nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Working secrets implementation

Browse Source
This commit is contained in:
niten
2021-04-20 17:53:25 -07:00
parent 951ffa3ff9
commit 353936d509
6 changed files with 242 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/host-config/limina.nix
+92 -35
View File
@@ -64,13 +64,23 @@ in {
network-definition = config.fudo.networks.${domain-name};
};
secrets = {
backplane-client-limina-passwd = {
source-file = /srv/secrets/backplane-client/limina.passwd;
target-file = "/srv/backplane/dns/client.passwd";
target-host = "limina";
user = config.fudo.client.dns.user;
};
};
client.dns = {
enable = true;
ipv4 = true;
ipv6 = true;
user = "fudo-client";
external-interface = "enp1s0";
password-file = "/srv/client/secure/client.passwd";
password-file =
config.fudo.secrets.backplane-client-limina-passwd.target-file;
};
garbage-collector = {
@@ -118,28 +128,6 @@ in {
};
};
services.nginx = {
enable = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
virtualHosts = {
"dns-hole.${domain-name}" = {
serverAliases = [
"pihole.${domain-name}"
"hole.${domain-name}"
"pihole"
"dns-hole"
"hole"
];
locations."/" = { proxyPass = "http://127.0.0.1:3080"; };
};
};
};
# Support for statelessness
environment.etc = {
nixos.source = "/state/nixos";
@@ -173,18 +161,87 @@ in {
"L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
];
services.openssh = {
hostKeys = [
{
path = "/state/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/state/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
security.acme.certs."sea-camera.fudo.link".email = "niten@fudo.org";
services = {
nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
virtualHosts = {
"dns-hole.${domain-name}" = {
serverAliases = [
"pi-hole.${domain-name}"
"pihole.${domain-name}"
"hole.${domain-name}"
"pi-hole"
"pihole"
"dns-hole"
"hole"
];
locations."/" = { proxyPass = "http://127.0.0.1:3080"; };
};
"sea-camera.fudo.link" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://panopticon.sea.fudo.org";
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-By $server_addr:$server_port;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
'';
};
};
# "sea-camera-od.fudo.link" = {
# enableACME = true;
# forceSSL = true;
# locations."/" = {
# proxyPass = "http://panopticon-od.sea.fudo.org";
# extraConfig = ''
# proxy_http_version 1.1;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "Upgrade";
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-By $server_addr:$server_port;
# proxy_set_header X-Forwarded-For $remote_addr;
# proxy_set_header X-Forwarded-Proto $scheme;
# '';
# };
# };
};
};
openssh = {
hostKeys = [
{
path = "/state/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/state/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
};
};
};
}