From f08f3812f40322b6098d75573413ed83f358871f Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sun, 1 Dec 2024 22:30:26 -0500 Subject: Cleanup xnet module and add baseline modules With these changes, the xnet module is useable as a system builder. At this point, it is still undecided whether all configuration will be generalized into this module, rather than keeping mini-modules local to the machine they will run on. --- flake.lock | 15 +++- flake.nix | 5 ++ modules/xnet/default.nix | 11 ++- modules/xnet/desktop/default.nix | 8 +- modules/xnet/disk.nix | 139 +++++++++++++++++++++++++++++++++++ modules/xnet/disk/boot.nix | 13 ---- modules/xnet/disk/default.nix | 113 ---------------------------- modules/xnet/disk/layouts/mirror.nix | 43 ----------- modules/xnet/disk/layouts/single.nix | 29 -------- modules/xnet/gitserver/default.nix | 53 +++++++++++++ modules/xnet/gitserver/gitweb.nix | 74 +++++++++++++++++++ modules/xnet/net/default.nix | 33 +-------- modules/xnet/net/sshd.nix | 46 ++++++++++++ modules/xnet/net/vpn-gateway.nix | 103 -------------------------- modules/xnet/nginx.nix | 30 ++++++++ modules/xnet/users.nix | 62 ++++++++++++++++ modules/xnet/users/default.nix | 8 -- modules/xnet/users/radicale.nix | 28 ------- modules/xnet/users/secret.yaml | 31 -------- 19 files changed, 441 insertions(+), 403 deletions(-) create mode 100644 modules/xnet/disk.nix delete mode 100644 modules/xnet/disk/boot.nix delete mode 100644 modules/xnet/disk/default.nix delete mode 100644 modules/xnet/disk/layouts/mirror.nix delete mode 100644 modules/xnet/disk/layouts/single.nix create mode 100644 modules/xnet/gitserver/default.nix create mode 100644 modules/xnet/gitserver/gitweb.nix create mode 100644 modules/xnet/net/sshd.nix delete mode 100644 modules/xnet/net/vpn-gateway.nix create mode 100644 modules/xnet/nginx.nix create mode 100644 modules/xnet/users.nix delete mode 100644 modules/xnet/users/default.nix delete mode 100644 modules/xnet/users/radicale.nix delete mode 100644 modules/xnet/users/secret.yaml diff --git a/flake.lock b/flake.lock index 38f1513..9995a09 100644 --- a/flake.lock +++ b/flake.lock @@ -62,7 +62,8 @@ "disko": "disko", "flake-parts": "flake-parts", "nixpkgs": "nixpkgs", - "sops-nix": "sops-nix" + "sops-nix": "sops-nix", + "sshKeys": "sshKeys" } }, "sops-nix": { @@ -84,6 +85,18 @@ "repo": "sops-nix", "type": "github" } + }, + "sshKeys": { + "flake": false, + "locked": { + "narHash": "sha256-BEKwObEHFoq0UzQcZ0VJ6uVl3Cx2MVylPRkylReyDUk=", + "type": "file", + "url": "https://github.com/kbujari.keys" + }, + "original": { + "type": "file", + "url": "https://github.com/kbujari.keys" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 103de63..bb74c02 100644 --- a/flake.nix +++ b/flake.nix @@ -12,6 +12,11 @@ sops-nix.url = "github:Mic92/sops-nix"; sops-nix.inputs.nixpkgs.follows = "nixpkgs"; + + sshKeys = { + url = "https://github.com/kbujari.keys"; + flake = false; + }; }; outputs = { flake-parts, ... } @ inputs: diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix index 87d17e7..6cb2e5e 100644 --- a/modules/xnet/default.nix +++ b/modules/xnet/default.nix @@ -4,11 +4,13 @@ let in { imports = [ - ./disk + ./disk.nix + ./users.nix + ./nginx.nix ./net ./desktop + ./gitserver # ./monitoring - # ./users ]; i18n.defaultLocale = mkDefault "en_US.UTF-8"; @@ -29,4 +31,9 @@ in