combine config
This commit is contained in:
zuckerberg
33
common/common.nix
Normal file
33
common/common.nix
Normal file
@@ -0,0 +1,33 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./flakes.nix
|
||||
];
|
||||
|
||||
boot.loader.timeout = 2;
|
||||
|
||||
time.timeZone = "America/New_York";
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
networking.firewall.allowedUDPPorts = [ ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
wget kakoune htop git dnsutils
|
||||
];
|
||||
|
||||
users.mutableUsers = false;
|
||||
users.users.googlebot = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVR/R3ZOsv7TZbICGBCHdjh1NDT8SnswUyINeJOC7QG"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0dcqL/FhHmv+a1iz3f9LJ48xubO7MZHy35rW9SZOYM"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0VFnn3+Mh0nWeN92jov81qNE9fpzTAHYBphNoY7HUx"
|
||||
];
|
||||
hashedPassword = "$6$TuDO46rILr$gkPUuLKZe3psexhs8WFZMpzgEBGksE.c3Tjh1f8sD0KMC4oV89K2pqAABfl.Lpxu2jVdr5bgvR5cWnZRnji/r/";
|
||||
};
|
||||
}
|
||||
19
common/efi.nix
Normal file
19
common/efi.nix
Normal file
@@ -0,0 +1,19 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Use GRUB2 for EFI
|
||||
|
||||
boot.loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
version = 2;
|
||||
efiSupport = true;
|
||||
useOSProber = true;
|
||||
# memtest86.enable = true;
|
||||
configurationLimit = 20;
|
||||
theme = pkgs.nixos-grub2-theme;
|
||||
};
|
||||
};
|
||||
}
|
||||
10
common/flakes.nix
Normal file
10
common/flakes.nix
Normal file
@@ -0,0 +1,10 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
}
|
||||
61
common/luks.nix
Normal file
61
common/luks.nix
Normal file
@@ -0,0 +1,61 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
# Unlock LUKS disk over ssh
|
||||
boot.initrd.network.enable = true;
|
||||
boot.initrd.kernelModules = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
|
||||
boot.initrd.network.ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
hostKeys = [
|
||||
"/secret/ssh_host_rsa_key"
|
||||
"/secret/ssh_host_ed25519_key"
|
||||
];
|
||||
authorizedKeys = config.users.users.googlebot.openssh.authorizedKeys.keys;
|
||||
};
|
||||
|
||||
boot.initrd.postDeviceCommands = ''
|
||||
echo 'waiting for root device to be opened...'
|
||||
mkfifo /crypt-ramfs/passphrase
|
||||
echo /crypt-ramfs/passphrase >> /dev/null
|
||||
'';
|
||||
|
||||
# Make machine accessable over tor for boot unlock
|
||||
boot.initrd.secrets = {
|
||||
"/etc/tor/onion/bootup" = /secret/onion;
|
||||
};
|
||||
boot.initrd.extraUtilsCommands = ''
|
||||
copy_bin_and_libs ${pkgs.tor}/bin/tor
|
||||
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
|
||||
'';
|
||||
# start tor during boot process
|
||||
boot.initrd.network.postCommands = let
|
||||
torRc = (pkgs.writeText "tor.rc" ''
|
||||
DataDirectory /etc/tor
|
||||
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
|
||||
SOCKSPort 127.0.0.1:9063
|
||||
HiddenServiceDir /etc/tor/onion/bootup
|
||||
HiddenServicePort 22 127.0.0.1:22
|
||||
'');
|
||||
in ''
|
||||
# Add nice prompt for giving LUKS passphrase over ssh
|
||||
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
|
||||
|
||||
echo "tor: preparing onion folder"
|
||||
# have to do this otherwise tor does not want to start
|
||||
chmod -R 700 /etc/tor
|
||||
|
||||
echo "make sure localhost is up"
|
||||
ip a a 127.0.0.1/8 dev lo
|
||||
ip link set lo up
