remove obsolete infra

7 files changed, 0 insertions, 359 deletions

diff --git a/hosts/cirrus/configuration.nix b/hosts/cirrus/configuration.nix
deleted file mode 100644
index bfdf7f5..0000000
--- a/hosts/cirrus/configuration.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ config, pkgs, ... }:
-
-{
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.efiSupport = true;
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
-
-  zramSwap = { enable = true; algorithm = "zstd"; };
-
-  networking = {
-    hostName = "cirrus"; # Define your hostname.
-  };
-
-  systemd.network = {
-    enable = true;
-    networks."uplink" = {
-      matchConfig = { Name = "enp1s0"; };
-      networkConfig = {
-        Address = "95.216.166.21/32";
-        DNS = "9.9.9.9";
-      };
-      routes = [
-        {
-          routeConfig = {
-            Gateway = "172.31.1.1";
-            GatewayOnLink = true;
-            Destination = "0.0.0.0/0";
-          };
-        }
-      ];
-    };
-  };
-
-
-  # Set your time zone.
-  time.timeZone = "Europe/Amsterdam";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-  # Open ports in the firewall.
-  networking.firewall.enable = true;
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-
-  # Copy the NixOS configuration file and link it from the resulting system
-  # (/run/current-system/configuration.nix). This is useful in case you
-  # accidentally delete configuration.nix.
-  # system.copySystemConfiguration = true;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.05"; # Did you read the comment?
-
-}
-
diff --git a/hosts/cirrus/default.nix b/hosts/cirrus/default.nix
deleted file mode 100644
index d205721..0000000
--- a/hosts/cirrus/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-    ./nextcloud-proxy.nix
-    ./secrets.nix
-    ./wireguard-server.nix
-  ];
-}
diff --git a/hosts/cirrus/hardware-configuration.nix b/hosts/cirrus/hardware-configuration.nix
deleted file mode 100644
index 0bd3907..0000000
--- a/hosts/cirrus/hardware-configuration.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/627952eb-107a-43c3-8223-bfea9af92837";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/5CA6-CCE4";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault false;
-  networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
-
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
diff --git a/hosts/cirrus/irc.nix b/hosts/cirrus/irc.nix
deleted file mode 100644
index 6bda646..0000000
--- a/hosts/cirrus/irc.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ pkgs, config, ... }: {
-  services.nginx = {
-    # reverse-proxy irc traffic on 7000
-    streamConfig = ''
-      upstream soju {
-        server 127.0.0.1:6667;
-      }
-
-      server {
-        listen 7000 ssl;
-        listen [::]:7000 ssl;
-
-        ssl_certificate /var/lib/acme/mrbouncy.oxapentane.com/fullchain.pem;
-        ssl_certificate_key /var/lib/acme/mrbouncy.oxapentane.com/key.pem;
-        ssl_trusted_certificate /var/lib/acme/mrbouncy.oxapentane.com/chain.pem;
-
-        proxy_pass soju;
-      }
-    '';
-    # just here to get the cert for irc reverse proxy
-    virtualHosts = {
-      "mrbouncy.oxapentane.com" = {
-        enableACME = true;
-        forceSSL = true;
-        locations = {
-          "/" = {
-            # no content for now, here just for no-boilerplate cert
-            return = "204";
-          };
-        };
-      };
-    };
-  };
-
-  services.soju = {
-    hostName = "mrbouncy.oxapentane.com";
-    listen = [ "irc+insecure://127.0.0.1:6667" ];
-    enable = true;
-    enableMessageLogging = true;
-    acceptProxyIP = [ "localhost" ];
-  };
-
-  environment.systemPackages = [ pkgs.soju ]; # expose soju mgmt commands
-
-  networking.firewall.allowedTCPPorts = [ 7000 ];
-}
diff --git a/hosts/cirrus/nextcloud-proxy.nix b/hosts/cirrus/nextcloud-proxy.nix
deleted file mode 100644
index 3b5166a..0000000
--- a/hosts/cirrus/nextcloud-proxy.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ config, pkgs, ... }: {
-  security.acme = {
-    defaults.email = "acme@oxapentane.com";
-    acceptTerms = true;
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-
-    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-  };
-
-  services.nginx.virtualHosts = {
-    "nc.oxapentane.com" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 512M;
-      '';
-      locations = {
-        "/" = {
-          proxyPass = "http://10.34.45.100:8080";
-        };
-        "/well-known/carddav" = {
-          return = "301 $scheme://$host/remote.php/dav";
-        };
