dot_testing/boxes/netbox/default.nix

275 lines
6.2 KiB
Nix
Raw Normal View History

2023-07-07 23:44:40 -05:00
{ lib, config, pkgs, ... }:
{
2023-07-07 23:44:40 -05:00
imports =
[
2024-01-18 04:28:32 -06:00
./hardware-configuration.nix
../../modules/bootstrap.nix
2023-07-07 23:44:40 -05:00
];
2024-01-18 04:28:32 -06:00
networking.networkmanager.enable = true;
time.timeZone = "America/Chicago";
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
environment.systemPackages = with pkgs; [
curl
htop
git
tree
dig
htop
gnumake
];
system.copySystemConfiguration = true;
system.stateVersion = "23.05"; # don't change this, lol
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/vda";
2023-07-07 23:44:40 -05:00
2024-01-18 04:28:32 -06:00
# services.cgit = {
# "beepboop.systems" = {
# extraConfig = ''
# root-desc="testing"
#
# section=main
# repo.url=dot_testing
# repo.path=/var/lib/git/dot_testing
# repo.desc=configuration for NixOS/Linux systems
# repo.owner=rndusr
#
# readme=:README.md
# '';
# enable = true;
# };
# };
networking.hostName = "netbox";
2023-07-07 23:44:40 -05:00
2024-01-02 15:20:19 -06:00
services.radicale = {
enable = true;
config = ''
[auth]
type = htpasswd
htpasswd_filename = radicale-passwd
htpasswd_encryption = plain
'';
};
2023-12-03 20:48:49 -06:00
services.rss2email = {
enable = true;
2023-12-03 21:46:37 -06:00
to = "ryan@beepboop.systems";
2023-12-03 20:48:49 -06:00
feeds = {
"eff" = {
url = "https://www.eff.org/rss/updates.xml";
};
2023-12-03 21:46:37 -06:00
"nixos" = {
url = "https://nixos.org/blog/announcements-rss.xml";
};
"drewdevault" = {
url = "https://drewdevault.com/blog/index.xml";
};
"nullprogram" = {
url = "https://nullprogram.com/feed/";
};
2023-12-03 20:48:49 -06:00
};
};
2023-12-03 21:46:37 -06:00
services.fail2ban = {
enable = true;
ignoreIP = [
"192.168.1.0/24"
];
extraPackages = [pkgs.ipset];
banaction = "iptables-ipset-proto6-allports";
jails = {
"nginx-bruteforce" = ''
enabled = true
filter = nginx-bruteforce
logpath = /var/log/nginx/access.log
backend = auto
maxretry = 6
findtime = 600
'';
"postfix-bruteforce" = ''
enabled = true
filter = postfix-bruteforce
maxretry = 6
findtime = 600
'';
};
};
environment.etc = {
"fail2ban/filter.d/nginx-bruteforce.conf".text = ''
[Definition]
failregex = ^<HOST>.*GET.*(matrix/server|\.php|admin|wp\-).* HTTP/\d.\d\" 404.*$
'';
"fail2ban/filter.d/postfix-bruteforce.conf".text = ''
[Definition]
failregex = warning: [\w\.\-]+\[<HOST>\]: SASL LOGIN authentication failed.*$
journalmatch = _SYSTEMD_UNIT=postfix.service
'';
};
users.users.useracc = {
isNormalUser = true;
extraGroups = [ "wheel" "docker" ];
};
2023-07-07 23:44:40 -05:00
users.users.ryan = {
isNormalUser = true;
extraGroups = [ "wheel" "docker" ];
};
services.openssh = {
enable = true;
ports = [55555];
};
2023-12-03 19:50:26 -06:00
services.endlessh.enable = true;
2023-12-03 20:02:19 -06:00
services.endlessh.port = 22;
2023-12-03 19:50:26 -06:00
services.vaultwarden.enable = true;
services.vaultwarden.config = {
2024-01-18 04:32:42 -06:00
DOMAIN = "https://bitwarden.beepboop.systems";
SIGNUPS_ALLOWED = false;
2023-12-03 19:50:26 -06:00
};
networking.usePredictableInterfaceNames = false;
2023-07-07 23:44:40 -05:00
services.gitea = {
enable = true;
appName = "crappy code"; # Give the site a name
database = {
