commit aafa33ec9c56a9dfe6619b8a1d7d8c938a45df6c
parent 0237d5144e92ae1e099f7f3d7cd2a7d04a9455d4
Author: MTRNord <mtrnord1@gmail.com>
Date: Sat, 12 Aug 2023 11:46:08 +0200
add default blocked ups for gpt
Diffstat:
3 files changed, 291 insertions(+), 258 deletions(-)
diff --git a/TODOs.md b/TODOs.md
@@ -1,2 +0,0 @@
-- Setup server age via <https://github.com/Mic92/sops-nix> -> Step 3
-- Make reusable stuff reusable (Timezone, users, ...)
diff --git a/nixos/common.nix b/nixos/common.nix
@@ -0,0 +1 @@
+
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -122,288 +122,322 @@
nameservers = [ "8.8.8.8" "8.8.4.4" ];
- # Open ports in the firewall.
- firewall = {
- allowPing = true;
- logRefusedConnections = false;
- enable = true;
- allowedTCPPorts = [
- 22 # ssh
- ];
- allowedUDPPorts = [ ];
- # TODO: Apply https://git.pixie.town/f0x/nixos/src/commit/ec359768c7fc40215e9a71b278ac7c33d7541277/nodes/aura/configuration.nix
- # blockedV4 = [
- # # https://openai.com/gptbot-ranges.txt
- # "20.15.240.64/28"
- # "20.15.240.80/28"
- # "20.15.240.96/28"
- # "20.15.240.176/28"
- # "20.15.241.0/28"
- # "20.15.242.128/28"
- # "20.15.242.144/28"
- # "20.15.242.192/28"
- # "40.83.2.64/28"
- # ];
- };
- };
+ # # Open ports in the firewall.
+ # firewall = {
+ # allowPing = true;
+ # logRefusedConnections = false;
+ # enable = true;
+ # allowedTCPPorts = [
+ # 22 # ssh
+ # ];
+ # allowedUDPPorts = [ ];
+ # # TODO: Apply https://git.pixie.town/f0x/nixos/src/commit/ec359768c7fc40215e9a71b278ac7c33d7541277/nodes/aura/configuration.nix
+ # # blockedV4 = [
+ # # # https://openai.com/gptbot-ranges.txt
+ # # "20.15.240.64/28"
+ # # "20.15.240.80/28"
+ # # "20.15.240.96/28"
+ # # "20.15.240.176/28"
+ # # "20.15.241.0/28"
+ # # "20.15.242.128/28"
+ # # "20.15.242.144/28"
+ # # "20.15.242.192/28"
+ # # "40.83.2.64/28"
+ # # ];
+ # };
+ # };
+
+ firewall =
+ let
+ blockedV4 = [
+ # https://openai.com/gptbot-ranges.txt
+ "20.15.240.64/28"
+ "20.15.240.80/28"
+ "20.15.240.96/28"
+ "20.15.240.176/28"
+ "20.15.241.0/28"
+ "20.15.242.128/28"
+ "20.15.242.144/28"
+ "20.15.242.192/28"
+ "40.83.2.64/28"
+ ];
+ blockedV6 = [ ];
+ in
+ {
+ enable = true;
+ allowPing = true;
+ logRefusedConnections = false;
+ allowedTCPPorts = [
+ 22 # ssh
+ ];
+ allowedUDPPorts = [ ];
- services.fail2ban.enable = true;
- # needed to ban on IPv4 and IPv6 for all ports
- services.fail2ban = {
- extraPackages = [ pkgs.ipset ];
- banaction = "iptables-ipset-proto6-allports";
- };
+ extraCommands =
+ builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4) + "\n"
+ + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6);
- # packages that are not flakes
- environment.systemPackages = with pkgs; [
- wget
- curl
- htop
- lsof
- git
- cargo
- clippy
- rustc
- rustfmt
- home-manager
- zsh
- restic
- thefuck
- dnsutils
- jq
- unstable.forgejo-actions-runner
- ];
+ extraStopCommands =
+ builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4) + "\n"
+ + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6);
+ };
+
+ services.fail2ban.enable = true;
+ # needed to ban on IPv4 and IPv6 for all ports
+ services.fail2ban = {
+ extraPackages = [ pkgs.ipset ];
+ banaction = "iptables-ipset-proto6-allports";
+ };