|
||||
|
||||
echo "haveged: starting haveged"
|
||||
haveged -F &
|
||||
|
||||
echo "tor: starting tor"
|
||||
tor -f ${torRc} --verify-config
|
||||
tor -f ${torRc} &
|
||||
'';
|
||||
|
||||
system.stateVersion = "20.09";
|
||||
}
|
||||
18
common/pc/audio.nix
Normal file
18
common/pc/audio.nix
Normal file
@@ -0,0 +1,18 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Audio
|
||||
sound.enable = true;
|
||||
nixpkgs.config.pulseaudio = true; # enable pulseaudio support for packages
|
||||
hardware.pulseaudio = {
|
||||
enable = true;
|
||||
support32Bit = true;
|
||||
package = pkgs.pulseaudioFull; # bt headset support
|
||||
extraConfig = "
|
||||
load-module module-switch-on-connect
|
||||
load-module module-switch-on-connect ignore_virtual=no
|
||||
";
|
||||
};
|
||||
hardware.bluetooth.enable = true;
|
||||
users.users.googlebot.extraGroups = [ "audio" ];
|
||||
}
|
||||
40
common/pc/chromium.nix
Normal file
40
common/pc/chromium.nix
Normal file
@@ -0,0 +1,40 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# chromium with specific extensions + settings
|
||||
programs.chromium = {
|
||||
enable = true;
|
||||
extensions = [
|
||||
"cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
|
||||
"gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere
|
||||
"oboonakemofpalcgghocfoadofidjkkk" # keepassxc plugin
|
||||
"cimiefiiaegbelhefglklhhakcgmhkai" # plasma integration
|
||||
"hkgfoiooedgoejojocmhlaklaeopbecg" # picture in picture
|
||||
];
|
||||
extraOpts = {
|
||||
"BrowserSignin" = 0;
|
||||
"SyncDisabled" = true;
|
||||
"PasswordManagerEnabled" = false;
|
||||
"SpellcheckEnabled" = true;
|
||||
"SpellcheckLanguage" = [ "en-US" ];
|
||||
};
|
||||
defaultSearchProviderSuggestURL = null;
|
||||
defaultSearchProviderSearchURL = " https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
|
||||
};
|
||||
|
||||
# hardware accelerated video playback (on intel)
|
||||
nixpkgs.config.packageOverrides = pkgs: {
|
||||
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
|
||||
chromium = pkgs.chromium.override { enableVaapi = true; };
|
||||
};
|
||||
hardware.opengl = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
intel-media-driver # LIBVA_DRIVER_NAME=iHD
|
||||
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
|
||||
vaapiVdpau
|
||||
libvdpau-va-gl
|
||||
];
|
||||
extraPackages32 = with pkgs.pkgsi686Linux; [ vaapiIntel ];
|
||||
};
|
||||
}
|
||||
40
common/pc/de.nix
Normal file
40
common/pc/de.nix
Normal file
@@ -0,0 +1,40 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
# General
|
||||
imports = [
|
||||
./kde.nix
|
||||
./xfce.nix
|
||||
./yubikey.nix
|
||||
./chromium.nix
|
||||
./audio.nix
|
||||
./torbrowser.nix
|
||||
./pithos.nix
|
||||
./vscodium.nix
|
||||
];
|
||||
|
||||
# allow specific unfree packages
|
||||
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
|
||||
"tigervnc" "font-bh-lucidatypewriter" # tigervnc
|
||||
];
|
||||
|
||||
# vulkan
|
||||
hardware.opengl.driSupport = true;
|
||||
hardware.opengl.driSupport32Bit = true;
|
||||
|
||||
# Applications
|
||||
users.users.googlebot.packages = with pkgs; [
|
||||
firefox chromium keepassxc mumble tigervnc bluez-tools vscodium element-desktop mpv
|
||||
];
|
||||
|
||||
# Networking
|
||||
networking.networkmanager.enable = true;
|
||||
users.users.googlebot.extraGroups = [ "networkmanager" ];
|
||||
|
||||
