diff --git a/.sops.yaml b/.sops.yaml index bd46c74..98b764a 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -5,6 +5,7 @@ keys: - &dishwasher age1cxlskqynwl5njjm0qf363308dsjwxjq59rq7pn6ucpscpzpvry4qwtpx73 - &nextcloud age1ds7zgenz9a664jqx5308m6q5mgtavzmelg239xsj8mdh64pmqa9qtkffmk - &toaster age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk + - &music age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk creation_rules: - path_regex: secrets/microwave/[^/]+\.yaml$ key_groups: @@ -36,3 +37,9 @@ creation_rules: - *admin_oxa age: - *toaster + - path_regex: secrets/music/[^/]+\.yaml$ + key_groups: + - pgp: + - *admin_oxa + age: + - *music diff --git a/flake.nix b/flake.nix index 35b2212..6061f7e 100644 --- a/flake.nix +++ b/flake.nix @@ -106,13 +106,6 @@ ./hosts/dishwasher ./modules/basic-tools ./modules/binary-caches.nix - - { - microvm.vms.nextcloud = { - flake = self; - updateFlake = "github:oxapentane/nix-config/master"; - }; - } ]; }; @@ -125,6 +118,16 @@ ./microvms/nextcloud ]; }; + + music = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + ./microvms/music + ]; + }; }; }; } diff --git a/hosts/cirrus/nextcloud-proxy.nix b/hosts/cirrus/nextcloud-proxy.nix index 647d29f..11fc5ed 100644 --- a/hosts/cirrus/nextcloud-proxy.nix +++ b/hosts/cirrus/nextcloud-proxy.nix @@ -16,15 +16,15 @@ sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; }; - services.nginx.virtualHosts."nc.oxapentane.com" = { - enableACME = true; - forceSSL = true; - extraConfig = '' + services.nginx.virtualHosts = { + "nc.oxapentane.com" = { + enableACME = true; + forceSSL = true; + extraConfig = '' client_max_body_size 512M; - ''; - locations = { - "/" = { - # extraConfig = '' return 503; ''; + ''; + locations = { + "/" = { proxyPass = "http://10.34.45.100:8080"; }; "/well-known/carddav" = { @@ -33,7 +33,29 @@ "/well-known/caldav" = { return = "301 $scheme://$host/remote.php/dav"; }; - }; }; + + "music.oxapentane.com" = { + enableACME = true; + forceSSL = true; + extraConfig = '' + client_max_body_size 32M; + ''; + locations = { + "/" = { + proxyPass = "http://10.34.45.101:4533"; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_buffering off; + ''; + }; + }; + }; +}; } diff --git a/hosts/cirrus/wireguard-server.nix b/hosts/cirrus/wireguard-server.nix index ee4cf60..45c3dcb 100644 --- a/hosts/cirrus/wireguard-server.nix +++ b/hosts/cirrus/wireguard-server.nix @@ -66,6 +66,14 @@ PersistentKeepalive = 25; }; } + # music + { + wireguardPeerConfig = { + PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0="; + AllowedIPs = [ "10.34.45.101/32" ]; + PersistentKeepalive = 25; + }; + } ]; }; networks."oxaproxy" = { diff --git a/hosts/dishwasher/default.nix b/hosts/dishwasher/default.nix index b6c6651..f6e7a79 100644 --- a/hosts/dishwasher/default.nix +++ b/hosts/dishwasher/default.nix @@ -5,5 +5,6 @@ ./secrets.nix ./oxalab.nix ./mcvm-network.nix + ./microvms.nix ]; } diff --git