randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial clean commit

Browse source
This commit is contained in:
randogoth 2026-02-05 17:57:02 +02:00
commit 1862821f8f
15 changed files with 1240 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

64
modules/services/caddy.nix Normal file
View file

@ -0,0 +1,64 @@
{ pkgs, ... }:
{
services.caddy.enable = true;
services.caddy.configFile = pkgs.writeText "Caddyfile" ''
http:// {
root * /usr/share/caddy
file_server
}
privatpraxis-last-heidelberg.de, www.privatpraxis-last-heidelberg.de {
root * /var/www/privatpraxis-last-heidelberg.de/public
encode zstd gzip
file_server
}
raayoni-last.com, www.raayoni-last.com, flux.vision, www.flux.vision {
redir https://tobias.raayoni-last.com
}
tobias.raayoni-last.com {
root * /var/www/raayoni-last.com/tobias/public
encode zstd gzip
file_server
}
randogoth.com, www.randogoth.com {
root * /var/www/raayoni-last.com/tobias/public
encode zstd gzip
file_server
}
sublunar.space, www.sublunar.space {
root * /var/www/sublunar.space/public
encode zstd gzip
file_server
}
almanac.sublunar.space {
root * /var/www/sublunar.space/almanac/public
encode zstd gzip
@wasm {
path /js/*.wasm
}
header @wasm Content-Type application/wasm
file_server
}
scopesessions.org, www.scopesessions.org {
root * /var/www/scopesessions.org/public
encode zstd gzip
file_server
}
nmns.place, www.nmns.place {
root * /var/www/nmns.place/public
encode zstd gzip
file_server
}
import Caddyfile.d/*.caddyfile
'';
}

104
modules/services/firewall.nix Normal file
View file

@ -0,0 +1,104 @@
{ ... }:
{
networking.firewall.enable = true;
networking.firewall.backend = "firewalld";
networking.nftables.enable = true;
services.firewalld.enable = true;
services.firewalld.settings.DefaultZone = "FedoraServer";
services.firewalld.zones.FedoraServer = {
target = "%%REJECT%%";
interfaces = [ "ens3" ];
forward = true;
services = [ "http" "https" "ssh" ];
ports = [
{
port = 8443;
protocol = "tcp";
}
];
rules = [
{
rule = {
"@family" = "ipv4";
source = { "@address" = "80.94.92.177"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "45.148.10.240"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "193.242.125.233"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "45.78.198.204"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "176.120.22.47"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "91.202.233.33"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "188.166.24.102"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "128.1.47.28"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "188.166.11.218"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "104.248.91.222"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
];
};
}

13
modules/services/openssh.nix Normal file
View file

@ -0,0 +1,13 @@
{ ... }:
{
services.openssh.enable = true;
services.openssh.settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
AllowTcpForwarding = "no";
X11Forwarding = false;
UseDns = false;
MaxAuthTries = 3;
};
}

39
modules/services/podman.nix Normal file
View file

@ -0,0 +1,39 @@
{ config, ... }:
{
environment.etc."sops/age/keys.txt".source = ../../secrets/age/keys.txt;
sops.defaultSopsFile = ../../secrets/bucur.yaml;
sops.age.keyFile = "/etc/sops/age/keys.txt";
sops.secrets.mtproto_secret = {};
sops.templates."mtproto-proxy.env".content = ''
SECRET=${config.sops.placeholder."mtproto_secret"}
'';
virtualisation.podman.enable = true;
virtualisation.oci-containers.backend = "podman";
virtualisation.oci-containers.containers = {
portainer = {
image = "docker.io/portainer/portainer-ce:lts";
autoStart = true;
ports = [
"100.124.109.92:8000:8000"
"100.124.109.92:9443:9443"
];
volumes = [
"portainer_data:/data"
"/run/podman/podman.sock:/var/run/docker.sock"
];
extraOptions = [ "--privileged" ];
};
mtproto-proxy = {
image = "docker.io/telegrammessenger/proxy:latest";
autoStart = true;
ports = [ "0.0.0.0:8443:443" ];
volumes = [ "mtproxy-data:/data" ];
environmentFiles = [ config.sops.templates."mtproto-proxy.env".path ];
};
};
}

