From 695e5a6e70b7e4a584009a938bf377048066cfc5 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 17 Aug 2023 09:32:42 -0500 Subject: [PATCH 01/19] Add virt tools --- hosts/jude/virt.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index ed78ae4..ad40c9b 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -4,9 +4,11 @@ environment.systemPackages = with pkgs; [ guestfs-tools libguestfs + ovftool packer virt-manager vmware-workstation + vmfs-tools ]; # Give my user access to the libvirtd process From 536cec290f67b34f0c0ed4c73af9dc3772c69a5c Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 17 Aug 2023 09:55:11 -0500 Subject: [PATCH 02/19] Update nixunstable and neovim --- flake.lock | 30 +++++++++++++++--------------- hosts/jude/boot.nix | 2 +- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/flake.lock b/flake.lock index e43165c..5cfc0da 100644 --- a/flake.lock +++ b/flake.lock @@ -219,11 +219,11 @@ ] }, "locked": { - "lastModified": 1691312444, - "narHash": "sha256-J9e9dGwAPTX+UlAn8jehoyaEq6fwK+L+gunfx0cYT4E=", + "lastModified": 1692260837, + "narHash": "sha256-2FpkX1zl+7ni7djK7NeE1ZGupRUwZgjW+RPCSBgDf4k=", "owner": "nix-community", "repo": "home-manager", - "rev": "903e06d734bcae48efb79b9afd51b406d2744179", + "rev": "6a94c1a59737783c282c4031555a289c28b961e4", "type": "github" }, "original": { @@ -281,11 +281,11 @@ "nmt": "nmt" }, "locked": { - "lastModified": 1691355845, - "narHash": "sha256-00GSWiXYdCiBOv7MTW4mCzoSCqBZYQ8K9NID5E3WVas=", + "lastModified": 1692281989, + "narHash": "sha256-b1WPbUNVWahAHvMxWnp+0zzswUj8lReX/c28O2Au2Og=", "owner": "NixNeovim", "repo": "NixNeovim", - "rev": "98296a348aad6d6430a568dfb17101c817f00714", + "rev": "929c6c4a188947801ac354e1c5d110937fca9449", "type": "github" }, "original": { @@ -307,11 +307,11 @@ "poetry2nix": "poetry2nix" }, "locked": { - "lastModified": 1691331489, - "narHash": "sha256-aSz1bJyHhKtjN5DpPLoIkpW3TYWs4zqiSBjAjnEObsw=", + "lastModified": 1692281871, + "narHash": "sha256-nyOnXgW1lyD+ngprSVrKAQdgcK+XSd0vvRaZm5PwRwk=", "owner": "nixneovim", "repo": "nixneovimplugins", - "rev": "76048147f3e04fe3f1fa79114d2feb7f35caa64d", + "rev": "93da8f94aa765d8597d631ee5beafb6d26824777", "type": "github" }, "original": { @@ -354,11 +354,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1691186842, - "narHash": "sha256-wxBVCvZUwq+XS4N4t9NqsHV4E64cPVqQ2fdDISpjcw0=", + "lastModified": 1692174805, + "narHash": "sha256-xmNPFDi/AUMIxwgOH/IVom55Dks34u1g7sFKKebxUm0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "18036c0be90f4e308ae3ebcab0e14aae0336fe42", + "rev": "caac0eb6bdcad0b32cb2522e03e4002c8975c62e", "type": "github" }, "original": { @@ -386,11 +386,11 @@ }, "nixunstable": { "locked": { - "lastModified": 1690272529, - "narHash": "sha256-MakzcKXEdv/I4qJUtq/k/eG+rVmyOZLnYNC2w1mB59Y=", + "lastModified": 