hamano againvulcan

4 files changed, 181 insertions, 39 deletions

diff --git a/modules/caddy.nix b/modules/caddy.nix
index 9c8e70d..d9023f5 100644
--- a/modules/caddy.nix
+++ b/modules/caddy.nix
@@ -1,8 +1,4 @@
-{
-  pkgs,
-  lib,
-  ...
-}:
+{ config, ... }:
 
 let
   tailnet = import ../tailnet.nix;
@@ -15,32 +11,37 @@ in
     443
   ];
 
-  services.caddy = {
-    enable = true;
-
-    package = pkgs.caddy.withPlugins {
-      plugins = [
-        "github.com/mholt/caddy-l4@v0.1.2"
-      ];
+  # TCP forwarding lives here alongside Caddy's HTTP/HTTPS reverse proxies.
+  systemd.sockets.git-ssh-proxy = {
+    wantedBy = [ "sockets.target" ];
+    listenStreams = [ "0.0.0.0:22" ];
+  };
 
-      hash = lib.fakeHash;
+  systemd.services.git-ssh-proxy = {
+    description = "TCP proxy for Git SSH";
+    requires = [ "git-ssh-proxy.socket" ];
+    serviceConfig = {
+      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra-git}:22";
+      DynamicUser = true;
     };
+  };
 
-    globalConfig = ''
-      layer4 {
-        0.0.0.0:22 {
-          route {
-            proxy ${tailnet.dijkstra-git}:22
-          }
-        }
+  systemd.sockets.minecraft-proxy = {
+    wantedBy = [ "sockets.target" ];
+    listenStreams = [ "0.0.0.0:25565" ];
+  };
 
-        0.0.0.0:25565 {
-          route {
-            proxy ${tailnet.dijkstra}:25565
-          }
-        }
-      }
-    '';
+  systemd.services.minecraft-proxy = {
+    description = "TCP proxy for Minecraft";
+    requires = [ "minecraft-proxy.socket" ];
+    serviceConfig = {
+      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra}:25565";
+      DynamicUser = true;
+    };
+  };
+
+  services.caddy = {
+    enable = true;
 
     extraConfig = ''
       # TODO: make it nice
diff --git a/modules/dns.nix b/modules/dns.nix
index 5454cc5..26c42f0 100644
--- a/modules/dns.nix
+++ b/modules/dns.nix
@@ -1,13 +1,11 @@
 { pkgs, ... }:
 
 let
-  serial = "2026100201";
+  serial = "2026100401";
 
   public = {
-    hamano = "152.44.39.247";
     lee = "152.44.40.91";
-    knuth = "x.x.x.x";
-    unused = "x.x.x.x";
+    knuth = "209.50.50.6";
   };
 
   tailnet = import ../tailnet.nix;
@@ -110,9 +108,10 @@ in
         # https://github.com/tailscale/tailscale/issues/1543#issuecomment-4703759447
         file = mkPrimaryZone {
           domain = "gae.moe";
-          address = public.hamano;
+          address = public.knuth;
           extraRecords = ''
-            ns1 IN A ${public.hamano}
+            ns1 IN A ${public.knuth}
+            _hi 3600 IN TXT "hi :3"
 
             ${tailnetRecords}
           '';
@@ -126,6 +125,9 @@ in
         file = mkPrimaryZone {
           domain = "grace.pink";
           address = public.lee;
+          extraRecords = ''
+            _atproto 3600 IN TXT "did=did:plc:rtokeh2dsmapicefqxkefbfn"
+          '';
         };
       };
 
