From 83f565ba8ceb10a1efd220800933dd7f52f6f868 Mon Sep 17 00:00:00 2001 From: bogale Date: Thu, 17 Sep 2026 11:41:39 +0900 Subject: [PATCH 01/10] sops-nix --- .sops.yaml | 7 +++++++ common.nix | 1 + home/common.nix | 4 ---- home/server/bogale.nix | 2 +- home/server/common.nix | 7 +++++++ home/server/root.nix | 2 +- server/configuration.nix | 3 +++ server/flake.lock | 23 ++++++++++++++++++++++- server/flake.nix | 7 ++++++- 9 files changed, 48 insertions(+), 8 deletions(-) create mode 100644 .sops.yaml create mode 100644 home/server/common.nix diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..edf9919 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,7 @@ +keys: + - &age age18uvtlgx442kkufwp6g42lfxk2ft3e4ksjhumdugjcc7uclyzj9vqk9f8fw +creation_rules: + - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *age diff --git a/common.nix b/common.nix index 759a349..e7c64c4 100644 --- a/common.nix +++ b/common.nix @@ -50,6 +50,7 @@ amneziawg-go amneziawg-tools sbctl + sops ]; services = { logind.settings.Login.HandleLidSwitch = "ignore"; diff --git a/home/common.nix b/home/common.nix index b789ab6..fdc2d90 100644 --- a/home/common.nix +++ b/home/common.nix @@ -39,13 +39,9 @@ extraConfig = '' unbind C-b set -g mouse on - set -g prefix M-d - set -g prefix M-f set-option -g focus-events on set -s set-clipboard external set-option -a terminal-features "xterm-256color:RGB" - bind f send-prefix - bind d send-prefix bind h select-pane -L bind j select-pane -D bind k select-pane -U diff --git a/home/server/bogale.nix b/home/server/bogale.nix index f6bd6f1..bcb97f6 100644 --- a/home/server/bogale.nix +++ b/home/server/bogale.nix @@ -1,4 +1,4 @@ { config, pkgs, ... }: { - imports = [ ../bogale.nix ]; + imports = [ ./common.nix ../bogale.nix ]; } diff --git a/home/server/common.nix b/home/server/common.nix new file mode 100644 index 0000000..4c8896f --- /dev/null +++ b/home/server/common.nix @@ -0,0 +1,7 @@ +{ config, pkgs, ... }: +{ + programs.tmux.extraConfig = '' + set -g prefix M-d + bind d send-prefix + ''; +} diff --git a/home/server/root.nix b/home/server/root.nix index 8998624..517ada8 100644 --- a/home/server/root.nix +++ b/home/server/root.nix @@ -1,6 +1,6 @@ { config, pkgs, ... }: { - imports = [ ../root.nix ]; + imports = [ ./common.nix ../root.nix ]; programs.bash = { shellAliases = { "nixos-rebuild" = "nixos-rebuild --impure --flake /etc/nixos/server#nixos-server"; }; }; diff --git a/server/configuration.nix b/server/configuration.nix index c572485..8e8891e 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -2,6 +2,9 @@ { imports = [ ../common.nix ./hardware-configuration.nix ]; boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ]; + users.users.bogale.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1" + ]; networking = { hostName = "nixos-server"; networkmanager.ensureProfiles.profiles.home-wifi = { diff --git a/server/flake.lock b/server/flake.lock index 0a16ff3..0c03c52 100644 --- a/server/flake.lock +++ b/server/flake.lock @@ -40,7 +40,28 @@ "root": { "inputs": { "home-manager": "home-manager", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1788914643, + "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "13616fff713a9f94055c66f15687ebdc17a335df", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" } } }, diff --git a/server/flake.nix b/server/flake.nix index 705a8a3..6000b63 100644 --- a/server/flake.nix +++ b/server/flake.nix @@ -1,15 +1,20 @@ { inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; home-manager = { url = "github:nix-community/home-manager/release-26.05"; inputs.nixpkgs.follows = "nixpkgs"; }; }; - outputs = inputs@{ self, nixpkgs, home-manager, ... }: { + outputs = inputs@{ self, nixpkgs, sops-nix, home-manager, ... }: { nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem { modules = [ ./configuration.nix + sops-nix.nixosModules.sops home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; From 28e370709f618c13ca9f5f58ee333da0200b5744 Mon Sep 17 00:00:00 2001 From: bogale Date: Thu, 17 Sep 2026 12:37:23 +0900 Subject: [PATCH 02/10] sops removed --- .sops.yaml | 7 ------- common.nix | 1 - server/flake.lock | 23 +---------------------- server/flake.nix | 10 ++-------- 4 files changed, 3 insertions(+), 38 deletions(-) delete mode 100644 .sops.yaml diff --git a/.sops.yaml b/.sops.yaml deleted file mode 100644 index edf9919..0000000 --- a/.sops.yaml +++ /dev/null @@ -1,7 +0,0 @@ -keys: - - &age age18uvtlgx442kkufwp6g42lfxk2ft3e4ksjhumdugjcc7uclyzj9vqk9f8fw -creation_rules: - - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ - key_groups: - - age: - - *age diff --git a/common.nix b/common.nix index e7c64c4..759a349 100644 --- a/common.nix +++ b/common.nix @@ -50,7 +50,6 @@ amneziawg-go amneziawg-tools sbctl - sops ]; services = { logind.settings.Login.HandleLidSwitch = "ignore"; diff --git a/server/flake.lock b/server/flake.lock index 0c03c52..0a16ff3 100644 --- a/server/flake.lock +++ b/server/flake.lock @@ -40,28 +40,7 @@ "root": { "inputs": { "home-manager": "home-manager", - "nixpkgs": "nixpkgs", - "sops-nix": "sops-nix" - } - }, - "sops-nix": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1788914643, - "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", - "owner": "Mic92", - "repo": "sops-nix", - "rev": "13616fff713a9f94055c66f15687ebdc17a335df", - "type": "github" - }, - "original": { - "owner": "Mic92", - "repo": "sops-nix", - "type": "github" + "nixpkgs": "nixpkgs" } } }, diff --git a/server/flake.nix b/server/flake.nix index 6000b63..8cd93c6 100644 --- a/server/flake.nix +++ b/server/flake.nix @@ -1,22 +1,16 @@ { inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; - sops-nix = { - url = "github:Mic92/sops-nix"; - inputs.nixpkgs.follows = "nixpkgs"; - }; home-manager = { url = "github:nix-community/home-manager/release-26.05"; inputs.nixpkgs.follows = "nixpkgs"; }; }; - outputs = inputs@{ self, nixpkgs, sops-nix, home-manager, ... }: { + outputs = inputs@{ self, nixpkgs, home-manager, ... }: { nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem { modules = [ ./configuration.nix - sops-nix.nixosModules.sops - home-manager.nixosModules.home-manager - { + home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; home-manager.extraSpecialArgs = { inherit inputs; }; From 3c8807e38f663a20b2f754c7fcbb27fd4acbf03e Mon Sep 17 00:00:00 2001 From: bogale Date: Thu, 17 Sep 2026 17:26:25 +0900 Subject: [PATCH 03/10] php-fpm, vaultwarden --- common.nix | 2 ++ marks | 4 ++- server/configuration.nix | 56 +++++++++++++++++++++++++++++++++++----- 3 files changed, 54 insertions(+), 8 deletions(-) diff --git a/common.nix b/common.nix index 759a349..5091582 100644 --- a/common.nix +++ b/common.nix @@ -15,7 +15,9 @@ swapDevices = [ { device = "/var/swapfile"; } ]; boot.loader.limine = { enable = true; + maxGenerations = 20; secureBoot.enable = true; + panicOnChecksumMismatch = true; }; users.users = { root = { diff --git a/marks b/marks index 6101e34..bfff643 100644 --- a/marks +++ b/marks @@ -12,4 +12,6 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 todo: -- lanzaboote +- php-fpm, postgresql, certbot +- postfix, dovecot, rspamd +- vaultwarden, gitea, mediawiki diff --git a/server/configuration.nix b/server/configuration.nix index 8e8891e..bbe3a86 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -18,21 +18,63 @@ ''; }; }; + #environment.systemPackages = with pkgs; [ + #php + #]; services = { + postgresql.enable = true; openssh = { enable = true; openFirewall = false; + settings = { + PermitRootLogin = "no"; + PasswordAuthentication = false; + }; + }; + phpfpm.pools.main = { + user = "nginx"; + group = "nginx"; + settings = { + "pm" = "ondemand"; + "pm.max_children" = 8; + "listen.owner" = "nginx"; + "listen.group" = "nginx"; + }; }; nginx = { enable = true; - virtualHosts."_".default = true; + recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedBrotliSettings = true; virtualHosts."_" = { - locations."/" = { - return = "200 'It works'"; - extraConfig = '' - default_type text/html; - ''; - }; + default = true; + root = "/srv/http/_"; + locations."~ \\.php$".extraConfig = '' + fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; + ''; + }; + }; + vaultwarden = { + enable = true; + configureNginx = true; + dbBackend = "postgresql"; + configurePostgres = true; + package = pkgs.vaultwarden-postgresql; + domain = "https://wg.bogaledev.ru/vault"; + environmentFile = "/root/secrets/vaultwarden.env"; + config = { + EMAIL_TOKEN_SIZE = 8; + SMTP_SECURITY = "off"; + SMTP_HOST = "localhost"; + SIGNUPS_ALLOWED = false; + REQUIRE_DEVICE_EMAIL = true; + TRASH_AUTO_DELETE_DAYS = 90; + ROCKET_ADDRESS = "127.0.0.1"; + PASSWORD_HINTS_ALLOWED = false; + EMERGENCY_ACCESS_ALLOWED = false; + SMTP_FROM = "vaultwarden@bogaledev.ru"; }; }; }; From 26d383ea960325226f9e7f4106353baa91cdca07 Mon Sep 17 00:00:00 2001 From: bogale Date: Thu, 17 Sep 2026 23:30:14 +0900 Subject: [PATCH 04/10] switched to unstable, amneziawg configured --- common.nix | 38 +++++++++++++++----------- desktop/configuration.nix | 7 +++++ server/flake.lock => flake.lock | 15 +++++------ flake.nix | 37 ++++++++++++++++++++++++++ home/desktop/bogale.nix | 4 +++ home/desktop/common.nix | 7 +++++ home/desktop/root.nix | 4 +++ home/server/root.nix | 3 --- server/configuration.nix | 47 +++++++++++++++------------------ server/flake.nix | 23 ---------------- 10 files changed, 110 insertions(+), 75 deletions(-) create mode 100644 desktop/configuration.nix rename server/flake.lock => flake.lock (65%) create mode 100644 flake.nix create mode 100644 home/desktop/bogale.nix create mode 100644 home/desktop/common.nix create mode 100644 home/desktop/root.nix delete mode 100644 server/flake.nix diff --git a/common.nix b/common.nix index 5091582..e37a063 100644 --- a/common.nix +++ b/common.nix @@ -13,11 +13,16 @@ "/boot" = { options = [ "noatime" ]; }; }; swapDevices = [ { device = "/var/swapfile"; } ]; - boot.loader.limine = { - enable = true; - maxGenerations = 20; - secureBoot.enable = true; - panicOnChecksumMismatch = true; + boot = { + kernelModules = [ "amneziawg" ]; + kernelPackages = pkgs.linuxPackages_latest; + extraModulePackages = [ config.boot.kernelPackages.amneziawg ]; + loader.limine = { + enable = true; + maxGenerations = 20; + secureBoot.enable = true; + panicOnChecksumMismatch = true; + }; }; users.users = { root = { @@ -33,24 +38,25 @@ }; networking = { nftables.enable = true; - #networking.wg-quick.interfaces.awg0 = { - #type = "amneziawg"; - #configFile = "/root/secrets/awg0.conf"; - #}; + wg-quick.interfaces.awg0 = { + type = "amneziawg"; + configFile = "/root/secrets/awg0.conf"; + }; networkmanager = { enable = true; - ensureProfiles.profiles.home-wifi = { - wifi-security.key-mgmt = "sae"; - connection = { - id = "home-wifi"; - type = "wifi"; + ensureProfiles = { + environmentFiles = [ "/root/secrets/wifi.env" ]; + profiles.home-wifi = { + wifi-security.key-mgmt = "sae"; + connection = { + id = "home-wifi"; + type = "wifi"; + }; }; }; }; }; environment.systemPackages = with pkgs; [ - amneziawg-go - amneziawg-tools sbctl ]; services = { diff --git a/desktop/configuration.nix b/desktop/configuration.nix new file mode 100644 index 0000000..3978190 --- /dev/null +++ b/desktop/configuration.nix @@ -0,0 +1,7 @@ +{ config, lib, pkgs, ... }: +{ + imports = [ ../common.nix ./hardware-configuration.nix ]; + networking = { + hostName = "nixos-desktop"; + }; +} diff --git a/server/flake.lock b/flake.lock similarity index 65% rename from server/flake.lock rename to flake.lock index 0a16ff3..8dae76d 100644 --- a/server/flake.lock +++ b/flake.lock @@ -7,32 +7,31 @@ ] }, "locked": { - "lastModified": 