1692174805, + "narHash": "sha256-xmNPFDi/AUMIxwgOH/IVom55Dks34u1g7sFKKebxUm0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "ef99fa5c5ed624460217c31ac4271cfb5cb2502c", + "rev": "caac0eb6bdcad0b32cb2522e03e4002c8975c62e", "type": "github" }, "original": { diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 9d53e14..6ab0cc9 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -9,7 +9,7 @@ menuentry "Windows" --class windows --class os { insmod nfts search --no-floppy --set=root --fs-uuid A41B-5963 - chainloader (${root})/EFI/Microsoft/Boot/bootmgfw.efi + chainloader (''${root})/EFI/Microsoft/Boot/bootmgfw.efi } ''; boot.loader.efi.canTouchEfiVariables = true; From 6e786e7d5941d6b3cc599a513b9fcd2211bcd2c5 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 17 Aug 2023 11:11:03 -0500 Subject: [PATCH 03/19] Try to update boot for jude --- home/xonsh.nix | 2 +- hosts/jude/boot.nix | 30 ++++++++++++++++++++---------- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/home/xonsh.nix b/home/xonsh.nix index 85e0148..3d03530 100644 --- a/home/xonsh.nix +++ b/home/xonsh.nix @@ -40,7 +40,7 @@ ctest = "compass workspace test"; cylint = "./scripts/run_yaml_lint.py"; - cleanup = "nix-collect-garbage -d && nix store optimise"; + cleanup = "nix-collect-garbage --delete-older-than 30d && nix store optimise"; d = "vox deactivate"; devroles = "cd ~/src/ansible_collections/devroles"; dirflake = "nix flake new -t github:nix-community/nix-direnv"; diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 6ab0cc9..ff5b492 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -1,17 +1,27 @@ { ... }: { + #fileSystems."/boot/efi" = { + # device = "/dev/by-uuid/9466C36266C34428"; + # fsType = "auto"; + #}; # Use the systemd-boot EFI boot loader. #boot.loader.systemd-boot.enable = true; - boot.loader.grub.device = "/dev/nvme0n1"; - boot.loader.grub.useOSProber = false; - boot.loader.grub.extraEntries = '' - menuentry "Windows" --class windows --class os { - insmod nfts - search --no-floppy --set=root --fs-uuid A41B-5963 - chainloader (''${root})/EFI/Microsoft/Boot/bootmgfw.efi - } - ''; - boot.loader.efi.canTouchEfiVariables = true; + boot = { + supportedFilesystems = [ "ntfs" ]; + loader = { + grub = { + device = "/dev/nvme0n1"; + useOSProber = true; + extraEntries = '' + menuentry "Windows" --class windows --class os { + insmod ntfs + chainloader (hd0,2)/Windows/Boot/EFI/bootmgfw.efi + } + ''; + }; + efi.canTouchEfiVariables = true; + }; + }; networking.interfaces.enp4s0.useDHCP = true; } From 5ec9135cbfc68222187dfab44e417852057a1801 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 17 Aug 2023 11:19:54 -0500 Subject: [PATCH 04/19] Disable waydroid and lxd --- hosts/jude/virt.