diff --git a/flake.nix b/flake.nix index 60585b0c..b3968ed0 100644 --- a/flake.nix +++ b/flake.nix @@ -122,10 +122,10 @@ }; suites = with profiles; rec { base = [ core users.root users.anish ]; - sealight = [ base server ]; # matrix rsshub backup wireguard - mossnet = [ base server taskd wireguard-box shaarli wallabag dns backup monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing + sealight = [ base server ]; # matrix rsshub backup wireguard-server + mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing cube = [ base site server ]; # backup - graphical = [ base bluetooth music sync wireguard wifi desktop ]; + graphical = [ base bluetooth music sync wifi desktop ]; curve = [ graphical secrets ]; # backup? work = [ base ]; }; diff --git a/hosts/box/default.nix b/hosts/box/default.nix index ada393dd..c4c6f2ee 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -1,4 +1,4 @@ -{ profiles, suites, ... }: +{ self, profiles, suites, ... }: { imports = [ ./configuration.nix @@ -12,4 +12,32 @@ services."grasp".enable = true; services."grasp".path = "/home/anish/kitaab/grasp"; services."grasp".user = "anish"; + + # Backups + age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; + services.postgresqlBackup = { + enable = true; + databases = [ "wallabag" ]; + location = "/var/backup/postgresql"; + }; + mossnet.backup = { + enable = true; + name = "mossnet"; + paths = [ + "/var/lib/taskserver" # taskwarrior + "/var/www/shaarli-config" # sharli + "/var/backup/postgresql" # wallabag + "/var/lib/radicale" # radicale + ]; + # seafile? + # syncthing + }; + + age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; + age.secrets.box-wg.owner = "anish"; + mossnet.wg = { + enable = true; + ips = [ "10.0.69.4/24" ]; + privateKeyFile = "/run/agenix/box-wg"; + }; } diff --git a/hosts/curve/default.nix b/hosts/curve/default.nix index 436519e5..26489b9c 100644 --- a/hosts/curve/default.nix +++ b/hosts/curve/default.nix @@ -1,4 +1,4 @@ -{ profiles, suites, ... }: +{ self, profiles, suites, ... }: { imports = [ ./configuration.nix @@ -28,22 +28,33 @@ boot.supportedFilesystems = [ "ntfs" ]; + age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age"; + age.secrets.curve-wg.owner = "anish"; + mossnet.wg = { + enable = true; + ips = [ "10.0.69.2/24" ]; + privateKeyFile = "/run/agenix/curve-wg"; + }; + + age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; + mossnet.backup = { + enable = true; + name = "curve"; + paths = [ "/home/anish" ]; + }; + # enable adb # TODO move this (it's for KaiOS WebIDE devShell?) programs.adb.enable = true; #virtualisation.docker.enable = true; services.udev.extraRules = '' - # Monitor plugged in - # Doesn't work, becuase /home/anish/bin/hotplug-monitor isn't part of the nix build - # KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/anish/.Xauthority", RUN+="/home/anish/bin/hotplug-monitor.sh" # TODO: add this file to nix home-manager + # Qualcomm EDL + SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" - # Qualcomm EDL - SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" + # Qualcomm Memory Debug + SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev" - # Qualcomm Memory Debug - SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev" - - # Atmel DFU + # Atmel DFU ### ATmega16U2 SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2fef", TAG+="uaccess" ### ATmega32U2 diff --git a/modules/backup.nix b/modules/backup.nix new file mode 100644 index 00000000..3980262d --- /dev/null +++ b/modules/backup.nix @@ -0,0 +1,53 @@ +# TODO: +# This currently works on a per host basis, and the host file has to define all the locations it wants