1789267039, - "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=", + "lastModified": 1789618856, + "narHash": "sha256-OSqj7eOijvCZfN7owFWRxLWRhej5lZI+Kt82q3INLvc=", "owner": "nix-community", "repo": "home-manager", - "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727", + "rev": "afa6821c70560bb19d1a8c577bff398f7f239869", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-26.05", "repo": "home-manager", "type": "github" } }, "nixpkgs": { "locked": { - "lastModified": 1789459628, - "narHash": "sha256-JOaadoI/IC9qEvwlnjwAhwdcWkCDqEeOJ+cOtUH/8RQ=", + "lastModified": 1789546076, + "narHash": "sha256-zVxLZiSnmaaPLwnhj7pwmqe3axBg/C6nG5JZsJMh2g4=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b67c7a60c3732edd4b947a7df8af06215851a614", + "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-26.05", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..23981a6 --- /dev/null +++ b/flake.nix @@ -0,0 +1,37 @@ +{ + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + home-manager = { + url = "github:nix-community/home-manager"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; + outputs = inputs@{ self, nixpkgs, home-manager, ... }: { + nixosConfigurations = { + nixos-server = nixpkgs.lib.nixosSystem { + modules = [ + ./server/configuration.nix + home-manager.nixosModules.home-manager { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.extraSpecialArgs = { inherit inputs; }; + home-manager.users.root = ./home/server/root.nix; + home-manager.users.bogale = ./home/server/bogale.nix; + } + ]; + }; + nixos-desktop = nixpkgs.lib.nixosSystem { + modules = [ + ./desktop/configuration.nix + home-manager.nixosModules.home-manager { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.extraSpecialArgs = { inherit inputs; }; + home-manager.users.root = ./home/desktop/root.nix; + home-manager.users.bogale = ./home/desktop/bogale.nix; + } + ]; + }; + }; + }; +} diff --git a/home/desktop/bogale.nix b/home/desktop/bogale.nix new file mode 100644 index 0000000..bcb97f6 --- /dev/null +++ b/home/desktop/bogale.nix @@ -0,0 +1,4 @@ +{ config, pkgs, ... }: +{ + imports = [ ./common.nix ../bogale.nix ]; +} diff --git a/home/desktop/common.nix b/home/desktop/common.nix new file mode 100644 index 0000000..c6d00b0 --- /dev/null +++ b/home/desktop/common.nix @@ -0,0 +1,7 @@ +{ config, pkgs, ... }: +{ + programs.tmux.extraConfig = '' + set -g prefix M-f + bind f send-prefix + ''; +} diff --git a/home/desktop/root.nix b/home/desktop/root.nix new file mode 100644 index 0000000..8d670fa --- /dev/null +++ b/home/desktop/root.nix @@ -0,0 +1,4 @@ +{ config, pkgs, ... }: +{ + imports = [ ./common.nix ../root.nix ]; +} diff --git a/home/server/root.nix b/home/server/root.nix index 517ada8..8d670fa 100644 --- a/home/server/root.nix +++ b/home/server/root.nix @@ -1,7 +1,4 @@ { config, pkgs, ... }: { imports = [ ./common.nix ../root.nix ]; - programs.bash = { - shellAliases = { "nixos-rebuild" = "nixos-rebuild --impure --flake /etc/nixos/server#nixos-server"; }; - }; } diff --git a/server/configuration.nix b/server/configuration.nix index bbe3a86..9b5efd1 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -9,7 +9,7 @@ hostName = "nixos-server"; networkmanager.ensureProfiles.profiles.home-wifi = { wifi.ssid = "bogale_2.4"; - wifi-security.psk = builtins.readFile "/root/secrets/home-wifi.psk"; + wifi-security.psk = "$BOGALE_2_4_PSK"; }; firewall = { allowedTCPPorts = [ 80 ]; @@ -18,9 +18,6 @@ ''; }; }; - #environment.systemPackages = with pkgs; [ - #php - #]; services = { postgresql.enable = true; openssh = { @@ -56,26 +53,26 @@ ''; }; }; - vaultwarden = { - enable = true; - configureNginx = true; - dbBackend = "postgresql"; - configurePostgres = true; - package = pkgs.vaultwarden-postgresql; - domain = "https://wg.bogaledev.ru/vault"; - environmentFile = "/root/secrets/vaultwarden.env"; - config = { - EMAIL_TOKEN_SIZE = 8; - SMTP_SECURITY = "off"; - SMTP_HOST = "localhost"; - SIGNUPS_ALLOWED = false; - REQUIRE_DEVICE_EMAIL = true; - TRASH_AUTO_DELETE_DAYS = 90; - ROCKET_ADDRESS = "127.0.0.1"; - PASSWORD_HINTS_ALLOWED = false; - EMERGENCY_ACCESS_ALLOWED = false; - SMTP_FROM = "vaultwarden@bogaledev.ru"; - }; - }; + #vaultwarden = { + #enable = true; + #configureNginx = true; + #dbBackend = "postgresql"; + #configurePostgres = true; + #package = pkgs.vaultwarden-postgresql; + #domain = "https://wg.bogaledev.ru/vault"; + #environmentFile = "/root/secrets/vaultwarden.env"; + #config = { + #EMAIL_TOKEN_SIZE = 8; + #SMTP_SECURITY = "off"; + #SMTP_HOST = "localhost"; + #SIGNUPS_ALLOWED = false; + #REQUIRE_DEVICE_EMAIL = true; + #TRASH_AUTO_DELETE_DAYS = 90; + #ROCKET_ADDRESS = "127.0.0.1"; + #PASSWORD_HINTS_ALLOWED = false; + #EMERGENCY_ACCESS_ALLOWED = false; + #SMTP_FROM = "vaultwarden@bogaledev.ru"; + #}; + #}; }; } diff --git a/server/flake.nix b/server/flake.nix deleted file mode 100644 index 8cd93c6..0000000 --- a/server/flake.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; - home-manager = { - url = "github:nix-community/home-manager/release-26.05"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - }; - outputs = inputs@{ self, nixpkgs, home-manager, ... }: { - nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem { - modules = [ - ./configuration.nix - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.extraSpecialArgs = { inherit inputs; }; - home-manager.users.root = ../home/server/root.nix; - home-manager.users.bogale = ../home/server/bogale.nix; - } - ]; - }; - }; -} From e5477915a7bbc9df8fad74b4790af7c6f22cc9e4 Mon Sep 17 00:00:00 2001 From: bogale Date: Sat, 19 Sep 2026 00:39:59 +0900 Subject: [PATCH 05/10] nginx, phpfpm, tls, vaultwarden configured --- home/common.nix | 2 + home/desktop/common.nix | 4 -- home/server/common.nix | 4 -- server/configuration.nix | 89 ++++++++++++++++++++++++++-------------- 4 files changed, 61 insertions(+), 38 deletions(-) diff --git