- # Ensure /etc/shells is setup for zsh
- programs.zsh.enable = true;
- environment.shells = with pkgs; [ zsh ];
+ # packages that are not flakes
+ environment.systemPackages = with pkgs; [
+ wget
+ curl
+ htop
+ lsof
+ git
+ cargo
+ clippy
+ rustc
+ rustfmt
+ home-manager
+ zsh
+ restic
+ thefuck
+ dnsutils
+ jq
+ unstable.forgejo-actions-runner
+ ];
- boot.loader = {
- systemd-boot = {
- enable = true;
- configurationLimit = 10;
- editor = false;
+ # Ensure /etc/shells is setup for zsh
+ programs.zsh.enable = true;
+ environment.shells = with pkgs; [ zsh ];
+
+ boot.loader = {
+ systemd-boot = {
+ enable = true;
+ configurationLimit = 10;
+ editor = false;
+ };
+ efi.canTouchEfiVariables = true;
};
- efi.canTouchEfiVariables = true;
- };
- boot.kernelParams = [ "ip=dhcp" ];
+ boot.kernelParams = [ "ip=dhcp" ];
- boot.initrd = {
- network.enable = true;
- luks.forceLuksSupportInInitrd = true;
- network.ssh = {
- enable = true;
- # Defaults to 22.
- port = 2222;
- shell = "/bin/cryptsetup-askpass";
- # The key is generated using `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key`
- #
- # Stored in plain text on boot partition, so don't reuse your host
- # keys. Also, make sure to use a boot loader with support for initrd
- # secrets (e.g. systemd-boot), or this will be exposed in the nix store
- # to unprivileged users.
- hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
- # I'll just authorize all keys authorized post-boot.
- authorizedKeys = config.users.users.marcel.openssh.authorizedKeys.keys;
+ boot.initrd = {
+ network.enable = true;
+ luks.forceLuksSupportInInitrd = true;
+ network.ssh = {
+ enable = true;
+ # Defaults to 22.
+ port = 2222;
+ shell = "/bin/cryptsetup-askpass";
+ # The key is generated using `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key`
+ #
+ # Stored in plain text on boot partition, so don't reuse your host
+ # keys. Also, make sure to use a boot loader with support for initrd
+ # secrets (e.g. systemd-boot), or this will be exposed in the nix store
+ # to unprivileged users.
+ hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+ # I'll just authorize all keys authorized post-boot.
+ authorizedKeys = config.users.users.marcel.openssh.authorizedKeys.keys;
+ };
};
- };
- # Write known-hosts
- programs.ssh.knownHosts = {
- "u362507.your-storagebox.de".publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
- };
+ # Write known-hosts
+ programs.ssh.knownHosts = {
+ "u362507.your-storagebox.de".publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
+ };
- # This setups a SSH server. Very important if you're setting up a headless system.
- # Feel free to remove if you don't need it.
- services.openssh = {
- enable = true;
- settings = {
- # Forbid root login through SSH.
- PermitRootLogin = "no";
- # Use keys only. Remove if you want to SSH using password (not recommended)
- PasswordAuthentication = false;
- X11Forwarding = false;
- KbdInteractiveAuthentication = false;
- UseDns = false;
+ # This setups a SSH server. Very important if you're setting up a headless system.
+ # Feel free to remove if you don't need it.
+ services.openssh = {
+ enable = true;
+ settings = {
+ # Forbid root login through SSH.
