diff --git a/common.nix b/common.nix index 759a349..ce72039 100644 --- a/common.nix +++ b/common.nix @@ -13,45 +13,72 @@ "/boot" = { options = [ "noatime" ]; }; }; swapDevices = [ { device = "/var/swapfile"; } ]; - boot.loader.limine = { - enable = true; - secureBoot.enable = true; - }; - users.users = { - root = { - home = "/root"; - hashedPasswordFile = "/root/secrets/root.passwd"; - }; - bogale = { - isNormalUser = true; - home = "/home/bogale"; - extraGroups = [ "wheel" ]; - hashedPasswordFile = "/root/secrets/bogale.passwd"; + boot = { + kernelModules = [ "amneziawg" ]; + kernelPackages = pkgs.linuxPackages_latest; + extraModulePackages = [ config.boot.kernelPackages.amneziawg ]; + loader.limine = { + enable = true; + maxGenerations = 20; + secureBoot.enable = true; + panicOnChecksumMismatch = true; }; }; + users.users.root.hashedPasswordFile = "/secrets/root.passwd"; networking = { - nftables.enable = true; - #networking.wg-quick.interfaces.awg0 = { - #type = "amneziawg"; - #configFile = "/root/secrets/awg0.conf"; - #}; + firewall = { + allowedTCPPorts = [ 53 80 ]; + allowedUDPPorts = [ 53 67 69 547 ]; + }; + wg-quick.interfaces.awg0 = { + type = "amneziawg"; + configFile = "/secrets/awg0.conf"; + }; networkmanager = { enable = true; - ensureProfiles.profiles.home-wifi = { - wifi-security.key-mgmt = "sae"; - connection = { - id = "home-wifi"; - type = "wifi"; + ensureProfiles = { + environmentFiles = [ "/secrets/wifi.env" ]; + profiles.home-wifi = { + wifi-security.key-mgmt = "sae"; + connection = { + id = "home-wifi"; + type = "wifi"; + }; }; }; }; }; environment.systemPackages = with pkgs; [ - amneziawg-go - amneziawg-tools sbctl ]; + systemd.tmpfiles.rules = [ "d /srv/tftp 0755 root root -" ]; services = { logind.settings.Login.HandleLidSwitch = "ignore"; + nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedBrotliSettings = true; + }; + dnsmasq = { + enable = true; + settings = { + enable-ra = true; + no-resolv = true; + cache-size = 1024; + bogus-priv = true; + enable-tftp = true; + interface = "enp1s0"; + domain-needed = true; + tftp-root = "/srv/tftp"; + dhcp-boot = "grubx64.efi"; + dhcp-range = [ "10.2.0.2,10.2.255.254,12h" + "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ]; + server = [ "1.0.0.1" "2606:4700:4700::1001" + "1.1.1.1" "2606:4700:4700::1111" ]; + }; + }; }; } diff --git a/desktop/configuration.nix b/desktop/configuration.nix new file mode 100644 index 0000000..74f6ac4 --- /dev/null +++ b/desktop/configuration.nix @@ -0,0 +1,15 @@ +{ config, lib, pkgs, ... }: +{ + imports = [ ../common.nix ./hardware-configuration.nix ]; + networking = { + hostName = "nixos-desktop"; + }; + users.users = { + bogale = { + isNormalUser = true; + home = "/home/bogale"; + extraGroups = [ "wheel" ]; + hashedPasswordFile = "/secrets/bogale.passwd"; + }; + }; +} diff --git a/server/flake.lock b/flake.lock similarity index 65% rename from server/flake.lock rename to flake.lock index 0a16ff3..8dae76d 100644 --- a/server/flake.lock +++ b/flake.lock @@ -7,32 +7,31 @@ ] }, "locked": { - "lastModified": 1789267039, - "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=", + "lastModified": 1789618856, + "narHash": "sha256-OSqj7eOijvCZfN7owFWRxLWRhej5lZI+Kt82q3INLvc=", "owner": "nix-community", "repo": "home-manager", - "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727", + "rev": "afa6821c70560bb19d1a8c577bff398f7f239869", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-26.05", "repo": "home-manager", "type": "github" } }, "nixpkgs": { "locked": { - "lastModified": 1789459628, - "narHash": "sha256-JOaadoI/IC9qEvwlnjwAhwdcWkCDqEeOJ+cOtUH/8RQ=", + "lastModified": 1789546076, + "narHash": "sha256-zVxLZiSnmaaPLwnhj7pwmqe3axBg/C6nG5JZsJMh2g4=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b67c7a60c3732edd4b947a7df8af06215851a614", + "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-26.05", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..6ee7a5c --- /dev/null +++ b/flake.nix @@ -0,0 +1,36 @@ +{ + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + home-manager = { + url = "github:nix-community/home-manager"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; + outputs = inputs@{ self, nixpkgs, home-manager, ... }: { + nixosConfigurations = { + nixos-server = nixpkgs.lib.nixosSystem { + modules = [ + ./server/configuration.nix + home-manager.nixosModules.home-manager { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.extraSpecialArgs = { inherit inputs; }; + home-manager.users.root = ./home/server/root.nix; + } + ]; + }; + nixos-desktop = nixpkgs.lib.nixosSystem { + modules = [ + ./desktop/configuration.nix + home-manager.nixosModules.home-manager { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.extraSpecialArgs = { inherit inputs; }; + home-manager.users.root = ./home/desktop/root.nix; + home-manager.users.bogale = ./home/desktop/bogale.nix; + } + ]; + }; + }; + }; +} diff --git a/home/bogale.nix b/home/bogale.nix deleted file mode 100644 index 372df57..0000000 --- a/home/bogale.