# Printing
|
||||
services.printing.enable = true;
|
||||
|
||||
# Security
|
||||
services.gnome3.gnome-keyring.enable = true;
|
||||
security.pam.services.googlebot.enableGnomeKeyring = true;
|
||||
}
|
||||
16
common/pc/kde.nix
Normal file
16
common/pc/kde.nix
Normal file
@@ -0,0 +1,16 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# kde plasma
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
desktopManager.plasma5.enable = true;
|
||||
displayManager.sddm.enable = true;
|
||||
};
|
||||
|
||||
# kde apps
|
||||
nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
|
||||
users.users.googlebot.packages = with pkgs; [
|
||||
akonadi kmail plasma5Packages.kmail-account-wizard
|
||||
];
|
||||
}
|
||||
47
common/pc/pithos.nix
Normal file
47
common/pc/pithos.nix
Normal file
@@ -0,0 +1,47 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
#let
|
||||
# pithos = pkgs.pithos.overrideAttrs (old: rec {
|
||||
# pname = "pithos";
|
||||
# version = "1.5.1";
|
||||
# src = pkgs.fetchFromGitHub {
|
||||
# owner = pname;
|
||||
# repo = pname;
|
||||
# rev = version;
|
||||
# sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
|
||||
# };
|
||||
# });
|
||||
#in
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
pithos = super.pithos.overrideAttrs (old: rec {
|
||||
pname = "pithos";
|
||||
version = "1.5.1";
|
||||
src = super.fetchFromGitHub {
|
||||
owner = pname;
|
||||
repo = pname;
|
||||
rev = version;
|
||||
sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
|
||||
};
|
||||
});
|
||||
})
|
||||
];
|
||||
|
||||
# nixpkgs.config.packageOverrides = pkgs: {
|
||||
# pithos = pkgs.pithos.overrideAttrs (old: rec {
|
||||
# pname = "pithos";
|
||||
# version = "1.5.1";
|
||||
# pithosSrc = pkgs.fetchFromGitHub {
|
||||
# owner = pname;
|
||||
# repo = pname;
|
||||
# rev = version;
|
||||
# sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
|
||||
# };
|
||||
# });
|
||||
# };
|
||||
|
||||
users.users.googlebot.packages = with pkgs; [
|
||||
pithos
|
||||
];
|
||||
}
|
||||
20
common/pc/torbrowser.nix
Normal file
20
common/pc/torbrowser.nix
Normal file
@@ -0,0 +1,20 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
tor-browser-bundle-bin = super.tor-browser-bundle-bin.overrideAttrs (old: rec {
|
||||
version = "10.0.10";
|
||||
lang = "en-US";
|
||||
src = pkgs.fetchurl {
|
||||
url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
|
||||
sha256 = "vYWZ+NsGN8YH5O61+zrUjlFv3rieaBqjBQ+a18sQcZg=";
|
||||
};
|
||||
});
|
||||
})
|
||||
];
|
||||
|
||||
users.users.googlebot.packages = with pkgs; [
|
||||
tor-browser-bundle-bin
|
||||
];
|
||||
}
|
||||
6
common/pc/touchpad.nix
Normal file
6
common/pc/touchpad.nix
Normal file
@@ -0,0 +1,6 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.xserver.libinput.enable = true;
|
||||
services.xserver.libinput.touchpad.naturalScrolling = true;
|
||||
}
|
||||
18
common/pc/vscodium.nix
Normal file
18
common/pc/vscodium.nix
Normal file
@@ -0,0 +1,18 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
extensions = with pkgs.vscode-extensions; [
|
||||
bbenoist.Nix # nix syntax support
|
||||
# arrterian.nix-env-selector # nix dev envs
|
||||
];
|
||||
|
||||
vscodium-with-extensions = pkgs.vscode-with-extensions.override {
|
||||
vscode = pkgs.vscodium;
|
||||
vscodeExtensions = extensions;
|
||||
};
|
||||
in
|
||||
{
|
||||
users.users.googlebot.packages = [