a/home/common.nix b/home/common.nix index fdc2d90..f8166fb 100644 --- a/home/common.nix +++ b/home/common.nix @@ -39,9 +39,11 @@ extraConfig = '' unbind C-b set -g mouse on + set -g prefix M-f set-option -g focus-events on set -s set-clipboard external set-option -a terminal-features "xterm-256color:RGB" + bind f send-prefix bind h select-pane -L bind j select-pane -D bind k select-pane -U diff --git a/home/desktop/common.nix b/home/desktop/common.nix index c6d00b0..0da09e2 100644 --- a/home/desktop/common.nix +++ b/home/desktop/common.nix @@ -1,7 +1,3 @@ { config, pkgs, ... }: { - programs.tmux.extraConfig = '' - set -g prefix M-f - bind f send-prefix - ''; } diff --git a/home/server/common.nix b/home/server/common.nix index 4c8896f..0da09e2 100644 --- a/home/server/common.nix +++ b/home/server/common.nix @@ -1,7 +1,3 @@ { config, pkgs, ... }: { - programs.tmux.extraConfig = '' - set -g prefix M-d - bind d send-prefix - ''; } diff --git a/server/configuration.nix b/server/configuration.nix index 9b5efd1..1f6ec8c 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -2,6 +2,7 @@ { imports = [ ../common.nix ./hardware-configuration.nix ]; boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ]; + users.users.nginx.extraGroups = [ "acme" ]; users.users.bogale.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1" ]; @@ -12,17 +13,25 @@ wifi-security.psk = "$BOGALE_2_4_PSK"; }; firewall = { - allowedTCPPorts = [ 80 ]; - extraInputRules = '' - ip saddr 192.168.1.0/24 tcp dport 22 accept - ''; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ 443 ]; + }; + }; + security.acme = { + acceptTerms = true; + certs."bogaledev.ru" = { + validMinDays = 3; + dnsProvider = "cloudflare"; + email = "acme-tls@bogaledev.ru"; + reloadServices = [ "nginx.service" ]; + extraDomainNames = [ "*.bogaledev.ru" ]; + credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/root/secrets/cf-token"; }; }; }; services = { postgresql.enable = true; openssh = { enable = true; - openFirewall = false; settings = { PermitRootLogin = "no"; PasswordAuthentication = false; @@ -38,6 +47,26 @@ "listen.group" = "nginx"; }; }; + vaultwarden = { + enable = true; + configureNginx = true; + dbBackend = "postgresql"; + configurePostgres = true; + domain = "vw.bogaledev.ru"; + package = pkgs.vaultwarden-postgresql; + environmentFile = "/root/secrets/vaultwarden.env"; + config = { + #EMAIL_TOKEN_SIZE = 8; + #SMTP_SECURITY = "off"; + #SMTP_HOST = "localhost"; + SIGNUPS_ALLOWED = false; + #REQUIRE_DEVICE_EMAIL = true; + TRASH_AUTO_DELETE_DAYS = 90; + PASSWORD_HINTS_ALLOWED = false; + EMERGENCY_ACCESS_ALLOWED = false; + #SMTP_FROM = "vaultwarden@bogaledev.ru"; + }; + }; nginx = { enable = true; recommendedTlsSettings = true; @@ -45,34 +74,34 @@ recommendedOptimisation = true; recommendedProxySettings = true; recommendedBrotliSettings = true; - virtualHosts."_" = { + virtualHosts."bogaledev.ru" = { + quic = true; default = true; - root = "/srv/http/_"; - locations."~ \\.php$".extraConfig = '' - fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; + forceSSL = true; + root = "/srv/http"; + useACMEHost = "bogaledev.ru"; + extraConfig = '' + add_header Alt-Svc 'h3=":443"; ma=86400' always; + ''; + locations = { + "/".index = "index.php index.html"; + "~ \\.php$".extraConfig = '' + fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; + ''; + }; + }; + virtualHosts."vw.bogaledev.ru" = { + quic = true; + forceSSL = true; + useACMEHost = "bogaledev.ru"; + extraConfig = '' + allow fc00::/64; + allow 10.0.0.0/24; + allow 192.168.1.0/24; + deny all; + add_header Alt-Svc 'h3=":443"; ma=86400' always; ''; }; }; - #vaultwarden = { - #enable = true; - #configureNginx = true; - #dbBackend = "postgresql"; - #configurePostgres = true; - #package = pkgs.vaultwarden-postgresql; - #domain = "https://wg.bogaledev.ru/vault"; - #environmentFile = "/root/secrets/vaultwarden.env"; - #config = { - #EMAIL_TOKEN_SIZE = 8; - #SMTP_SECURITY = "off"; - #SMTP_HOST = "localhost"; - #SIGNUPS_ALLOWED = false; - #REQUIRE_DEVICE_EMAIL = true; - #TRASH_AUTO_DELETE_DAYS = 90; - #ROCKET_ADDRESS = "127.0.0.1"; - #PASSWORD_HINTS_ALLOWED = false; - #EMERGENCY_ACCESS_ALLOWED = false; - #SMTP_FROM = "vaultwarden@bogaledev.ru"; - #}; - #}; }; } From 8967478f210b2651898d8ce6039165ecae33838c Mon Sep 17 00:00:00 2001 From: bogale Date: Sun, 20 Sep 2026 20:38:26 +0900 Subject: [PATCH 06/10] postfix configured --- marks | 3 +-- server/configuration.nix | 50 +++++++++++++++++++++++++++++++++------- 2 files changed, 43 insertions(+), 10 deletions(-) diff --git a/marks b/marks index bfff643..d59588c 100644 --- a/marks +++ b/marks @@ -12,6 +12,5 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 todo: -- php-fpm, postgresql, certbot - postfix, dovecot, rspamd -- vaultwarden, gitea, mediawiki +- gitea, mediawiki diff --git a/server/configuration.nix b/server/configuration.nix index 1f6ec8c..3cc16ec 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -2,10 +2,18 @@ { imports = [ ../common.nix ./hardware-configuration.nix ]; boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ]; - users.users.nginx.extraGroups = [ "acme" ]; - users.users.bogale.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1" - ]; + users = { + groups.vmail.gid = 1819; + users = { + nginx.extraGroups = [ "acme" ]; + bogale.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ]; + vmail = { + uid = 1819; + group = "vmail"; + isSystemUser = true; + }; + }; + }; networking = { hostName = "nixos-server"; networkmanager.ensureProfiles.profiles.home-wifi = { @@ -13,7 +21,7 @@ wifi-security.psk = "$BOGALE_2_4_PSK"; }; firewall = { - allowedTCPPorts = [ 80 443 ]; + allowedTCPPorts = [ 25 80 443 ]; allowedUDPPorts = [ 443 ]; }; }; @@ -47,6 +55,33 @@ "listen.group" = "nginx"; }; }; + dovecot2 = { + enable = true; + settings = { + mail_uid = ; + mail_gid = ; + }; + }; + postfix = { + enable = true; + #enableSubmission = true; + virtualMapType = "regexp"; + virtual = ''/.