hamano stuff

5 files changed, 435 insertions, 0 deletions

diff --git a/modules/auto-update.nix b/modules/auto-update.nix
new file mode 100644
index 0000000..b370390
--- /dev/null
+++ b/modules/auto-update.nix
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  system.autoUpgrade = {
+    enable = true;
+    dates = "minutely";
+    allowReboot = true;
+    upgrade = false;
+  };
+
+  systemd.services.nixos-upgrade = {
+    path = [ pkgs.git ];
+    serviceConfig = {
+      WorkingDirectory = "/etc/nixos";
+      StateDirectory = "nixos-repo-update";
+      ExecCondition = pkgs.writeShellScript "check-nixos-repo" ''
+        set -euo pipefail
+        git fetch || exit 255
+        test "$(cat "$STATE_DIRECTORY/applied" 2>/dev/null || true)" != "$(git rev-parse '@{upstream}')"
+      '';
+    };
+
+    preStart = "git pull --ff-only";
+    postStart = ''git rev-parse HEAD > "$STATE_DIRECTORY/applied"'';
+  };
+}
diff --git a/modules/caddy.nix b/modules/caddy.nix
new file mode 100644
index 0000000..a250c96
--- /dev/null
+++ b/modules/caddy.nix
@@ -0,0 +1,217 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  tailnet = import ../tailnet.nix;
+in
+{
+  networking.firewall.allowedTCPPorts = [
+    22
+    25565
+  ];
+
+  services.caddy = {
+    enable = true;
+    openFirewall = true;
+
+    package = pkgs.caddy.withPlugins {
+      plugins = [
+        "github.com/mholt/caddy-l4@v0.1.2"
+      ];
+
+      hash = lib.fakeHash;
+    };
+
+    globalConfig = ''
+      layer4 {
+        0.0.0.0:22 {
+          route {
+            proxy ${tailnet.dijkstra-git}:22
+          }
+        }
+
+        0.0.0.0:25565 {
+          route {
+            proxy ${tailnet.dijkstra}:25565
+          }
+        }
+      }
+    '';
+
+    extraConfig = ''
+      # TODO: make it nice
+      (offline_page) {
+        handle_errors {
+          @offline expression {err.status_code} in [502, 503, 504]
+
+          handle @offline {
+            header Content-Type "text/html; charset=utf-8"
+            header Cache-Control "no-store"
+            respond <<HTML
+              <!doctype html>
+              <html lang="en">
+                <head>
+                  <title>Service temporarily offline</title>
+                </head>
+                <body>
+                  <main>
+                    <h1>Page Down</h1>
+                    <p>If you are seeing this, the backend server is offline. It should be back up soon so check again later.</p>
+                    <p class="status">Error {err.status_code}</p>
+                  </main>
+                </body>
+              </html>
+              HTML {err.status_code}
+          }
+
+          handle {
+            respond "{err.status_code} — {err.status_text}" {err.status_code}
+          }
+        }
+      }
+    '';
+
+    virtualHosts =
+      builtins.mapAttrs
+        (
+          _: virtualHost:
+          virtualHost
+          // {
+            extraConfig = ''
+              import offline_page
+              ${virtualHost.extraConfig}
+            '';
+          }
+        )
+        {
+          "map.mc.gae.moe".extraConfig = ''
+            reverse_proxy ${tailnet.dijkstra}:8101
+          '';
+
+          "fin.gae.moe".extraConfig = ''
+            request_body {
+              max_size 10GB
+            }
+
+            reverse_proxy ${tailnet.dijkstra}:8096 {
+              transport http {
+                read_buffer 16KiB
+                write_buffer 16KiB
+                dial_timeout 10s
+                response_header_timeout 300s
+                keepalive 60s
+              }
+            }
+          '';
+
+          "files.gae.moe".extraConfig = ''
+            request_body {
+              max_size 10GB
+            }
+
+            reverse_proxy ${tailnet.dijkstra}:8080 {
+              transport http {
+                read_buffer 16KiB
+                write_buffer 16KiB
+                dial_timeout 10s
+                response_header_timeout 300s
+                keepalive 60s
+              }
+            }
+          '';
+
+          "img.gae.moe".extraConfig = ''
+            reverse_proxy ${tailnet.dijkstra}:2283
+          '';
+
+          "git.gae.moe, git.tools.grace.pink".extraConfig = ''
+            request_body {
+              max_size 10GB
+            }
+
+            reverse_proxy http://${tailnet.dijkstra-git}:3000 {
+              flush_interval -1
+
+              header_up X-Real-IP {remote_host}
+              header_up X-Forwarded-For {remote_host}
+              header_up X-Forwarded-Proto {scheme}
+
+              transport http {
+                read_buffer 16KiB
+                write_buffer 16KiB
+                dial_timeout 10s
+                response_header_timeout 300s
+                keepalive 60s
+              }
+            }
+          '';
+
+          "ci.gae.moe".extraConfig = ''
+            reverse_proxy ${tailnet.dijkstra-git}:8000
+          '';
+
+          "knot.gae.moe".extraConfig = ''
+            reverse_proxy ${tailnet.dijkstra-git}:5555
+          '';
+
+          "books.gae.moe".extraConfig = ''
+            reverse_proxy localhost:6822
+          '';
+
+          "term.gae.moe".extraConfig = ''
+            reverse_proxy ${tailnet.dijkstra}:8082 {
+              transport http {
+                tls_insecure_skip_verify
+              }
+            }
+          '';
+
+          "pds.gae.moe, grace.pds.gae.moe, art.pds.gae.moe".extraConfig = ''