+ PermitRootLogin = "no";
+ # Use keys only. Remove if you want to SSH using password (not recommended)
+ PasswordAuthentication = false;
+ X11Forwarding = false;
+ KbdInteractiveAuthentication = false;
+ UseDns = false;
+ };
};
- };
- # SOPS
- sops.age.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
- sops.gnupg.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_rsa_key" ];
- # This is using an age key that is expected to already be in the filesystem
- sops.age.keyFile = "/persist/var/lib/sops-nix/key.txt";
- # This will generate a new key if the key specified above does not exist
- sops.age.generateKey = true;
- sops.defaultSopsFile = ./secrets/secrets.yaml;
- sops.secrets.marcel_initial_password.neededForUsers = true;
- sops.secrets.root_initial_password.neededForUsers = true;
- sops.secrets.ssh_host_ed25519_key = {
- mode = "0600";
- path = "/etc/ssh/ssh_host_ed25519_key";
- };
- sops.secrets.ssh_host_ed25519_key_pub = {
- mode = "0644";
- path = "/etc/ssh/ssh_host_ed25519_key.pub";
- };
- sops.secrets.ssh_host_rsa_key = {
- mode = "0600";
- path = "/etc/ssh/ssh_host_rsa_key";
- };
- sops.secrets.ssh_host_rsa_key_pub = {
- mode = "0644";
- path = "/etc/ssh/ssh_host_rsa_key.pub";
- };
+ # SOPS
+ sops.age.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
+ sops.gnupg.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_rsa_key" ];
+ # This is using an age key that is expected to already be in the filesystem
+ sops.age.keyFile = "/persist/var/lib/sops-nix/key.txt";
+ # This will generate a new key if the key specified above does not exist
+ sops.age.generateKey = true;
+ sops.defaultSopsFile = ./secrets/secrets.yaml;
+ sops.secrets.marcel_initial_password.neededForUsers = true;
+ sops.secrets.root_initial_password.neededForUsers = true;
+ sops.secrets.ssh_host_ed25519_key = {
+ mode = "0600";
+ path = "/etc/ssh/ssh_host_ed25519_key";
+ };
+ sops.secrets.ssh_host_ed25519_key_pub = {
+ mode = "0644";
+ path = "/etc/ssh/ssh_host_ed25519_key.pub";
+ };
+ sops.secrets.ssh_host_rsa_key = {
+ mode = "0600";
+ path = "/etc/ssh/ssh_host_rsa_key";
+ };
+ sops.secrets.ssh_host_rsa_key_pub = {
+ mode = "0644";
+ path = "/etc/ssh/ssh_host_rsa_key.pub";
+ };
- sops.secrets."ssh/marcel/id_ed25519" = {
- mode = "0600";
- owner = config.users.users.marcel.name;
- path = "/home/marcel/.ssh/id_ed25519";
- };
+ sops.secrets."ssh/marcel/id_ed25519" = {
+ mode = "0600";
+ owner = config.users.users.marcel.name;
+ path = "/home/marcel/.ssh/id_ed25519";
+ };
- sops.secrets."ssh/marcel/id_ed25519_pub" = {
- mode = "0644";
- owner = config.users.users.marcel.name;
- path = "/home/marcel/.ssh/id_ed25519.pub";
- };
+ sops.secrets."ssh/marcel/id_ed25519_pub" = {
+ mode = "0644";
+ owner = config.users.users.marcel.name;
+ path = "/home/marcel/.ssh/id_ed25519.pub";
+ };
- sops.secrets."ssh/root/id_ed25519" = {
- mode = "0600";
- owner = config.users.users.marcel.name;
- path = "/root/.ssh/id_ed25519";
- };
+ sops.secrets."ssh/root/id_ed25519" = {
+ mode = "0600";
+ owner = config.users.users.marcel.name;
+ path = "/root/.ssh/id_ed25519";
+ };
- sops.secrets."ssh/root/id_ed25519_pub" = {
- mode = "0644";
- owner = config.users.users.marcel.name;
- path = "/root/.ssh/id_ed25519.pub";
- };
+ sops.secrets."ssh/root/id_ed25519_pub" = {
+ mode = "0644";
+ owner = config.users.users.marcel.name;
+ path = "/root/.ssh/id_ed25519.pub";
+ };
- sops.secrets.backup_password = { };
+ sops.secrets.backup_password = { };
- # Configure your system-wide user settings (groups, etc), add more users as needed.