160
modules/services/static-sites/default.nix Normal file
View file

@ -0,0 +1,160 @@
{ inputs, pkgs, ... }:
let
buildPelicanSite = { name, src, subdir ? "", pluginSources ? [ ] }:
let
workdir = if subdir == "" then "." else subdir;
pythonEnv = pkgs.python3.withPackages (ps: [
ps.pelican
ps.markdown
ps.pygments
]);
copyPlugins = pkgs.lib.concatStringsSep "\n" (map (plugin: ''
mkdir -p "${workdir}/${plugin.dest}"
cp -a "${plugin.src}${if plugin ? subdir then "/${plugin.subdir}" else ""}/." "${workdir}/${plugin.dest}/"
'') pluginSources);
in
pkgs.stdenvNoCC.mkDerivation {
pname = name;
version = "git";
src = src;
nativeBuildInputs = [ pythonEnv ];
buildPhase = ''
runHook preBuild
cd ${workdir}
${copyPlugins}
${pythonEnv}/bin/pelican content -o "$out"
runHook postBuild
'';
installPhase = "true";
};
buildJekyllSite = { name, src, gemset }:
let
bundlerEnv = pkgs.bundlerEnv {
name = "${name}-bundler-env";
gemdir = src;
gemset = gemset;
};
in
pkgs.stdenvNoCC.mkDerivation {
pname = name;
version = "git";
src = src;
nativeBuildInputs = [ bundlerEnv ];
buildPhase = ''
runHook preBuild
JEKYLL_ENV=production bundle exec jekyll build -s . -d "$out"
runHook postBuild
'';
installPhase = "true";
};
buildStaticSite = { name, src, subdir ? "" }:
let
srcPath = if subdir == "" then src else "${src}/${subdir}";
in
pkgs.stdenvNoCC.mkDerivation {
pname = name;
version = "git";
src = src;
dontUnpack = true;
installPhase = ''
runHook preInstall
mkdir -p "$out"
cp -a ${srcPath}/. "$out/"
runHook postInstall
'';
};
mkDeployService = { name, src, dest }:
{
description = "Deploy ${name} site";
path = [ pkgs.coreutils pkgs.rsync ];
serviceConfig = {
Type = "oneshot";
};
script = ''
install -d -m 755 ${dest}
rsync -a --delete ${src}/ ${dest}/
'';
};
sublunarSite = buildPelicanSite {
name = "sublunar";
src = inputs.sublunar;
};
tobiasRaayoniLastSite = buildPelicanSite {
name = "tobias-raayoni-last";
src = inputs.flux_vision;
subdir = "web";
};
nmnsSite = buildPelicanSite {
name = "nmns";
src = inputs.nfc_web;
subdir = "web";
};
scopesessionsSite = buildJekyllSite {
name = "scopesessions";
src = inputs.scopesessions;
gemset = ./scopesessions-gemset.nix;
};
almanacSite = buildStaticSite {
name = "sublunar-almanac";
src = inputs.sublunar_almanac;
};
praxisSite = buildStaticSite {
name = "praxis";
src = inputs.praxis;
};
isNixBuild = builtins.getEnv "IN_NIX_BUILD" == "1";
in
{
sops.secrets.codeberg_id_ed25519 = {
owner = "root";
group = "root";
mode = "0400";
path = "/etc/ssh/codeberg_id_ed25519";
};
systemd.services."deploy-sublunar" = mkDeployService {
name = "sublunar";
src = sublunarSite;
dest = "/var/www/sublunar.space/public";
};
systemd.services."deploy-tobias-raayoni-last" = mkDeployService {
name = "tobias-raayoni-last";
src = tobiasRaayoniLastSite;
dest = "/var/www/raayoni-last.com/tobias/public";
};
systemd.services."deploy-nmns" = mkDeployService {
name = "nmns";
src = nmnsSite;
dest = "/var/www/nmns.place/public";
};
systemd.services."deploy-scopesessions" = mkDeployService {
name = "scopesessions";
src = scopesessionsSite;
dest = "/var/www/scopesessions.org/public";
};
systemd.services."deploy-almanac" = mkDeployService {
name = "almanac";
src = almanacSite;
dest = "/var/www/sublunar.space/almanac/public";
};
systemd.services."deploy-privatpraxis" = mkDeployService {
name = "privatpraxis";
src = praxisSite;
dest = "/var/www/privatpraxis-last-heidelberg.de/public";
};
}