to back up. +# Ideally, this would create a job for each profile instead, so the backup strategy is included in the profile regardless of host +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.mossnet.backup; +in +{ + options = { + mossnet.backup = { + enable = mkEnableOption "Backup module using borg for Anish's computer nursery"; + name = lib.mkOption { + type = types.str; + default = { }; + example = literalExample '' + mossnet + ''; + description = '' + name for the backup operator + ''; + }; + paths = lib.mkOption { + type = with types; listOf str; + default = { }; + example = literalExample '' + [ "/home/anish/usr" ]; + ''; + description = '' + A list of folders to backup + ''; + }; + }; + }; + + config = mkIf cfg.enable { + services.borgbackup.jobs = { + "${cfg.name}" = { + paths = cfg.paths; + doInit = true; + repo = "20779@hk-s020.rsync.net:${cfg.name}"; + encryption = { + mode = "repokey-blake2"; + passCommand = "cat /run/agenix/borg-password"; + }; + environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY + compression = "auto,lzma"; + startAt = "daily"; + extraArgs = "--remote-path=borg1"; + }; + }; + }; +} diff --git a/modules/wireguard.nix b/modules/wireguard.nix new file mode 100644 index 00000000..5e9e9b52 --- /dev/null +++ b/modules/wireguard.nix @@ -0,0 +1,54 @@ +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.mossnet.wg; +in +{ + options = { + mossnet.wg = { + enable = mkEnableOption "Gain access to all mossnet systems through wireguard"; + ips = lib.mkOption { + type = with types; listOf str; + default = { }; + example = literalExample '' + [ "10.0.69.2/24" ]; + ''; + description = '' + The IP this machine is allowed to connect to + ''; + }; + privateKeyFile = lib.mkOption { + type = types.path; + default = { }; + example = literalExample '' + /run/agenix/wg-curve + ''; + description = '' + The private ssh key file to use to connect! + Remember set age.secrets.*.file and age.secrets.*.user + ''; + }; + }; + }; + config = mkIf cfg.enable { + networking.firewall.allowedUDPPorts = [ 60990 ]; + networking.wireguard.interfaces = { + wg0 = { + ips = cfg.ips; + listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers) + + privateKeyFile = cfg.privateKeyFile; + peers = [ + # For a client configuration, one peer entry for the server will suffice. + { + publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI="; + allowedIPs = [ "10.0.69.0/24" ]; + # Set this to the server IP and port. + endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 + persistentKeepalive = 25; + } + ]; + }; + }; + }; +} diff --git a/profiles/backup/default.nix b/profiles/backup/default.nix index ee9ecb43..ffcd4415 100644 --- a/profiles/backup/default.nix +++ b/profiles/backup/default.nix @@ -1,34 +1 @@ -{ - # Assumes the remote borg backup server has already been initialized - # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net: - services.borgbackup.jobs = { - backupTaskwarriorRsync = { - paths = [ "/var/lib/taskserver" ]; - doInit = true; - repo = "20779@hk-s020.rsync.net:taskwarrior"; - encryption = { - mode = "repokey-blake2"; - passCommand = "cat /run/keys/rsync"; - }; - environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; - compression = "auto,lzma"; - startAt = "weekly"; - extraArgs = "--remote-path=borg1"; - }; - }; - services.borgbackup.jobs = { - backupShaarliRsync = { - paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ]; - doInit = true; - repo = "20779@hk-s020.rsync.net:shaarli"; - encryption = { - mode = "repokey-blake2"; - passCommand = "cat /run/keys/rsync"; - }; - environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; - compression = "auto,lzma"; - startAt = "weekly"; - extraArgs = "--remote-path=borg1"; - }; - }; -} +{ } diff --git a/profiles/monitoring/default.nix b/profiles/monitoring/default.nix index 793ac393..c652a5ab 100644 --- a/profiles/monitoring/default.nix +++ b/profiles/monitoring/default.nix @@ -6,12 +6,13 @@ port = 2342; addr = "127.0.0.1"; }; - + # nginx reverse proxy + services.nginx.recommendedProxySettings = true; # Needed for new grafana versions services.nginx.virtualHosts.