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index ad40c9b..ade6429 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -25,8 +25,8 @@ enableExtensionPack = true; }; - waydroid.enable = true; - lxd.enable = true; + waydroid.enable = false; + lxd.enable = false; }; users.extraGroups.vboxusers.members = [ "greg" ]; From 791b276e3705f194c511d5f24d441313cf20ad78 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 17 Aug 2023 13:57:30 -0500 Subject: [PATCH 05/19] Change to systemd-boot --- hosts/jude/boot.nix | 24 ++++++++++++++++-------- hosts/jude/default.nix | 10 ++++++++++ 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index ff5b492..501a351 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -1,26 +1,34 @@ -{ ... }: +{ lib, ... }: { - #fileSystems."/boot/efi" = { - # device = "/dev/by-uuid/9466C36266C34428"; - # fsType = "auto"; - #}; # Use the systemd-boot EFI boot loader. #boot.loader.systemd-boot.enable = true; boot = { supportedFilesystems = [ "ntfs" ]; loader = { + systemd-boot = { + enable = true; + configurationLimit = 10; + extraEntries = { + "Windows.conf" = (lib.strings.concatStringsSep "\n" [ + "title Windows" + "efi /EFI/Windows/bootmgfw.efi" + ]); + }; + }; grub = { + enable = false; device = "/dev/nvme0n1"; useOSProber = true; + efiSupport = true; extraEntries = '' menuentry "Windows" --class windows --class os { - insmod ntfs - chainloader (hd0,2)/Windows/Boot/EFI/bootmgfw.efi + insmod ntfs + chainloader (hd0,0)/EFI/Windows/bootmgfw.efi } ''; }; - efi.canTouchEfiVariables = true; + #efi.canTouchEfiVariables = true; }; }; networking.interfaces.enp4s0.useDHCP = true; diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index ca949ad..8401320 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -19,4 +19,14 @@ environment.systemPackages = with pkgs; [ oathToolkit ]; + fileSystems = { + "/boot" = { + device = "/dev/nvme0n1p1"; + fsType = "auto"; + }; + "/windows" = { + device = "/dev/nvme0n1p3"; + fsType = "ntfs-3g"; + }; + }; } From 836c3764036f0cbe9edb93b63fdc54d9a20b0d3e Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 17 Aug 2023 14:52:18 -0500 Subject: [PATCH 06/19] Update gnome defaults --- home/gui/default.nix | 1 + home/modules/gnome.nix | 63 +++++++++++++++++++++++++++++++++++++++--- hosts/jude/boot.nix | 4 +-- 3 files changed, 62 insertions(+), 6 deletions(-) diff --git a/home/gui/default.nix b/home/gui/default.nix index 1b803b8..b8dff15 100644 --- a/home/gui/default.nix +++ b/home/gui/default.nix @@ -14,6 +14,7 @@ in home.packages = with pkgs; [ cdrtools + dconf2nix ffmpeg gnucash handbrake diff --git a/home/modules/gnome.nix b/home/modules/gnome.nix index 6696770..edd0749 100644 --- a/home/modules/gnome.nix +++ b/home/modules/gnome.nix @@ -19,8 +19,18 @@ in { }; dconf.settings = { + "org/gnome/Disks" = { + image-dir-uri = "file:///home/greg/Downloads"; + }; "org/gnome/desktop/interface" = { clock-show-weekday = true; + color-scheme = "default"; + cursor-size = 24; + toolbar-style = "text"; + }; + "org/gnome/desktop/screensaver" = { + lock-delay = "uint32 0"; + lock-enabled = false; }; "org/gnome/desktop/wm/keybindings" = { switch-applications = []; @@ -28,16 +38,28 @@ in { switch-windows = ["Tab"]; switch-windows-backward = [ "Tab" ]; }; + "org/gnome/desktop/wm/preferences" = { + button-layout="icon:minimize,maximize,close"; + }; + "org/gnome/file-roller/listing" = { + list-mode = "as-folder"; + name-coloumn-width = 302; + show-path = true; + sort-method = "name"; + sort-type = "ascending"; + }; "org/gnome/nautilus/preferences" = { default-folder-viewer = "icon-view"; search-filter-time-type = "last_modified"; search-view = "list-view"; }; - "org/gnome/shell/window-switcher" = { - app-icon-mode = "both"; - current-workspace-only = true; - }; "org/gnome/shell" = { + enabled-extensions = [ + "appindicatorsupport@rgcjonas.gmail.com" + "Vitals@CoreCoding.com" + "window-list@gnome-shell-extensions.gcampax.github.com" + "gsconnect@andyholmes.github.io" + ]; favorite-apps = [ "org.gnome.Calendar.desktop" "org.gnome.Nautilus.desktop" @@ -45,6 +67,16 @@ in { "firefox.desktop" "vlc.desktop" ]; + remember-mount-password = true; + }; + "org/gnome/shell/extensions/vitals" = { + hot-sensors = [ + "_memory_usage_" + "_system_load_1m_" + "__network-rx_max__" + "_temperature_k10temp_tccd1_" + "_temperature_k10temp_tctl_" + ]; }; "org/gnome/shell/overrides" = { attach-modal-dialogs = true; @@ -53,6 +85,29 @@ in { focus-change-on-pointer-rest = true; workspaces-only-on-primary = true; }; + "org/gnome/shell/weather" = { + automation-location = true; + locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]"; + }; + "org/gnome/shell/window-switcher" = { + app-icon-mode = "both"; + current-workspace-only = true; + }; + "org/gtk/settings/file-chooser" = { + location-mode = "path-bar"; + show-hidden = false; + show-size-column = true; + sort-column = "modified"; + sort-directories-first = false; + sort-order = "descending"; + }; + "org/virt-manager/virt-manager/confirm" = { + delete-storage = true; + forcepoweroff = false; + }; + "org/virt-manager/virt-manager/details" = { + show-toolbar = true; + }; "org/virt-manager/virt-manager/connections" = { autoconnect = [ "qemu:///session" "qemu:///system" ]; uris = [ "qemu:///session" "qemu:///system" ]; diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 501a351..3d196c5 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -7,7 +7,7 @@ supportedFilesystems = [ "ntfs" ]; loader = { systemd-boot = { - enable = true; + enable = false; configurationLimit = 10; extraEntries = { "Windows.conf" = (lib.strings.concatStringsSep "\n" [ @@ -17,7 +17,7 @@ }; }; grub = { - enable = false; + enable = true; device = "/dev/nvme0n1"; useOSProber = true; efiSupport = true; From 69a10eb0e12bfc24f85f2e956812240514baca6c Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 18 Aug 2023 19:12:57 -0500 Subject: [PATCH 07/19] Switch to systemd-boot --- hosts/jude/boot.