|
||||
vscodium-with-extensions
|
||||
];
|
||||
}
|
||||
16
common/pc/xfce.nix
Normal file
16
common/pc/xfce.nix
Normal file
@@ -0,0 +1,16 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
desktopManager = {
|
||||
xterm.enable = false;
|
||||
xfce.enable = true;
|
||||
};
|
||||
displayManager.sddm.enable = true;
|
||||
};
|
||||
|
||||
# xfce apps
|
||||
users.users.googlebot.packages = with pkgs; [
|
||||
];
|
||||
}
|
||||
7
common/pc/yubikey.nix
Normal file
7
common/pc/yubikey.nix
Normal file
@@ -0,0 +1,7 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# yubikey
|
||||
services.pcscd.enable = true;
|
||||
services.udev.packages = [ pkgs.yubikey-personalization ];
|
||||
}
|
||||
113
common/server/gitlab.nix
Normal file
113
common/server/gitlab.nix
Normal file
@@ -0,0 +1,113 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.gitlab = {
|
||||
enable = true;
|
||||
databasePasswordFile = "/var/keys/gitlab/db_password";
|
||||
initialRootPasswordFile = "/var/keys/gitlab/root_password";
|
||||
https = true;
|
||||
host = "git.neet.dev";
|
||||
port = 443;
|
||||
user = "git";
|
||||
group = "git";
|
||||
databaseUsername = "git";
|
||||
smtp = {
|
||||
enable = true;
|
||||
address = "localhost";
|
||||
port = 25;
|
||||
};
|
||||
secrets = {
|
||||
dbFile = "/var/keys/gitlab/db";
|
||||
secretFile = "/var/keys/gitlab/secret";
|
||||
otpFile = "/var/keys/gitlab/otp";
|
||||
jwsFile = "/var/keys/gitlab/jws";
|
||||
};
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
email_from = "gitlab-no-reply@neet.dev";
|
||||
email_display_name = "neet.dev GitLab";
|
||||
email_reply_to = "gitlab-no-reply@neet.dev";
|
||||
};
|
||||
pages = {
|
||||
enabled = true;
|
||||
host = "pages.neet.dev";
|
||||
port = 443;
|
||||
https = true;
|
||||
};
|
||||
};
|
||||
pagesExtraArgs = [ "-listen-proxy" "127.0.0.1:8090" ];
|
||||
};
|
||||
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
||||
services.gitlab-runner = {
|
||||
# enable = true;
|
||||
enable = false;
|
||||
services = {
|
||||
# runner for building in docker via host's nix-daemon
|
||||
# nix store will be readable in runner, might be insecure
|
||||
nix = {
|
||||
registrationConfigFile = "/run/secrets/gitlab-runner-registration";
|
||||
dockerImage = "alpine";
|
||||
dockerVolumes = [
|
||||
"/nix/store:/nix/store:ro"
|
||||
"/nix/var/nix/db:/nix/var/nix/db:ro"
|
||||
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
|
||||
];
|
||||
dockerDisableCache = true;
|
||||
preBuildScript = pkgs.writeScript "setup-container" ''
|
||||
mkdir -p -m 0755 /nix/var/log/nix/drvs
|
||||
mkdir -p -m 0755 /nix/var/nix/gcroots
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles
|
||||
mkdir -p -m 0755 /nix/var/nix/temproots
|
||||
mkdir -p -m 0755 /nix/var/nix/userpool
|
||||
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
|
||||
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
|
||||
mkdir -p -m 0700 "$HOME/.nix-defexpr"
|
||||
|
||||
. ${pkgs.nix}/etc/profile.d/nix.sh
|
||||
|
||||
${pkgs.nix}/bin/nix-env -i ${builtins.concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
|
||||
|
||||
${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
|
||||
${pkgs.nix}/bin/nix-channel --update nixpkgs
|
||||
'';
|
||||
environmentVariables = {
|
||||
ENV = "/etc/profile";
|
||||
USER = "root";
|
||||
NIX_REMOTE = "daemon";
|
||||
PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
|
||||
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
|
||||
};
|
||||
tagList = [ "nix" ];
|
||||
};
|
||||
# runner for building docker images
|
||||
docker-images = {
|
||||
registrationConfigFile = "/run/secrets/gitlab-runner-registration";
|
||||
dockerImage = "docker:stable";
|
||||
dockerVolumes = [
|
||||
"/var/run/docker.sock:/var/run/docker.sock"
|
||||
];
|
||||
tagList = [ "docker-images" ];
|
||||
};
|
||||
# runner for everything else
|
||||
default = {
|
||||
registrationConfigFile = "/run/secrets/gitlab-runner-registration";
|
||||
dockerImage = "debian:stable";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"git.neet.dev" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
};
|
||||
"*.pages.neet.dev" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "pages.neet.dev";
|
||||
locations."/".proxyPass = "http://localhost:8090";
|
||||
};
|
||||
};
|
||||
}
|
||||
31
common/server/mumble.nix
Normal file
31
common/server/mumble.nix
Normal file
@@ -0,0 +1,31 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
murmurPort = 23563;
|
||||
domain = "voice.neet.space";
|
||||
certs = config.security.acme.certs;
|
||||
in {
|
||||
config.networking.firewall.allowedTCPPorts = [ murmurPort ];
|
||||
config.networking.firewall.allowedUDPPorts = [ murmurPort ];
|
||||
|
||||
config.services.murmur = {
|
||||
enable = true;
|
||||
port = murmurPort;
|
||||
sslCa = "${certs.${domain}.directory}/chain.pem";
|
||||
sslKey = "${certs.${domain}.directory}/key.pem";
|
||||
sslCert = "${certs.${domain}.directory}/fullchain.pem";
|
||||
welcometext = "Welcome to ${domain}";
|
||||
};
|
||||
|
||||
config.services.nginx.virtualHosts."${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
|
||||
# give mumble access to acme certs
|
||||
config.security.acme.certs.${domain} = {
|
||||
group = "murmur";
|
||||
postRun = "systemctl reload-or-restart murmur";
|
||||
};
|
||||
config.users.users.nginx.extraGroups = [ "murmur" ];
|
||||
}
|
||||
95
common/server/nsd.nix
Normal file
95
common/server/nsd.nix
Normal file
@@ -0,0 +1,95 @@
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
services.nsd = let
|
||||
self = "142.4.210.222";
|
||||
secondary = "167.114.154.31";
|
||||
in {
|
||||
enable = true;
|
||||
interfaces = [ "0.0.0.0" ];
|
||||
roundRobin = true;
|
||||
ipTransparent = true;
|
||||
zones.neet = rec {
|
||||
provideXFR = [ "${secondary} NOKEY" ];
|
||||
notify = provideXFR;
|
||||
children = {
|
||||
"neet.dev.".data = ''
|
||||
$TTL 300
|
||||
@ IN SOA ns1.neet.dev. contact.neet.dev. (
|
||||
2011072000 ;Serial
|
||||
300 ;Refresh
|
||||
300 ;Retry
|
||||
604800 ;Expire
|
||||
300 ;Minimum TTL
|
||||
)
|
||||
|
||||
@ IN NS ns1.neet.dev.
|
||||
@ IN NS ns2.neet.dev.
|
||||
|
||||
@ IN A ${self}
|
||||
www IN A ${self}
|
||||
irc IN A ${self}
|
||||
wiki IN A ${self}
|
||||
ns1 IN A ${self}
|
||||
ns2 IN A 167.114.154.31
|
||||
ragnarok IN A 155.138.219.146
|
||||
coder IN A ${self}
|
||||
git IN A ${self}
|
||||
|
||||
@ IN TXT "rizon_vhost=Googlebot"
|
||||
ownercheck IN TXT "dc97b3fd"
|
||||
'';
|
||||
"neet.space.".data = ''
|
||||
$TTL 300
|
||||
@ IN SOA ns1.neet.dev. contact.neet.dev. (
|
||||
2011071017 ;Serial
|
||||
300 ;Refresh
|
||||
300 ;Retry
|
||||
604800 ;Expire
|
||||
300 ;Minimum TTL
|
||||
)
|
||||
|
||||
@ IN NS ns1.neet.dev.
|
||||
@ IN NS ns2.neet.dev.