${config.services.grafana.domain} = { locations."/" = { - proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; - proxyWebsockets = true; + proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; + proxyWebsockets = true; }; }; diff --git a/profiles/radicale/default.nix b/profiles/radicale/default.nix index 9604acd6..e08af459 100644 --- a/profiles/radicale/default.nix +++ b/profiles/radicale/default.nix @@ -7,5 +7,18 @@ server.hosts = [ "0.0.0.0:5252" ]; }; }; + networking.firewall.allowedTCPPorts = [ 5252 ]; + + services.nginx.virtualHosts."cal.mossnet.lan" = { + enableACME = false; + forceSSL = false; + + locations."/" = { + extraConfig = '' + proxy_pass http://localhost:5252/; + proxy_set_header X-Forwarded-Host $host; + ''; + }; + }; } diff --git a/profiles/secrets/default.nix b/profiles/secrets/default.nix index acc2f41f..3fc78875 100644 --- a/profiles/secrets/default.nix +++ b/profiles/secrets/default.nix @@ -1,9 +1,9 @@ -{ pkgs, config, lib, ... }: +{ self, pkgs, config, lib, ... }: { # Secrets used by home-manager modules - age.secrets.fastmail.file = "/etc/nixos/secrets/fastmail.age"; + age.secrets.fastmail.file = "${self}/secrets/fastmail.age"; age.secrets.fastmail.owner = "anish"; - age.secrets.mossnet.file = "/etc/nixos/secrets/mossnet.age"; + age.secrets.mossnet.file = "${self}/secrets/mossnet.age"; age.secrets.mossnet.owner = "anish"; } diff --git a/profiles/sync/default.nix b/profiles/sync/default.nix index a689e571..7a3da959 100644 --- a/profiles/sync/default.nix +++ b/profiles/sync/default.nix @@ -5,16 +5,22 @@ serviceConfig.Type = "oneshot"; path = [ pkgs.git + pkgs.coreutils ]; script = '' - ${pkgs.coreutils}/bin/cd /home/anish/kitaab/vimwiki - ${pkgs.git} commit -am "syncing curve" - ${pkgs.git} push + cd /home/anish/kitaab + git add -A + git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1 + git push + exit 0 ''; + serviceConfig = { + User = "anish"; + }; }; systemd.timers.kitaab-timer = { wantedBy = [ "timers.target" ]; partOf = [ "kitaab-sync.service" ]; - timerConfig.OnCalendar = [ "*-*-* *:00:00" ]; + timerConfig.OnCalendar = [ "daily" ]; }; } diff --git a/profiles/sync/get-music.nix b/profiles/sync/get-music.nix index 721696ec..4c070e43 100644 --- a/profiles/sync/get-music.nix +++ b/profiles/sync/get-music.nix @@ -1,12 +1,20 @@ { pkgs, lib, ... }: { - services.cron = { - enable = true; - systemCronJobs = [ - "* */24 * * * * anish /etc/get-music.sh" + systemd.services.get-music-sync = { + serviceConfig.Type = "oneshot"; + path = [ + pkgs.coreutils + pkgs.rsync ]; + script = builtins.readFile ./get-music.sh; + serviceConfig = { + User = "anish"; + }; + }; + systemd.timers.get-music-timer = { + wantedBy = [ "timers.target" ]; + partOf = [ "get-music-sync.service" ]; + timerConfig.OnCalendar = [ "daily" ]; }; - environment.etc."get-music.sh".text = builtins.readFile "./get-music.sh"; - evironment.systemPackages = [ pkgs.rsync ]; } diff --git a/secrets/borg-password.age b/secrets/borg-password.age new file mode 100644 index 00000000..ae9b8787 Binary files /dev/null and b/secrets/borg-password.age differ diff --git a/secrets/box-wg.age b/secrets/box-wg.age new file mode 100644 index 00000000..51508c37 --- /dev/null +++ b/secrets/box-wg.