Commit fc6b07b392e4
Changed files (11)
alpine
common
root
etc
init.d
systems
athena
demeter
alpine/common/root/etc/init.d/secrets
@@ -14,7 +14,7 @@ start() {
ebegin "Decrypting secrets"
mkdir -p /run/secrets
- chmod 700 /run/secrets
+ chmod 711 /run/secrets
local key="/persist/ssh/ssh_host_ed25519_key"
if [ ! -f "$key" ]; then
systems/athena/boot.nix
@@ -1,4 +0,0 @@
-{ ... }:
-{
- imports = [ ../common/hardware/rpi4-boot.nix ];
-}
systems/athena/extra.nix
@@ -1,61 +0,0 @@
-{
- ...
-}:
-{
- imports = [
- ../common/services/bind.nix
-
- ../common/services/prometheus-exporters-bind.nix
- ];
-
- networking.firewall.enable = false;
-
- # Push home public IP to carthage for fail2ban whitelisting
- # Carthage has a systemd path unit that watches /var/lib/fail2ban/home-ip.txt
- # and dynamically updates fail2ban ignoreip when it changes.
- # TODO: disabled — needs SSH key setup on athena (see org TODO)
- # systemd.services.push-home-ip = {
- # description = "Push home public IP to carthage for fail2ban whitelist";
- # serviceConfig = {
- # Type = "oneshot";
- # User = "vincent";
- # Group = "users";
- # };
- # path = with pkgs; [
- # curl
- # openssh
- # coreutils
- # ];
- # script = ''
- # set -euo pipefail
- # IP=$(curl -sf --max-time 10 https://ifconfig.me || curl -sf --max-time 10 https://icanhazip.com || exit 1)
- # IP=$(echo "$IP" | tr -d '[:space:]')
- # if [ -z "$IP" ]; then
- # echo "Failed to get public IP"
- # exit 1
- # fi
- # echo "Home public IP: $IP"
- # echo "$IP" | ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 carthage.vpn "cat > /var/lib/fail2ban/home-ip.txt"
- # echo "Pushed IP to carthage"
- # '';
- # };
- #
- # systemd.timers.push-home-ip = {
- # description = "Push home public IP to carthage every 5 minutes";
- # wantedBy = [ "timers.target" ];
- # timerConfig = {
- # OnBootSec = "1min";
- # OnUnitActiveSec = "5min";
- # RandomizedDelaySec = "30s";
- # };
- # };
-
- # Age secrets for imapfilter
- age.secrets."icloud-vdemeester-password" = {
- file = ../../secrets/mails/icloud-vdemeester.age;
- mode = "400";
- owner = "vincent";
- group = "users";
- };
-
-}
systems/athena/hardware.nix
@@ -1,16 +0,0 @@
-_: {
- fileSystems = {
- "/" = {
- device = "/dev/disk/by-label/NIXOS_SD";
- fsType = "ext4";
- options = [ "noatime" ];
- };
- };
-
- swapDevices = [
- {
- device = "/swapfile";
- size = 2 * 1024; # 2GB
- }
- ];
-}
systems/athena/home.nix
@@ -1,5 +0,0 @@
-{ ... }:
-{
- # Mail services (imapfilter, goimapnotify, mail-monitor) moved to sakhalin
- # Passage is a desktop tool, not needed on a DNS server
-}
systems/demeter/boot.nix
@@ -1,4 +0,0 @@
-{ ... }:
-{
- imports = [ ../common/hardware/rpi4-boot.nix ];
-}
systems/demeter/extra.nix
@@ -1,57 +0,0 @@
-{
- config,
- ...
