blob: 42c8d8da61c3a43d1e5beb443dd56c617879a89c (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
{ config, pkgs, lib, ... }:
let
myLib = import ./lib.nix { inherit pkgs lib; };
myPkgs = import ./pkgs.nix { inherit pkgs lib myLib; };
warpspeedPort = 1338;
myKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNMQvmOfon956Z0ZVdp186YhPHtSBrXsBwaCt0JAbkf/U/P+4fG0OROA++fHDiFM4RrRHH6plsGY3W6L26mSsCM2LtlHJINFZtVILkI26MDEIKWEsfBatDW+XNAvkfYEahy16P5CBtTVNKEGsTcPD+VDistHseFNKiVlSLDCvJ0vMwOykHhq+rdJmjJ8tkUWC2bNqTIH26bU0UbhMAtJstWqaTUGnB0WVutKmkZbnylLMICAvnFoZLoMPmbvx8efgLYY2vD1pRd8Uwnq9MFV1EPbkJoinTf1XSo8VUo7WCjL79aYSIvHmXG+5qKB9ed2GWbBLolAoXkZ00E4WsVp9H philip@nyx";
in
{
imports = [
./base-server.nix
];
config = {
# TODO abstract out
nix.maxJobs = 2;
vuizvui.modifyNixPath = false;
nix.nixPath = [
"vuizvui=/root/vuizvui"
"nixpkgs=/root/nixpkgs"
# TODO: nicer?
"nixos-config=${pkgs.writeText "haku-configuration.nix" ''
(import <vuizvui/machines>).profpatsch.haku.config
''}"
];
system.autoUpgrade = {
enable = true;
channel = "https://headcounter.org/hydra/channel/custom/openlab/vuizvui/channels.machines.profpatsch.haku";
};
vuizvui.user.profpatsch.server.sshPort = 7001;
boot.loader.grub.device = "/dev/sda";
fileSystems = {
"/" = {
device = "/dev/sda3";
fsType = "ext4";
};
"/boot" = {
device = "/dev/sda2";
fsType = "ext4";
};
};
environment.systemPackages = with pkgs; [
rtorrent # bittorrent client
mktorrent # torrent file creator
pkgs.vuizvui.profpatsch.warpspeed # trivial http file server
];
users.users = {
root.openssh.authorizedKeys.keys = [ myKey ];
rtorrent = {
isNormalUser = true;
};
vorstand = {
isNormalUser = true;
openssh.authorizedKeys.keys = [ myKey
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUgS0VB5XayQobQfOi0tYeqpSSCXzftTKEyII4OYDhuF0/CdXSqOIvdqnWQ8933lPZ5234qCXCniIlRJpJQLBPJdJ7/XnC6W37asuft6yVYxTZnZat8edCuJETMvwZJZNttxHC04k3JPf9RMj25luICWabICH5XP9Mz3GoWSaOz7IOm7jiLQiF3UtiFOG06w76d3UfcIVbqjImwWv8nysphi9IQfL0XgC24zNE6LSeE7IN5xTOxoZxORQGsCEnFNCPevReNcSB0pI9xQ1iao7evaZkpzT4D4iQ/K7Ss8dsfFWN30NPMQS5ReQTUKtmGn1YlgkitiYTEXbMjkYbQaQr daniel@shadow"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtfWeIH7YZpWUUOZ3oC5FB2/J+P3scxm29gUQdVij/K0TuxW1yN/HtcvrO1mwSshS6sNZ2N6/Kb6+kuGyx1mEnaFt87K5ucxC7TNqiURh4eeZE1xX7B5Ob8TVegrBxoe+vcfaoyxn7sUzgF719H0aYC7PP6p3AIbhq3hRLcvY26u9/gZ39H79A71wCunauvpcnpb+rqyJMN6m2YoeOcoloe7wUDI8Xw5dUetHpNKn9k1vzS16CdwP4pAKI8aBtdNK7ZojVMe9LfBG8HHPr9K+cwcaxQuXkFBJzrfrtBCfQwrgWppsu/W/kGBs1ybku2bOFI5UXJBnsraXQqr1NLIfL phj@phj-X220"
];
};
};
systemd.services.warpspeed =
let user = config.users.users.rtorrent;
in {
description = "internally served public files (see nginx)";
wantedBy = [ "default.target" ];
serviceConfig.WorkingDirectory = "${user.home}/public";
script = "${pkgs.vuizvui.profpatsch.warpspeed}/bin/warpspeed ${toString warpspeedPort}";
serviceConfig.User = config.users.users.rtorrent.name;
};
services.nginx = {
enable = true;
virtualHosts."haku.profpatsch.de" = {
forceSSL = true;
enableACME = true;
locations."/pub/" = {
proxyPass = "http://127.0.0.1:${toString warpspeedPort}/";
};
locations."/".root =
let lojbanistanSrc = pkgs.fetchFromGitHub {
owner = "lojbanistan";
repo = "lojbanistan.de";
rev = "ef02aa8f074d0d5209839cd12ba7a67685fdaa05";
sha256 = "1hr2si73lam463pcf25napfbk0zb30kgv3ncc0ahv6wndjpsvg7z";
};
in pkgs.runCommand "lojbanistan-www" {} ''
mkdir $out
echo "coi do" > $out/index.html
${pkgs.imagemagick}/bin/convert \
${lojbanistanSrc}/design/flag-of-lojbanistan-icon.svg \
-define icon:auto-resize=64,48,32,16 \
$out/favicon.ico
'';
serverAliases = [ "lojbanistan.de" ];
};
};
# services.mlmmj = {
# enable = true;
# listDomain = "cz.profpatsch.de";
# mailLists = [ "worship" "test" ];
# };
# services.postfix = {
# # mostly configured by mlmmj
# hostname = "cz.profpatsch.de";
# postmasterAlias = "mail@profpatsch.de";
# };
networking = {
hostName = "haku";
firewall = {
allowedTCPPorts =
[ 80 443
];
allowedTCPPortRanges =
# rtorrent
[{ from = 6881; to = 6889; }];
};
nameservers = [
"62.210.16.6"
"62.210.16.7"
];
};
};
}
|