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 K2vF/Q Vbe7tvR9OtiY6YCfCAwkV9L/wlKd4h+stYnZu3aCSC4 +U5V2qDLFNrY4SQn9aZZyNtsfXpae8eqo6JH66gbKwdg +-> %!/-grease ErIq e d{ZU +vKMMQJKGGb1YCU3Jn6xq5JTLoGYgC+X58WVxjpHYF126aDBN0NOYxYqDJFRQGe5S +7wuRgDPn +--- QE25f0fQlnz4v6ei4OczAW9BpqOvnkwdc7re508d4A4 +z@fE/_`)YVhc~w'F1iEޖU(3xtPZ; 3g[a6a0aU0 \ No newline at end of file diff --git a/secrets/curve-wg.age b/secrets/curve-wg.age index ada0fb2f..a1cdf212 100644 --- a/secrets/curve-wg.age +++ b/secrets/curve-wg.age @@ -1,10 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 E8y8hg ajjA98JsX1JBHd/6pPoTLCrMdkmgnviOZFTWUMtKfzk -+ekDAlEfkZ9G6oYfek6kBu0z1jbfQDQfH2ukwk4pvNU --> ssh-ed25519 AiezdQ sZNx8/7RVk9XLvwxrbxjYb3q6uB8ny/DxktST7HMQSk -EdEXGSPGJ9j52llednOb8ViK3a+C+ru1weF7wOL3Lzk --> B~GRUs-grease v) >0EI 7cA9 m&8 -iYaE+kBtuRHNi7zc9xtWYnNs6ThyHNvSPYnY1SYsugftuao1wkXyFvRrd8wubj1k -Y4e50A ---- GAVr4RrSEgBxdamubXJNhRPXOeXccN7Nw5GqGLPwdWI -7x╥$-*^;~ N{X=Z٦}Fۼ󖼇fޕǍc \ No newline at end of file +-> ssh-ed25519 E8y8hg hedyIPcLQGc3KmKFzhVWU/zHcattXe4oRGo8wY/TV3s +wXjPQaUnxci/pQKoNXMm7/yhXZ8Ec69w/3bJOxkiXws +-> ssh-ed25519 AiezdQ lb8Hwsl8FDk/CExAVqMS0w20MJq5GKUm0NkE5O7k/is +aspWW5q6YpXKIvkIzFIPdPFp7/oRgrE/cpqtis5BASY +-> ssh-ed25519 K2vF/Q qw5EytbSJskHAcuKFbqZyvut5iJomIRMwgxFohvJBQo +GkHaGU3BnBX2BCZ2eF8X1whFmQTKueXvOqC08UggQWU +-> z-grease +h8wf5RrYDiHoC5CuvGmL6xeol9K2o24A7WAky8qrmKWgjzlhR7IcitQ4AX9teOec +9wsfVkTBgbc +--- +l7lATgPTYXuOOCaTYEOVMGxW0Ryaj5RAYaAVT/zIQE +fؑExP?sdPBg* |dnb9P + HŚ}-)$5W \ No newline at end of file diff --git a/secrets/fastmail.age b/secrets/fastmail.age index d65baa50..3a3aeb4a 100644 Binary files a/secrets/fastmail.age and b/secrets/fastmail.age differ diff --git a/secrets/mossnet.age b/secrets/mossnet.age index d2ac8f74..2a75cae7 100644 --- a/secrets/mossnet.age +++ b/secrets/mossnet.age @@ -1,9 +1,12 @@ age-encryption.org/v1 --> ssh-ed25519 E8y8hg zUl7tdxWGLDPiv9cX9/vTITX+H+rqgVSZ77YFZUQzBQ -ZW9d2bKCo969jT1HWKw8tPSlYJpjm8T7mbcztPVWdyA --> ssh-ed25519 AiezdQ Gb5IB4nHlyBsjIgt52/BL7lcWZFEWly26HND0I/Q824 -VyTx5jzEhsekC87qejQsfJGcHNlt0VghloDT+AVo9rQ --> Nbgn:*-grease -5IfKwbqa8Yrv5zz2Vcy98A ---- D26v86VajBn6V2Go1nnNdBBwe7K+rLiVw5MVvAob/dk -ҍ@=s`62ZނO:ռ30rSo=] \ No newline at end of file +-> ssh-ed25519 E8y8hg g7zZHmh04X43ZguiRhdjeZ2BtBsT3o8qhSntPxDzd0k +6Cwi06GFH36g44rbkIK1rLxkXFJ5yWLpMsvl3xzFSY8 +-> ssh-ed25519 AiezdQ tpn28KlGD2vaeS+3tsaxjhXfcMMNMgsZbQE9YySup3w +TbfWuW62lYWkp0xnrrzbdMzNJ+jNn+5tMCZEz4GdTVs +-> ssh-ed25519 K2vF/Q 7SQse/JhNP09k7xtyjw1Y2mnhFH5bmaXjqWrpxO5Bxg +aKV2EN0a8t6NS+88eAG9+bu6+sFd9/Rc4nNoR0os9X0 +-> xjS>-grease *{_ +fOiZzBai7fC+jxV7RH8bKLx05h+UVmCR51CGMaAAsIyHivI+hb2M3lDfWdn0shZQ +byznwCva3kNQwG3m4MYgk6J4/QiasZGF0O+QoA +--- gEmFFhuHpKOP74G/65xuCK0EA3ERvF78q8eVTMlmkOY +ʝdD3-\XBS||9TSz@/ZUdR" \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 15998d87..1685d2d0 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -3,12 +3,15 @@ let user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTdCyYVur6LzRQf08JZUcEAr23H7fTRRmDJOzoOc6A anish@curve"; system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; - allKeys = [ system user ]; + curve = [ system user ]; + allKeys = [ system user mossnet ]; + systemOnly = [ system mossnet ]; in { "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; - "curve-wg.age".publicKeys = allKeys; - #"nextcloud-db.age".publicKeys = mossnet; - #"nextcloud-admin.age".publicKeys = mossnet; + "curve-wg.age".publicKeys = curve; + "box-wg.age".publicKeys = [ mossnet ]; + # "wallabag.age".publicKeys = [ mossnet ]; + "borg-password.age".publicKeys = systemOnly; }