diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/caddy.nix | 55 | ||||
| -rw-r--r-- | modules/dns.nix | 16 | ||||
| -rw-r--r-- | modules/gitsrv.nix | 133 | ||||
| -rw-r--r-- | modules/users.nix | 16 |
4 files changed, 181 insertions, 39 deletions
diff --git a/modules/caddy.nix b/modules/caddy.nix index 9c8e70d..d9023f5 100644 --- a/modules/caddy.nix +++ b/modules/caddy.nix @@ -1,8 +1,4 @@ -{ - pkgs, - lib, - ... -}: +{ config, ... }: let tailnet = import ../tailnet.nix; @@ -15,32 +11,37 @@ in 443 ]; - services.caddy = { - enable = true; - - package = pkgs.caddy.withPlugins { - plugins = [ - "github.com/mholt/caddy-l4@v0.1.2" - ]; + # TCP forwarding lives here alongside Caddy's HTTP/HTTPS reverse proxies. + systemd.sockets.git-ssh-proxy = { + wantedBy = [ "sockets.target" ]; + listenStreams = [ "0.0.0.0:22" ]; + }; - hash = lib.fakeHash; + systemd.services.git-ssh-proxy = { + description = "TCP proxy for Git SSH"; + requires = [ "git-ssh-proxy.socket" ]; + serviceConfig = { + ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra-git}:22"; + DynamicUser = true; }; + }; - globalConfig = '' - layer4 { - 0.0.0.0:22 { - route { - proxy ${tailnet.dijkstra-git}:22 - } - } + systemd.sockets.minecraft-proxy = { + wantedBy = [ "sockets.target" ]; + listenStreams = [ "0.0.0.0:25565" ]; + }; - 0.0.0.0:25565 { - route { - proxy ${tailnet.dijkstra}:25565 - } - } - } - ''; + systemd.services.minecraft-proxy = { + description = "TCP proxy for Minecraft"; + requires = [ "minecraft-proxy.socket" ]; + serviceConfig = { + ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra}:25565"; + DynamicUser = true; + }; + }; + + services.caddy = { + enable = true; extraConfig = '' # TODO: make it nice diff --git a/modules/dns.nix b/modules/dns.nix index 5454cc5..26c42f0 100644 --- a/modules/dns.nix +++ b/modules/dns.nix @@ -1,13 +1,11 @@ { pkgs, ... }: let - serial = "2026100201"; + serial = "2026100401"; public = { - hamano = "152.44.39.247"; lee = "152.44.40.91"; - knuth = "x.x.x.x"; - unused = "x.x.x.x"; + knuth = "209.50.50.6"; }; tailnet = import ../tailnet.nix; @@ -110,9 +108,10 @@ in # https://github.com/tailscale/tailscale/issues/1543#issuecomment-4703759447 file = mkPrimaryZone { domain = "gae.moe"; - address = public.hamano; + address = public.knuth; extraRecords = '' - ns1 IN A ${public.hamano} + ns1 IN A ${public.knuth} + _hi 3600 IN TXT "hi :3" ${tailnetRecords} ''; @@ -126,6 +125,9 @@ in file = mkPrimaryZone { domain = "grace.pink"; address = public.lee; + extraRecords = '' + _atproto 3600 IN TXT "did=did:plc:rtokeh2dsmapicefqxkefbfn" + ''; }; }; @@ -135,7 +137,7 @@ in file = mkPrimaryZone { domain = "words.gay"; - address = public.unused; + address = public.lee; }; }; } diff --git a/modules/gitsrv.nix b/modules/gitsrv.nix new file mode 100644 index 0000000..e4098e7 --- /dev/null +++ b/modules/gitsrv.nix @@ -0,0 +1,133 @@ +{ + config, + pkgs, + lib, + ... +}: + +let + gitoliteKeys = { + gitolite-admin = [ + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com" + # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINySDE+jaYpuAWUdPQf/JcAWETeHgmh+T5Y4GUa7MfeM grace@turing" + ]; + + grace = [ ]; + grace-read = [ ]; + }; + + mkGitoliteKey = + user: key: + ''command="${pkgs.gitolite}/bin/gitolite-shell ${user}",restrict ${key}''; + + gitoliteAuthorizedKeys = + lib.concatStringsSep "\n" ( + lib.flatten ( + lib.mapAttrsToList ( + user: keys: + map (mkGitoliteKey user) keys + ) gitoliteKeys + ) + ); + + fixGitolitePermissions = pkgs.writeShellScript "fix-gitolite-permissions" '' + set -eu + + ${pkgs.coreutils}/bin/mkdir -p /var/lib/git-server/.ssh + + ${pkgs.coreutils}/bin/chown git:git /var/lib/git-server + ${pkgs.coreutils}/bin/chmod 0750 /var/lib/git-server + + ${pkgs.coreutils}/bin/chown git:git /var/lib/git-server/.ssh + ${pkgs.coreutils}/bin/chmod 0700 /var/lib/git-server/.ssh + + if [ -e /var/lib/git-server/.ssh/authorized_keys ]; then + ${pkgs.coreutils}/bin/chown git:git \ + /var/lib/git-server/.ssh/authorized_keys + + ${pkgs.coreutils}/bin/chmod 0600 \ + /var/lib/git-server/.ssh/authorized_keys + fi + ''; +in +{ + services.gitolite = { + enable = true; + + user = "git"; + group = "git"; + + dataDir = "/var/lib/git-server"; + + adminPubkey = + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com"; + }; + + # IMPORTANT: + # mode != "symlink" makes these REAL /etc files instead of + # symlinks through /nix/store, which sshd StrictModes rejects. + + environment.etc."ssh/git-user-ca.pub" = { + mode = "0644"; + user = "root"; + group = "root"; + + text = '' + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuc4HCdyEMu4uiYhlokSXmu+68hkm7j6CqVwjDkCeSj grace.pink + ''; + }; + + environment.etc."ssh/git-principals" = { + mode = "0644"; + user = "root"; + group = "root"; + + text = '' + command="${pkgs.gitolite}/bin/gitolite-shell grace",restrict t:dev + command="${pkgs.gitolite}/bin/gitolite-shell grace-read",restrict u:grace + ''; + }; + + environment.etc."ssh/git-authorized-keys" = { + mode = "0644"; + user = "root"; + group = "root"; + + text = gitoliteAuthorizedKeys + "\n"; + }; + + services.openssh = { + enable = true; + + ports = [ + 22 + 2222 + ]; + + extraConfig = '' + Match User git + TrustedUserCAKeys /etc/ssh/git-user-ca.pub + AuthorizedPrincipalsFile /etc/ssh/git-principals + AuthorizedKeysFile /etc/ssh/git-authorized-keys + + PubkeyAuthentication yes + PasswordAuthentication no + KbdInteractiveAuthentication no + + DisableForwarding yes + PermitTTY no + PermitUserRC no + X11Forwarding no + ''; + }; + + systemd.services.gitolite-init.serviceConfig.ExecStartPre = + lib.mkBefore [ + "+${fixGitolitePermissions}" + ]; + + systemd.tmpfiles.rules = [ + "d /var/lib/git-server 0750 git git -" + "d /var/lib/git-server/.ssh 0700 git git -" + ]; +} diff --git a/modules/users.nix b/modules/users.nix index 53fce69..d18e366 100644 --- a/modules/users.nix +++ b/modules/users.nix @@ -1,15 +1,21 @@ { pkgs, ... }: let + host = import ../hosts.nix; home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/master.tar.gz"; - host = import ../host.nix; in { imports = [ "${home-manager}/nixos" ]; - users.users.grace = { + nix.settings.trusted-users = [ + "root" + "grace" + ]; + + users.users.${host.user} = { isNormalUser = true; - description = "grace"; + description = host.user; + home = host.home; extraGroups = [ "wheel" "networkmanager" @@ -23,11 +29,11 @@ in security.sudo.wheelNeedsPassword = false; home-manager = { - useGlobalPkgs = true; + useGlobalPkgs = false; useUserPackages = true; backupFileExtension = "backup"; - users.grace = { + users.${host.user} = { imports = [ ../home.nix ]; home.username = host.user; |