zoey/config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

updates

Browse source
This commit is contained in:
zoey 2026-01-13 15:39:16 -05:00
parent 6198cf14d4
commit 1506941c66
Signed by: zoey
GPG key ID: 81FB9FECDD6A33E2
49 changed files with 1963 additions and 1822 deletions
Download patch file Download diff file Expand all files Collapse all files

26
modules/nixos/services/crypto/default.nix
View file

@ -14,18 +14,18 @@ in {
config = mkIf cfg.enable {
services.wg-container.enable = true;
systemd.services.monero.vpnConfinement = {
enable = true;
vpnNamespace = "wg";
};
services.monero = {
enable = true;
mining.enable = false;
rpc = {address = "192.168.15.1";};
extraConfig = ''
confirm-external-bind=1
'';
};
# systemd.services.monero.vpnConfinement = {
# enable = true;
# vpnNamespace = "wg";
# };
#
# services.monero = {
# enable = true;
# mining.enable = false;
# rpc = {address = "192.168.15.1";};
# extraConfig = ''
# confirm-external-bind=1
# '';
# };
};
}

32
modules/nixos/services/mail/default.nix
View file

@ -33,7 +33,7 @@ in {
gitlab-email-pw-hashed.file = ./sec/gitlab-email-pw-hashed.age;
};
mailserver = {
mailserver = rec {
enable = true;
fqdn = "mail.zoeys.email";
domains = ["zoeys.email" "zoeys.cloud" "zoeys.computer" "zackmyers.io" "zacharymyers.com" "pictureofcat.com"];
@ -64,27 +64,23 @@ in {
};
};
certificateScheme = "acme-nginx";
enableManageSieve = true;
dmarcReporting.enable = true;
x509.useACMEHost = fqdn;
virusScanning = true;
stateVersion = 3;
};
# services.nginx = {
# virtualHosts = {
# "cal.zoeys.cloud" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://localhost:5232/";
# extraConfig = ''
# proxy_set_header X-Script-Name /;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_pass_header Authorization;
# '';
# };
# };
# };
# };
services.nginx = {
virtualHosts = {
"${config.mailserver.fqdn}" = {
forceSSL = true;
enableACME = true;
};
};
};
services.roundcube = {
enable = true;

146
modules/nixos/services/matrix/default.nix Normal file
View file

@ -0,0 +1,146 @@
{
lib,
config,
pkgs,
...
}:
with lib;
with lib.custom; let
cfg = config.services.matrix;
in {
options.services.matrix = with types; {
enable = mkBoolOpt false "Matrix Web Server";
};
config = mkIf cfg.enable {
sops = {
defaultSopsFile = ../../../.sops.yaml;
gnupg.home = "/var/lib/sops";
gnupg.sshKeyPaths = [];
secrets = {
"password" = {
sopsFile = ../../../../secrets/matrix-db.yaml;
owner = "root";
group = "root";
mode = "0444";
neededForUsers = true;
};
};
};
services.matrix-synapse-next = {
enable = true;
workers.federationSenders = 2;
workers.federationReceivers = 2;
workers.initialSyncers = 2;
workers.normalSyncers = 2;
workers.eventPersisters = 2;
workers.useUserDirectoryWorker = true;
enableNginx = true;
settings = {
server_name = "zoeys.cloud";
recaptcha_public_key = "6LdcENQrAAAAAKFi-gTzPnf6Q2xq7yTmIYv6Xw5o";
recaptcha_private_key = "6LdcENQrAAAAABfnE6TVkMWtRrw0OZqZEfYaGm7m";
enable_registration = true;
enable_registration_captcha = true;
database = {
name = "psycopg2";
args = {
host = "localhost";
user = "synapse";
password = "synapse";
dbname = "synapse";
};
};
};
};
services.redis.servers."".enable = true;
services.coturn = rec {
enable = true;
no-cli = true;
no-tcp-relay = true;
min-port = 49000;
max-port = 50000;
use-auth-secret = true;
static-auth-secret = "will be world readable for local users :(";
realm = "turn.zoeys.cloud";
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
extraConfig = ''
verbose
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
'';
};
networking.firewall = {
interfaces.ens3 = let
range = with config.services.coturn; [
{
from = min-port;
to = max-port;
}
];
in {
allowedUDPPortRanges = range;
allowedUDPPorts = [3478 5349];
allowedTCPPortRanges = [];
allowedTCPPorts = [3478 5349];
};
};
services.nginx.virtualHosts.${config.services.coturn.realm} = {
forceSSL = true;
enableACME = true;
locations."/" = {
return = "200 '<html><body>Hai :3</body></html>'";
};
};
users.groups.turnserver.members = ["nginx"];
security.acme.certs.${config.services.coturn.realm} = {
/*
insert here the right configuration to obtain a certificate
*/
postRun = "systemctl restart coturn.service";
group = "turnserver";
};
# configure synapse to point users to coturn
services.matrix-synapse.settings = with config.services.coturn; {
turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
turn_shared_secret = static-auth-secret;
turn_user_lifetime = "1h";
};
};
}

2
modules/nixos/services/web/nginx/default.nix
View file

@ -20,7 +20,7 @@ in {
services.nginx = {
enable = true;
package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
# package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
recommendedProxySettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;