+            encode gzip
+
+            request_body {
+              max_size 10GB
+            }
+
+            handle /xrpc/* {
+              reverse_proxy http://${tailnet.lee}:8642 {
+                header_up Host {host}
+                header_up X-Real-IP {remote_host}
+                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-Proto {scheme}
+                header_up Upgrade {http.request.header.Upgrade}
+                header_up Connection "Upgrade"
+                flush_interval -1
+
+                transport http {
+                  response_header_timeout 86400s
+                  keepalive 32s
+                  keepalive_idle_conns 32
+                }
+              }
+            }
+
+            handle /oauth/* {
+              reverse_proxy http://${tailnet.lee}:8642 {
+                header_up Host {host}
+                header_up X-Real-IP {remote_host}
+                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-Proto {scheme}
+              }
+            }
+
+            handle /.well-known/webfinger {
+              rewrite * /helpers/webfinger
+              reverse_proxy https://atlogin.net
+            }
+
+            handle {
+              reverse_proxy http://${tailnet.lee}:8642
+            }
+          '';
+        };
+  };
+}
diff --git a/modules/dns.nix b/modules/dns.nix
new file mode 100644
index 0000000..ea284e3
--- /dev/null
+++ b/modules/dns.nix
@@ -0,0 +1,149 @@
+{ pkgs, ... }:
+
+let
+  serial = "2026100201";
+
+  public = {
+    hamano = "x.x.x.x";
+    lee = "x.x.x.x";
+    knuth = "x.x.x.x";
+    unused = "x.x.x.x";
+  };
+
+  tailnet = import ../tailnet.nix;
+
+  tailnetRecords = builtins.concatStringsSep "\n" (
+    builtins.map (name: "${name}.i IN A ${tailnet.${name}}") (builtins.attrNames tailnet)
+  );
+
+  mafiaSecondaries = [
+    "45.8.201.122"
+    "45.8.201.114"
+    "158.101.112.125"
+  ];
+
+  publicNameservers = ''
+    @ IN NS ns1.gae.moe.
+    @ IN NS ns1.inx.moe.
+    @ IN NS denise.charbroil.me.
+    @ IN NS ns1.shad.moe.
+  '';
+
+  mkPrimaryZone =
+    {
+      domain,
+      address,
+      extraRecords ? "",
+    }:
+    pkgs.writeText "zone-${domain}" ''
+      $ORIGIN ${domain}.
+      $TTL 300
+
+      @ IN SOA ns1.gae.moe. hostmaster.gae.moe. (
+        ${serial}
+        1h
+        15m
+        1w
+        5m
+      )
+
+      ${publicNameservers}
+
+      @ IN A ${address}
+      * IN A ${address}
+
+      ${extraRecords}
+    '';
+
+  mkSecondary =
+    master: zones:
+    builtins.listToAttrs (
+      map (zone: {
+        name = zone;
+        value = {
+          master = false;
+          masters = [ master ];
+          file = zone;
+        };
+      }) zones
+    );
+
+  mafiaZones =
+    mkSecondary "45.8.201.122" [
+      "inx.moe"
+      "doge-inc.net"
+      "foxy.software"
+      "swedish.fish"
+      "unreliable.email"
+      "funmafia.industries"
+      "vulcan.moe"
+    ]
+    // mkSecondary "45.8.201.114" [
+      "charbroil.me"
+      "puppy.observer"
+      "bdsm.equipment"
+      "ilovehewlettpackard.com"
+    ]
+    // mkSecondary "158.101.112.125" [
+      "shad.moe"
+      "konpeki.solutions"
+      "konpekisolutions.com"
+    ];
+
+in
+{
+  services.bind = {
+    enable = true;
+
+    cacheNetworks = [
+      "127.0.0.0/8"
+      "::1/128"
+      "100.64.0.0/10"
+    ];
+
+    zones = {
+      "gae.moe" = {
+        master = true;
+        slaves = mafiaSecondaries;
+
+        # Potentially could use DNAME forwarding while defining a Quad100 forwarder?
+        # https://github.com/tailscale/tailscale/issues/1543#issuecomment-4703759447
+        file = mkPrimaryZone {
+          domain = "gae.moe";
+          address = public.hamano;
+          extraRecords = ''
+            ns1 IN A ${public.hamano}
+
+            ${tailnetRecords}
+          '';
+        };
+      };
+
+      "grace.pink" = {
+        master = true;
+        slaves = mafiaSecondaries;
+
+        file = mkPrimaryZone {
+          domain = "grace.pink";
+          address = public.lee;
+        };
+      };
+
+      "words.gay" = {
+        master = true;
+        slaves = mafiaSecondaries;
+
+        file = mkPrimaryZone {
+          domain = "words.gay";
+          address = public.unused;
+        };
+      };
+    }
+    // mafiaZones;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+}
diff --git a/modules/tailscale.nix b/modules/tailscale.nix
new file mode 100644
index 0000000..3d0f596
--- /dev/null
+++ b/modules/tailscale.nix
@@ -0,0 +1,6 @@
+{ ... }:
+
+{
+  services.tailscale.enable = true;
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}
diff --git a/modules/users.nix b/modules/users.nix
new file mode 100644
index 0000000..53fce69
--- /dev/null
+++ b/modules/users.nix
@@ -0,0 +1,37 @@
+{ pkgs, ... }:
+
+let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/master.tar.gz";
+  host = import ../host.nix;
+in
+{
+  imports = [ "${home-manager}/nixos" ];
+
+  users.users.grace = {
+    isNormalUser = true;
+    description = "grace";
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ];
+
+    shell = pkgs.fish;
+  };
+
+  programs.fish.enable = true;
+
+  security.sudo.wheelNeedsPassword = false;
+
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    backupFileExtension = "backup";
+
+    users.grace = {
+      imports = [ ../home.nix ];
+
+      home.username = host.user;
+      home.homeDirectory = host.home;
+    };
+  };
+}