;
+        profiles.system = {
+          user = "root";
+          remoteBuild = false;
+          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
+        };
       };
 	};
     checks = {

hosts/backup/default.nix

@@ -0,0 +1,109 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ./hardware-configuration.nix ../../modules/ssh.nix ];
+
+  networking.hostName = "backup";
+
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
+  home-manager = {
+    useGlobalPkgs = true;
+	useUserPackages = true;
+
+	users.lilac = import ../../home/lilac.nix;
+	};
+  programs.zsh.enable = true;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  time.timeZone = "America/Winnipeg";
+
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = "no";
+    AllowHibernation = "no";
+    AllowHybridSleep = "no";
+    AllowSuspendThenHibernate = "no";
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  services.xserver.enable = true;
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    whipper
+	flac
+	tor-browser
+  ];
+
+  networking.wireless.enable = true;
+  networking.networkmanager.enable = true;
+
+  services.timesyncd.enable = true;    # optional
+
+networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.4/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
+  nixpkgs.config.allowUnfree = true;
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "26.05";
+
+
+
+  services.restic.server = {
+    enable = true;
+	listenAddress = "10.0.0.4:8000";
+	dataDir = "/var/lib/restic";
+	appendOnly = true;
+	extraFlags = [ "--no-auth" ];
+  };
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
+}

hosts/backup/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/E157-E223";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/desktop/default.nix

@@ -4,19 +4,16 @@
   imports = [
     ./hardware-configuration.nix
 
-	../../modules/network.nix
-	../../modules/ssh.nix
-	../../modules/wireguard.nix
-	../../modules/headscale.nix
-	../../modules/tailscale.nix
+    ../../modules/site/blog.nix
+    ../../modules/site/code.nix
+    ../../modules/site/mail.nix
+    ../../modules/site/music.nix
+    ../../modules/site/photo.nix
+	../../modules/site/vault.nix
 
-	../../modules/site.nix
-	../../modules/gitea.nix
-	../../modules/navidrome.nix
-	../../modules/immich.nix
+	../../modules/ssh.nix
   ];
 
-  network.node = "desktop";
   networking.hostName = "desktop";
 
   users.users.lilac = {
@@ -106,9 +103,42 @@
   environment.systemPackages = with pkgs; [
     whipper
 	flac
+	tor-browser
+	restic
   ];
 
+  programs.steam.enable = true;
+
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.2/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
+
+  services.restic.backups.backup = {
+    repository = "rest:http://10.0.0.4:8000/backup";
+	initialize = true;
+	passwordFile = "/home/lilac/test-password";
+	paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
+	timerConfig.OnCalendar = "03:30";
+	pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
+  };
 }

hosts/vps/default.nix

@@ -4,17 +4,75 @@
   imports = [
     ./hardware-configuration.nix
 
-    ../../modules/network.nix
     ../../modules/ssh.nix
-    ../../modules/wireguard.nix
-	../../modules/tailscale.nix
-
-    ../../modules/http-forwarding.nix
   ];
 
-  network.node = "vps";
   networking.hostName = "vps";
 
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    users.lilac = import ../../home/lilac.nix;
+  };
+  programs.zsh.enable = true;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  # forwarding inbound network traffic over wireguard
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedTCPPorts = [ 80 443 ];
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.3/24" ];
+	  listenPort = 51820;
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [
+	    {
+		  allowedIPs = [ "10.0.0.1/32" ];
+          publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
+		}
+		{
+          allowedIPs = [ "10.0.0.2/32" ];
+		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+		}
+		{
+		  allowedIPs = [ "10.0.0.4/32" ];
+		  publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
+		}
+      ];
+	};
+	nftables = {
+	  enable = true;
+	  tables.nat = {
+	    family = "ip";
+		content = ''
+          chain prerouting {
+            type nat hook prerouting priority dstnat; policy accept;
+            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+          }
+	      chain postrouting {
+            type nat hook postrouting priority srcnat; policy accept;
+            oifname "wg0" masquerade
+          }
+        '';
+      };
+	};
+  };
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
 }

hosts/vps/hardware-configuration.nix

@@ -7,11 +7,11 @@
 	extraModulePackages = [ ];
   	loader.systemd-boot.enable = true;
   	loader.efi.canTouchEfiVariables = true;
-  	loader.efi.efiSysMountPoint = "/boot";
+  	loader.efi.efiSysMountPoint = "/boot/efi";
   };
 
   fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
-  fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
+  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

modules/http-forwarding.nix

@@ -1,28 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  networking.nftables.enable = true;
-  networking.nftables.tables.nat = {
-    family = "ip";
-    content = ''
-      chain prerouting {
-        type nat hook prerouting priority dstnat; policy accept;
-
-        iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
-        iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
-      }
-	    chain postrouting {
-        type nat hook postrouting priority srcnat; policy accept;
-
-        oifname "wg0" masquerade
-      }
-    '';
-  };
-
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-  };
-}