-}:
-{
- imports = [
- ../common/services/bind.nix
-
- ../common/services/prometheus-exporters-bind.nix
- ];
-
- networking.firewall.enable = false;
-
- services = {
- mosquitto = {
- enable = true;
- listeners = [
- {
- address = "0.0.0.0";
- port = 1883;
- omitPasswordAuth = false;
- settings = {
- allow_anonymous = false;
- };
- acl = [ "topic readwrite #" ];
- users = {
- homeassistant = {
- acl = [ "readwrite #" ];
- hashedPasswordFile = config.age.secrets."mosquitto-homeassistant-password".path;
- };
- };
- }
- ];
- };
-
- # MQTT exporter disabled due to broken package in nixpkgs
- # ImportError: cannot import name 'main' from 'mqtt_exporter.main'
- # prometheus.exporters.mqtt = {
- # enable = true;
- # port = 9234;
- # mqttAddress = "127.0.0.1";
- # mqttPort = 1883;
- # mqttTopic = "#"; # Subscribe to all topics
- # mqttUsername = "homeassistant";
- # environmentFile = config.age.secrets."mosquitto-homeassistant-password".path;
- # logLevel = "INFO";
- # };
-
- };
-
- age.secrets."mosquitto-homeassistant-password" = {
- file = ../../secrets/demeter/mosquitto-homeassistant-password.age;
- mode = "400";
- owner = "mosquitto";
- group = "mosquitto";
- };
-}
systems/demeter/hardware.nix
@@ -1,16 +0,0 @@
-_: {
- fileSystems = {
- "/" = {
- device = "/dev/disk/by-label/NIXOS_SD";
- fsType = "ext4";
- options = [ "noatime" ];
- };
- };
-
- swapDevices = [
- {
- device = "/swapfile";
- size = 2 * 1024; # 2GB
- }
- ];
-}
systems/demeter/home.nix
@@ -1,2 +0,0 @@
-_: {
-}
flake.nix
@@ -91,22 +91,6 @@
# hostname = "shikoku";
# };
# Servers (stable)
- athena = libx.mkHost {
- hostname = "athena";
- system = "aarch64-linux";
- hardwareType = "rpi4";
- pkgsInput = inputs.nixpkgs-26_05;
- homeInput = inputs.home-manager-26_05;
- agenixInput = inputs.agenix-26_05;
- };
- demeter = libx.mkHost {
- hostname = "demeter";
- system = "aarch64-linux";
- hardwareType = "rpi4";
- pkgsInput = inputs.nixpkgs-26_05;
- homeInput = inputs.home-manager-26_05;
- agenixInput = inputs.agenix-26_05;
- };
aix = libx.mkHost {
hostname = "aix";
system = "aarch64-linux";
@@ -172,18 +156,6 @@
"${inputs.nixpkgs-26_05}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
];
}).config.system.build.sdImage;
- athena =
- (self.nixosConfigurations.athena.extendModules {
- modules = [
- "${inputs.nixpkgs-26_05}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
- ];
- }).config.system.build.sdImage;
- demeter =
- (self.nixosConfigurations.demeter.extendModules {
- modules = [
- "${inputs.nixpkgs-26_05}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
- ];
- }).config.system.build.sdImage;
};
overlays = import ./overlays { inherit inputs; };
@@ -253,8 +225,6 @@
in
pkgs.runCommand "wg-configs" { } ''
mkdir -p $out
- cp ${mkWgConfig "athena"} $out/wg0-athena.conf
- cp ${mkWgConfig "demeter"} $out/wg0-demeter.conf
cp ${mkWgConfig "aix"} $out/wg0-aix.conf
'';
}
secrets.nix
@@ -8,8 +8,6 @@ let
vincent-yubikey5c2
];
- athena = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/4KRP1rzOwyA2zP1Nf1WlLRHqAGutLtOHYWfH732xh"; # ssh-keyscan -q -t ed25519 athena.sbr.pm
- demeter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqQfEyHyjIGglayB9FtCqL7bnYfNSQlBXks2IuyCPmd"; # ssh-keyscan -q -t ed25519 demeter.sbr.pm
rhea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFH3Lk4bRgNyFRK/Hzg1PvVbL/dpyI1SmLJFkb6VQDw"; # ssh-keyscan -q -t ed25519 rhea.sbr.pm
sakhalin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/PMBThi4DhgZR8VywbRDzzMVh2Qp3T6NJAcPubfXz6"; # ssh-keyscan -q -t ed25519 sakhalin.sbr.pm
shikoku = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH18c6kcorVbK2TwCgdewL6nQf29Cd5BVTeq8nRYUigm"; # ssh-keyscan -q -t ed25519 shikoku.sbr.pm
@@ -27,9 +25,7 @@ let
servers = [
aion
aix
- athena
carthage
- demeter
nagoya
rhea
sakhalin
@@ -45,7 +41,6 @@ in
# Mail passwords
"secrets/mails/icloud-vdemeester.age".publicKeys = users ++ [
- athena
sakhalin
];
@@ -149,7 +144,6 @@ in
carthage
];
"secrets/sakhalin/homeassistant-prometheus-token.age".publicKeys = users ++ [ sakhalin ];
- "secrets/demeter/mosquitto-homeassistant-password.age".publicKeys = users ++ [ demeter ];
"secrets/aion/restic-aix-password.age".publicKeys = users ++ [ aion ];
# Wallabag + Miniflux on aion
"secrets/aion/miniflux-admin-credentials.age".publicKeys = users ++ [ aion ];