|
||||
|
||||
@ IN A ${self}
|
||||
www IN A ${self}
|
||||
voice IN A ${self}
|
||||
stream IN A ${self}
|
||||
radio IN A ${self}
|
||||
tube IN A ${self}
|
||||
sock.tube IN A ${self}
|
||||
mural IN A ${self}
|
||||
|
||||
_minecraft._tcp IN SRV 0 5 23589 neet.space.
|
||||
_mumble._tcp IN SRV 0 5 23563 voice.neet.space.
|
||||
_mumble._tcp.voice IN SRV 0 5 23563 voice.neet.space.
|
||||
|
||||
@ IN TXT "rizon_vhost=Googlebot"
|
||||
ownercheck IN TXT "dc97b3fd"
|
||||
'';
|
||||
"neet.cloud.".data = ''
|
||||
$TTL 300
|
||||
@ IN SOA ns1.neet.dev. contact.neet.dev. (
|
||||
2011071011 ;Serial
|
||||
300 ;Refresh
|
||||
300 ;Retry
|
||||
604800 ;Expire
|
||||
300 ;Minimum TTL
|
||||
)
|
||||
|
||||
@ IN NS ns1.neet.dev.
|
||||
@ IN NS ns2.neet.dev.
|
||||
|
||||
@ IN A ${self}
|
||||
www IN A ${self}
|
||||
paste IN A ${self}
|
||||
globie-info IN A ${self}
|
||||
files IN A ${self}
|
||||
|
||||
ownercheck IN TXT "dc97b3fd"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
44
common/server/thelounge.nix
Normal file
44
common/server/thelounge.nix
Normal file
@@ -0,0 +1,44 @@
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
services.thelounge = {
|
||||
enable = true;
|
||||
port = 9000;
|
||||
private = true;
|
||||
extraConfig = {
|
||||
reverseProxy = true;
|
||||
maxHistory = -1;
|
||||
https.enable = false;
|
||||
# theme = "thelounge-theme-solarized";
|
||||
prefetch = false;
|
||||
prefetchStorage = false;
|
||||
fileUpload = {
|
||||
enable = true;
|
||||
maxFileSize = -1;
|
||||
baseUrl = "https://files.neet.cloud/irc/";
|
||||
};
|
||||
transports = [ "websocket" "polling" ];
|
||||
leaveMessage = "leaving";
|
||||
messageStorage = [ "sqlite" "text" ];
|
||||
};
|
||||
};
|
||||
|
||||
# the lounge client
|
||||
services.nginx.virtualHosts."irc.neet.dev" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString config.services.thelounge.port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
# the lounge files
|
||||
services.nginx.virtualHosts."files.neet.cloud" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/irc" = {
|
||||
proxyPass = "http://localhost:${toString config.services.thelounge.port}/uploads";
|
||||
};
|
||||
};
|
||||
}
|
||||
94
common/server/video-stream.nix
Normal file
94
common/server/video-stream.nix
Normal file
@@ -0,0 +1,94 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
# external
|
||||
rtp-port = 8083;
|
||||
webrtc-peer-lower-port = 20000;
|
||||
webrtc-peer-upper-port = 20100;
|
||||
domain = "live.neet.space";
|
||||
|
||||
# internal
|
||||
ingest-port = 8084;
|
||||
web-port = 8085;
|
||||
webrtc-port = 8086;
|
||||
toStr = builtins.toString;
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedUDPPorts = [ rtp-port ];
|
||||
networking.firewall.allowedTCPPortRanges = [ {
|
||||
from = webrtc-peer-lower-port;
|
||||
to = webrtc-peer-upper-port;
|
||||
} ];
|
||||
networking.firewall.allowedUDPPortRanges = [ {
|
||||
from = webrtc-peer-lower-port;
|
||||
to = webrtc-peer-upper-port;
|
||||
} ];
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://localhost:${toStr web-port}";
|
||||
};
|
||||
"websocket" = {
|
||||
proxyPass = "http://localhost:${toStr webrtc-port}/websocket";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.oci-containers = {
|
||||
backend = "docker";
|
||||
containers = {
|
||||
"lightspeed-ingest" = {
|
||||
workdir = "/var/lib/lightspeed-ingest";
