tstarr/dotfiles
1
0
Fork 0
mirror of https://github.com/starr-dusT/dotfiles.git synced 2025-02-19 19:27:31 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:starr-dusT/dotfiles

Browse Source
This commit is contained in:
Tyler Starr 2023-10-07 02:16:41 -07:00
commit 60313fc1b6
5 changed files with 107 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
provision/nixos/hosts/torus/configuration.nix
View File

@ -1,5 +1,11 @@
{ config, pkgs, user, lib, ... }:
{
imports = [
./wireguard-server.nix
./samba-server.nix
../../modules
];
nix = {
package = pkgs.nixFlakes;
extraOptions = "experimental-features = nix-command flakes";
@ -28,8 +34,14 @@
# Set networking options
networking.hostName = "torus";
networking.networkmanager.enable = true;
# Needed for wireguard-server
boot.kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = true;
};
networking.firewall.enable = true;
networking.firewall.checkReversePath = "loose";
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
# Set your time zone.
time.timeZone = "America/Los_Angeles";
@ -78,8 +90,6 @@
defaults.email = "starrtyler88@gmail.com";
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
security.pam.services.nginx.setEnvironment = false;
systemd.services.nginx.serviceConfig = {
@ -103,9 +113,6 @@
"media.tstarr.us" = (SSL // {
locations."/".proxyPass = "http://localhost:8096/";
});
"joplin.tstarr.us" = (SSL // {
locations."/".proxyPass = "http://localhost:22300/";
});
"wiki.tstarr.us" = (SSL // {
locations."/".proxyPass = "http://localhost:4567/";
extraConfig = ''
@ -117,13 +124,11 @@
};
# Enable modules
imports = [ ../../modules ];
modules = {
devel = {
tooling.enable = true;
};
services = {
samba-server.enable = true;
jellyfin.enable = true;
syncthing.enable = true;
};

41
provision/nixos/hosts/torus/samba-server.nix Normal file
View File

@ -0,0 +1,41 @@
{ config, lib, pkgs, ... }:
{
services.samba = {
enable = true;
extraConfig = ''
workgroup = WORKGROUP
server string = smbnix
netbios name = smbnix
security = user
hosts allow = 192.168.1. 127.0.0.1 localhost
hosts deny = 0.0.0.0/0
guest account = nobody
map to guest = bad user
'';
shares = {
private = {
"path" = "/engi";
browseable = "yes";
"read only" = "no";
"guest ok" = "no";
"force user" = "tstarr";
"force group" = "users";
};
public = {
"path" = "/engi";
browseable = "yes";
"read only" = "yes";
"guest ok" = "yes";
};
};
};
# Curiously, `services.samba` does not automatically open
# the needed ports in the firewall.
networking.firewall.allowedTCPPorts = [ 445 139 ];
networking.firewall.allowedUDPPorts = [ 137 138 ];
# To make SMB mounting easier on the command line
environment.systemPackages = with pkgs; [ cifs-utils ];
}

52
provision/nixos/hosts/torus/wireguard-server.nix Normal file
View File

@ -0,0 +1,52 @@
{ config, lib, pkgs, ... }:
{
# Enable NAT
networking.nat = {
enable = true;
enableIPv6 = true;
externalInterface = "enp4s0";
internalInterfaces = [ "wg0" ];
};
# Open ports in the firewall
networking.firewall = {
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 51820 ];
};
networking.wg-quick.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface
address = [ "192.168.2.1/24" ];
# The port that WireGuard listens to - recommended that this be changed from default
listenPort = 51820;
# Path to the server's private key
privateKeyFile = "/engi/apps/wireguard/private";
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
'';
# Undo the above
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT
${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE
'';
peers = [
{
# Adjudicator
publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM=";
allowedIPs = [ "192.168.2.2/32" ];
}
# More peers can be added here.
];
};
};
}

2
provision/nixos/modules/services/default.nix
View File

@ -1,4 +1,4 @@
{ ... }:
{
imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
imports = [ ./syncthing.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
}

46
provision/nixos/modules/services/samba-server.nix
View File

@ -1,46 +0,0 @@
{ config, lib, pkgs, ... }:
let cfg = config.modules.services.samba-server;
in {
options.modules.services.samba-server.enable = lib.mkEnableOption "samba-server";
config = lib.mkIf cfg.enable {
services.samba = {
enable = true;
extraConfig = ''
workgroup = WORKGROUP
server string = smbnix
netbios name = smbnix
security = user
hosts allow = 192.168.1. 127.0.0.1 localhost
hosts deny = 0.0.0.0/0
guest account = nobody
map to guest = bad user
'';
shares = {
private = {
"path" = "/engi";
browseable = "yes";
"read only" = "no";
"guest ok" = "no";
"force user" = "tstarr";
"force group" = "users";
};
public = {
"path" = "/engi";
browseable = "yes";
"read only" = "yes";
"guest ok" = "yes";
};
};
};
# Curiously, `services.samba` does not automatically open
# the needed ports in the firewall.
networking.firewall.allowedTCPPorts = [ 445 139 ];
networking.firewall.allowedUDPPorts = [ 137 138 ];
# To make SMB mounting easier on the command line
environment.systemPackages = with pkgs; [ cifs-utils ];
};
}