From 1ea959ffb66c8e27f9f6e48060023fa07db865af Mon Sep 17 00:00:00 2001
From: Grigory Shipunov
Date: Mon, 15 May 2023 16:50:29 +0200
Subject: add news

---
 microvms/news/default.nix  | 49 +++++++++++++++++++++++++++++++++
 microvms/news/miniflux.nix | 18 ++++++++++++
 microvms/news/oxaproxy.nix | 68 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 135 insertions(+)
 create mode 100644 microvms/news/default.nix
 create mode 100644 microvms/news/miniflux.nix
 create mode 100644 microvms/news/oxaproxy.nix

(limited to 'microvms')

diff --git a/microvms/news/default.nix b/microvms/news/default.nix
new file mode 100644
index 0000000..9ad3e18
--- /dev/null
+++ b/microvms/news/default.nix
@@ -0,0 +1,49 @@
+{ config, ... }: {
+  imports = [
+    ./miniflux.nix
+    ./oxaproxy.nix
+  ];
+
+  microvm = {
+    hypervisor = "qemu";
+    mem = 1 * 1024;
+    vcpu = 1;
+
+    shares = [{
+      source = "/nix/store";
+      mountPoint = "/nix/.ro-store";
+      tag = "store";
+      proto = "virtiofs";
+      socket = "store.socket";
+    }] ++ map
+      (dir: {
+        source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
+        mountPoint = "/${dir}";
+        tag = dir;
+        proto = "virtiofs";
+        socket = "${dir}.socket";
+      }) [ "etc" "var" "home" ];
+
+    interfaces = [{
+      type = "tap";
+      id = "vm-news";
+      mac = "EA:40:E8:60:C5:38";
+    }];
+  };
+
+  networking = {
+    hostName = "news";
+  };
+
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "prohibit-password";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 348"
+  ];
+
+  system.stateVersion = "22.11";
+}
diff --git a/microvms/news/miniflux.nix b/microvms/news/miniflux.nix
new file mode 100644
index 0000000..c4cd628
--- /dev/null
+++ b/microvms/news/miniflux.nix
@@ -0,0 +1,18 @@
+{ config, ... }:
+let
+  listenport = 8080;
+in
+  {
+    sops.secrets."miniflux-admin" = { };
+
+  networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ listenport ];
+  services.miniflux = {
+    enable = true;
+    config = {
+      LISTEN_ADDR = "10.34.45.102:${toString listenport}";
+      POLLING_FREQUENCY = "37";
+      CREATE_ADMIN = "1";
+    };
+    adminCredentialsFile = config.sops.secrets."miniflux-admin".path;
+  };
+}
diff --git a/microvms/news/oxaproxy.nix b/microvms/news/oxaproxy.nix
new file mode 100644
index 0000000..451bb53
--- /dev/null
+++ b/microvms/news/oxaproxy.nix
@@ -0,0 +1,68 @@
+{ config, ... }: {
+
+  networking.wireguard.enable = true;
+  networking.useNetworkd = true;
+
+  #oxaproxy secret
+  sops.defaultSopsFile = ../../secrets/news/secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."oxaproxy-seckey" = {
+    owner = config.users.users.systemd-network.name;
+  };
+
+  systemd.network = {
+    enable = true;
+    netdevs."10-oxaproxy" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "oxaproxy";
+        Description = "oxa's enterprise reverse-proxy network";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."oxaproxy-seckey".path;
+        #own pubkey: guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=
+      };
+      wireguardPeers = [
+        {
+          # cirrus
+          wireguardPeerConfig = {
+            PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
+            AllowedIPs = [ "10.34.45.0/24" ];
+            Endpoint = [ "95.216.166.21:51821" ];
+            PersistentKeepalive = 25;
+          };
+        }
+      ];
+    };
+    networks."10-oxaproxy" = {
+      matchConfig.Name = "oxaproxy";
+      networkConfig = {
+        Address = "10.34.45.102/24";
+      };
+    };
+
+    networks."111-host" = {
+      matchConfig.Name = "enp0s8";
+      networkConfig = {
+        Address = "10.99.99.102/24";
+      };
+      routes = [
+        {
+          routeConfig = {
+            Gateway = "10.99.99.1";
+            Destination = "0.0.0.0/0";
+            Metric = 1024;
+          };
+        }
+        {
+          routeConfig = {
+            Gateway = "10.99.99.1";
+            Destination = "10.99.99.0/24";
+            Metric = 1024;
+          };
+        }
+      ];
+    };
+  };
+}
-- 
cgit v1.3.1