Setup mail server and restructure some things

config/common/default.nix

@@ -0,0 +1,74 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./prometheus-node-exporter.nix
+    ./nginx.nix
+    ../users/colmena-deploy
+    ../users/yuri
+  ];
+
+  time.timeZone = "Europe/Berlin";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    keyMap = "de-latin1";
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  nix.settings = {
+    trusted-users = [ "colmena-deploy" ];
+    auto-optimise-store = true;
+    experimental-features = [ "nix-command" "flakes" ];
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    parted
+    tmux
+    nano
+  ];
+
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  security.acme = {
+    defaults.email = "acme@grzb.de";
+    acceptTerms = true;
+    preliminarySelfsigned = true;
+  };
+
+  # Print the ed25519 public ssh host key to console when booting
+  systemd.units."print-public-ssh-host-key.service" = {
+    enable = true;
+    text = ''
+      [Unit]
+      Description=print-public-ssh-host-key.service
+      Before=getty@tty1.service
+      After=sshd.service
+
+      [Service]
+      Type=oneshot
+      ExecStart=/run/current-system/sw/bin/bash -c "/run/current-system/sw/bin/echo -e \"----- ED25519 PUBLIC SSH HOST KEY -----\
+                \n$(/run/current-system/sw/bin/cut -d ' ' -f 1-2 /etc/ssh/ssh_host_ed25519_key.pub)\""
+      RemainAfterExit=no
+      StandardOutput=tty
+    '';
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  services.fstrim.enable = true;
+}

config/common/nginx.nix

@@ -0,0 +1,9 @@
+{ ... }: {
+  services.nginx = {
+    enableReload = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+}

config/common/prometheus-node-exporter.nix

@@ -0,0 +1,7 @@
+{ lib, ... }:
+{
+  services.prometheus.exporters.node = {
+    enable = lib.mkDefault true;
+    openFirewall = true;
+  };
+}

config/environments/proxmox-vm/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  services.qemuGuest.enable = true;
+}

config/environments/proxmox-vm/hardware-configuration.nix

@@ -0,0 +1,45 @@
+{ config, lib, modulesPath, ... }:
+{
+  # hardware-configuration.nix copied and adapted from the default configuration generated by nixos-generators
+
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    initrd = {
+      # To use the VirtIO SCSI disks, add the "virtio_scsi" kernel module to availableKernelModules
+      availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_blk" ];
+      kernelModules = [ ];
+    };
+
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+
+    # Enable console output on TTY1 and serial console
+    kernelParams = [
+      "console=tty1"
+      "console=ttyS0,115200"
+    ];
+
+    growPartition = true;
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+    autoResize = true;
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

config/hosts/coturn/acme.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  security.acme.certs = {
+    "turn.nekover.se" = {
+      listenHTTP = ":80";
+      group = "turnserver";
+      reloadServices = [ "coturn.service" ];
+    };
+  };
+}

config/hosts/coturn/configuration.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "coturn";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 3478 5349 ];
+      allowedUDPPorts = [ 3478 5349 ];
+      allowedUDPPortRanges = [{
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/coturn/coturn.nix

@@ -0,0 +1,45 @@
+{ config, ... }:
+{
+  services.coturn = {
+    enable = true;
+    min-port = 49200;
+    max-port = 49500;
+    use-auth-secret = true;
+    static-auth-secret-file = "/secrets/static-auth-secret.secret";
+    realm = "turn.nekover.se";
+    cert = "${config.security.acme.certs."turn.nekover.se".directory}/fullchain.pem";
+    pkey = "${config.security.acme.certs."turn.nekover.se".directory}/key.pem";
+    no-tcp-relay = true;
+    no-cli = true;
+    extraConfig = ''
+      external-ip=170.133.2.81/10.202.41.118
+      prometheus
+      syslog
+
+      no-tlsv1
+      no-tlsv1_1
+
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+
+      no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+
+      allowed-peer-ip=10.202.41.118
+
+      user-quota=12
+      total-quota=1200
+    '';
+  };
+}

config/hosts/coturn/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./acme.nix
+    ./coturn.nix
+  ];
+}

config/hosts/coturn/secrets.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  deployment.keys."static-auth-secret.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "coturn/static-auth-secret" ];
+    destDir = "/secrets";
+    user = "turnserver";
+    group = "turnserver";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+}

config/hosts/hydra/configuration.nix

@@ -0,0 +1,40 @@
+{ ... }:
+{
+  boot = {
+    loader.grub = {
+      enable = true;
+      device = "/dev/vda";
+    };
+
+    binfmt.emulatedSystems = [
+      "armv6l-linux"
+      "armv7l-linux"
+      "aarch64-linux"
+    ];
+  };
+
+  networking = {
+    hostName = "hydra";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 8443 ];
+    };
+  };
+
+  nix = {
+    settings.allowed-uris = "http:// https://";
+    buildMachines = [
+      {
+        hostName = "localhost";
+        systems = [
+          "x86_64-linux"
+          "armv6l-linux"
+          "armv7l-linux"
+          "aarch64-linux"
+        ];
+      }
+    ];
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/hydra/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./hydra.nix
+    ./nix-serve.nix
+    ./nginx.nix
+  ];
+}

config/hosts/hydra/hydra.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://hydra.nekover.se";
+    listenHost = "localhost";
+    port = 3001;
+    useSubstitutes = true;
+    notificationSender = "hydra@robot.grzb.de";
+    extraConfig = "
+      binary_cache_public_uri = https://nix-cache.nekover.se
+    ";
+  };
+}

config/hosts/hydra/nginx.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "hydra.nekover.se" = {
+        forceSSL = true;
+        enableACME = true;
+        listen = [{
+          addr = "0.0.0.0";
+          port = 80;
+        }];
+        locations."/" = {
+          proxyPass = "http://localhost:3001";
+        };
+        extraConfig = ''
+          listen 0.0.0.0:8443 http2 ssl proxy_protocol;
+
+          set_real_ip_from 10.202.41.100;
+          real_ip_header proxy_protocol;
+        '';
+      };
+      "nix-cache.nekover.se" = {
+        forceSSL = true;
+        enableACME = true;
+        listen = [        {
+          addr = "0.0.0.0";
+          port = 80;
+        }];
+        locations."/" = {
+          proxyPass = "http://localhost:5005";
+        };
+        extraConfig = ''
+          listen 0.0.0.0:8443 http2 ssl proxy_protocol;
+
+          set_real_ip_from 10.202.41.100;
+          real_ip_header proxy_protocol;
+        '';
+      };
+    };
+  };
+}

config/hosts/hydra/nix-serve.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  services.nix-serve = {
+    enable = true;
+    port = 5005;
+    bindAddress = "localhost";
+    secretKeyFile = "/secrets/signing-key.secret";
+  };
+}

config/hosts/hydra/secrets.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  deployment.keys."signing-key.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "hydra/signing-key" ];
+    destDir = "/secrets";
+    user = "root";
+    group = "root";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+}

config/hosts/iperf/configuration.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "iperf";
+    firewall.enable = true;
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/iperf/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./iperf.nix
+  ];
+}

config/hosts/iperf/iperf.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.iperf3 = {
+    enable = true;
+    openFirewall = true;
+  };
+}

config/hosts/jackett/configuration.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "jackett";
+    firewall.enable = false;
+  };
+
+  system.stateVersion = "23.05";
+}