modules/network.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  options.network = {
-    nodes = lib.mkOption { type = lib.types.attrsOf
-	  (lib.types.submodule ({ name, config, ... }: {
-        options = {
-          id          = lib.mkOption { type = lib.types.int; };
-          ssh         = lib.mkOption { type = lib.types.str; };
-          vpn         = lib.mkOption { type = lib.types.str; };
-		  address-vpn = lib.mkOption { type = lib.types.str; };
-          address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
-		};
-		config = {
-          address-vpn = "10.0.0.${toString config.id}";
-		};
-	  }));
-	};
-	node = lib.mkOption { type = lib.types.str; };
-  };
-  config.network = {
-    nodes = {
-      laptop = {
-        id = 1;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
-        vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
-      };
-      desktop = {
-        id = 2;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
-        vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
-      };
-      vps = {
-        id = 3;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
-        vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
-        address-pub = "216.128.177.13";
-      };
-    };
-  };
-}

modules/site/blog.nix

@@ -23,11 +23,5 @@ in
       root * ${website}/blog
       file_server
     '';
-
-    virtualHosts."birds.grasswren.net".extraConfig = ''
-      encode
-      root * ${website}/birds
-      file_server
-    '';
   };
 }

modules/site/code.nix

@@ -19,6 +19,8 @@
       name = "gitea";
       user = "gitea";
     };
+
+	settings.service.DISABLE_REGISTRATION = true;
   };
 
   services.caddy = {

modules/site/photo.nix

@@ -10,7 +10,7 @@
 
   services.caddy = {
     enable = true;
-	virtualHosts."image.grasswren.net".extraConfig = ''
+	virtualHosts."photo.grasswren.net".extraConfig = ''
       reverse_proxy localhost:2283
 	'';
   };

modules/site/vault.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.vaultwarden = {
+    enable = true;
+	backupDir = "/var/lib/vault-backup";
+    config = {
+      DOMAIN = "https://vault.example.com";
+      SIGNUPS_ALLOWED = false;
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."vault.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:8222
+	'';
+  };
+}

modules/site/vpn.nix

@@ -1,17 +1,11 @@
 { config, lib, pkgs, ... }:
 
 {
-systemd.services.headscale.environment = {
-  GODEBUG = "netdns=go";
-};
-networking.enableIPv6 = false;
-  environment.etc."headscale/derp.yaml".source = ./derp.yaml;
   services.headscale = {
-
     enable = true;
 	settings = {
       server_url = "https://vpn.grasswren.net";
-	  listen_addr = "0.0.0.0:8080";
+	  listen_addr = "127.0.0.1:8080";
 
 	  database.type = "sqlite";
 
@@ -21,8 +15,8 @@ networking.enableIPv6 = false;
       ];
 
 	  dns = {
-	    magic_dns = true;
-	    base_domain = "vpn";
+	    magic_domain = true;
+	    base_domain = "vpn.grasswren.net";
 		nameservers.global = [ "1.1.1.1" ];
 	  };
 	};

modules/ssh.nix

@@ -1,12 +1,9 @@
 { config, lib, pkgs, ... }:
 
-let
-  me = config.network.nodes.${config.network.node};
-in
 {
   networking.firewall = {
     enable = true;
-	allowedTCPPorts = [ 22 ];
+	interfaces.wg0.allowedTCPPorts = [ 22 ];
   };
   services.openssh = {
     enable = true;
@@ -21,14 +18,11 @@ in
 	}];
   };
 
+  users.users.lilac.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
+  ];
+
   users.users.root.openssh.authorizedKeys.keys = [
-    config.network.nodes.laptop.ssh
-	config.network.nodes.desktop.ssh
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
   ];
-  users.users.lilac = lib.mkIf (config.network.node != "vps") {
-    openssh.authorizedKeys.keys = [
-      config.network.nodes.laptop.ssh
-      config.network.nodes.desktop.ssh
-    ];
-  };
 }

modules/tailscale.nix

@@ -1,5 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.tailscale.enable = true;
-}

modules/wireguard.nix

@@ -1,38 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  me = config.network.nodes.${config.network.node};
-in
-{
-  networking = {
-    firewall = {
-      allowedUDPPorts = [ 51820 ];
-	    trustedInterfaces = [ "wg0" ];
-	  };
-	  wireguard.interfaces."wg0" = {
-      ips = [ "${me.address-vpn}/24" ];
-	    listenPort = 51820;
-	    generatePrivateKeyFile = true;
-	    privateKeyFile = "/var/lib/wireguard/wg0.key";
-	    peers = lib.mapAttrsToList (name: peer: {
-        publicKey = peer.vpn;
-		    allowedIPs =
-		      if config.network.node == "vps"
-			      then [ "${peer.address-vpn}/32" ]
-			      else [ "10.0.0.0/24" ];
-		    endpoint =
-		      if peer.address-pub != null
-			      then "${peer.address-pub}:51820"
-			      else null;
-		    persistentKeepalive =
-		      if peer.address-pub != null
-			      then 25
-			      else null;
-	    }) (lib.filterAttrs (name: _:
-        if config.network.node == "vps"
-		      then name != "vps"
-          else name == "vps"
-      ) config.network.nodes);
-	  };
-  };
-}