type = "postgres";
passwordFile = "/etc/gittea-pass";
};
settings.server = {
DOMAIN = "git.beepboop.systems";
ROOT_URL = "https://git.beepboop.systems/";
HTTP_PORT = 3001;
2023-07-07 23:44:40 -05:00
};
};
2023-07-07 23:44:40 -05:00
services.postgresql = {
enable = true; # Ensure postgresql is enabled
authentication = ''
local gitea all ident map=gitea-users
'';
identMap = # Map the gitea user to postgresql
''
gitea-users gitea gitea
2023-07-07 23:44:40 -05:00
'';
};
2023-07-07 23:44:40 -05:00
services.nginx.enable = true;
services.nginx.clientMaxBodySize = "100m";
2023-07-07 23:44:40 -05:00
services.nginx.virtualHosts."beepboop.systems" = {
forceSSL = true;
enableACME = true;
root = "/var/www/beepboop.systems";
};
2023-07-07 23:44:40 -05:00
2024-01-02 15:20:19 -06:00
services.nginx.virtualHosts."webhooks.beepboop.systems" = {
forceSSL = true;
enableACME = true;
root = "/var/www/webhooks.beepboop.systems";
};
services.nginx.virtualHosts."git.beepboop.systems" = {
forceSSL = true;
enableACME = true;
locations."/".proxyPass = "http://localhost:3001";
};
2023-07-07 23:44:40 -05:00
2023-12-18 16:52:42 -06:00
services.nginx.virtualHosts."bit.beepboop.systems" = {
forceSSL = true;
enableACME = true;
globalRedirect = "bitwarden.beepboop.systems";
};
services.nginx.virtualHosts."bitwarden.beepboop.systems" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8000";
2023-07-07 23:44:40 -05:00
};
};
2023-07-07 23:44:40 -05:00
services.nginx.virtualHosts."radicale.beepboop.systems" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:5232";
extraConfig = ''
proxy_set_header X-Script-Name /;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass_header Authorization;
'';
};
};
2023-12-18 16:52:42 -06:00
services.nginx.virtualHosts."calendar.beepboop.systems" = {
2023-07-15 23:10:22 -05:00
forceSSL = true;
enableACME = true;
2023-12-18 16:52:42 -06:00
globalRedirect = "radicale.beepboop.systems";
};
services.nginx.virtualHosts."cal.beepboop.systems" = {
forceSSL = true;
enableACME = true;
globalRedirect = "radicale.beepboop.systems";
2023-07-15 23:10:22 -05:00
};
services.nginx.virtualHosts."skillissue.agency" = {
forceSSL = true;
enableACME = true;
root = "/var/www/skillissue.agency";
};
2023-07-07 23:44:40 -05:00
security.acme = {
acceptTerms = true;
2023-12-03 19:50:26 -06:00
email = "nickforanick@protonmail.com";
};
2023-07-07 23:44:40 -05:00
2024-01-18 04:28:32 -06:00
# services.roundcube = {
# enable = true;
# # this is the url of the vhost, not necessarily the same as the fqdn of
# # the mailserver
# hostName = "cube.beepboop.systems";
# extraConfig = ''
# # starttls needed for authentication, so the fqdn required to match
# # the certificate
# $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
# $config['smtp_user'] = "%u";
# $config['smtp_pass'] = "%p";
# '';
# };
2023-07-07 23:44:40 -05:00
2023-12-18 16:52:42 -06:00
services.nginx.virtualHosts."roundcube.beepboop.systems" = {
forceSSL = true;
enableACME = true;
globalRedirect = "cube.beepboop.systems";
};
services.nginx.virtualHosts."mail.beepboop.systems" = {
forceSSL = true;
enableACME = true;
globalRedirect = "cube.beepboop.systems";
};
2023-12-03 19:50:26 -06:00
networking.firewall = {
enable = true;
allowedTCPPorts = [ 5232 55555 22 80 443 ];
};
2023-07-07 23:44:40 -05:00
}