doc.enable = mkDefault false; info.enable = mkDefault false; }; + + security.sudo = { + execWheelOnly = true; + extraConfig = "Defaults lecture = never"; + }; } diff --git a/modules/xnet/desktop/default.nix b/modules/xnet/desktop/default.nix index f919798..2eeb272 100644 --- a/modules/xnet/desktop/default.nix +++ b/modules/xnet/desktop/default.nix @@ -32,18 +32,20 @@ in extraPackages = with pkgs; [ foot fuzzel - grim + imv mako - pwvucontrol + mpv playerctl pop-icon-theme pwvucontrol - slurp sway-contrib.grimshot swayidle swaylock + tigervnc waybar wl-clipboard + xwayland + zathura ]; extraSessionCommands = '' export MOZ_ENABLE_WAYLAND=1 diff --git a/modules/xnet/disk.nix b/modules/xnet/disk.nix new file mode 100644 index 0000000..caef61d --- /dev/null +++ b/modules/xnet/disk.nix @@ -0,0 +1,139 @@ +{ config, lib, modulesPath, ... }: +let + cfg = config.xnet.disk; + commonOpts = { + acltype = "posixacl"; + atime = "off"; + compression = "on"; + normalization = "formD"; + relatime = "off"; + xattr = "sa"; + "com.sun:auto-snapshot" = "false"; + }; + + inherit (lib) mkOption mkDefault mkIf types; +in +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + options.xnet.disk = { + enable = mkOption { + type = types.bool; + default = false; + description = "Apply xnet-standard ZFS disk layout."; + }; + + device = mkOption { + type = types.str; + description = "Device used for zroot ZFS pool."; + }; + }; + + config = mkIf cfg.enable { + networking.hostId = builtins.substring 0 8 + (builtins.hashString "md5" config.networking.hostName); + + services.zfs = { + autoScrub.enable = true; + trim.enable = true; + }; + + # With root running in memory, swap should be required unless + # otherwise specified + zramSwap.enable = mkDefault true; + + boot = { + kernelParams = [ "nohibernate" "elevator=none" ]; + supportedFilesystems = [ "vfat" "zfs" ]; + zfs.devNodes = "/dev/disk/by-partuuid"; + loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + initrd = { + systemd.enable = true; + availableKernelModules = [ + "xhci_pci" + "ahci" + "nvme" + "usb_storage" + "sd_mod" + "sdhci_pci" + ]; + }; + tmp.cleanOnBoot = mkDefault true; + }; + + disko.devices.disk.main = { + type = "disk"; + device = cfg.device; + content = { + type = "gpt"; + partitions.ESP = { + size = "1G"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + partitions.ZFS = { + size = "100%"; + content = { + type = "zfs"; + pool = "zroot"; + }; + }; + }; + }; + + disko.devices = { + nodev."/" = { + fsType = "tmpfs"; + mountOptions = [ "defaults" "size=2G" "mode=755" ]; + }; + + zpool.zroot = { + type = "zpool"; + options = { + ashift = "12"; + autotrim = "on"; + }; + + datasets = { + "local" = { + type = "zfs_fs"; + options = commonOpts // { + mountpoint = "none"; + }; + }; + + "local/nix" = { + type = "zfs_fs"; + mountpoint = "/nix"; + options.mountpoint = "legacy"; + }; + + "local/reserved" = { + type = "zfs_fs"; + options = { + refreservation = "10G"; + mountpoint = "none"; + }; + }; + + "persist" = { + type = "zfs_fs"; + mountpoint = "/persist"; + options = commonOpts // { + mountpoint = "legacy"; + }; + }; + }; + }; + }; + }; +} diff --git a/modules/xnet/disk/boot.nix b/modules/xnet/disk/boot.nix deleted file mode 100644 index 65be2f3..0000000 --- a/modules/xnet/disk/boot.