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 3d196c5..efde9e0 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -7,17 +7,17 @@ supportedFilesystems = [ "ntfs" ]; loader = { systemd-boot = { - enable = false; + enable = true; configurationLimit = 10; extraEntries = { "Windows.conf" = (lib.strings.concatStringsSep "\n" [ "title Windows" - "efi /EFI/Windows/bootmgfw.efi" + "efi /EFI/Microsoft/EFI/bootmgfw.efi" ]); }; }; grub = { - enable = true; + enable = false; device = "/dev/nvme0n1"; useOSProber = true; efiSupport = true; From 9c22f7414cf7cf27db663ab3e32969cd430ec97b Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sat, 19 Aug 2023 01:08:26 +0000 Subject: [PATCH 08/19] Update secrets and SSH to ed25519 --- home/ssh/authorized_keys | 1 + overlays/setup-ssh.sh | 9 +- secrets/3proxy.age | Bin 2407 -> 11572 bytes secrets/drone.age | Bin 4616 -> 11618 bytes secrets/matrix.age | Bin 2378 -> 11565 bytes secrets/nextcloudadmin.age | 226 +++++++++++++++++++++++++++++++------ secrets/secrets.nix | 19 +++- 7 files changed, 212 insertions(+), 43 deletions(-) diff --git a/home/ssh/authorized_keys b/home/ssh/authorized_keys index 6634830..a657b83 100644 --- a/home/ssh/authorized_keys +++ b/home/ssh/authorized_keys @@ -3,3 +3,4 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCgg6FGmtWPjw5iYTlxJLz1WBCE7zhYhXgmfPvFRt6c ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDUd5LQVl/spIfJ3mh/MERlCfSIHCh3jXnaNVnyHY2AVD2dFVgFX+Q+1adA64plXqXHEQVb3q2EMzVW14QAMP9VJspnODgpyMHwpxp6ZNUsZIH83RN8kauVHgW2LRDCZ4DLRzbqaeDm92rntapoUB74Vjto00AE3gWyGQp/v6BeAUhqE0J2p6T6xDgsuyJ+Tzm2YEUozFW8w8LSGDgaoTKzjq0WVkAo9rNaxGLr/ez8P3SUHgb2VSUrL1qrHE99KL8rravOjP0aQmGGWu/MOjgvh7icQuqYlBF6MHfxeSd7/FZApVNKzEXD9TKBg5IaCOjHH2GHnxthSC0mcjKmF2EVAXuWYDARqxmtIfV/9YdeECEFxzB6X+t6b3RYxA0/oa5Zt70WH2LILmc3U5EfiRf88x4WcsdmbcsKQ74/julgg7vYlTlndBxvl8Nd1IKd6ZD3nJBMMMKrDOYbME5r6x2VTzm/RQkpp+SHarCMXxjukhguYY3Iz9CTO2hdGaQ/41ftlOhpb3I1Gai9GymTPFDt9n3JCEVyQ1+a97ELVr+Ky1L3hMewE8nqZFIoXUB2RFMu2pD9GggDO2e6bXdN3SIHLL/8amoDK62iYgVEp1XBkzHJ7U6hhIYbkFji0KK8A7Cwg8+gOKdovycJIAWndHjaDcLmWDlBktqHIRQvLMTzE9f935faTcrSTpnrCLK/pR3f7ir7HGpD8lUug8m7DfxhH3am1Fz7uY9iNI1GLctexC7espXq/xEA/+j7JRVVKbpIubXcmJjNlKs6jOx849SpdWvLlnJpqo1PIjxE9ZDa7zlPSLMTKGTuY0ekKvvbuaOhcOBuYg1RfbdN1QIX5ba86U7giFMZb7wGh7Pbsy0PhFgO7ANgNZy81RKp45G8ozHLnXCj/qhstqjcEgUICDkT/CGnNkreu023kqOaix0nELBLwWBVM/5iWmKQZnpiBhHHDNJ3Q6DsCkIUdfOWZNCIRwGDPuV8uMOEHJIemg25Z282QqWUIfWzGOO1f0ylVmhTQooZIfjhyGXxKa6AV+/tAXQtkF5B1Z8rB5A3pYYLDmnY1E007sWpvm2L/HKV7cWUX7bkuS+qBXZyHxEn+cc6YvalJbDi5/bE5kFQudZFgKInwFiMLhX/8BpbgBUv+6MvvCn79o9qnoOnkI36A9bEOdQKpjwPdg9tkVWr0RotXfP62tIAQsxS05J7yxprC5Uitf+Bhp+Hph0tS/hyxTbN1h30vfdABouvQpcqbgUlp6psyTT17efeNbGcs9l4gkg4HOGpmF60alA1+PBZ1l7ba6bglp+CZoeA5qsCTmMxT5yLaWcEck/8WR3NHQqkER5ZyH1204Kci35kNon69y1/ greg@linode ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCoGGV3eD1oF0O62JZfCWNxmViRjRGQsfOhRkQfzQROkwDlFZ7S1+02fudD9t7mPtZE6dQ4yS2+6Q3NIfGW8NBbZAlWwsQ6PnrpuAhWpWc+ng/IDQd9CH/rBCt5bWSLL8AGHa4c+qde7iyoFGK0l9jXVD9wATBFQ274WTmPacVQVHmIAmJS6ISmR6vlq9eaDj1fX8wixao6WvzfwAUvXIs8nhPEfmtyu4T/1Eev9rVIxOw3ODQjk/E0VWV4Koeptsyc+V+j+XMyA91v8f20T4Uwe5LGnJHSQS0WavHnCMWHb1tzkmiKdaNCymoDUcUF2rywMYry7JN0kZo2mp2d7OzE/RP3bz/IsAI33+DwRlDYDNzgeLsLVmOJij61AtqBZque6WDcyCF8HN0ZaY0KJPOtNlN92+GUBRF/Faei0MXZ7wW2BZL5Bc7qnXc9USyhPNsm2vQ7LLhh/NtBGqB88+C+AidTTZ/xiIHKWZJXPkWLPRcK5cfaFqHFqcVMk4U+b0FYB95vYPKmjURlAZ6WrU6dNaNaMH9hJSE6/03is4hb4t8RCRiNaR41pEACDZbATjY0DInFn1LxxpUV66xfpOVg5hKm5ScIks3KxWJ8i3v4/cX7WvbDC/UzWb2UygpsqR7/1n5LV1SNPl+/qxFfdaOyZ8WVvx7DKGxkKfkPBgGwdpSthdv7BY+SC4sT9WXQAPGnvOIk6HwKhHjJYX7AIKK64ACfGZbjBC2gg7Ocl4HkgwpYYlUWLRJdJUhHOCi3VhPZDspYhw/UxPnUhYa8lxq5l7kgkks/tFe1qHOvPe3QRW6brg3EdJNkwtMrlrstW4/nph/KFqSshzNVDlEqTAnhE1cjbBZNmlHt1Un4ixcW1b8b86mE+472pSsIEfO8vxP26brQhxepJFZGOFv2vs3XDrrtn6IMJok4e+AQSCCY0kCcgfG5nMYXUoWpGyTpN/JLG0joJuhPWt58OaOzzKNPq2+rCVAbS7/UmDCqkwxjCywxOZRwluBsEWbZaLEdOwQOfIZQGwSDBM0hfHJJxMSaLN3rCe6VZb+c/5mFXUZ46L5mOGkRlO1TOEAe4jqawAQnuGaHN8mMWSw1gKM+UBXTKa0tBR6Aj/OSfPW0jU+mz/YzzJkzNnlRFiSrLxWvL4eXaBsMZvgKdpA41+E4JG8Vu+9D9KNGRnLASOCxRknV18MubZlEEyKby9A6TaKoPrz7GVQZP+36V9DtAJAza74nHSDNAQG/4w2BLOw9+VrDNdXwjMbgG+SN4f1K+e554OirtSMVB73VXjdwoH/FyX+7+dcUZRQ7V2n37jIVOE6CcuEPjzdnkvKSqBsdTO3Bt66+QtS9BwGHu5c01+Q7jvIl greg@nixos ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode diff --git a/overlays/setup-ssh.sh b/overlays/setup-ssh.sh index c2dd88b..cec958a 100644 --- a/overlays/setup-ssh.sh +++ b/overlays/setup-ssh.sh @@ -1,11 +1,12 @@ # vim: set ft=bash: -if [ ! -f "${HOME}/.ssh/id_rsa" ]; then +file="${HOME}/.ssh/id_ed25519" +if [ ! -f "${file}" ]; then echo "Generating a new key" - ssh-keygen -t rsa -b 8192 -f "${HOME}/.ssh/id_rsa" -N '' - cat "${HOME}/.ssh/id_rsa.pub" >> /etc/nixos/home/ssh/authorized_keys + ssh-keygen -t ed25519 -f "${file}" -N '' + cat "${file}.pub" >> /etc/nixos/home/ssh/authorized_keys echo "Authing key to GitHub - may fail" gh auth refresh -h github.com -s admin:public_key - gh ssh-key add -t ${HOSTNAME}-auto ~/.ssh/id_rsa.pub || true + gh ssh-key add -t ${HOSTNAME}-auto "${file}" || true fi cp /etc/nixos/home/ssh/authorized_keys "${HOME}/.ssh/authorized_keys" diff --git a/secrets/3proxy.age b/secrets/3proxy.age index be6cc0e2946680baefe8672baaab88a10cfd3970..39b12a8bd0568e33a4e8af9eefb83df86bfe4382 100644 GIT binary patch literal 11572 zcmZviDG$W{x7Hny5)cFhh<^wO()@0>>1Iee-S^J4(@l_c-}k+Oa1lrlINkytM-VvP z0w^4TppXa}g19%~1Me_EFEk9mpy zq%L0&K7dli5o@vMW$Wgv*}uhg1VZ+ca-sU+(PmnWG@2z;w^ffq>-}T2lXloP#m>yv zzt9eZb|JAC@7SKhBR4cKd6ra0hK;s6&aJ_dufgi6BeS$qNDoCRYhh;WC^X>#Z&l0# z96?6SPg>d0ytYB1XBN#-!H$+4|IOGc+DcpQ)^bI?SA+e!0{5r=I@_uI5QqaI zG^+^)NsJ#s2I8VJ2ki8=*YsZ7A4T-1Fm*EEp#&m1B_@!