From d0309c51a06868913f5a6df75f380141fe6af75c Mon Sep 17 00:00:00 2001 From: Henrik Lissner Date: Wed, 20 Jan 2021 03:43:03 -0500 Subject: [PATCH] hosts/ao: rewrite & use agenix --- hosts/ao/default.nix | 113 ++++++------------------ hosts/ao/modules/bitwarden.nix | 32 +++++++ hosts/ao/modules/gitea.nix | 31 +++++++ hosts/ao/secrets/bitwarden-smtp-env.age | Bin 0 -> 441 bytes hosts/ao/secrets/gitea-smtp.age | 7 ++ hosts/ao/secrets/secrets.nix | 5 ++ 6 files changed, 100 insertions(+), 88 deletions(-) create mode 100644 hosts/ao/modules/bitwarden.nix create mode 100644 hosts/ao/modules/gitea.nix create mode 100644 hosts/ao/secrets/bitwarden-smtp-env.age create mode 100644 hosts/ao/secrets/gitea-smtp.age create mode 100644 hosts/ao/secrets/secrets.nix diff --git a/hosts/ao/default.nix b/hosts/ao/default.nix index f8799ba2..4672077d 100644 --- a/hosts/ao/default.nix +++ b/hosts/ao/default.nix @@ -7,17 +7,25 @@ with lib.my; imports = [ ../personal.nix ./hardware-configuration.nix + + # ./modules/postgresql.nix + ./modules/gitea.nix + ./modules/bitwarden.nix + # ./modules/tinytinyrss.nix ]; + ## Modules modules = { - shell.git.enable = true; - shell.zsh.enable = true; - services.ssh.enable = true; - services.nginx.enable = true; - services.gitea.enable = true; - services.bitwarden.enable = true; - # services.syncthing.enable = true; + shell = { + git.enable = true; + zsh.enable = true; + }; + services = { + fail2ban.enable = true; + ssh.enable = true; + nginx.enable = true; + }; theme.active = "alucard"; }; @@ -27,87 +35,16 @@ with lib.my; networking.networkmanager.enable = true; # nginx hosts - services.nginx = { - user = config.user.name; - virtualHosts = { - "v0.io" = { - default = true; - forceSSL = true; - enableACME = true; - extraConfig = '' - client_max_body_size 128M; - ''; - locations."/" = { - proxyPass = "https://192.168.1.3:8001"; - extraConfig = '' - proxy_ssl_server_name on; - proxy_pass_header Authorization; - ''; - }; - }; - "git.v0.io" = { - forceSSL = true; - enableACME = true; - locations."/".proxyPass = "http://127.0.0.1:3000"; - }; - "p.v0.io" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8000"; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - ''; - }; - locations."/notifications/hub" = { - proxyPass = "http://127.0.0.1:3012"; - extraConfig = '' - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - ''; - }; - locations."/notifications/hub/negotiate" = { - proxyPass = "http://127.0.0.1:8001"; - }; - }; - }; - }; - - security.acme = { - acceptTerms = true; - certs = let email = "henrik@lissner.net"; in { - "v0.io".email = email; - "git.v0.io".email = email; - "p.v0.io".email = email; - }; - }; - - services.gitea = { - appName = "V-NOUGHT"; - domain = "v0.io"; - rootUrl = "https://git.v0.io/"; - settings.server.SSH_DOMAIN = "v0.io"; - }; - - services.bitwarden_rs.config = { - signupsAllowed = false; - domain = "https://p.v0.io"; - httpPort = 8002; - }; - - services.fail2ban = { - enable = true; - ignoreIP = [ "127.0.0.1/8" "192.168.1.0/24" ]; - jails.DEFAULT = '' - bantime = 3600 - ''; - jails.sshd = '' - filter = sshd - action = iptables[name=ssh, port=22, protocl=tcp] - enabled = true + services.nginx.virtualHosts."v0.io" = { + default = true; + forceSSL = true; + enableACME = true; + locations."