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ lib, ... }: -let - inherit (lib) mkDefault; -in -{ - boot = { - loader.systemd-boot.enable = true; - initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "sdhci_pci" ]; - kernelModules = [ "kvm-intel" "kvm-amd" ]; - swraid.mdadmConf = "MAILADDR = nobody@example.com"; - tmp.cleanOnBoot = mkDefault true; - }; -} diff --git a/modules/xnet/disk/default.nix b/modules/xnet/disk/default.nix deleted file mode 100644 index aca6ae2..0000000 --- a/modules/xnet/disk/default.nix +++ /dev/null @@ -1,113 +0,0 @@ -{ config, lib, modulesPath, ... }: -let - cfg = config.xnet.disk; - commonOpts = { - acltype = "posixacl"; - atime = "off"; - compression = "on"; - normalization = "formD"; - relatime = "off"; - xattr = "sa"; - "com.sun:auto-snapshot" = "false"; - }; - - inherit (lib) mkOption mkDefault mkIf types; -in -{ - imports = [ - ./boot.nix - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - options.xnet.disk = { - enable = mkOption { - type = types.bool; - default = false; - description = "Apply xnet-standard ZFS disk layout."; - }; - - device = mkOption { - type = types.str; - description = "Underlying device that build the root ZFS pool."; - }; - - extraDatasets = mkOption { }; - }; - - config = mkIf cfg.enable { - networking.hostId = builtins.substring 0 8 - (builtins.hashString "md5" config.networking.hostName); - - services.zfs = { - autoScrub.enable = true; - trim.enable = true; - }; - - zramSwap.enable = mkDefault true; - - boot = { - kernelParams = [ "nohibernate" "elevator=none" ]; - supportedFilesystems = [ "vfat" "zfs" ]; - zfs.devNodes = "/dev/disk/by-partuuid"; - }; - - disko.devices = (import ./layouts/single.nix cfg.device) // { - nodev."/" = { - fsType = "tmpfs"; - mountOptions = [ "defaults" "size=2G" "mode=755" ]; - }; - - zpool.zroot = { - type = "zpool"; - options = { - ashift = "12"; - autotrim = "on"; - }; - - datasets = { - "local" = { - type = "zfs_fs"; - options = commonOpts; - }; - - "local/reserved" = { - type = "zfs_fs"; - options = { - refreservation = "10G"; - mountpoint = "none"; - }; - }; - - "local/nix" = { - type = "zfs_fs"; - mountpoint = "/nix"; - options.mountpoint = "legacy"; - }; - - "local/certs" = { - type = "zfs_fs"; - mountpoint = "/certs"; - options.mountpoint = "legacy"; - }; - - "persist" = { - type = "zfs_fs"; - mountpoint = "/persist"; - options = { mountpoint = "legacy"; } // commonOpts; - }; - - "persist/data" = { - type = "zfs_fs"; - mountpoint = "/persist/data"; - options.mountpoint = "legacy"; - }; - } // cfg.extraDatasets; - }; - }; - - users.groups.backup = { - members = [ config.services.syncoid.group ]; - gid = 2001; - }; - }; -} diff --git a/modules/xnet/disk/layouts/mirror.nix b/modules/xnet/disk/layouts/mirror.nix deleted file mode 100644 index 5a9835b..0000000 --- a/modules/xnet/disk/layouts/mirror.nix +++ /dev/null @@ -1,43 +0,0 @@ -devices: { - disk = builtins.listToAttrs (map - (device: { - name = device; - value = { - type = "disk"; - device = "/dev/${device}"; - content = { - type = "gpt"; - partitions = { - ESP = { - size = "1G"; - type = "EF00"; - content = { - type = "mdraid"; - name = "boot"; - }; - }; - ZFS = { - size = "100%"; - content = { - type = "zfs"; - pool = "zroot"; - }; - }; - }; - }; - }; - }) - devices); - mdadm = { - boot = { - type = "mdadm"; - level = 1; - metadata = "1.0"; - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - }; - }; - }; -} diff --git a/modules/xnet/disk/layouts/single.nix b/modules/xnet/disk/layouts/single.nix deleted file mode 100644 index b779a39..0000000 --- a/modules/xnet/disk/layouts/single.nix +++ /dev/null @@ -1,29 +0,0 @@ -device: { - disk = { - "${device}" = { - type = "disk"; - device = "/dev/${device}"; - content = { - type = "gpt"; - partitions = { - ESP = { - size = "1G"; - type = "EF00"; - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - }; - }; - ZFS = { - size = "100%"; - content = { - type = "zfs"; - pool = "zroot"; - }; - }; - }; - }; - }; - }; -} diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix new file mode 100644 index 0000000..5e04398 --- /dev/null +++ b/modules/xnet/gitserver/default.nix @@ -0,0 +1,53 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.xnet.gitServer; + inherit (lib) mkOption mkIf types; +in +{ + imports = [ ./gitweb.nix ]; + + options.xnet.gitServer = { + enable = mkOption { + type = types.bool; + default = false; + description = "Serve git repos over SSH."; + }; + + path = mkOption { + type = types.path; + default = "/persist/repo/git"; + description = "Directory where repos will be stored."; + }; + + keys = mkOption { + type = types.listOf types.str; + description = "SSH public keys used for git operations."; + }; + }; + + config = mkIf cfg.enable { + users.users.git = { + group = "git"; + initialPassword = ""; + isSystemUser = true; + home = cfg.path; + createHome = true; + shell = "${pkgs.git}/bin/git-shell"; + openssh.authorizedKeys.keys = cfg.keys; + }; + + users.groups.git = { }; + + programs.git = { + enable = true; + config = { + init = { + defaultBranch = "master"; + }; + safe = { + directory = "*"; + }; + }; + }; + }; +} diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix new file mode 100644 index 0000000..c3696ab --- /dev/null +++ b/modules/xnet/gitserver/gitweb.nix @@ -0,0 +1,74 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.xnet.gitServer.gitweb; + inherit (lib) mkOption mkIf types; +in +{ + options.xnet.gitServer.gitweb = { + enable = mkOption { + type = types.bool; + default = false; + description = "Enable web interface to git repos."; + }; + + hostName = mkOption { + type = types.str; + default = "src.web.4kb.net"; + description = "Hostname the webUI is served from."; + }; + }; + + config = mkIf cfg.enable { + xnet.nginx.enable = true; + + services.cgit.main = { + enable = true; + scanPath = config.xnet.gitServer.path; + package = pkgs.cgit-pink; + nginx = { + virtualHost = cfg.hostName; + location = "/"; + }; + extraConfig = '' + mimetype.gif=image/gif + mimetype.html=text/html + mimetype.jpeg=image/jpeg + mimetype.jpg=image/jpeg + mimetype.pdf=application/pdf + mimetype.png=image/png + mimetype.svg=image/svg+xml + readme=:readme + readme=:readme.md + readme=:readme.txt + readme=:README + readme=:README.md + readme=:README.txt + ''; + settings = { + about-filter = "${pkgs.cgit-pink}/lib/cgit/filters/about-formatting.sh"; + clone-url = "https://${cfg.hostName}/$CGIT_REPO_URL git@${cfg.hostName}:$CGIT_REPO_URL"; + enable-commit-graph = true; + enable-http-clone = false; + enable-index-links = true; + enable-remote-branches = true; + remove-suffix = true; + robots = "noindex, nofollow"; + root-desc = "What I cannot create, I do not understand"; + root-title = cfg.hostName; + section-from-path = true; + snapshots = "tar.gz tar.bz2 zip"; + }; + }; + + # required for rendering markdown readme + environment.systemPackages = with pkgs; [ + python312 + python312Packages.markdown + ]; + + # services.nginx.virtualHosts."