|
||||
image = "projectlightspeed/ingest";
|
||||
ports = [
|
||||
"${toStr ingest-port}:8084"
|
||||
];
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/ingest";
|
||||
# finalImageTag = "version-0.1.4";
|
||||
# imageDigest = "sha256:9fc51833b7c27a76d26e40f092b9cec1ac1c4bfebe452e94ad3269f1f73ff2fc";
|
||||
# sha256 = "19kxl02x0a3i6hlnsfcm49hl6qxnq2f3hfmyv1v8qdaz58f35kd5";
|
||||
# };
|
||||
};
|
||||
"lightspeed-react" = {
|
||||
workdir = "/var/lib/lightspeed-react";
|
||||
image = "projectlightspeed/react";
|
||||
ports = [
|
||||
"${toStr web-port}:80"
|
||||
];
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/react";
|
||||
# finalImageTag = "version-0.1.3";
|
||||
# imageDigest = "sha256:b7c58425f1593f7b4304726b57aa399b6e216e55af9c0962c5c19333fae638b6";
|
||||
# sha256 = "0d2jh7mr20h7dxgsp7ml7cw2qd4m8ja9rj75dpy59zyb6v0bn7js";
|
||||
# };
|
||||
};
|
||||
"lightspeed-webrtc" = {
|
||||
workdir = "/var/lib/lightspeed-webrtc";
|
||||
image = "projectlightspeed/webrtc";
|
||||
ports = [
|
||||
"${toStr webrtc-port}:8080"
|
||||
"${toStr rtp-port}:65535/udp"
|
||||
"${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}:${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}/tcp"
|
||||
"${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}:${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}/udp"
|
||||
];
|
||||
cmd = [
|
||||
"lightspeed-webrtc" "--addr=0.0.0.0" "--ip=${domain}"
|
||||
"--ports=${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}" "run"
|
||||
];
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/webrtc";
|
||||
# finalImageTag = "version-0.1.2";
|
||||
# imageDigest = "sha256:ddf8b3dd294485529ec11d1234a3fc38e365a53c4738998c6bc2c6930be45ecf";
|
||||
# sha256 = "1bdy4ak99fjdphj5bsk8rp13xxmbqdhfyfab14drbyffivg9ad2i";
|
||||
# };
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
55
common/server/zerobin.nix
Normal file
55
common/server/zerobin.nix
Normal file
@@ -0,0 +1,55 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
zerobin_config = pkgs.writeText "zerobin-config.py" ''
|
||||
PASTE_FILES_ROOT = "/var/lib/zerobin"
|
||||
'';
|
||||
in {
|
||||
# services.zerobin = {
|
||||
# enable = true;
|
||||
# listenAddress = "0.0.0.0";
|
||||
# listenPort = 9002;
|
||||
# };
|
||||
|
||||
nixpkgs.config.packageOverrides = pkgs:
|
||||
with pkgs;
|
||||
{
|
||||
python38Packages.cherrypy = python38Packages.cherrypy.overrideAttrs (attrs: rec {
|
||||
src = fetchPypi {
|
||||
pname = "CherryPy";
|
||||
version = "8.9.1";
|
||||
sha256 = "";
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."paste.neet.cloud" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:9002";
|
||||
};
|
||||
};
|
||||
|
||||
users.users.zerobin = {
|
||||
isSystemUser = true;
|
||||
group = "zerobin";
|
||||
home = "/var/lib/zerobin";
|
||||
createHome = true;
|
||||
};
|
||||
users.groups.zerobin = {};
|
||||
|
||||
systemd.services.zerobin = {
|
||||
enable = true;
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig.ExecStart = "${pkgs.python38Packages.zerobin}/bin/zerobin 0.0.0.0 9002 false zerobin zerobin ${zerobin_config}";
|
||||
serviceConfig.PrivateTmp="yes";
|
||||
serviceConfig.User = "zerobin";
|
||||
serviceConfig.Group = "zerobin";
|
||||
preStart = ''
|
||||
mkdir -p "/var/lib/zerobin"
|
||||
chown zerobin "/var/lib/zerobin"
|
||||
'';
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user