aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity
2153 commits 16 branches 0 tags 41 MiB
Commit graph

57 commits

Author SHA1 Message Date
Henrik Lissner 327b113a07 refactor!: rename bitwarden -> vaultwarden 
Was renamed upstream, in NixOS 21.11.
 2021-09-04 00:10:46 +02:00
Henrik Lissner 4050e6ae28 users.users.git.isSystemUser = true 2021-05-28 00:19:17 -04:00
Henrik Lissner 8fe1fbb6e7 hosts/ao: refactor backups 2021-03-12 01:01:12 -05:00
Henrik Lissner 9d90e3a822 Replace lib.paths with config.dotfiles.* 2021-03-01 20:43:12 -05:00
Henrik Lissner 0325968f12 Polish mock syncthing config 2021-02-28 14:26:48 -05:00
Henrik Lissner 8ca2cc66ba mkdir /run/backups/bitwarden_rs 
Since the service fails to do it itself.
 2021-02-27 15:30:02 -05:00
Henrik Lissner c883524efc Replace backup module with built-in solutions 
May not be as universal, but is more certain to work correctly than my
hacked up version that I'm not so invested in.
 2021-02-22 10:40:22 -05:00
Henrik Lissner b7d49362a8 gitea.lfs.enable = true 2021-02-01 19:55:05 -05:00
Henrik Lissner ffb097ce0c fail2ban: move maxretry default to jails 
Throws a "option 'maxretry' in section 'DEFAULT' already exists" error
on startup otherwise.
 2021-01-31 18:43:29 -05:00
Henrik Lissner 25a87f24d9 Reduce gitea logging & disable basic auth for api 
- Disabled SQL logs because they quickly fill up the logs and aren't
  useful, currently. Also, smaller logs = easier job for fail2ban.
- Disabled basic auth because it's the least secure method of
  interacting with the gitea API. Tokens/oauth are better.
 2021-01-31 18:39:01 -05:00
Henrik Lissner c32a1846e0 Tweak fail2ban defaults 2021-01-31 18:39:01 -05:00
Henrik Lissner 68fa845a73 Add comments & remove redundant config 
IS_TLS_ENABLED = true is implied if HOST's port is 465
 2021-01-31 18:20:17 -05:00
Henrik Lissner 78d85018b0 Fix redundant nginx directive 
And typo. Should be 128k, not 1k!
 2021-01-30 17:10:25 -05:00
Henrik Lissner fe4a34a9e3 Harden nginx defaults 2021-01-30 17:07:52 -05:00
Henrik Lissner 2da00f3ad5 fail2ban: speed up gitea/bitwarden jails 
These services log to syslog, so a log file doesn't exist, meaning
fail2ban must scan the whole journal to seek authentication failure
logs, which is slow! By specifying a journalmatch, it significantly
narrows the scope of their searches.
 2021-01-30 06:04:38 -05:00
Henrik Lissner d380e06cba Make fail2ban defaults less forgiving 2021-01-30 04:52:13 -05:00
Henrik Lissner f88552ad64 Add modules/services/syncthing.nix 
Generalizes the module so it's not so Henrik-centric. I know,
blasphemous, but the world only sometimes revolves around me.

Also, adds a new, much simpler config for syncthing.
 2021-01-26 23:00:01 -05:00
Henrik Lissner 41ac027216 Add modules/backup.nix 
A rudimentary backup and restoration system.
 2021-01-26 23:00:01 -05:00
Henrik Lissner 5ceb72ddee Remove services.gitea.disableRegistration default 
This can be done in the host file, once its ready to disable
registration.
 2021-01-26 22:58:47 -05:00
Henrik Lissner e703bd374d New ssh pubkey & redesign 'hey push' 
Remote rebuilding requires root access, but I don't want root ssh
access (even by ssh key) to be a permanent fixture of my servers.  So
I've changed 'hey push' to copy my remote user's `authorized_keys` to
/root/.ssh/ temporarily, until the rebuild is complete. It is removed
afterwards.

This should be done non-destructively in the future, but it suits my
needs for now.
 2021-01-26 22:56:50 -05:00
Henrik Lissner a1ab0811bb Refactor 2021-01-20 01:28:30 -05:00
Henrik Lissner 096a60d61f
services/nginx: add main user to nginx group 2021-01-02 00:26:07 -05:00
Henrik Lissner bca8c84ab3
Minor refactors & readme revision 2021-01-02 00:26:00 -05:00
Henrik Lissner 177a7eec6f
Add services/fail2ban module 
With bitwarden_rs & gitea filters
 2021-01-01 21:19:06 -05:00
Henrik Lissner 25f0d8044a
Minor refactors 2020-12-31 19:34:11 -05:00
Henrik Lissner 9572aa99a6
Default gitea to sqlite 
Most portable default.
 2020-12-19 23:02:46 -05:00
Henrik Lissner 807b76e640
hosts/ao: finish bitwarden config 2020-12-19 08:05:05 -05:00
Henrik Lissner c9efc8c9e0
Add basic bitwarden service module 2020-12-18 23:42:52 -05:00
Henrik Lissner 2736c461a1
Add services/teamviewer module 2020-10-21 15:49:45 -04:00
Henrik Lissner a75c64d04a
Rewrite to use flakes 
This puts a hard dependency on 20.09, but that's to be expected.
 2020-10-11 01:31:33 -04:00
Henrik Lissner a41169c073
Add docker module 2020-04-22 19:55:26 -04:00
Henrik Lissner 592ee79a83
Modularize config 2020-03-29 01:55:14 -04:00
Henrik Lissner 51daefb119
ao: plex -> jellyfin, add calibre-server 2020-01-18 21:35:12 -05:00
Henrik Lissner 6e29d0d302
Fix projects shared folder 2020-01-17 21:28:56 -05:00
Henrik Lissner a5a75a7f20
Fix ao syncthing id 2020-01-17 20:23:50 -05:00
Henrik Lissner f831429666
Minor refactors 2020-01-17 19:36:34 -05:00
Henrik Lissner d1cbda1c36
Refactor syncthing config 
And fix issue where folder types were set to null.
 2020-01-17 16:42:35 -05:00
Henrik Lissner c7e6da3f73
Major refactor 2020-01-17 04:22:50 -05:00
Henrik Lissner 740046f3f0
Fix syncthing config 
Some ids were mixed up. Extra settings for various shares.
 2020-01-17 04:06:44 -05:00
Henrik Lissner 38d7725c3a
Allow password w/ local ssh connections 2020-01-16 18:57:59 -05:00
Henrik Lissner a6ec7bd020
Set up syncthing declaratively 2020-01-15 18:19:34 -05:00
Henrik Lissner 5d2018aa91
Add services/transmission module 2020-01-14 00:25:39 -05:00
Henrik Lissner 8f8f07314b
Add jellyfin module 2020-01-12 18:20:45 -05:00
Henrik Lissner b90b0894f0
Complete rewrite 2020-01-12 18:20:28 -05:00
Henrik Lissner e25c14eed8
Open port 51413 2019-11-19 02:59:40 -05:00
Henrik Lissner 16c4b995e3
Remove radarr 
For now.
 2019-11-19 02:57:30 -05:00
Henrik Lissner b5557d7d5a
transmission: whitelist local network 2019-11-19 02:56:07 -05:00
Henrik Lissner 8af5d0438b
Switch sonarr -> radarr 2019-11-19 02:48:55 -05:00
Henrik Lissner 6498ec5b21
Open port 9091 on aka 2019-11-19 02:46:51 -05:00
Henrik Lissner e5fe0acb9a
Add sonarr & transmission to plex module 2019-11-19 02:23:38 -05:00