aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity
2013 commits 16 branches 0 tags 41 MiB
Commit graph

2013 commits

This branch
This branch
All branches
Author SHA1 Message Date
Henrik Lissner ffb097ce0c fail2ban: move maxretry default to jails 
Throws a "option 'maxretry' in section 'DEFAULT' already exists" error
on startup otherwise.
 2021-01-31 18:43:29 -05:00
Henrik Lissner 25a87f24d9 Reduce gitea logging & disable basic auth for api 
- Disabled SQL logs because they quickly fill up the logs and aren't
  useful, currently. Also, smaller logs = easier job for fail2ban.
- Disabled basic auth because it's the least secure method of
  interacting with the gitea API. Tokens/oauth are better.
 2021-01-31 18:39:01 -05:00
Henrik Lissner c32a1846e0 Tweak fail2ban defaults 2021-01-31 18:39:01 -05:00
Henrik Lissner 68fa845a73 Add comments & remove redundant config 
IS_TLS_ENABLED = true is implied if HOST's port is 465
 2021-01-31 18:20:17 -05:00
Henrik Lissner 78d85018b0 Fix redundant nginx directive 
And typo. Should be 128k, not 1k!
 2021-01-30 17:10:25 -05:00
Henrik Lissner fe4a34a9e3 Harden nginx defaults 2021-01-30 17:07:52 -05:00
Henrik Lissner 2da00f3ad5 fail2ban: speed up gitea/bitwarden jails 
These services log to syslog, so a log file doesn't exist, meaning
fail2ban must scan the whole journal to seek authentication failure
logs, which is slow! By specifying a journalmatch, it significantly
narrows the scope of their searches.
 2021-01-30 06:04:38 -05:00
Henrik Lissner 0fb9406b75 Add bind package to default global packages 2021-01-30 04:52:16 -05:00
Henrik Lissner d380e06cba Make fail2ban defaults less forgiving 2021-01-30 04:52:13 -05:00
Henrik Lissner 24d5a426f5 Clean up modules/desktop/media/daw.nix 2021-01-30 02:39:00 -05:00
Henrik Lissner af525f2514 bin/hey: forward -iApeq to nix-env 2021-01-29 23:09:17 -05:00
Henrik Lissner 622121d7da Correct clone path in README 2021-01-29 14:23:18 -05:00
Henrik Lissner 2c3b2b1294 hosts/kuro: remove asic kernel module 
No longer needed now that we're on 5.10 (with built in support for my
2.5G network card).
 2021-01-29 14:22:52 -05:00
Henrik Lissner a7e7b1703a hosts/{ao,shiro}: tweak cpu governors 2021-01-29 14:07:05 -05:00
Henrik Lissner 1455114778 hosts/shiro: update module list 2021-01-26 23:00:01 -05:00
Henrik Lissner f88552ad64 Add modules/services/syncthing.nix 
Generalizes the module so it's not so Henrik-centric. I know,
blasphemous, but the world only sometimes revolves around me.