*@bogaledev.ru/ main@bogaledev.ru''; + mapFiles.mailbox = pkgs.writeText "mailbox" ''main@bogaledev.ru bogaledev.ru/''; + settings.main = { + virtual_uid_maps = "static:1819"; + virtual_gid_maps = "static:1819"; + smtp_tls_security_level = "encrypt"; + smtpd_tls_security_level = "encrypt"; + virtual_mailbox_domains = "bogaledev.ru"; + virtual_mailbox_base = "/var/spool/mail/vmail"; + virtual_mailbox_maps = "hash:/etc/postfix/mailbox"; + smtpd_tls_chain_files = [ + "/var/lib/acme/bogaledev.ru/key.pem" + "/var/lib/acme/bogaledev.ru/fullchain.pem" + ]; + }; + }; vaultwarden = { enable = true; configureNginx = true; @@ -80,9 +115,7 @@ forceSSL = true; root = "/srv/http"; useACMEHost = "bogaledev.ru"; - extraConfig = '' - add_header Alt-Svc 'h3=":443"; ma=86400' always; - ''; + extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;''; locations = { "/".index = "index.php index.html"; "~ \\.php$".extraConfig = '' @@ -94,6 +127,7 @@ quic = true; forceSSL = true; useACMEHost = "bogaledev.ru"; + serverAliases = [ "vw-wl.bogaledev.ru" ]; extraConfig = '' allow fc00::/64; allow 10.0.0.0/24; From 5894fa9aa58c68d2a9357ecd4ee70b3fa09208ae Mon Sep 17 00:00:00 2001 From: bogale Date: Mon, 21 Sep 2026 03:22:17 +0900 Subject: [PATCH 07/10] network-watchdog, dovecot --- common.nix | 8 +++--- home/common.nix | 4 +++ server/configuration.nix | 56 +++++++++++++++++++++++++++++++++------- 3 files changed, 55 insertions(+), 13 deletions(-) diff --git a/common.nix b/common.nix index e37a063..7f0551a 100644 --- a/common.nix +++ b/common.nix @@ -27,25 +27,25 @@ users.users = { root = { home = "/root"; - hashedPasswordFile = "/root/secrets/root.passwd"; + hashedPasswordFile = "/secrets/root.passwd"; }; bogale = { isNormalUser = true; home = "/home/bogale"; extraGroups = [ "wheel" ]; - hashedPasswordFile = "/root/secrets/bogale.passwd"; + hashedPasswordFile = "/secrets/bogale.passwd"; }; }; networking = { nftables.enable = true; wg-quick.interfaces.awg0 = { type = "amneziawg"; - configFile = "/root/secrets/awg0.conf"; + configFile = "/secrets/awg0.conf"; }; networkmanager = { enable = true; ensureProfiles = { - environmentFiles = [ "/root/secrets/wifi.env" ]; + environmentFiles = [ "/secrets/wifi.env" ]; profiles.home-wifi = { wifi-security.key-mgmt = "sae"; connection = { diff --git a/home/common.nix b/home/common.nix index f8166fb..cf7c093 100644 --- a/home/common.nix +++ b/home/common.nix @@ -3,6 +3,10 @@ home.stateVersion = "26.05"; programs = { home-manager.enable = true; + gh = { + enable = true; + settings.git_protocol = "ssh"; + }; bash = { enable = true; historyControl = [ "ignoreboth" ]; diff --git a/server/configuration.nix b/server/configuration.nix index 3cc16ec..95fe40f 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -21,7 +21,7 @@ wifi-security.psk = "$BOGALE_2_4_PSK"; }; firewall = { - allowedTCPPorts = [ 25 80 443 ]; + allowedTCPPorts = [ 25 80 443 993 ]; allowedUDPPorts = [ 443 ]; }; }; @@ -30,10 +30,37 @@ certs."bogaledev.ru" = { validMinDays = 3; dnsProvider = "cloudflare"; - email = "acme-tls@bogaledev.ru"; - reloadServices = [ "nginx.service" ]; + email = "letsencrypt@bogaledev.ru"; extraDomainNames = [ "*.bogaledev.ru" ]; - credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/root/secrets/cf-token"; }; + reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; + credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; }; + }; + }; + systemd = { + services.network-watchdog = { + path = [ pkgs.iputils ]; + serviceConfig.Type = "oneshot"; + script = '' + if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then + failures=0 + else + failures=$(($(cat /run/network.failures)+1)) + if [ $failures -ge 3 ]; then + systemctl restart NetworkManager + failures=0 + fi + fi + echo $failures > /run/network.failures + ''; + }; + timers.network-watchdog = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = 5; + AccuracySec = 1; + OnUnitActiveSec = 5; + Unit = "network-watchdog.service"; + }; }; }; services = { @@ -58,16 +85,27 @@ dovecot2 = { enable = true; settings = { - mail_uid = ; - mail_gid = ; + mail_path = "~"; + ssl = "required"; + mail_gid = "vmail"; + mail_uid = "vmail"; + protocols.imap = true; + mail_driver = "maildir"; + mail_home = "/var/mail/vmail"; + auth_mechanisms = [ "plain" ]; + dovecot_config_version = "2.4.5"; + dovecot_storage_version = "2.4.5"; + ssl_server_key_file = "/var/lib/acme/bogaledev.ru/key.pem"; + ssl_server_cert_file = "/var/lib/acme/bogaledev.ru/fullchain.pem"; + "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd"; }; }; postfix = { enable = true; #enableSubmission = true; virtualMapType = "regexp"; - virtual = ''/.*@bogaledev.ru/ main@bogaledev.ru''; - mapFiles.mailbox = pkgs.writeText "mailbox" ''main@bogaledev.ru bogaledev.ru/''; + virtual = ''/.*@bogaledev.ru/ mail@bogaledev.ru''; + mapFiles.mailbox = pkgs.writeText "mailbox" ''mail@bogaledev.ru /''; settings.main = { virtual_uid_maps = "static:1819"; virtual_gid_maps = "static:1819"; @@ -89,7 +127,7 @@ configurePostgres = true; domain = "vw.bogaledev.ru"; package = pkgs.vaultwarden-postgresql; - environmentFile = "/root/secrets/vaultwarden.env"; + environmentFile = "/secrets/vaultwarden.env"; config = { #EMAIL_TOKEN_SIZE = 8; #SMTP_SECURITY = "off"; From 4ee6c7957ca8ad919f18391eb8b004fa29fc18c7 Mon Sep 17 00:00:00 2001 From: bogale Date: Mon, 21 Sep 2026 14:11:36 +0900 Subject: [PATCH 08/10] submission configured, vaultwarden url changed --- home/common.nix | 11 ++--- server/configuration.nix | 96 +++++++++++++++++++++++----------------- 2 files changed, 61 insertions(+), 46 deletions(-) diff --git a/home/common.nix b/home/common.nix index cf7c093..7ef07d1 100644 --- a/home/common.nix +++ b/home/common.nix @@ -1,12 +1,13 @@ { config, pkgs, ... }: { - home.stateVersion = "26.05"; + home = { + stateVersion = "26.05"; + packages = with pkgs; [ + gh + ]; + }; programs = { home-manager.enable = true; - gh = { - enable = true; - settings.git_protocol = "ssh"; - }; bash = { enable = true; historyControl = [ "ignoreboth" ]; diff --git a/server/configuration.nix b/server/configuration.nix index 95fe40f..66f156c 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -21,7 +21,7 @@ wifi-security.psk = "$BOGALE_2_4_PSK"; }; firewall = { - allowedTCPPorts = [ 25 80 443 993 ]; + allowedTCPPorts = [ 25 80 443 587 993 ]; allowedUDPPorts = [ 443 ]; }; }; @@ -37,6 +37,21 @@ }; }; systemd = { + tmpfiles.rules = [ + "d /var/spool/postfix 0755 postfix postfix -" + "d /var/spool/postfix/private 0755 postfix postfix -" + ]; + timers.network-watchdog = { + wantedBy = [ "timers.target" ]; + after = [ "NetworkManager.service" ]; + wants = [ "NetworkManager.service" ]; + timerConfig = { + OnBootSec = 5; + AccuracySec = 1; + OnUnitActiveSec = 5; + Unit = "network-watchdog.service"; + }; + }; services.network-watchdog = { path = [ pkgs.iputils ]; serviceConfig.Type = "oneshot"; @@ -46,24 +61,18 @@ else failures=$(($(cat /run/network.failures)+1)) if [ $failures -ge 3 ]; then - systemctl restart NetworkManager + systemctl restart NetworkManager.service failures=0 fi fi echo $failures > /run/network.failures ''; }; - timers.network-watchdog = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnBootSec = 5; - AccuracySec = 1; - OnUnitActiveSec = 5; - Unit = "network-watchdog.service"; - }; - }; }; - services = { + services = let + saslSocket = "/var/spool/postfix/private/auth"; + sslCertDir = config.security.acme.certs."bogaledev.ru".directory; + in { postgresql.enable = true; openssh = { enable = true; @@ -85,59 +94,67 @@ dovecot2 = { enable = true; settings = { - mail_path = "~"; ssl = "required"; mail_gid = "vmail"; mail_uid = "vmail"; protocols.imap = true; mail_driver = "maildir"; - mail_home = "/var/mail/vmail"; + mail_path = "/var/mail/vmail"; auth_mechanisms = [ "plain" ]; dovecot_config_version = "2.4.5"; dovecot_storage_version = "2.4.5"; - ssl_server_key_file = "/var/lib/acme/bogaledev.ru/key.pem"; - ssl_server_cert_file = "/var/lib/acme/bogaledev.ru/fullchain.pem"; + ssl_server_key_file = "${sslCertDir}/key.pem"; + ssl_server_cert_file = "${sslCertDir}/fullchain.pem"; "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd"; + "service auth"."unix_listener ${saslSocket}" = { + mode = "0660"; + user = "postfix"; + group = "postfix"; + }; }; }; postfix = { enable = true; - #enableSubmission = true; + enableSubmission = true; virtualMapType = "regexp"; - virtual = ''/.*@bogaledev.ru/ mail@bogaledev.ru''; - mapFiles.mailbox = pkgs.writeText "mailbox" ''mail@bogaledev.ru /''; + virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru"; + mapFiles = { + smtp_passwd = "/secrets/smtp_passwd"; + mailbox = pkgs.writeText "mailbox" "mail@bogaledev.ru /"; + }; settings.main = { + smtpd_sasl_type = "dovecot"; + smtpd_sasl_path = saslSocket; + smtp_sasl_auth_enable = "yes"; + smtpd_sasl_auth_enable = "yes"; virtual_uid_maps = "static:1819"; virtual_gid_maps = "static:1819"; smtp_tls_security_level = "encrypt"; smtpd_tls_security_level = "encrypt"; + relayhost = [ "smtp.resend.com:2587" ]; virtual_mailbox_domains = "bogaledev.ru"; virtual_mailbox_base = "/var/spool/mail/vmail"; + smtp_sasl_tls_security_options = "noanonymous"; virtual_mailbox_maps = "hash:/etc/postfix/mailbox"; + smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd"; smtpd_tls_chain_files = [ - "/var/lib/acme/bogaledev.ru/key.pem" - "/var/lib/acme/bogaledev.ru/fullchain.pem" + "${sslCertDir}/key.pem" + "${sslCertDir}/fullchain.pem" ]; }; }; vaultwarden = { enable = true; - configureNginx = true; dbBackend = "postgresql"; configurePostgres = true; - domain = "vw.bogaledev.ru"; package = pkgs.vaultwarden-postgresql; environmentFile = "/secrets/vaultwarden.env"; config = { - #EMAIL_TOKEN_SIZE = 8; - #SMTP_SECURITY = "off"; - #SMTP_HOST = "localhost"; SIGNUPS_ALLOWED = false; - #REQUIRE_DEVICE_EMAIL = true; TRASH_AUTO_DELETE_DAYS = 90; PASSWORD_HINTS_ALLOWED = false; EMERGENCY_ACCESS_ALLOWED = false; - #SMTP_FROM = "vaultwarden@bogaledev.ru"; + DOMAIN = "https://bogaledev.ru/vw"; }; }; nginx = { @@ -159,21 +176,18 @@ "~ \\.php$".extraConfig = '' fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; ''; + "/vw" = { + proxyPass = "http://127.0.0.1:8000"; + proxyWebsockets = true; + extraConfig = '' + allow fc00::/64; + allow 10.0.0.0/24; + allow 192.168.1.0/24; + deny all; + ''; + }; }; }; - virtualHosts."vw.bogaledev.ru" = { - quic = true; - forceSSL = true; - useACMEHost = "bogaledev.ru"; - serverAliases = [ "vw-wl.bogaledev.ru" ]; - extraConfig = '' - allow fc00::/64; - allow 10.0.0.0/24; - allow 192.168.1.0/24; - deny all; - add_header Alt-Svc 'h3=":443"; ma=86400' always; - ''; - }; }; }; } From 2e60504041c3b49263d4597d920b72af85847410 Mon Sep 17 00:00:00 2001 From: bogale Date: Mon, 21 Sep 2026 23:34:50 +0900 Subject: [PATCH 09/10] dnsmasq --- common.nix | 19 ++++++++++++++ marks | 3 ++- server/configuration.nix | 55 ++++++++++++++++++++++++---------------- 3 files changed, 54 insertions(+), 23 deletions(-) diff --git a/common.nix b/common.nix index 7f0551a..c4e0402 100644 --- a/common.nix +++ b/common.nix @@ -59,7 +59,26 @@ environment.systemPackages = with pkgs; [ sbctl ]; + systemd.tmpfiles.rules = [ "d /srv/tftp 0755 root root -" ]; services = { logind.settings.Login.HandleLidSwitch = "ignore"; + dnsmasq = { + enable = true; + settings = { + enable-ra = true; + no-resolv = true; + cache-size = 1024; + bogus-priv = true; + enable-tftp = true; + interface = "enp1s0"; + domain-needed = true; + tftp-root = "/srv/tftp"; + dhcp-boot = "grubx64.efi"; + dhcp-range = [ "10.2.0.2,10.2.255.254,12h" + "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ]; + server = [ "1.0.0.1" "2606:4700:4700::1001" + "1.1.1.1" "2606:4700:4700::1111" ]; + }; + }; }; } diff --git a/marks b/marks index d59588c..c5bb457 100644 --- a/marks +++ b/marks @@ -12,5 +12,6 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 todo: -- postfix, dovecot, rspamd +- ssh-add, rspamd +- email tracking - gitea, mediawiki diff --git a/server/configuration.nix b/server/configuration.nix index 66f156c..b064994 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -16,14 +16,24 @@ }; networking = { hostName = "nixos-server"; - networkmanager.ensureProfiles.profiles.home-wifi = { - wifi.ssid = "bogale_2.4"; - wifi-security.psk = "$BOGALE_2_4_PSK"; - }; firewall = { allowedTCPPorts = [ 25 80 443 587 993 ]; allowedUDPPorts = [ 443 ]; }; + networkmanager.ensureProfiles.profiles.home-wifi = { + wifi.ssid = "bogale_2.4"; + wifi-security.psk = "$BOGALE_2_4_PSK"; + ipv4 = { + method = "manual"; + gateway = "10.1.0.1"; + addresses = "10.1.0.2/16"; + }; + ipv6 = { + method = "manual"; + gateway = "fc01::1"; + addresses = "fc01::2/64"; + }; + }; }; security.acme = { acceptTerms = true; @@ -32,8 +42,8 @@ dnsProvider = "cloudflare"; email = "letsencrypt@bogaledev.ru"; extraDomainNames = [ "*.bogaledev.ru" ]; - reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; }; + reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; }; }; systemd = { @@ -91,6 +101,20 @@ "listen.group" = "nginx"; }; }; + vaultwarden = { + enable = true; + dbBackend = "postgresql"; + configurePostgres = true; + package = pkgs.vaultwarden-postgresql; + environmentFile = "/secrets/vaultwarden.env"; + config = { + SIGNUPS_ALLOWED = false; + TRASH_AUTO_DELETE_DAYS = 90; + PASSWORD_HINTS_ALLOWED = false; + EMERGENCY_ACCESS_ALLOWED = false; + DOMAIN = "https://bogaledev.ru/vw"; + }; + }; dovecot2 = { enable = true; settings = { @@ -99,12 +123,12 @@ mail_uid = "vmail"; protocols.imap = true; mail_driver = "maildir"; - mail_path = "/var/mail/vmail"; auth_mechanisms = [ "plain" ]; - dovecot_config_version = "2.4.5"; dovecot_storage_version = "2.4.5"; + mail_path = "/var/spool/mail/vmail"; ssl_server_key_file = "${sslCertDir}/key.pem"; ssl_server_cert_file = "${sslCertDir}/fullchain.pem"; + dovecot_config_version = config.services.dovecot2.package.version; "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd"; "service auth"."unix_listener ${saslSocket}" = { mode = "0660"; @@ -143,20 +167,6 @@ ]; }; }; - vaultwarden = { - enable = true; - dbBackend = "postgresql"; - configurePostgres = true; - package = pkgs.vaultwarden-postgresql; - environmentFile = "/secrets/vaultwarden.env"; - config = { - SIGNUPS_ALLOWED = false; - TRASH_AUTO_DELETE_DAYS = 90; - PASSWORD_HINTS_ALLOWED = false; - EMERGENCY_ACCESS_ALLOWED = false; - DOMAIN = "https://bogaledev.ru/vw"; - }; - }; nginx = { enable = true; recommendedTlsSettings = true; @@ -181,8 +191,9 @@ proxyWebsockets = true; extraConfig = '' allow fc00::/64; + allow fc01::/64; allow 10.0.0.0/24; - allow 192.168.1.0/24; + allow 10.1.0.0/24; deny all; ''; }; From 0eccc752078aa9c244ee8078aa28573897487c00 Mon Sep 17 00:00:00 2001 From: bogale Date: Tue, 22 Sep 2026 15:24:18 +0900 Subject: [PATCH 10/10] ssh-agent, rspamd --- common.nix | 26 ++++++------ desktop/configuration.nix | 8 ++++ flake.nix | 1 - home/bogale.nix | 6 --- home/common.nix | 1 + home/desktop/bogale.nix | 6 ++- home/desktop/common.nix | 3 -- home/desktop/root.nix | 6 ++- home/root.nix | 6 --- home/server/bogale.nix | 4 -- home/server/common.nix | 3 -- home/server/root.nix | 6 ++- marks | 4 +- server/configuration.nix | 85 +++++++++++++++++++-------------------- 14 files changed, 80 insertions(+), 85 deletions(-) delete mode 100644 home/bogale.nix delete mode 100644 home/desktop/common.nix delete mode 100644 home/root.nix delete mode 100644 home/server/bogale.nix delete mode 100644 home/server/common.nix diff --git a/common.nix b/common.nix index c4e0402..ce72039 100644 --- a/common.nix +++ b/common.nix @@ -24,20 +24,12 @@ panicOnChecksumMismatch = true; }; }; - users.users = { - root = { - home = "/root"; - hashedPasswordFile = "/secrets/root.passwd"; - }; - bogale = { - isNormalUser = true; - home = "/home/bogale"; - extraGroups = [ "wheel" ]; - hashedPasswordFile = "/secrets/bogale.passwd"; - }; - }; + users.users.root.hashedPasswordFile = "/secrets/root.passwd"; networking = { - nftables.enable = true; + firewall = { + allowedTCPPorts = [ 53 80 ]; + allowedUDPPorts = [ 53 67 69 547 ]; + }; wg-quick.interfaces.awg0 = { type = "amneziawg"; configFile = "/secrets/awg0.conf"; @@ -62,6 +54,14 @@ systemd.tmpfiles.rules = [ "d /srv/tftp 0755 root root -" ]; services = { logind.settings.Login.HandleLidSwitch = "ignore"; + nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedBrotliSettings = true; + }; dnsmasq = { enable = true; settings = { diff --git a/desktop/configuration.nix b/desktop/configuration.nix index 3978190..74f6ac4 100644 --- a/desktop/configuration.nix +++ b/desktop/configuration.nix @@ -4,4 +4,12 @@ networking = { hostName = "nixos-desktop"; }; + users.users = { + bogale = { + isNormalUser = true; + home = "/home/bogale"; + extraGroups = [ "wheel" ]; + hashedPasswordFile = "/secrets/bogale.passwd"; + }; + }; } diff --git a/flake.nix b/flake.nix index 23981a6..6ee7a5c 100644 --- a/flake.nix +++ b/flake.nix @@ -16,7 +16,6 @@ home-manager.useUserPackages = true; home-manager.extraSpecialArgs = { inherit inputs; }; home-manager.users.root = ./home/server/root.nix; - home-manager.users.bogale = ./home/server/bogale.nix; } ]; }; diff --git a/home/bogale.nix b/home/bogale.nix deleted file mode 100644 index 372df57..0000000 --- a/home/bogale.