419
modules/services/static-sites/scopesessions-gemset.nix Normal file
View file

@ -0,0 +1,419 @@
{
addressable = {
dependencies = ["public_suffix"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0mxhjgihzsx45l9wh2n0ywl9w0c6k70igm5r0d63dxkcagwvh4vw";
type = "gem";
};
version = "2.8.8";
};
base64 = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
type = "gem";
};
version = "0.3.0";
};
bigdecimal = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
type = "gem";
};
version = "4.0.1";
};
colorator = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0f7wvpam948cglrciyqd798gdc6z3cfijciavd0dfixgaypmvy72";
type = "gem";
};
version = "1.1.0";
};
concurrent-ruby = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
type = "gem";
};
version = "1.3.6";
};
csv = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
type = "gem";
};
version = "3.3.5";
};
em-websocket = {
dependencies = ["eventmachine" "http_parser.rb"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1a66b0kjk6jx7pai9gc7i27zd0a128gy73nmas98gjz6wjyr4spm";
type = "gem";
};
version = "0.5.3";
};
eventmachine = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
type = "gem";
};
version = "1.2.7";
};
faraday = {
dependencies = ["faraday-net_http" "json" "logger"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1ka175ci0q9ylpcy651pjj580diplkaskycn4n7jcmbyv7jwz6c6";
type = "gem";
};
version = "2.14.0";
};
faraday-net_http = {
dependencies = ["net-http"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
type = "gem";
};
version = "3.4.2";
};
ffi = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
type = "gem";
};
version = "1.17.2";
};
forwardable-extended = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "15zcqfxfvsnprwm8agia85x64vjzr2w0xn9vxfnxzgcv8s699v0v";
type = "gem";
};
version = "2.6.0";
};
google-protobuf = {
dependencies = ["bigdecimal" "rake"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0583agdf2jvnq78scf8008bddrmbybn27ylyydg6bza2qvb510bl";
type = "gem";
};
version = "4.33.2";
};
"http_parser.rb" = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1gj4fmls0mf52dlr928gaq0c0cb0m3aqa9kaa6l0ikl2zbqk42as";
type = "gem";
};
version = "0.8.0";
};
i18n = {
dependencies = ["concurrent-ruby"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
type = "gem";
};
version = "1.14.8";
};
jekyll = {
dependencies = ["addressable" "base64" "colorator" "csv" "em-websocket" "i18n" "jekyll-sass-converter" "jekyll-watch" "json" "kramdown" "kramdown-parser-gfm" "liquid" "mercenary" "pathutil" "rouge" "safe_yaml" "terminal-table" "webrick"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1h8qpki1zcw4srnzmbba2gwajycm50w53kxq8l6vicm5azc484ac";
type = "gem";
};
version = "4.4.1";
};
jekyll-sass-converter = {
dependencies = ["sass-embedded"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0hr4hsir8lm8aw3yj9zi7hx2xs4k00xn9inh24642d6iy625v4l3";
type = "gem";
};
version = "3.1.0";
};
jekyll-watch = {
dependencies = ["listen"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1qd7hy1kl87fl7l0frw5qbn22x7ayfzlv9a5ca1m59g0ym1ysi5w";
type = "gem";
};
version = "2.2.1";
};
json = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "01fmiz052cvnxgdnhb3qwcy88xbv7l3liz0fkvs5qgqqwjp0c1di";
type = "gem";
};
version = "2.18.0";
};
kramdown = {
dependencies = ["rexml"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "131nwypz8b4pq1hxs6gsz3k00i9b75y3cgpkq57vxknkv6mvdfw7";
type = "gem";
};
version = "2.5.1";
};
kramdown-parser-gfm = {