@@ -135,7 +137,7 @@ in
 
         file = mkPrimaryZone {
           domain = "words.gay";
-          address = public.unused;
+          address = public.lee;
         };
       };
     }
diff --git a/modules/gitsrv.nix b/modules/gitsrv.nix
new file mode 100644
index 0000000..e4098e7
--- /dev/null
+++ b/modules/gitsrv.nix
@@ -0,0 +1,133 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  gitoliteKeys = {
+    gitolite-admin = [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com"
+      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINySDE+jaYpuAWUdPQf/JcAWETeHgmh+T5Y4GUa7MfeM grace@turing"
+    ];
+
+    grace = [ ];
+    grace-read = [ ];
+  };
+
+  mkGitoliteKey =
+    user: key:
+    ''command="${pkgs.gitolite}/bin/gitolite-shell ${user}",restrict ${key}'';
+
+  gitoliteAuthorizedKeys =
+    lib.concatStringsSep "\n" (
+      lib.flatten (
+        lib.mapAttrsToList (
+          user: keys:
+          map (mkGitoliteKey user) keys
+        ) gitoliteKeys
+      )
+    );
+
+  fixGitolitePermissions = pkgs.writeShellScript "fix-gitolite-permissions" ''
+    set -eu
+
+    ${pkgs.coreutils}/bin/mkdir -p /var/lib/git-server/.ssh
+
+    ${pkgs.coreutils}/bin/chown git:git /var/lib/git-server
+    ${pkgs.coreutils}/bin/chmod 0750 /var/lib/git-server
+
+    ${pkgs.coreutils}/bin/chown git:git /var/lib/git-server/.ssh
+    ${pkgs.coreutils}/bin/chmod 0700 /var/lib/git-server/.ssh
+
+    if [ -e /var/lib/git-server/.ssh/authorized_keys ]; then
+      ${pkgs.coreutils}/bin/chown git:git \
+        /var/lib/git-server/.ssh/authorized_keys
+
+      ${pkgs.coreutils}/bin/chmod 0600 \
+        /var/lib/git-server/.ssh/authorized_keys
+    fi
+  '';
+in
+{
+  services.gitolite = {
+    enable = true;
+
+    user = "git";
+    group = "git";
+
+    dataDir = "/var/lib/git-server";
+
+    adminPubkey =
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com";
+  };
+
+  # IMPORTANT:
+  # mode != "symlink" makes these REAL /etc files instead of
+  # symlinks through /nix/store, which sshd StrictModes rejects.
+
+  environment.etc."ssh/git-user-ca.pub" = {
+    mode = "0644";
+    user = "root";
+    group = "root";
+
+    text = ''
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuc4HCdyEMu4uiYhlokSXmu+68hkm7j6CqVwjDkCeSj grace.pink
+    '';
+  };
+
+  environment.etc."ssh/git-principals" = {
+    mode = "0644";
+    user = "root";
+    group = "root";
+
+    text = ''
+      command="${pkgs.gitolite}/bin/gitolite-shell grace",restrict t:dev
+      command="${pkgs.gitolite}/bin/gitolite-shell grace-read",restrict u:grace
+    '';
+  };
+
+  environment.etc."ssh/git-authorized-keys" = {
+    mode = "0644";
+    user = "root";
+    group = "root";
+
+    text = gitoliteAuthorizedKeys + "\n";
+  };
+
+  services.openssh = {
+    enable = true;
+
+    ports = [
+      22
+      2222
+    ];
+
+    extraConfig = ''
+      Match User git
+        TrustedUserCAKeys /etc/ssh/git-user-ca.pub
+        AuthorizedPrincipalsFile /etc/ssh/git-principals
+        AuthorizedKeysFile /etc/ssh/git-authorized-keys
+
+        PubkeyAuthentication yes
+        PasswordAuthentication no
+        KbdInteractiveAuthentication no
+
+        DisableForwarding yes
+        PermitTTY no
+        PermitUserRC no
+        X11Forwarding no
+    '';
+  };
+
+  systemd.services.gitolite-init.serviceConfig.ExecStartPre =
+    lib.mkBefore [
+      "+${fixGitolitePermissions}"
+    ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/git-server 0750 git git -"
+    "d /var/lib/git-server/.ssh 0700 git git -"
+  ];
+}
diff --git a/modules/users.nix b/modules/users.nix
index 53fce69..d18e366 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -1,15 +1,21 @@
 { pkgs, ... }:
 
 let
+  host = import ../hosts.nix;
   home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/master.tar.gz";
-  host = import ../host.nix;
 in
 {
   imports = [ "${home-manager}/nixos" ];
 
-  users.users.grace = {
+  nix.settings.trusted-users = [
+    "root"
+    "grace"
+  ];
+
+  users.users.${host.user} = {
     isNormalUser = true;
-    description = "grace";
+    description = host.user;
+    home = host.home;
     extraGroups = [
       "wheel"
       "networkmanager"
@@ -23,11 +29,11 @@ in
   security.sudo.wheelNeedsPassword = false;
 
   home-manager = {
-    useGlobalPkgs = true;
+    useGlobalPkgs = false;
     useUserPackages = true;
     backupFileExtension = "backup";
 
-    users.grace = {
+    users.${host.user} = {
       imports = [ ../home.nix ];
 
       home.username = host.user;