${cfg.gitweb.hostName}" = { + # useACMEHost = "4kb.net"; + # addSSL = true; + # }; + }; +} diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix index 143f189..2255f53 100644 --- a/modules/xnet/net/default.nix +++ b/modules/xnet/net/default.nix @@ -5,6 +5,10 @@ let prefix = "10.26.4"; in { + imports = [ + ./sshd.nix + ]; + options.xnet.net = { interface = mkOption { type = types.str; @@ -17,12 +21,6 @@ in description = "Final octet for xnet address."; example = 4; }; - - sshd = mkOption { - type = types.bool; - default = false; - description = "Enable hardened SSH service."; - }; }; # TODO: @@ -42,28 +40,5 @@ in prefixLength = 24; }]; }; - - services.openssh = { - enable = cfg.sshd; - startWhenNeeded = true; - settings = { - X11Forwarding = false; - UsePAM = false; - PermitRootLogin = "prohibit-password"; - }; - extraConfig = - let - p = [ - "sk-ssh-ed25519-cert-v01@openssh.com" - "ssh-ed25519-cert-v01@openssh.com" - "ssh-ed25519" - ]; - in - "PubkeyAcceptedKeyTypes ${lib.strings.concatStringsSep "," p}"; - hostKeys = [{ - path = "/certs/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - }]; - }; }; } diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix new file mode 100644 index 0000000..ef225db --- /dev/null +++ b/modules/xnet/net/sshd.nix @@ -0,0 +1,46 @@ +{ config, lib, ... }: +let + cfg = config.xnet.net.sshd; + inherit (lib) mkOption mkIf types; +in +{ + options.xnet.net.sshd = { + enable = mkOption { + type = types.bool; + default = false; + description = "Enable hardened SSH service."; + }; + }; + + config = mkIf cfg.enable { + services.openssh = { + enable = true; + startWhenNeeded = true; + openFirewall = true; + hostKeys = [{ + path = "/persist/certs/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + }]; + settings = { + UsePAM = true; + X11Forwarding = false; + PermitRootLogin = "no"; + PasswordAuthentication = false; + Ciphers = [ "chacha20-poly1305@openssh.com" ]; + Macs = [ "hmac-sha2-512-etm@openssh.com" ]; + KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; + }; + sftpServerExecutable = "internal-sftp"; + sftpFlags = [ "-f AUTHPRIV" "-l INFO" ]; + extraConfig = + let + pubkeyTypes = lib.strings.concatStringsSep "," [ + "sk-ssh-ed25519-cert-v01@openssh.com" + "ssh-ed25519-cert-v01@openssh.com" + "ssh-ed25519" + ]; + in + "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; + }; + }; +} diff --git a/modules/xnet/net/vpn-gateway.nix b/modules/xnet/net/vpn-gateway.nix deleted file mode 100644 index d26ced1..0000000 --- a/modules/xnet/net/vpn-gateway.nix +++ /dev/null @@ -1,103 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.xnet.net.vpnGateway; - inherit (lib) mkOption mkIf types; - - iface = "enp2s0"; - fwmark = "0x1"; - ip = "192.168.2.113"; - vpn = { - iface = "wg0"; - endpoint = "149.88.22.129:51820"; - addr = "10.69.70.71/32"; - peers = [ - - ]; - }; -in - -{ - # options.xnet.net.vpnGateway = { - # interface = mkOption { - # type = types.str; - # description = "Interface to forward VPN routed packets to internet"; - # }; - # - # vpn = types.subModule { - # interface = mkOption { - # type = types.str; - # default = "wg0"; - # description = "Name of VPN interface."; - # }; - # - # endpoint = mkOption { - # type = types.str; - # description = "ip:port of the VPN endpoint."; - # }; - # - # addr = mkOption { - # type = types.str; - # description = "Address of the VPN interface."; - # }; - # - # privateKeyFile = mkOption { - # type = types.str; - # description = "Path to private key."; - # }; - # - # peers = types.listOf types.subModule { - # - # }; - # }; - - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = 1; - "net.ipv6.conf.all.forwarding" = 1; - }; - - networking = { - wg-quick.interfaces."${vpn.iface}" = { - address = [ vpn.addr ]; - privateKeyFile = "/certs/wg/private.key"; - - peers = [{ - publicKey = "yxyntWsANEwxeR0pOPNAcfWY7zEVICZe9G+GxortzEY="; - allowedIPs = [ "0.0.0.0/0" ]; - endpoint = "149.88.22.129:51820"; - persistentKeepalive = 25; - }]; - }; - - nat = { - enable = true; - externalInterface = "wg0"; - internalInterfaces = [ "enp2s0" ]; - }; - - firewall = { - extraCommands = '' - # Create a new routing table for forwarded traffic - echo "200 vpn" >> /etc/iproute2/rt_tables - - # Mark packets from other hosts - iptables -t mangle -A PREROUTING -i enp2s0 ! -s 192.168.1.113 -j MARK --set-mark 0x1 - - # Route marked packets through WireGuard - ip rule add fwmark 0x1 table vpn - ip route add default dev wg0 table vpn - - # Allow forwarding - iptables -A FORWARD -i enp2s0 -o wg0 -j ACCEPT - iptables -A FORWARD -i wg0 -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT - - # NAT only forwarded traffic - iptables -t nat -A POSTROUTING -o wg0 ! -s 192.168.1.113 -j MASQUERADE - ''; - - extraStopCommands = '' - ip rule del fwmark 0x1 table vpn 2>/dev/null || true - ip route flush table vpn 2>/dev/null || true - ''; - }; - }; -} diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix new file mode 100644 index 0000000..1a3df78 --- /dev/null +++ b/modules/xnet/nginx.nix @@ -0,0 +1,30 @@ +{ config, lib, ... }: +let + cfg = config.xnet.nginx; + + inherit (lib) mkOption mkIf types; +in +{ + + options.xnet.nginx = { + enable = mkOption { + type = types.bool; + default = false; + description = "Enable optimized nginx."; + }; + }; + + config = mkIf cfg.enable { + networking.firewall.allowedTCPPorts = [ 80 443 ]; + + services.nginx = { + enable = true; + recommendedBrotliSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + recommendedZstdSettings = true; + }; + }; +} diff --git a/modules/xnet/users.nix b/modules/xnet/users.nix new file mode 100644 index 0000000..d9f6081 --- /dev/null +++ b/modules/xnet/users.nix @@ -0,0 +1,62 @@ +{ pkgs, lib, config, ... }: +let + cfg = config.xnet.users; + inherit (lib) mkOption mkIf types; +in +{ + + options.xnet.users = { + enable = mkOption { + type = types.listOf (types.enum [ "kle" ]); + default = [ ]; + description = "Users to enable."; + }; + }; + + config = { + users.mutableUsers = false; + + users.users.kle = mkIf (builtins.elem "kle" cfg.enable) { + hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/"; + isNormalUser = true; + createHome = true; + extraGroups = [ "wheel" "users" "networkmanager" "video" ]; + packages = with pkgs; [ + btop + curl + fzf + git + jq + lynx + neovim + ranger + rsync + sshfs + tree + zip + ]; + }; + + programs.ssh.extraConfig = '' + Host github + HostName github.com + User git + PreferredAuthentications publickey + ''; + + programs.git = { + config = { + init = { + defaultBranch = "master"; + }; + push = { + default = "upstream"; + autoSetupRemote = true; + }; + fetch = { + prune = true; + }; + }; + }; + }; +} diff --git a/modules/xnet/users/default.nix b/modules/xnet/users/default.nix deleted file mode 100644 index c567c23..0000000 --- a/modules/xnet/users/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ ... }: { - imports = [ ./radicale.nix ]; - - security.sudo = { - execWheelOnly = true; - extraConfig = "Defaults lecture = never"; - }; -} diff --git a/modules/xnet/users/radicale.nix b/modules/xnet/users/radicale.nix deleted file mode 100644 index 7d752f0..0000000 --- a/modules/xnet/users/radicale.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ config, ... }: -let path = "/persist/data/radicale"; in { - services.radicale = { - enable = false; - settings = { - server.hosts = [ "127.0.0.1:5232" ]; - storage.filesystem_folder = "${path}/collections"; - auth = { - type = "htpasswd"; - htpasswd_filename = "${path}/users"; - htpasswd_encryption = "plain"; - }; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${path} 0700 radicale radicale -" - "Z ${path} 0700 radicale radicale - -" - ]; - - services.nginx.virtualHosts."dav.web.4kb.net" = { - useACMEHost = "4kb.net"; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:5232/"; - }; - }; -} diff --git a/modules/xnet/users/secret.yaml b/modules/xnet/users/secret.yaml deleted file mode 100644 index 0381dea..0000000 --- a/modules/xnet/users/secret.yaml +++ /dev/null @@ -1,31 +0,0 @@ -root: ENC[AES256_GCM,data:N0CdjX9uY9IeLX95SSzQYsV/6IVfs0r1rX0JTCbb6WD7/oID0/y9CwErPKhCP03x7aKS4mqwgU6dVECAqsEIs35AS/O84FELTw==,iv:8+jKwsBfUfiEkclW2moLtzwB6MDouNq7N4U24f18kiQ=,tag:Ekw+vOXyhMgw5oPRTzV/Qg==,type:str] -kleidi: ENC[AES256_GCM,data:r0C5/fuY/RwNv9FFCrDMr4UnDK4cA1vFcDPlGTHSKYExzd+T6zrw5Zl/YO98uB3WC4mEtIgfZQxGwMgYyCVU2piJeW40/wftLA==,iv:hRa2eUx7tgyoV/hh6H+e5QCrTtQc/rOYIYefs32yzNg=,tag:Z/m+f+SvOHGleLtWU49nsA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age15f6mcwjjav4z757kad8wksalgemael364wwxz7qsral5gmjzmd2qre78d5 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRE85OWRmR1VtcWg0cnBz - SW9JRDJpN1RwRER5alAwUDBNM2ZrQ0Jna2tJClEweStEdmsyTnZNcXBsN3RIRXln - eUxUcUZwYU9CMDBjejlQRG0rdVRCUG8KLS0tIGt6MS9kN05MY0xhbWY5cjBBMlBG - dmpXeloxTDNydGRtd0ZFUVhKOWlMT1kKNj6BpUhgq6/AAHvFfNaEeHPsB2eRMzjS - lH7Vxn0mj00LdilatnWMajr8u3FWq+XYc2kPIo/XM8AmM/u17rMoag== - -----END AGE ENCRYPTED FILE----- - - recipient: age1nw5yklj57fegqllhqfjuy9f89cx9f9p0xptw9uv58rzleh8fdyssv0zyp4 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWXBuWGZ3NzI4ZHJOZllm - UVJYYnB5RklPTkh3ODdhY3hXUnFnWnBEaTNvClQ4RXpkWDI0ZUF2NHdvT2lOZDUv - dmgvSWtXU3p0WjhWeHV3L0VjRGdweE0KLS0tIE1kSm4xajd6MVNsNUlsSHhlbXUz - c2NGY3luQ2prUFNLKytEVFlFdDhtWEUKl3tUxQIpJA9RJLs2Fvb7s4Cn21CEC3r6 - XZ1BXjXKxHoEPyTARvxDqJXJxSvaH76283rhSG1vcQzmGUm56LZcLw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-10-31T01:49:17Z" - mac: ENC[AES256_GCM,data:ye2kvRJCGn/h1QviQ+Zrhykau7gCSe78QWEd2QgvfIPMgcDh3COdhavsd9zDRmDMNJBAiDTWQkrgTtYDzx859TsxfJdEDp6X7xRWhI/2dU94aRVGQGxdKTRiswJR+RzHmO0Cf4tNqYYjIySym4v39yWKioQlV4Vm9BW2eUTYLNo=,iv:gSvqxLggrf085IY+u/VeNkYAho/gMC5U2xkqgfSpeTc=,tag:gRTfIoFqta+7udwANTqO2A==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.1 -- cgit v1.3.1