- users = {
- #mutableUsers = false;
+ # Configure your system-wide user settings (groups, etc), add more users as needed.
users = {
- marcel = {
- isNormalUser = true;
- passwordFile = config.sops.secrets.marcel_initial_password.path;
- openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev"
- ];
- extraGroups = [ "wheel" ];
- shell = pkgs.zsh;
+ #mutableUsers = false;
+ users = {
+ marcel = {
+ isNormalUser = true;
+ passwordFile = config.sops.secrets.marcel_initial_password.path;
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev"
+ ];
+ extraGroups = [ "wheel" ];
+ shell = pkgs.zsh;
+ };
};
};
- };
- # forgejo
- virtualisation.podman.enable = true;
-
- services.gitea-actions-runner = {
- instances = {
- nordgedanken = {
- enable = true;
- url = "https://git.nordgedanken.dev";
- tokenFile = config.sops.secrets.forgejo_runner_token.path;
- labels = [ ];
- name = "worker-1";
+ # forgejo
+ virtualisation.podman.enable = true;
+
+ services.gitea-actions-runner = {
+ instances = {
+ nordgedanken = {
+ enable = true;
+ url = "https://git.nordgedanken.dev";
+ tokenFile = config.sops.secrets.forgejo_runner_token.path;
+ labels = [ ];
+ name = "worker-1";
+ };
};
};
- };
- systemd.services.gitea-runner-nordgedanken = {
- serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];
- };
- sops.secrets.forgejo_runner_token = { };
- # sops.secrets.forgejo_runner_token.owner = config.users."gitea-runner".name;
-
- users.users."root".passwordFile = config.sops.secrets.root_initial_password.path;
-
- # Restic Backup
- services.restic.backups = {
- storagebox = {
- passwordFile = config.sops.secrets.backup_password.path;
- paths = [
- "/persist"
- ];
- repository = "sftp://u362507@u362507.your-storagebox.de:22//backups/worker-1";
- timerConfig = {
- OnCalendar = "00:05";
- RandomizedDelaySec = "5h";
- };
- pruneOpts = [
- "--keep-daily 7"
- "--keep-weekly 5"
- "--keep-monthly 12"
- ];
- initialize = true;
+ systemd.services.gitea-runner-nordgedanken = {
+ serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];
};
- };
+ sops.secrets.forgejo_runner_token = { };
+ # sops.secrets.forgejo_runner_token.owner = config.users."gitea-runner".name;
- # Darling Erasure
- environment.etc = {
- nixos.source = "/persist/etc/nixos";
- NIXOS.source = "/persist/etc/NIXOS";
- machine-id.source = "/persist/etc/machine-id";
- "secrets/initrd/ssh_host_ed25519_key" = {
- mode = "0600";
- source = "/persist/etc/secrets/initrd/ssh_host_ed25519_key";
+ users.users."root".passwordFile = config.sops.secrets.root_initial_password.path;
+
+ # Restic Backup
+ services.restic.backups = {
+ storagebox = {
+ passwordFile = config.sops.secrets.backup_password.path;
+ paths = [
+ "/persist"
+ ];
+ repository = "sftp://u362507@u362507.your-storagebox.de:22//backups/worker-1";
+ timerConfig = {
+ OnCalendar = "00:05";
+ RandomizedDelaySec = "5h";
+ };
+ pruneOpts = [
+ "--keep-daily 7"
+ "--keep-weekly 5"
+ "--keep-monthly 12"
+ ];
+ initialize = true;
+ };
};
- "secrets/initrd/ssh_host_ed25519_key.pub" = {
- mode = "0644";
- source = "/persist/etc/secrets/initrd/ssh_host_ed25519_key.pub";
+
+ # Darling Erasure
+ environment.etc = {
+ nixos.source = "/persist/etc/nixos";
+ NIXOS.source = "/persist/etc/NIXOS";
+ machine-id.source = "/persist/etc/machine-id";
+ "secrets/initrd/ssh_host_ed25519_key" = {
+ mode = "0600";
+ source = "/persist/etc/secrets/initrd/ssh_host_ed25519_key";
+ };
+ "secrets/initrd/ssh_host_ed25519_key.pub" = {
+ mode = "0644";
+ source = "/persist/etc/secrets/initrd/ssh_host_ed25519_key.pub";
+ };
};
- };
- systemd.tmpfiles.rules = [
- "L /home/marcel - - - - /persist/home/marcel"
- "L /var/lib/sops-nix/key.txt - - - - /persist/var/lib/sops-nix/key.txt"
- ];
- security.sudo.extraConfig = ''
- # rollback results in sudo lectures after each reboot
- Defaults lecture = never
- '';
- # Note `lib.mkBefore` is used instead of `lib.mkAfter` here.