/".extraConfig = '' + proxy_pass https://kiiro:8001; + proxy_ssl_server_name on; + proxy_pass_header Authorization; ''; }; + + security.acme.email = "henrik@lissner.net"; } diff --git a/hosts/ao/modules/bitwarden.nix b/hosts/ao/modules/bitwarden.nix new file mode 100644 index 00000000..31ad8fa7 --- /dev/null +++ b/hosts/ao/modules/bitwarden.nix @@ -0,0 +1,32 @@ +{ config, lib, ... }: + +{ + modules.services.bitwarden.enable = true; + + services.bitwarden_rs.config = { + signupsAllowed = false; + invitationsAllowed = true; + domain = "https://p.v0.io"; + httpPort = 8002; + }; + + # Inject secrets at runtime + systemd.services.bitwarden_rs.serviceConfig = { + EnvironmentFile = [ config.age.secrets.bitwarden-smtp-env.path ]; + Restart = "on-failure"; + RestartSec = "2s"; + }; + + services.nginx.virtualHosts."p.v0.io" = { + forceSSL = true; + enableACME = true; + extraConfig = '' + client_max_body_size 128M; + ''; + locations = { + "/".proxyPass = "http://127.0.0.1:8000"; + "/notifications/hub".proxyWebsockets = true; + "/notifications/hub/negotiate".proxyPass = "http://127.0.0.1:8001"; + }; + }; +} diff --git a/hosts/ao/modules/gitea.nix b/hosts/ao/modules/gitea.nix new file mode 100644 index 00000000..65164414 --- /dev/null +++ b/hosts/ao/modules/gitea.nix @@ -0,0 +1,31 @@ +{ config, lib, ... }: + +{ + modules.services.gitea.enable = true; + + services.gitea = { + appName = "V-NOUGHT"; + domain = "v0.io"; + rootUrl = "https://git.v0.io/"; + disableRegistration = false; + settings = { + server.SSH_DOMAIN = "v0.io"; + mailer = { + ENABLED = true; + FROM = "mail@v0.io"; + HOST = "mail.gmail.com:465"; + USER = "hlissner@gmail.com"; + MAILER_TYPE = "smtp"; + IS_TLS_ENABLED = "true"; + }; + }; + mailerPasswordFile = config.age.secrets.gitea-smtp.path; + database.type = "sqlite3"; + }; + + services.nginx.virtualHosts."git.v0.io" = { + forceSSL = true; + enableACME = true; + locations."/".proxyPass = "http://127.0.0.1:3000"; + }; +} diff --git a/hosts/ao/secrets/bitwarden-smtp-env.age b/hosts/ao/secrets/bitwarden-smtp-env.age new file mode 100644 index 0000000000000000000000000000000000000000..a5d7aae133480ce3a379b360d431dc5746b919b7 GIT binary patch literal 441 zcmV;q0Y?5|XJsvAZewzJaCB*JZZ2 zXnAmLP-to|YD;M_O-W~2VRK}6dS_*GV`VcdPDpW1RaFWtJ|HGuL?v2TEoX9NVRL05 zB{pa)c4Z)3aCBuxAVnZ;H9&hnS2R@$dN^ooN>wj6Sa?Hsb22qAGh#L}Y->zXVlj1b zbW=x7a&U4(Y)eLCHcVu7D{VJPG ssh-ed25519 4+kR2g aFztrZ7QN3Odj4EbFwuaRn+1VSuTFSUZ1Gwtgf5ELmw +H2s3EFMm4cRnFw5AbeOmX+OdADnEuMW5KqR4erH8Rv0 +-> (-grease 10P|_2X +JP9WDuBVhwq8P4B/QTPM/UFVgEM +--- IV78E3ztrIne6HidhqvOUfg//H77bnXQlXvEtqmpkBA +,S"2(*b ׍z=CIPmg܅g4tog!DJm \ No newline at end of file diff --git a/hosts/ao/secrets/secrets.nix b/hosts/ao/secrets/secrets.nix new file mode 100644 index 00000000..5b788a63 --- /dev/null +++ b/hosts/ao/secrets/secrets.nix @@ -0,0 +1,5 @@ +let key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd+4ijlEHI98NLpgP/El73BmpBUfzka9ovdt8FoaVAG hlissner@home"; +in { + "bitwarden-smtp-env.age".publicKeys = [key]; + "gitea-smtp.age".publicKeys = [key]; +}