diff --git a/ca/intermediate_ca.crt b/ca/intermediate_ca.crt new file mode 100644 index 0000000..164afa0 --- /dev/null +++ b/ca/intermediate_ca.crt @@ -0,0 +1,12 @@ +-----BEGIN CERTIFICATE----- +MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER +MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN +MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n +czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi +7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD +AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt +zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49 +BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb +LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA== +-----END CERTIFICATE----- diff --git a/ca/root_ca.crt b/ca/root_ca.crt new file mode 100644 index 0000000..594e4ae --- /dev/null +++ b/ca/root_ca.crt @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER +MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN +MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n +czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49 +AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2 +g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV +HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK +BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi +pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ== +-----END CERTIFICATE----- diff --git a/home/ssh.nix b/home/ssh.nix index 0491074..6e50347 100644 --- a/home/ssh.nix +++ b/home/ssh.nix @@ -1,6 +1,12 @@ { lib, ... }: { + # Workaround to set the config value to user read-only + # This allows things like SSH in distrobox to read the config file just fine + home.file.".ssh/config" = { + target = ".ssh/config_source"; + onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 400 ~/.ssh/config''; + }; programs.ssh = { enable = true; serverAliveInterval = 60; diff --git a/hosts/genesis/acme.nix b/hosts/genesis/acme.nix new file mode 100644 index 0000000..0d43069 --- /dev/null +++ b/hosts/genesis/acme.nix @@ -0,0 +1,62 @@ +{ pkgs, config, lib, ... }: + +let + address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address; + root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt); + intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt); +in { + age.secrets.acme_password = { + file = ../../secrets/acme_password.age; + }; + age.secrets.intermediate_ca_key = { + file = ../../secrets/ca/intermediate_key.age; + }; + age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age; + systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"]; + services.step-ca = { + inherit address; + enable = false; + intermediatePasswordFile = config.age.secrets.acme_password.path; + openFirewall = true; + port = 8443; + settings = { + root = root_ca; + federatedRoots = null; + cert = intermediate_ca; + key = config.age.secrets.intermediate_ca_key.path; + dnsNames = [ + "10.42.1.5" + "acme.thehellings.lan" + ]; + logger.format = "text"; + db = { + type = "badgerv2"; + dataSource = "/var/lib/step-ca/db"; + badgerFileLoadingMode = ""; + }; + authority.provisioners = [ { + type = "JWK"; + name = "greg@thehellings.com"; + key = { + use = "sig"; + kty = "EC"; + kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI"; + crv = "P-256"; + alg = "ES256"; + x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4"; + y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk"; + }; + encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg"; + } ]; + tls = { + cipherSuites = [ + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" + ]; + minVersion = 1.2; + maxVersion = 1.3; + renegotiation = false; + }; + }; + }; +} diff --git a/hosts/genesis/adblockUpdate.sh b/hosts/genesis/adblockUpdate.sh index 69b8994..3a9d5e5 100644 --- a/hosts/genesis/adblockUpdate.sh +++ b/hosts/genesis/adblockUpdate.sh @@ -2,6 +2,7 @@ set -ex curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts +curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts # Custom domains that I need to preserve for some reason for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 3c92a4b..860a288 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -7,6 +7,7 @@ { imports = [ # Include the results of the hardware scan. + ./acme.nix ./hardware-configuration.nix ./home-assistant.nix ./networking.nix @@ -34,5 +35,13 @@ environment.systemPackages = with pkgs; [ awscli2 create_ssl + step-ca ]; + + virtualisation.oci-containers.containers.speedtest = { + image = "ghcr.io/librespeed/speedtest"; + hostname = "speedtest"; + ports = [ "19472:80" ]; + }; + greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472"; } diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index 2dc35fb..7c905b3 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -17,8 +17,13 @@ in "eufy" "lovelace" "nextcloud" + "ping" "piper" + "radio_browser" + "rainbird" + "roborock" "smart_meter_texas" + "speedtestdotnet" "solaredge" "tplink" "whisper" @@ -83,6 +88,7 @@ in ]; environment = { TZ = "America/Chicago"; + CONSOLE_OUTPUT = "true"; }; }; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 71dba62..4de5551 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -12,7 +12,7 @@ let "10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan" "10.42.1.3 printer.thehellings.lan" "10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan" - "10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan" "10.42.1.6 isaiah isaiah.thehellings.lan" "10.42.1.12 tv" @@ -23,7 +23,7 @@ let "100.88.91.27 dns.home" "100.119.228.115 chronicles.home nas.home chronicles.shire-zebra.ts.net" "100.115.57.8 linode.home" - "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" + "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home nixcache.home" "100.78.16.88 mm.home" "100.84.183.79 myself.home myself.shire-zebra.ts.net" "100.78.226.76 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan" @@ -76,7 +76,7 @@ in { }; }; firewall = { - enable = true; + enable = false; allowedUDPPorts = [ dhcpPort dnsPort @@ -86,17 +86,24 @@ in { allowedTCPPorts = [ dnsPort proxyPort + 80 ]; }; - nftables.enable = true; + nftables.enable = false; }; environment.etc."hosts.d/local".text = extraHosts; - fileSystems."/media" = { - device = "10.42.1.4:/volume1/video/"; - fsType = "nfs"; - options = [ "ro" ]; + fileSystems = { + "/media" = { + device = "10.42.1.4:/volume1/video/"; + fsType = "nfs"; + options = [ "ro" ]; + }; + "/proxy" = { + device = "10.42.1.4:/volume1/nixpkgs/"; + fsType = "nfs"; + }; }; services = { @@ -157,7 +164,7 @@ in { "98:da:c4:20:f3:64,192.168.66.6" "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba - "4c:a1:61:05:cd:52,192.168.66.61" + "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird "48:d6:d5:5d:81:21,192.168.66.65" # Google Home "6c:29:90:3e:e2:02,192.168.66.66" # wiz "28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch @@ -204,10 +211,39 @@ in { "jellyfin.home".target = "http://localhost:8096/"; }; - #age.secrets."3proxy" = { - # file = ../../secrets/3proxy.age; - # mode = "776"; - #}; + services.nginx.virtualHosts."nixcache.thehellings.lan" = { + serverName = "nixcache.thehellings.lan"; + serverAliases = [ "nixcache" "nixcache.home" ]; + root = "/proxy"; + locations = { + "~ ^/nix-cache-info" = { + proxyPass = "http://cache.nixos.org"; + root = "/proxy/nix-cache-info/store"; + recommendedProxySettings = false; + extraConfig = '' + error_log /var/log/nginx/proxy.og debug; + proxy_store on; + proxy_store_access user:rw group:rw all:r; + proxy_temp_path /proxy/nix-cache-info/temp; + proxy_pass_request_headers on; + proxy_set_header Host "cache.nixos.org"; + ''; + }; + "~^/nar/.+$" = { + proxyPass = "https://cache.nixos.org"; + root = "/proxy/nar/store"; + recommendedProxySettings = false; + extraConfig = '' + proxy_store on; + proxy_store_access user:rw group:rw all:r; + proxy_temp_path /proxy/nar/temp; + proxy_pass_request_headers on; + proxy_set_header Host "cache.nixos.org"; + ''; + }; + }; + }; + systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/proxy" ]; environment.systemPackages = with pkgs; [ bind diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index 913ac6d..e6103d0 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -48,6 +48,7 @@ bind # For things like nslookup create_ssl darktable + distrobox expect gimp gparted diff --git a/modules/baseline.nix b/modules/baseline.nix index a5ed5a7..2734a33 100644 --- a/modules/baseline.nix +++ b/modules/baseline.nix @@ -16,6 +16,7 @@ min-free = (toString (1024 * 1024 * 1024) ); max-free = (toString (5 * 1024 * 1024 * 1024) ); substituters = [ + "http://nixcache.home" "https://cache.garnix.io" "https://ai.cachix.org" ]; diff --git a/modules/nixos/kde.nix b/modules/nixos/kde.nix index d7776e6..050f09e 100644 --- a/modules/nixos/kde.nix +++ b/modules/nixos/kde.nix @@ -1,4 +1,4 @@ -{ config, pkgs, lib, ... }: +{ config, pkgs, lib, options, ... }: let cfg = config.greg.kde; @@ -13,7 +13,6 @@ in with lib; { services = { xserver = { enable = true; - desktopManager.plasma6.enable = true; displayManager = { defaultSession = "plasma"; sddm.enable = true; @@ -21,7 +20,9 @@ in with lib; { xkb.layout = "us"; # Trackpad support libinput.enable = true; - }; + } // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) { + desktopManager.plasma6.enable = true; + }); pipewire = { enable = true; diff --git a/secrets/acme_password.age b/secrets/acme_password.age new file mode 100644 index 0000000..82ea257 --- /dev/null +++ b/secrets/acme_password.age @@ -0,0 +1,25 @@ +age-encryption.org/v1 +-> ssh-ed25519 oyEmTw zbV99LdVip0Ue4na4iExnygPuVUcBxL5Ki612EYJJlw +/34SFIs24gHBvF/wMB5O81gYFrBqIkxzjBBElQgz5OI +-> ssh-ed25519 mOmPfg 9eAe1jFeZfk1+gUhCSvfgyO9f4Ie+SreaOISpSl86Vg +WIqvnMDV6R7ITLO6cmyzbXKNZ6L23cjt5QVQrTHzIbc +-> ssh-ed25519 YJiRbw B9L20sN9e3jrwH+vxXP/zsTjN/fmLn4etHvxVkWwF2Q +HmdolHBYzj38T59HwHTplEWJAmgPn2s4TQOQVMDC2Cw +-> ssh-ed25519 aY2AXA yHYZToS1XvRG9HCTj3P+s0+STNAZL7fAo3sY33cWQHc +19PE7i08IHXYsu/FHjiWqaaWZxuKTa4AoVph7SRBTeI +-> ssh-ed25519 Nl/5yA 826aY2oyGdm4c3ThDDiXDgfcvWCH5aUaOpj1xfqDdGY +a2dDX3qXjnmLuvoJPbTKREYh0EFDR7fcS1ymz/52m04 +-> ssh-ed25519 GdLgCQ q0mgYfAxuDe7tN86E95AR7k/3aMqn9AtuukAiM/zbmA +yCjhBhw+HcjaSBcgSZA1MgsaXqB62Sy35rAyawm6klA +-> ssh-ed25519 tOH/HQ hxMKclRikxrBBLXPViAlOMs1pJ30k7HsQ/NDd1VYtAA +69f9cFemqZi+VgghjPO+tlI8k1rqME4sxqbViESIe30 +-> ssh-ed25519 FpzvfQ 7bz+d5D4OSgg/QK6+ifX7FCZzkGGgbMeeo2BB5rluCY +LcTz84kxMonUCuYtiMrqOZMo4gJgSYxn5EJTQPtFe28 +-> ssh-ed25519 kdPvzQ IB0rG41TM5d92UzRqw/udYtPZqvi+5nGtD0fxFda6HA +S/1EX/SRZHA8tzNmhenY1Rh6e0taLfnLhTs7VFxX+xU +-> d8@{-grease }5, ciXX +QentcxSx8Pc1Seeglx3Fs5BeXgpHfcCK9WmDiPsDdaqUG4X+RN/1yKOAj/ed607B +r6J2w+o0wqPmZ8x1cThScPKcbLwHPxnGLm6yPDjVpCiZ8w +--- 9AIOxX8b3+DcGx7UOyCxGqGFIS2HAkf6iWONMXyBrhs +U, ΀bu%=y=0T +Qq ͔,eMϞtԲA4Ll \ No newline at end of file diff --git a/secrets/ca/intermediate_key.age b/secrets/ca/intermediate_key.age new file mode 100644 index 0000000..fdf9963 --- /dev/null +++ b/secrets/ca/intermediate_key.age @@ -0,0 +1,24 @@ +age-encryption.org/v1 +-> ssh-ed25519 oyEmTw XYgaYOG/TdORzlNa0dTtlVQXa638D85F/JfnR2qPelA +K9OijiuT0NaDn7pAR8Xf4UUDNHrqj+rU4bElFrRLiWU +-> ssh-ed25519 mOmPfg 456rOSEoksyYo6N+kf2MaLYamHso832VkE258jpnsjo +AUKIL4/WRZcis77SOB/lGUhHahtG+3DK+0ta1gk+1XM +-> ssh-ed25519 YJiRbw U+gdrDM2keq9BCoTes1A/Z85imCpTd5UdApL5Laz7G0 +DITLePiSNJUMQDJXGnkeV6RvvPUEcGg+pKY79x0LrrI +-> ssh-ed25519 aY2AXA cpYJS94a3oKAW7FwER9YtVqV7dQg6U32QWk/jdAdrR0 +K4CLPKfcWuI+mayt9AGLETq70jc/39iX+0N5sbLQBQA +-> ssh-ed25519 Nl/5yA QIpbQDN1bo9WYSpoqHXm+Zy1VbNo2VAipx0veL7uok0 +bYoRP7EZmdr5W26JG88Ti+IsSdBFRBzc74aE4ktsr2A +-> ssh-ed25519 GdLgCQ H+svDK9qG00TtRpYEYoNYmueSYr88Eh3aGo7WORdIkk +qOFSi44tj7RUgoXR8ceTQt33bq6bOVwGPgDMj70+uqI +-> ssh-ed25519 tOH/HQ kkyo7nBFwfMqWcLn6i98lMyWUNp7Ku5RfRst12PZyww +xkrxGhpChd9yIGPAwp5BNisklQ0awKT8snkxIaLp6O4 +-> ssh-ed25519 FpzvfQ EKwI+91UMxA8YU7f5oMEAJaa5+sfo0OtkdXwgH0DNkI +wMK6QDRW9hVnynWN2X5Wr89Lo0gkAKSdODjNuZg1hjQ +-> ssh-ed25519 kdPvzQ 974vhI/WBWhfUfrf8boRPmPDQednUkrJ4lzitP1DZic +I4CZR7MocHw952svX/N323NwcoLRLbaRUsgDi0HCiJI +-> wo-grease CEFbC)L sl3UVcT +lL5eH1cVp7/EZczRU8nOYdSCYPEVIL4m2tP26W+NrwZ6pJcrDvPhE1M3ku5OmPL2 +145XTZ2LLg +--- 8x3GNrftj7uKvg58yyEjtoa902wmn9Mv3urUjy3EBdE +`M=ܷ6l.uid끜~B{5r y$;;guRNja,XBtf  ƒќ>ƀ|[;y(! 2'*2%DG"015o\^O: m8wEb a# -Œ'hݕ݅J!Ȗ$}wҐ5A7#Sx9Hġ:!蛵6pǁβL&M4`"V3_Ng722P]JG9]V {DKXD?]^0r)£3Bu%74$}vUT͡cfU\"բ6_Zocs@ \ No newline at end of file diff --git a/secrets/ca/root_key.age b/secrets/ca/root_key.age new file mode 100644 index 0000000..10c8c33 --- /dev/null +++ b/secrets/ca/root_key.age @@ -0,0 +1,23 @@ +age-encryption.org/v1 +-> ssh-ed25519 oyEmTw t8IlhxUHsfX8bZBkzKP035St6LhImsP1MzQNV+WBlQw +JlpU4n3VLxsvrPnbb8D4Us/OfGwK2V9E1uQKV21MGVA +-> ssh-ed25519 mOmPfg izgCuzvrqXq9KLYz2oA9E5T7Ob41NEUER98vw3NP538 +Fl3+pbXgcrgih1TeWXiZum+gqSjt6Y/lUz7AILglEPs +-> ssh-ed25519 YJiRbw hLF0HqiauSQdcaFPnvDhobEn+NmVKKcL/GydcEyPVC8 +iA9j+MhiRVjWrtAHf6RyRIKqDAhsoQ6nvF+tvUNOt0M +-> ssh-ed25519 aY2AXA ra2cmEu5Z7o+Ablevs3wZY7QmrEF75WxP2lPsVSYTF8 +D6YWbm+OU2tthmHe7OgkXWOesgiIlB8b3SeymzrvSOo +-> ssh-ed25519 Nl/5yA RZBJBdhrVnsb5VIOwt1XB60qdLuB/OXn1pHUdkZ9Bg4 +8QlK/wB5WoPT9ly9KFgwDiczRQT8hufz0AwNIS2Kd68 +-> ssh-ed25519 GdLgCQ LpiStf7rZp21VaBu8cbKUbM3Ac+wFGYXQL48W7LGQHw +BIiDXodBypN5JeuGCEhQCPajAjeKIsxP7b/Vby9kNIg +-> ssh-ed25519 tOH/HQ WS9V+NqFsfzcJaHVkgxeBFCqy6AKlkqQzjtBRJZn8Sw +5Or4B/0NMFmvAcbBc09rBRF2aJhpGuH1+rkRzvFoKRU +-> ssh-ed25519 FpzvfQ C/eUOR/yNbwi8GJeuBYgUav3QWKSGHqJ51gptnFg/yg +PKbefEAxP0LCiWI2wciJETrRI382VXKeFxb4igkFRII +-> ssh-ed25519 kdPvzQ r/g6zi16NYAxU1Bu7VMAjBufZreEfxF6YSbKAvfcmmA ++CuORGonPXZZ2BbQtGI8iY/oveQeRwrftG3BLcnwDrg +-> {'