a/hosts/dishwasher/mcvm-network.nix b/hosts/dishwasher/mcvm-network.nix index 1e59d3f..73894f8 100644 --- a/hosts/dishwasher/mcvm-network.nix +++ b/hosts/dishwasher/mcvm-network.nix @@ -14,9 +14,9 @@ addresses = [{ addressConfig.Address = "10.99.99.1/24"; } - { - addressConfig.Address = "fd12:3456:789a::1/64"; - }]; + { + addressConfig.Address = "fd12:3456:789a::1/64"; + }]; ipv6Prefixes = [{ ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64"; }]; diff --git a/hosts/dishwasher/microvms.nix b/hosts/dishwasher/microvms.nix new file mode 100644 index 0000000..9c69142 --- /dev/null +++ b/hosts/dishwasher/microvms.nix @@ -0,0 +1,12 @@ +{ self, ... }: { + microvm.vms = { + nextcloud = { + flake = self; + updateFlake = "github:oxapentane/nix-config/master"; + }; + music = { + flake = self; + updateFlake = "github:oxapentane/nix-config/navidrome"; + }; + }; +} diff --git a/microvms/music/default.nix b/microvms/music/default.nix new file mode 100644 index 0000000..f57de58 --- /dev/null +++ b/microvms/music/default.nix @@ -0,0 +1,49 @@ +{ pkgs, lib, config, ... }: { + imports = [ + ./navidrome.nix + ./oxaproxy.nix + ]; + + microvm = { + hypervisor = "qemu"; + mem = 4 * 1024; + vcpu = 3; + + shares = [{ + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + }] ++ map + (dir: { + source = "/var/lib/microvms/${config.networking.hostName}/${dir}"; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) [ "etc" "var" "home" ]; + + interfaces = [{ + type = "tap"; + id = "vm-music"; + mac = "EA:40:E8:60:C5:37"; + }]; + }; + + networking = { + hostName = "music"; + }; + + services.openssh = { + enable = true; + permitRootLogin = "prohibit-password"; + }; + + networking.firewall.allowedTCPPorts = [ 22 ]; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 348" + ]; + + system.stateVersion = "22.11"; +} diff --git a/microvms/music/navidrome.nix b/microvms/music/navidrome.nix new file mode 100644 index 0000000..a9c52df --- /dev/null +++ b/microvms/music/navidrome.nix @@ -0,0 +1,12 @@ +{ config, ... }: { + services.navidrome = { + enable = true; + settings = { + BaseUrl = "/"; + EnableExternalServices = false; + MusicFolder = "/var/lib/navidrome/library"; + ScanSchedule = "@every 17min"; + TranscondigCacheSize = "5GiB"; + }; + }; +} diff --git a/microvms/music/oxaproxy.nix b/microvms/music/oxaproxy.nix new file mode 100644 index 0000000..3340cdc --- /dev/null +++ b/microvms/music/oxaproxy.nix @@ -0,0 +1,68 @@ +{ config, ... }: { + + networking.wireguard.enable = true; + networking.useNetworkd = true; + + #oxaproxy secret + sops.defaultSopsFile = ../../secrets/music/secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets."wg/oxaproxy-seckey" = { + owner = config.users.users.systemd-network.name; + }; + + systemd.network = { + enable = true; + netdevs."10-oxaproxy" = { + netdevConfig = { + Kind = "wireguard"; + Name = "oxaproxy"; + Description = "oxa's enterprise reverse-proxy