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ./common.nix ]; - home.username = "bogale"; - home.homeDirectory = "/home/bogale"; -} diff --git a/home/common.nix b/home/common.nix index b789ab6..c3730c0 100644 --- a/home/common.nix +++ b/home/common.nix @@ -1,6 +1,12 @@ { config, pkgs, ... }: { - home.stateVersion = "26.05"; + home = { + stateVersion = "26.05"; + packages = with pkgs; [ + gh + ]; + }; + services.ssh-agent.enable = true; programs = { home-manager.enable = true; bash = { @@ -39,13 +45,11 @@ extraConfig = '' unbind C-b set -g mouse on - set -g prefix M-d set -g prefix M-f set-option -g focus-events on set -s set-clipboard external set-option -a terminal-features "xterm-256color:RGB" bind f send-prefix - bind d send-prefix bind h select-pane -L bind j select-pane -D bind k select-pane -U diff --git a/home/desktop/bogale.nix b/home/desktop/bogale.nix new file mode 100644 index 0000000..3fe8e42 --- /dev/null +++ b/home/desktop/bogale.nix @@ -0,0 +1,8 @@ +{ config, pkgs, ... }: +{ + imports = [ ../common.nix ]; + home = { + username = "bogale"; + homeDirectory = "/home/bogale"; + }; +} diff --git a/home/desktop/root.nix b/home/desktop/root.nix new file mode 100644 index 0000000..f9e4713 --- /dev/null +++ b/home/desktop/root.nix @@ -0,0 +1,8 @@ +{ config, pkgs, ... }: +{ + imports = [ ../common.nix ]; + home = { + username = "root"; + homeDirectory = "/root"; + }; +} diff --git a/home/root.nix b/home/root.nix deleted file mode 100644 index ae559a9..0000000 --- a/home/root.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ./common.nix ]; - home.username = "root"; - home.homeDirectory = "/root"; -} diff --git a/home/server/bogale.nix b/home/server/bogale.nix deleted file mode 100644 index f6bd6f1..0000000 --- a/home/server/bogale.nix +++ /dev/null @@ -1,4 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ ../bogale.nix ]; -} diff --git a/home/server/root.nix b/home/server/root.nix index 8998624..f9e4713 100644 --- a/home/server/root.nix +++ b/home/server/root.nix @@ -1,7 +1,8 @@ { config, pkgs, ... }: { - imports = [ ../root.nix ]; - programs.bash = { - shellAliases = { "nixos-rebuild" = "nixos-rebuild --impure --flake /etc/nixos/server#nixos-server"; }; + imports = [ ../common.nix ]; + home = { + username = "root"; + homeDirectory = "/root"; }; } diff --git a/marks b/marks index 6101e34..8c99111 100644 --- a/marks +++ b/marks @@ -12,4 +12,6 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 todo: -- lanzaboote +- gitea, mediawiki +- email tracking +- redirect randomizer diff --git a/server/configuration.nix b/server/configuration.nix index c572485..a3d924a 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -2,35 +2,200 @@ { imports = [ ../common.nix ./hardware-configuration.nix ]; boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ]; + users = { + groups.vmail.gid = 1819; + users = { + nginx.extraGroups = [ "acme" ]; + root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ]; + vmail = { + uid = 1819; + group = "vmail"; + isSystemUser = true; + }; + }; + }; networking = { hostName = "nixos-server"; + firewall = { + allowedTCPPorts = [ 25 443 587 993 ]; + allowedUDPPorts = [ 443 ]; + }; networkmanager.ensureProfiles.profiles.home-wifi = { wifi.ssid = "bogale_2.4"; - wifi-security.psk = builtins.readFile "/root/secrets/home-wifi.psk"; + wifi-security.psk = "$BOGALE_2_4_PSK"; + ipv4 = { + method = "manual"; + gateway = "10.1.0.1"; + addresses = "10.1.0.2/16"; + }; + ipv6 = { + method = "manual"; + gateway = "fc01::1"; + addresses = "fc01::2/64"; + }; }; - firewall = { - allowedTCPPorts = [ 80 ]; - extraInputRules = '' - ip saddr 192.168.1.0/24 tcp dport 22 accept + }; + security.acme = { + acceptTerms = true; + defaults.email = "letsencrypt@bogaledev.ru"; + certs."bogaledev.ru" = { + validMinDays = 3; + dnsProvider = "cloudflare"; + extraDomainNames = [ "*.bogaledev.ru" ]; + credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; }; + reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; + }; + }; + systemd = { + tmpfiles.rules = [ + "d /var/spool/postfix 0755 postfix postfix -" + "d /var/spool/postfix/private 0755 postfix postfix -" + ]; + timers.network-watchdog = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = 5; + AccuracySec = 1; + OnUnitActiveSec = 5; + Unit = "network-watchdog.service"; + }; + }; + services.network-watchdog = { + path = [ pkgs.iputils ]; + serviceConfig = { + Type = "oneshot"; + LogLevelMax = "notice"; + }; + script = '' + if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then + failures=0 + else + failures=$(($(cat /run/network.failures)+1)) + if [ $failures -ge 3 ]; then + systemctl restart NetworkManager.service + failures=0 + fi + fi + echo $failures > /run/network.failures + if [ $failures -ge 0 ]; then + echo "<5>failures = $failures" + fi ''; }; }; - services = { + services = let + saslSocket = "/var/spool/postfix/private/auth"; + sslCertDir = config.security.acme.certs."bogaledev.ru".directory; + in { openssh = { enable = true; - openFirewall = false; + settings.PasswordAuthentication = false; }; - nginx = { + postgresql.enable = true; + phpfpm.pools.main = { + user = "nginx"; + group = "nginx"; + settings = { + "pm" = "ondemand"; + "pm.max_children" = 8; + "listen.owner" = "nginx"; + "listen.group" = "nginx"; + }; + }; + vaultwarden = { enable = true; - virtualHosts."_".default = true; - virtualHosts."_" = { - locations."/" = { - return = "200 'It works'"; + dbBackend = "postgresql"; + configurePostgres = true; + package = pkgs.vaultwarden-postgresql; + environmentFile = "/secrets/vaultwarden.env"; + config = { + SIGNUPS_ALLOWED = false; + TRASH_AUTO_DELETE_DAYS = 90; + PASSWORD_HINTS_ALLOWED = false; + EMERGENCY_ACCESS_ALLOWED = false; + DOMAIN = "https://bogaledev.ru/vw"; + }; + }; + nginx.virtualHosts."bogaledev.ru" = { + quic = true; + default = true; + forceSSL = true; + root = "/srv/http"; + useACMEHost = "bogaledev.ru"; + extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;''; + locations = { + "/".index = "index.php index.html"; + "~ \\.php$".extraConfig = '' + fastcgi_pass unix:${config.services.phpfpm.pools.main.socket}; + ''; + "/vw" = { + proxyPass = "http://127.0.0.1:8000"; + proxyWebsockets = true; extraConfig = '' - default_type text/html; + allow fc00::/64; + allow fc01::/64; + allow 10.0.0.0/24; + allow 10.1.0.0/24; + deny all; ''; }; }; }; + rspamd = { + enable = true; + postfix.enable = true; + }; + dovecot2 = { + enable = true; + settings = { + ssl = "required"; + mail_gid = "vmail"; + mail_uid = "vmail"; + protocols.imap = true; + mail_driver = "maildir"; + auth_mechanisms = [ "plain" ]; + dovecot_storage_version = "2.4.5"; + mail_path = "/var/spool/mail/vmail"; + ssl_server_key_file = "${sslCertDir}/key.pem"; + ssl_server_cert_file = "${sslCertDir}/fullchain.pem"; + dovecot_config_version = config.services.dovecot2.package.version; + "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd"; + "service auth"."unix_listener ${saslSocket}" = { + mode = "0660"; + user = "postfix"; + group = "postfix"; + }; + }; + }; + postfix = { + enable = true; + enableSubmission = true; + virtualMapType = "regexp"; + virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru"; + mapFiles = { + smtp_passwd = "/secrets/smtp_passwd"; + mailbox = pkgs.writeText "mailbox" "mail@bogaledev.ru /"; + }; + settings.main = { + smtpd_sasl_type = "dovecot"; + smtpd_sasl_path = saslSocket; + smtp_sasl_auth_enable = "yes"; + smtpd_sasl_auth_enable = "yes"; + virtual_uid_maps = "static:1819"; + virtual_gid_maps = "static:1819"; + smtp_tls_security_level = "encrypt"; + smtpd_tls_security_level = "encrypt"; + relayhost = [ "smtp.resend.com:2587" ]; + virtual_mailbox_domains = "bogaledev.ru"; + virtual_mailbox_base = "/var/spool/mail/vmail"; + smtp_sasl_tls_security_options = "noanonymous"; + virtual_mailbox_maps = "hash:/etc/postfix/mailbox"; + smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd"; + smtpd_tls_chain_files = [ + "${sslCertDir}/key.pem" + "${sslCertDir}/fullchain.pem" + ]; + }; + }; }; } diff --git a/server/flake.nix b/server/flake.nix deleted file mode 100644 index 705a8a3..0000000 --- a/server/flake.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; - home-manager = { - url = "github:nix-community/home-manager/release-26.05"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - }; - outputs = inputs@{ self, nixpkgs, home-manager, ... }: { - nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem { - modules = [ - ./configuration.nix - home-manager.nixosModules.home-manager - { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.extraSpecialArgs = { inherit inputs; }; - home-manager.users.root = ../home/server/root.nix; - home-manager.users.bogale = ../home/server/bogale.nix; - } - ]; - }; - }; -}