-        "/well-known/caldav" = {
-          return = "301 $scheme://$host/remote.php/dav";
-        };
-      };
-    };
-
-    "music.oxapentane.com" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 32M;
-      '';
-      locations = {
-        "/" = {
-          proxyPass = "http://10.34.45.101:4533";
-        };
-      };
-    };
-    "news.oxapentane.com" = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 32M;
-      '';
-      locations = {
-        "/" = {
-          proxyPass = "http://10.34.45.102:8080";
-        };
-      };
-    };
-  };
-}
diff --git a/hosts/cirrus/secrets.nix b/hosts/cirrus/secrets.nix
deleted file mode 100644
index df095a7..0000000
--- a/hosts/cirrus/secrets.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  sops.defaultSopsFile = ../../secrets/cirrus/secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-  sops.secrets = {
-    "wg/oxalab-seckey" = {
-      owner = config.users.users.systemd-network.name;
-    };
-    "wg/oxaproxy-seckey" = {
-      owner = config.users.users.systemd-network.name;
-    };
-  };
-}
diff --git a/hosts/cirrus/wireguard-server.nix b/hosts/cirrus/wireguard-server.nix
deleted file mode 100644
index 74e6091..0000000
--- a/hosts/cirrus/wireguard-server.nix
+++ /dev/null
@@ -1,123 +0,0 @@
-{ config, ... }:
-{
-  networking.firewall = {
-    allowedUDPPorts = [
-      # wireguards
-      51820
-      51821
-      34197
-    ];
-    allowedTCPPorts = [
-      # port forward ssh to music
-      2020
-    ];
-    # port-forward ssh to the music machine
-    extraCommands = ''
-      iptables -t nat -I PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22
-      iptables -t nat -I PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197
-      iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE
-    '';
-    extraStopCommands = ''
-      iptables -t nat -D PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22 || true
-      iptables -t nat -D PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197 || true
-    '';
-  };
-
-
-  networking.wireguard.enable = true;
-
-  systemd.network = {
-    # oxalab
-    netdevs."oxalab" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "oxalab";
-        Description = "oxa's enterprise network";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
-        ListenPort = 51820;
-        # own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=
-      };
-      wireguardPeers = [
-        {
-          # microwave
-          wireguardPeerConfig = {
-            PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc=";
-            AllowedIPs = [ "10.66.66.10/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        {
-          # Dishwasher
-          wireguardPeerConfig = {
-            PublicKey = "AdWUBbyeRkxdP9HUu25PpISoxbgQ8oeCw3BmV93xtAw=";
-            AllowedIPs = [ "10.66.66.100/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-      ];
-    };
-    networks."oxalab" = {
-      matchConfig.Name = "oxalab";
-      networkConfig = {
-        Address = "10.66.66.1/24";
-        IPForward = "ipv4";
-      };
-    };
-
-
-    # oxaproxy
-    netdevs."oxaproxy" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "oxaproxy";
-        Description = "oxa's enterprise reverse-proxy network";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
-        #own pubkey 0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=
-        ListenPort = 51821;
-      };
-      wireguardPeers = [
-        # nextcloud
-        {
-          wireguardPeerConfig = {
-            PublicKey = "KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=";
-            AllowedIPs = [ "10.34.45.100/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        # music
-        {
-          wireguardPeerConfig = {
-            PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=";
-            AllowedIPs = [ "10.34.45.101/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        # news
-        {
-          wireguardPeerConfig = {
-            PublicKey = "guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=";
-            AllowedIPs = [ "10.34.45.102/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-        {
-          wireguardPeerConfig = {
-            PublicKey = "6rwSThPEfTyYvMVSnHNcNPRntCHEQFyscF2SodI8A34=";
-            AllowedIPs = [ "10.34.45.111/32" ];
-            PersistentKeepalive = 25;
-          };
-        }
-      ];
-    };
-    networks."oxaproxy" = {
-      matchConfig.Name = "oxaproxy";
-      networkConfig = {
-        Address = "10.34.45.1/24";
-      };
-    };
-  };
-}