network"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path; + #own pubkey: vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0= + }; + wireguardPeers = [ + { + # cirrus + wireguardPeerConfig = { + PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM="; + AllowedIPs = [ "10.34.45.0/24" ]; + Endpoint = [ "95.216.166.21:51821" ]; + PersistentKeepalive = 25; + }; + } + ]; + }; + networks."10-oxaproxy" = { + matchConfig.Name = "oxaproxy"; + networkConfig = { + Address = "10.34.45.101/24"; + }; + }; + + networks."111-host" = { + matchConfig.Name = "enp0s8"; + networkConfig = { + Address = "10.99.99.101/24"; + }; + routes = [ + { + routeConfig = { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + }; + } + { + routeConfig = { + Gateway = "10.99.99.1"; + Destination = "10.99.99.0/24"; + Metric = 1024; + }; + } + ]; + }; + }; +} diff --git a/secrets/music/secrets.yaml b/secrets/music/secrets.yaml new file mode 100644 index 0000000..608f92a --- /dev/null +++ b/secrets/music/secrets.yaml @@ -0,0 +1,42 @@ +wg: + oxaproxy-seckey: ENC[AES256_GCM,data:8gBeqbtQ3mA3dKlidBOMfxZJZEkR/aVhawW9MJ8t/uDx+f2ciZIlrl/ggLw=,iv:w+gbINc5ORmPO9QZfeR3nzMa6QE3ISqBsIBywplij3w=,tag:oNecMKIuySepT0LiShJ29w==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMWV0TXBsMTV2UUE2cklt + dDV1UkkzdlRuK1NFRXFGWEd0Tk9MSHExcUdnCmtIM05LOC9wRE1tMUliRnBQbDE2 + QnFpMzBPMkFHQU1GUHlUdVBJYVFhSVkKLS0tIFJYVE1pSmlTU2NqUmEyaW9ReXhy + S0pTWlc5MTRYMTcyaHZoamRxVElkcncKCqntCHrNQjxTWdiQwFtKJ81Z1cK1id1P + wZSnmiAszn4qwrI9x8loS9tqq0lnq1NcJ+EbGfjygcsk0kXJHkPLIQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2023-01-24T19:36:01Z" + mac: ENC[AES256_GCM,data:SGRS/Xp0bc4omUq2WHKFx5F55rZvh2bo0KmxxZ73srImkF+65GAFeVaWJVxH8ie01N2jYDtVbe6NOfapRvcPFaXEIwJItTcMgUmqPr8fLI9WAzZpAWS1LeaNKkLAOcYHIoCEFgJbxtm3Ngj1NGxlam2/Cbwo1ONNNnulwvWDASo=,iv:ClDkkpsZHn4z9d1cnuN0zgqtxWijqjyhUCPDzrWCW8g=,tag:g65C9RazwWiI1jjap+/TnQ==,type:str] + pgp: + - created_at: "2023-01-24T19:33:50Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcFMA7zUOKwzpAE7AQ//cFpabxVtZeMwn6UPr+gLlWTFB1VgW3aFugmHfHbC7+gW + fdmh0ENsl8v8q7AiQWU8U9SfYE09C9RwrHinHnRpE7UT97jtu3PZ24WaJhXbfUEC + 4PvZKCLK9tqkyK74wFl/yVfPZXvkMKCzUn99mZvtqz7X/KCV3JgEz+HzjvO8gS0y + gKYSUYtu9t4jsH7VL662AuF2sjlslH61PFpUCC8CkWPkwBoyvRGyRt7Qpc2TCFD0 + 9Kqd4YaAILIIu3xM8oP+xq/KGuledo6+k/xASjTkJDhOJ5L+aDBl0MYyJ1tUFEDt + twn5rDw5/BJYSrqDlRFEsr5QDdagMXrLmDSJ3Lm9mXgJh7rRE1Cz8cMDfP/bkvDv + U/c2aM5U3+HNaiFNVQGALWqHK774n4QZlJfH+KqFcECfXMZTRg7g8DM3EkdGUUXF + U5oa3LgYimMxC/1sNroHNpztmozCqdpCPXiyduTQzPDp24UqyfVWw4CDtuQnpmX7 + NQtCzzG4J3+vHFhUrRBTtqdbdjmbJAzA9FXZeyCCrhLg4iT2W9MrR6ZCBBsZDxXB + QJv/A1wRLHVSuG9fZEFQFyaH3YT8BZHnHnBF+hcyMlo0cgoUm1cbbxwESb7JqkeM + 4J8f8kKVCH93Cw4d0AcaIKmaBVxFZ1clwO/8gvce2EQ+YoydLC+G2p9HOGXuhGjS + UQEOTZFBDy0sLffDr4G+FCGXACuxgaCJZ1SHGTyot1Ljj1hpAoz8xFoioHR8BGID + 0AYvaf6cmDcYAX5uf5mCKZaXHvVBzbuitNUr7GsQ54zawA== + =k8qB + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.7.3