dependencies = ["kramdown"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0a8pb3v951f4x7h968rqfsa19c8arz21zw1vaj42jza22rap8fgv";
type = "gem";
};
version = "1.1.0";
};
liquid = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1czxv2i1gv3k7hxnrgfjb0z8khz74l4pmfwd70c7kr25l2qypksg";
type = "gem";
};
version = "4.0.4";
};
listen = {
dependencies = ["rb-fsevent" "rb-inotify"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0rwwsmvq79qwzl6324yc53py02kbrcww35si720490z5w0j497nv";
type = "gem";
};
version = "3.9.0";
};
logger = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
type = "gem";
};
version = "1.7.0";
};
mercenary = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0f2i827w4lmsizrxixsrv2ssa3gk1b7lmqh8brk8ijmdb551wnmj";
type = "gem";
};
version = "0.4.0";
};
mini_magick = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1nfxjpmka12ihbwd87d5k2hh7d2pv3aq95x0l2lh8gca1s72bmki";
type = "gem";
};
version = "4.13.2";
};
net-http = {
dependencies = ["uri"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "15k96fj6qwbaiv6g52l538ass95ds1qwgynqdridz29yqrkhpfi5";
type = "gem";
};
version = "0.9.1";
};
pathutil = {
dependencies = ["forwardable-extended"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "12fm93ljw9fbxmv2krki5k5wkvr7560qy8p4spvb9jiiaqv78fz4";
type = "gem";
};
version = "0.16.2";
};
public_suffix = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "15dhl6k4gbax0xz8frfs4nsb6lg5zgax9vkr1pqzjmhfxddhn2gp";
type = "gem";
};
version = "7.0.0";
};
rake = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
type = "gem";
};
version = "13.3.1";
};
rb-fsevent = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1zmf31rnpm8553lqwibvv3kkx0v7majm1f341xbxc0bk5sbhp423";
type = "gem";
};
version = "0.11.2";
};
rb-inotify = {
dependencies = ["ffi"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0vmy8xgahixcz6hzwy4zdcyn2y6d6ri8dqv5xccgzc1r292019x0";
type = "gem";
};
version = "0.11.1";
};
rexml = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
type = "gem";
};
version = "3.4.4";
};
rouge = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1pkp5icgm7s10b2n6b2pzbdsfiv0l5sxqyizx55qdmlpaxnk8xah";
type = "gem";
};
version = "4.6.1";
};
safe_yaml = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0j7qv63p0vqcd838i2iy2f76c3dgwzkiz1d1xkg7n0pbnxj2vb56";
type = "gem";
};
version = "1.0.5";
};
sass-embedded = {
dependencies = ["google-protobuf" "rake"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1nb8wy2v397qi7hn3vamya6yv7v4ix2zfdsrk3mairslb24yhbhi";
type = "gem";
};
version = "1.97.1";
};
terminal-table = {
dependencies = ["unicode-display_width"];
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "14dfmfjppmng5hwj7c5ka6qdapawm3h6k9lhn8zj001ybypvclgr";
type = "gem";
};
version = "3.0.2";
};
unicode-display_width = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0nkz7fadlrdbkf37m0x7sw8bnz8r355q3vwcfb9f9md6pds9h9qj";
type = "gem";
};
version = "2.6.0";
};
uri = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "1ijpbj7mdrq7rhpq2kb51yykhrs2s54wfs6sm9z3icgz4y6sb7rp";
type = "gem";
};
version = "1.1.1";
};
webrick = {
groups = ["default"];
platforms = [];
source = {
remotes = ["https://rubygems.org"];
sha256 = "0ca1hr2rxrfw7s613rp4r4bxb454i3ylzniv9b9gxpklqigs3d5y";
type = "gem";
};
version = "1.9.2";
};
}

5
modules/services/tailscale.nix Normal file
View file

@ -0,0 +1,5 @@
{ ... }:
{
services.tailscale.enable = true;
services.tailscale.port = 41641;
}