Also, adds a new, much simpler config for syncthing.
 2021-01-26 23:00:01 -05:00
Henrik Lissner 41ac027216 Add modules/backup.nix 
A rudimentary backup and restoration system.
 2021-01-26 23:00:01 -05:00
Henrik Lissner 5443df10b9 Bump 2021-01-26 22:58:47 -05:00
Henrik Lissner 8fd332dcc4 Add nofail option to zfs filesystems 
So they don't prevent startup when zfs fails to mount non-essential
drives, like it currently does with 2.0.1 for some reason.
 2021-01-26 22:58:47 -05:00
Henrik Lissner e35f0cff50 Upgrade to 5.10 kernel 2021-01-26 22:58:47 -05:00
Henrik Lissner 24a93a756b bin/hey: fallback to hey-X binary 
Allows for extensions.
 2021-01-26 22:58:47 -05:00
Henrik Lissner 4a57fc7d2a Remove -h/--help 
Redundant with h|help. Instead, we're using -h/--host for setting target
hostname.
 2021-01-26 22:58:47 -05:00
Henrik Lissner a1c46f27ce Update shell.nix to reflect recent changes 2021-01-26 22:58:47 -05:00
Henrik Lissner c805e9bedc Don't sign commits anymore 
There's not much point to it. It isn't foolproof and only slows down the
process.
 2021-01-26 22:58:47 -05:00
Henrik Lissner 64bec0f415 Generalize bin/hey 
It'll operate out of /etc/nixos or /etc/dotfiles, rather than where the
script lives. This allows it to be used for flakes instantiated from our
templates.
 2021-01-26 22:58:47 -05:00
Henrik Lissner abf2aeb689 bin/hey gc: clean up & delete leftover secrets 2021-01-26 22:58:47 -05:00
Henrik Lissner 3d3497d9e9 bin/hey push: clean up/stop redundant sudo prompts 2021-01-26 22:58:47 -05:00
Henrik Lissner dd62442c09 Install ripgrep in zsh module 2021-01-26 22:58:47 -05:00
Henrik Lissner d0309c51a0 hosts/ao: rewrite & use agenix 2021-01-26 22:58:47 -05:00
Henrik Lissner d1e987c4ba hosts/kuro: set default browser to brave 
Testing the waters. Firefox's occasional crashes and freezes are a
bother.
 2021-01-26 22:58:47 -05:00
Henrik Lissner be343218e9 Add modules/desktop/browsers/brave.nix 2021-01-26 22:58:47 -05:00
Henrik Lissner 07f82da2a2 bin/hey: revise comments & refactor 2021-01-26 22:58:47 -05:00
Henrik Lissner 82ee5bef6a bin/hey: add --option pure-eval no 
There are cases where impure evaluate is necessary or unavoidable.
 2021-01-26 22:58:47 -05:00
Henrik Lissner 5ceb72ddee Remove services.gitea.disableRegistration default 
This can be done in the host file, once its ready to disable
registration.
 2021-01-26 22:58:47 -05:00
Henrik Lissner e703bd374d New ssh pubkey & redesign 'hey push' 
Remote rebuilding requires root access, but I don't want root ssh
access (even by ssh key) to be a permanent fixture of my servers.  So
I've changed 'hey push' to copy my remote user's `authorized_keys` to
/root/.ssh/ temporarily, until the rebuild is complete. It is removed
afterwards.

This should be done non-destructively in the future, but it suits my
needs for now.
 2021-01-26 22:56:50 -05:00
Henrik Lissner 69d730f89d Add agenix 
Indexes all *.age files in $HOST/secrets/
 2021-01-22 20:01:55 -05:00
Henrik Lissner c92199848c Add flake templates and defaultApp 
defaultApp lets you use bin/hey via nix run.
 2021-01-22 20:01:55 -05:00
Henrik Lissner a1ab0811bb Refactor 2021-01-20 01:28:30 -05:00
Henrik Lissner 0152e1a95f Bump emacs-overlay, nixos-hardware, nixpkgs-unstable 2021-01-20 01:04:02 -05:00
Henrik Lissner cf85294497 bin/mov2gif: fix comments; use cached-nix-shell 2021-01-20 00:44:35 -05:00
Henrik Lissner ab1640e486 Update license year 2021-01-20 00:44:17 -05:00
Henrik Lissner 101effe2da
kuro: replace pass with bitwarden CLI 
First step to switch to bitwarden; currently hosted on ao, but haven't
finalized ao's config yet.
 2021-01-02 00:27:15 -05:00
Henrik Lissner 096a60d61f
services/nginx: add main user to nginx group 2021-01-02 00:26:07 -05:00
Henrik Lissner bca8c84ab3
Minor refactors & readme revision 2021-01-02 00:26:00 -05:00
Henrik Lissner 608b3472b9
security.acme.acceptTerms = true 
So we don't have to later.
 2021-01-02 00:24:20 -05:00
Henrik Lissner 2a678d2b75
Register as flake template 
First step to generalizing this repo. Makes it easier to deploy. Later I
may move my host configs to another repo.
 2021-01-02 00:24:14 -05:00
Henrik Lissner 177a7eec6f
Add services/fail2ban module 
With bitwarden_rs & gitea filters
 2021-01-01 21:19:06 -05:00
Henrik Lissner 25f0d8044a
Minor refactors 2020-12-31 19:34:11 -05:00
Henrik Lissner 86a7b8ab79
Bump emacs-overlay, nixos-hardware, nixpkgs-unstable 2020-12-31 19:32:50 -05:00
Henrik Lissner 0b549caada
Update linode config 2020-12-31 17:34:39 -05:00