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ./common.nix ]; - home.username = "bogale"; - home.homeDirectory = "/home/bogale"; -} diff --git a/home/common.nix b/home/common.nix index 7ef07d1..c3730c0 100644 --- a/home/common.nix +++ b/home/common.nix @@ -6,6 +6,7 @@ gh ]; }; + services.ssh-agent.enable = true; programs = { home-manager.enable = true; bash = { diff --git a/home/desktop/bogale.nix b/home/desktop/bogale.nix index bcb97f6..3fe8e42 100644 --- a/home/desktop/bogale.nix +++ b/home/desktop/bogale.nix @@ -1,4 +1,8 @@ { config, pkgs, ... }: { - imports = [ ./common.nix ../bogale.nix ]; + imports = [ ../common.nix ]; + home = { + username = "bogale"; + homeDirectory = "/home/bogale"; + }; } diff --git a/home/desktop/common.nix b/home/desktop/common.nix deleted file mode 100644 index 0da09e2..0000000 --- a/home/desktop/common.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ config, pkgs, ... }: -{ -} diff --git a/home/desktop/root.nix b/home/desktop/root.nix index 8d670fa..f9e4713 100644 --- a/home/desktop/root.nix +++ b/home/desktop/root.nix @@ -1,4 +1,8 @@ { config, pkgs, ... }: { - imports = [ ./common.nix ../root.nix ]; + imports = [ ../common.nix ]; + home = { + username = "root"; + homeDirectory = "/root"; + }; } diff --git a/home/root.nix b/home/root.nix deleted file mode 100644 index ae559a9..0000000 --- a/home/root.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ./common.nix ]; - home.username = "root"; - home.homeDirectory = "/root"; -} diff --git a/home/server/bogale.nix b/home/server/bogale.nix deleted file mode 100644 index bcb97f6..0000000 --- a/home/server/bogale.nix +++ /dev/null @@ -1,4 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ./common.nix ../bogale.nix ]; -} diff --git a/home/server/common.nix b/home/server/common.nix deleted file mode 100644 index 0da09e2..0000000 --- a/home/server/common.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ config, pkgs, ... }: -{ -} diff --git a/home/server/root.nix b/home/server/root.nix index 8d670fa..f9e4713 100644 --- a/home/server/root.nix +++ b/home/server/root.nix @@ -1,4 +1,8 @@ { config, pkgs, ... }: { - imports = [ ./common.nix ../root.nix ]; + imports = [ ../common.nix ]; + home = { + username = "root"; + homeDirectory = "/root"; + }; } diff --git a/marks b/marks index c5bb457..8c99111 100644 --- a/marks +++ b/marks @@ -12,6 +12,6 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 todo: -- ssh-add, rspamd -- email tracking - gitea, mediawiki +- email tracking +- redirect randomizer diff --git a/server/configuration.nix b/server/configuration.nix index b064994..a3d924a 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -6,7 +6,7 @@ groups.vmail.gid = 1819; users = { nginx.extraGroups = [ "acme" ]; - bogale.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ]; + root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ]; vmail = { uid = 1819; group = "vmail"; @@ -17,7 +17,7 @@ networking = { hostName = "nixos-server"; firewall = { - allowedTCPPorts = [ 25 80 443 587 993 ]; + allowedTCPPorts = [ 25 443 587 993 ]; allowedUDPPorts = [ 443 ]; }; networkmanager.ensureProfiles.profiles.home-wifi = { @@ -37,10 +37,10 @@ }; security.acme = { acceptTerms = true; + defaults.email = "letsencrypt@bogaledev.ru"; certs."bogaledev.ru" = { validMinDays = 3; dnsProvider = "cloudflare"; - email = "letsencrypt@bogaledev.ru"; extraDomainNames = [ "*.bogaledev.ru" ]; credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; }; reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; @@ -53,8 +53,6 @@ ]; timers.network-watchdog = { wantedBy = [ "timers.target" ]; - after = [ "NetworkManager.service" ]; - wants = [ "NetworkManager.service" ]; timerConfig = { OnBootSec = 5; AccuracySec = 1; @@ -64,7 +62,10 @@ }; services.network-watchdog = { path = [ pkgs.iputils ]; - serviceConfig.Type = "oneshot"; + serviceConfig = { + Type = "oneshot"; + LogLevelMax = "notice"; + }; script = '' if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then failures=0 @@ -76,6 +77,9 @@ fi fi echo $failures > /run/network.failures + if [ $failures -ge 0 ]; then + echo "<5>failures = $failures" + fi ''; }; }; @@ -83,14 +87,11 @@ saslSocket = "/var/spool/postfix/private/auth"; sslCertDir = config.security.acme.certs."bogaledev.ru".directory; in { - postgresql.enable = true; openssh = { enable = true; - settings = { - PermitRootLogin = "no"; - PasswordAuthentication = false; - }; + settings.PasswordAuthentication = false; }; + postgresql.enable = true; phpfpm.pools.main = { user = "nginx"; group = "nginx"; @@ -115,6 +116,35 @@ DOMAIN = "https://bogaledev.ru/vw"; }; }; + nginx.virtualHosts."bogaledev.ru" = { + quic = true; + default = true; + forceSSL = true; + root = "/srv/http"; + useACMEHost = "bogaledev.ru"; + extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;''; + locations = { + "/".index = "index.php index.html"; + "~ \\.php$".extraConfig = '' + fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; + ''; + "/vw" = { + proxyPass = "http://127.0.0.1:8000"; + proxyWebsockets = true; + extraConfig = '' + allow fc00::/64; + allow fc01::/64; + allow 10.0.0.0/24; + allow 10.1.0.0/24; + deny all; + ''; + }; + }; + }; + rspamd = { + enable = true; + postfix.enable = true; + }; dovecot2 = { enable = true; settings = { @@ -167,38 +197,5 @@ ]; }; }; - nginx = { - enable = true; - recommendedTlsSettings = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedBrotliSettings = true; - virtualHosts."bogaledev.ru" = { - quic = true; - default = true; - forceSSL = true; - root = "/srv/http"; - useACMEHost = "bogaledev.ru"; - extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;''; - locations = { - "/".index = "index.php index.html"; - "~ \\.php$".extraConfig = '' - fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; - ''; - "/vw" = { - proxyPass = "http://127.0.0.1:8000"; - proxyWebsockets = true; - extraConfig = '' - allow fc00::/64; - allow fc01::/64; - allow 10.0.0.0/24; - allow 10.1.0.0/24; - deny all; - ''; - }; - }; - }; - }; }; }