From c1e09364bb412f1e09d1a680e5200d375a61694f Mon Sep 17 00:00:00 2001 From: Grigory Shipunov Date: Thu, 2 Jan 2025 15:35:05 +0000 Subject: remove obsolete infra --- hosts/cirrus/configuration.nix | 64 ----------------- hosts/cirrus/default.nix | 9 --- hosts/cirrus/hardware-configuration.nix | 39 ---------- hosts/cirrus/irc.nix | 46 ------------ hosts/cirrus/nextcloud-proxy.nix | 64 ----------------- hosts/cirrus/secrets.nix | 14 ---- hosts/cirrus/wireguard-server.nix | 123 -------------------------------- 7 files changed, 359 deletions(-) delete mode 100644 hosts/cirrus/configuration.nix delete mode 100644 hosts/cirrus/default.nix delete mode 100644 hosts/cirrus/hardware-configuration.nix delete mode 100644 hosts/cirrus/irc.nix delete mode 100644 hosts/cirrus/nextcloud-proxy.nix delete mode 100644 hosts/cirrus/secrets.nix delete mode 100644 hosts/cirrus/wireguard-server.nix (limited to 'hosts/cirrus') diff --git a/hosts/cirrus/configuration.nix b/hosts/cirrus/configuration.nix deleted file mode 100644 index bfdf7f5..0000000 --- a/hosts/cirrus/configuration.nix +++ /dev/null @@ -1,64 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, ... }: - -{ - # Use the GRUB 2 boot loader. - boot.loader.grub.enable = true; - boot.loader.grub.efiSupport = true; - boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only - - zramSwap = { enable = true; algorithm = "zstd"; }; - - networking = { - hostName = "cirrus"; # Define your hostname. - }; - - systemd.network = { - enable = true; - networks."uplink" = { - matchConfig = { Name = "enp1s0"; }; - networkConfig = { - Address = "95.216.166.21/32"; - DNS = "9.9.9.9"; - }; - routes = [ - { - routeConfig = { - Gateway = "172.31.1.1"; - GatewayOnLink = true; - Destination = "0.0.0.0/0"; - }; - } - ]; - }; - }; - - - # Set your time zone. - time.timeZone = "Europe/Amsterdam"; - - # Select internationalisation properties. - i18n.defaultLocale = "en_US.UTF-8"; - # Open ports in the firewall. - networking.firewall.enable = true; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "22.05"; # Did you read the comment? - -} - diff --git a/hosts/cirrus/default.nix b/hosts/cirrus/default.nix deleted file mode 100644 index d205721..0000000 --- a/hosts/cirrus/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ - imports = [ - ./configuration.nix - ./hardware-configuration.nix - ./nextcloud-proxy.nix - ./secrets.nix - ./wireguard-server.nix - ]; -} diff --git a/hosts/cirrus/hardware-configuration.nix b/hosts/cirrus/hardware-configuration.nix deleted file mode 100644 index 0bd3907..0000000 --- a/hosts/cirrus/hardware-configuration.nix +++ /dev/null @@ -1,39 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ - (modulesPath + "/profiles/qemu-guest.nix") - ]; - - boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { - device = "/dev/disk/by-uuid/627952eb-107a-43c3-8223-bfea9af92837"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { - device = "/dev/disk/by-uuid/5CA6-CCE4"; - fsType = "vfat"; - }; - - swapDevices = [ ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault false; - networking.interfaces.enp1s0.useDHCP = lib.mkDefault false; - - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/hosts/cirrus/irc.nix b/hosts/cirrus/irc.nix deleted file mode 100644 index 6bda646..0000000 --- a/hosts/cirrus/irc.nix +++ /dev/null @@ -1,46 +0,0 @@ -{ pkgs, config, ... }: { - services.nginx = { - # reverse-proxy irc traffic on 7000 - streamConfig = '' - upstream soju { - server 127.0.0.1:6667; - } - - server { - listen 7000 ssl; - listen [::]:7000 ssl; - - ssl_certificate /var/lib/acme/mrbouncy.oxapentane.com/fullchain.pem; - ssl_certificate_key /var/lib/acme/mrbouncy.oxapentane.com/key.pem; - ssl_trusted_certificate /var/lib/acme/mrbouncy.oxapentane.com/chain.pem; - - proxy_pass soju; - } - ''; - # just here to get the cert for irc reverse proxy - virtualHosts = { - "mrbouncy.oxapentane.com" = { - enableACME = true; - forceSSL = true; - locations = { - "/" = { - # no content for now, here just for no-boilerplate cert - return = "204"; - }; - }; - }; - }; - }; - - services.soju = { - hostName = "mrbouncy.oxapentane.com"; - listen = [ "irc+insecure://127.0.0.1:6667" ]; - enable = true; - enableMessageLogging = true; - acceptProxyIP = [ "localhost" ]; - }; - - environment.systemPackages = [ pkgs.soju ]; # expose soju mgmt commands - - networking.firewall.allowedTCPPorts = [ 7000 ]; -} diff --git a/hosts/cirrus/nextcloud-proxy.nix b/hosts/cirrus/nextcloud-proxy.nix deleted file mode 100644 index 3b5166a..0000000 --- a/hosts/cirrus/nextcloud-proxy.nix +++ /dev/null @@ -1,64 +0,0 @@ -{ config, pkgs, ... }: { - security.acme = { - defaults.email = "acme@oxapentane.com"; - acceptTerms = true; - }; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; - - services.nginx = { - enable = true; - recommendedProxySettings = true; - recommendedGzipSettings = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - - sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; - }; - - services.nginx.virtualHosts = { - "nc.oxapentane.com" = { - enableACME = true; - forceSSL = true; - extraConfig = '' - client_max_body_size 512M; - ''; - locations = { - "/" = { - proxyPass = "http://10.34.45.100:8080"; - }; - "/well-known/carddav" = { - return = "301 $scheme://$host/remote.php/dav"; - }; - "/well-known/caldav" = { - return = "301 $scheme://$host/remote.php/dav"; - }; - }; - }; - - "music.oxapentane.com" = { - enableACME = true; - forceSSL = true; - extraConfig = '' - client_max_body_size 32M; - ''; - locations = { - "/" = { - proxyPass = "http://10.34.45.101:4533"; - }; - }; - }; - "news.oxapentane.com" = { - enableACME = true; - forceSSL = true; - extraConfig = '' - client_max_body_size 32M; - ''; - locations = { - "/" = { - proxyPass = "http://10.34.45.102:8080"; - }; - }; - }; - }; -} diff --git a/hosts/cirrus/secrets.nix b/hosts/cirrus/secrets.nix deleted file mode 100644 index df095a7..0000000 --- a/hosts/cirrus/secrets.nix +++ /dev/null @@ -1,14 +0,0 @@ -{ config, ... }: -{ - sops.defaultSopsFile = ../../secrets/cirrus/secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/oxalab-seckey" = { - owner = config.users.users.systemd-network.name; - }; - "wg/oxaproxy-seckey" = { - owner = config.users.users.systemd-network.name; - }; - }; -} diff --git a/hosts/cirrus/wireguard-server.nix b/hosts/cirrus/wireguard-server.nix deleted file mode 100644 index 74e6091..0000000 --- a/hosts/cirrus/wireguard-server.nix +++ /dev/null @@ -1,123 +0,0 @@ -{ config, ... }: -{ - networking.firewall = { - allowedUDPPorts = [ - # wireguards - 51820 - 51821 - 34197 - ]; - allowedTCPPorts = [ - # port forward ssh to music - 2020 - ]; - # port-forward ssh to the music machine - extraCommands = '' - iptables -t nat -I PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22 - iptables -t nat -I PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197 - iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE - ''; - extraStopCommands = '' - iptables -t nat -D PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22 || true - iptables -t nat -D PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197 || true - ''; - }; - - - networking.wireguard.enable = true; - - systemd.network = { - # oxalab - netdevs."oxalab" = { - netdevConfig = { - Kind = "wireguard"; - Name = "oxalab"; - Description = "oxa's enterprise network"; - }; - wireguardConfig = { - PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path; - ListenPort = 51820; - # own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E= - }; - wireguardPeers = [ - { - # microwave - wireguardPeerConfig = { - PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc="; - AllowedIPs = [ "10.66.66.10/32" ]; - PersistentKeepalive = 25; - }; - } - { - # Dishwasher - wireguardPeerConfig = { - PublicKey = "AdWUBbyeRkxdP9HUu25PpISoxbgQ8oeCw3BmV93xtAw="; - AllowedIPs = [ "10.66.66.100/32" ]; - PersistentKeepalive = 25; - }; - } - ]; - }; - networks."oxalab" = { - matchConfig.Name = "oxalab"; - networkConfig = { - Address = "10.66.66.1/24"; - IPForward = "ipv4"; - }; - }; - - - # oxaproxy - netdevs."oxaproxy" = { - netdevConfig = { - Kind = "wireguard"; - Name = "oxaproxy"; - Description = "oxa's enterprise reverse-proxy network"; - }; - wireguardConfig = { - PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path; - #own pubkey 0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM= - ListenPort = 51821; - }; - wireguardPeers = [ - # nextcloud - { - wireguardPeerConfig = { - PublicKey = "KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0="; - AllowedIPs = [ "10.34.45.100/32" ]; - PersistentKeepalive = 25; - }; - } - # music - { - wireguardPeerConfig = { - PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0="; - AllowedIPs = [ "10.34.45.101/32" ]; - PersistentKeepalive = 25; - }; - } - # news - { - wireguardPeerConfig = { - PublicKey = "guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0="; - AllowedIPs = [ "10.34.45.102/32" ]; - PersistentKeepalive = 25; - }; - } - { - wireguardPeerConfig = { - PublicKey = "6rwSThPEfTyYvMVSnHNcNPRntCHEQFyscF2SodI8A34="; - AllowedIPs = [ "10.34.45.111/32" ]; - PersistentKeepalive = 25; - }; - } - ]; - }; - networks."oxaproxy" = { - matchConfig.Name = "oxaproxy"; - networkConfig = { - Address = "10.34.45.1/24"; - }; - }; - }; -} -- cgit v1.3.1