- boot.initrd.postDeviceCommands = pkgs.lib.mkBefore ''
- mkdir -p /mnt
-
- # We first mount the btrfs root to /mnt
- # so we can manipulate btrfs subvolumes.
- mount -o subvol=/ /dev/mapper/enc /mnt
-
- # While we're tempted to just delete /root and create
- # a new snapshot from /root-blank, /root is already
- # populated at this point with a number of subvolumes,
- # which makes `btrfs subvolume delete` fail.
- # So, we remove them first.
- #
- # /root contains subvolumes:
- # - /root/var/lib/portables
- # - /root/var/lib/machines
- #
- # I suspect these are related to systemd-nspawn, but
- # since I don't use it I'm not 100% sure.
- # Anyhow, deleting these subvolumes hasn't resulted
- # in any issues so far, except for fairly
- # benign-looking errors from systemd-tmpfiles.
- btrfs subvolume list -o /mnt/root |
- cut -f9 -d' ' |
- while read subvolume; do
- echo "deleting /$subvolume subvolume..."
- btrfs subvolume delete "/mnt/$subvolume"
- done &&
- echo "deleting /root subvolume..." &&
- btrfs subvolume delete /mnt/root
-
- echo "restoring blank /root subvolume..."
- btrfs subvolume snapshot /mnt/root-blank /mnt/root
-
- # Once we're done rolling back to a blank snapshot,
- # we can unmount /mnt and continue on the boot process.
- umount /mnt
- '';
-
- # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
- system.stateVersion = "23.05";
-}
+ systemd.tmpfiles.rules = [
+ "L /home/marcel - - - - /persist/home/marcel"
+ "L /var/lib/sops-nix/key.txt - - - - /persist/var/lib/sops-nix/key.txt"
+ ];
+ security.sudo.extraConfig = ''
+ # rollback results in sudo lectures after each reboot
+ Defaults lecture = never
+ '';
+ # Note `lib.mkBefore` is used instead of `lib.mkAfter` here.
+ boot.initrd.postDeviceCommands = pkgs.lib.mkBefore ''
+ mkdir -p /mnt
+
+ # We first mount the btrfs root to /mnt
+ # so we can manipulate btrfs subvolumes.
+ mount -o subvol=/ /dev/mapper/enc /mnt
+
+ # While we're tempted to just delete /root and create
+ # a new snapshot from /root-blank, /root is already
+ # populated at this point with a number of subvolumes,
+ # which makes `btrfs subvolume delete` fail.
+ # So, we remove them first.
+ #
+ # /root contains subvolumes:
+ # - /root/var/lib/portables
+ # - /root/var/lib/machines
+ #
+ # I suspect these are related to systemd-nspawn, but
+ # since I don't use it I'm not 100% sure.
+ # Anyhow, deleting these subvolumes hasn't resulted
+ # in any issues so far, except for fairly
+ # benign-looking errors from systemd-tmpfiles.
+ btrfs subvolume list -o /mnt/root |
+ cut -f9 -d' ' |
+ while read subvolume; do
+ echo "deleting /$subvolume subvolume..."
+ btrfs subvolume delete "/mnt/$subvolume"
+ done &&
+ echo "deleting /root subvolume..." &&
+ btrfs subvolume delete /mnt/root
+
+ echo "restoring blank /root subvolume..."
+ btrfs subvolume snapshot /mnt/root-blank /mnt/root
+
+ # Once we're done rolling back to a blank snapshot,
+ # we can unmount /mnt and continue on the boot process.
+ umount /mnt
+ '';
+
+ # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
+ system.stateVersion = "23.05";
+ }