^ z>ZHWGSxP3Q!;d;4#C^dZ=aux5iy77zGzbn&mXRb~mf-omHa>$I1ADCvvtOlLYAbT2 zwl|e$2$I?15P=n^Tr{FO8L_ilFL)d2>WDRS`O3J`TGMa|LA#0QTEJ{LqUz6gsw}7=BdmdT^a+M@eL~q_A>(E*ZXDt1d_-n zjD?BR>^t;1#5hse@}?QGS48dG+0WS_e8IlB5nC_|AnRejz&KP(2SxAQyeYcYOVD?* z-CcblIe1sdsY0Yk`FoPbdwAU%rKUXOEgd*_Z-9VPJbp=jL43|H$7K!uF?RvE;R$+! za)kSoF-33H4HV`t)^Wq{`pp1*DK8%q!{xdjK_XGrNaYtIn|3_%33Qk0(U3#-S3j5-4KJm^*8=zTzvMH4dFZCCxx1 zPhMKsfVhWYqn-x33YaKyO~?7Vn*1i|l=&Qld2Q+>YYx)+v%P;u!5BTz$tB6?uDzAL zJ(1}wg+z+jNE}cV-s6-_4M|uPkdRGQs!ynIWEiP-tV%6?A!s+&W5$&}6lAQb-Jion zd%Vw{0>UNWb#>L@Q~ISnTOOT}WnDfR+8Ubzog?*BLq}F+jbL{DB&PN%70;6z;>G)g zdUNb=fa|U5_Lvmw;BNgGT&H0O%igMLeF`6!{TjWa{qxIgekP~fJylc>q%VKt_s&Nz z(+A#Pyp(5$6BkQ>cq%?J_k>SHN$N0SHtof^Of)d-F6Jyv%US9nc-z01+FqD=-39_c z6()~pw}n}-h}DQf4(~TBAxqe&_I{r7y36q`7;}2-fw_s1Q2MYEmHWH>V(rOTfCt&B z=tvHnGAUC2{1uAT8`S8{fM631f3)|7zYT^3U)>`YHTgQp(Zr z!WUzr?51&~^3P=q33uNrX*QOP9beuUIYH?L#W{d_{y@G@hW;Epuab)mSqs7%v~0?e zNN=l*br*X-D*6_?N_ou=c0r$Xf&HsS3pgMFZ}E1Mq-dPZXJhD3*JHn;MeU}aX47ps zpwwzt6MHOf>PHNTJ{r2dQu~zD;amTy0DaI`eISVr9qBQ|`9zu{!*YiAcJLCY3qz?L zB>Ao8pH&w(x@bS)SH9vt)B<7=8yr{?Gmc-*?Y}z`#nG@dw}pXV&P7BR_F0kIQ!5f7 zwstRyxti~_M4KXhUYx<(12F`EPx&BYq4LjW$UPiT0(#9R6Cf_gu?&Pl&bVdY{KIFn zSX#NmQ|g()<@exvPR^++2PoybRH%K6Z_g9)V9?GLN^>CD#Q0Mk6(k_-Y>|6 z-R9tnx_eW*)qWzhx*#AkBvf4euog$GC z>-|SD1HGH|vo4JR^! z0P^LS+uc?1;Ae+VAC+XeM_#=iov26cxsfHOiD`mfhRD;h2^_&`r+(wTP*>`>>poD^ zn|~0zI!^`4>l)I0uGu_>8dA|zQ z&(V2JTLycRlgj}&d#4B?d*k$V?MT}}hOYZMk#=OomR^S9i>wTD;()LC>~A>>U);oe zG;qDG-;Y3fGuGu*f&)rm-;42v|F5-{cxB!P@D=FRa;+uhFgRCvEPJl z7MpW<**Bd%+V#{5{|PRUEw-`s)2N<9T-4V!-HN!R1O}Q2@CK>)BaLrF>_Vy9=8n*R zc_>1a^?d5rC!o#~ftr}SM2OFXWEnL=9ZnU zlhjmgJo1Y>C((j#$w!Gfp)bDONUV-lDMW8}q>2J-S+8y|8?O+V$CH*V`pcUhIluEW zbf6lNp8@~2bN=nHq-o`#_%WOui^V9X$l0D*Ac@&PO}k+Lf1_mM;?2@Te*DGm+v&MF zF~AZbmEj|u9g)|BVr#I(u#J5Rv|tHn6WzB3g8eJ2Vng&N5TwsLSvxdfHu||)LNU(7OK2%NGni|uOJCw2#goC$_T;Y4mb1i+64rHM1=*}O0@^4|5m z=Be>4kiUxZPb%L(YHu&{YhoIg+P-vlL$=h|xvb)>YGr_viJT!igiI*BfVWuOX}$J# zpw;=IsJ+?fg+lQ7bbsYuNL1Tviu*#+i?Hu8*0L4?#=cWGA&vy@fCTk@$%KQzZD>-e zckfR-w*}vgE;162V|+Xd{gH+lMk~3PG}KZu9)NO8qKMKr2ewxxxz)4m8f)hSt#@1P zGLn1CpsJN!)GBM*y;~P`HTz0wm4{xug#%D8kp4;=&t5Wn3QeDHVeo|~OpFH(QuN&* zjt}@u!=?gP5CeY~TX@JEJMiz8Ck@+EA$_)}wZDnC3?QwbJE+1A2Dt2wE}QUKTy5AX)33ie5}uc5;ysGd zL#HxfI0h>~xdxbBw~uOu=d%Gh{&&w4!69Bgg;_6Ffwx{Wcq@ zFMI2{K$iv{lk5kH-6}gP(faYhv7kRk0V!B?9ST#!QOLS~Bj@%Oi+n&^w~~+7ydjia zgFrS+0DO+6Nuj>kg_63}>R4b2!I~`)Tq=C2>mYFr=D%$7=V?osPVD z{gw*!!7Ta_0COeyxdMFmazd-GOi&cTt-Y2daWg%=hO|sBulQnFF7*5L7WfcAd_btO zu5{A%1brAB6tfDz!c8{yzapmU@ajz8m1$f0%&*uV&`OFYk8W24L>k3Th|c#T9$&Bc zm@$NrO~MjEK*us+ZW?o7mIGaRy}*OQItFmNB@n@plDZ2 zgRjv1N(eC9`qKBi1ZhH?B7U)%4X+WWvAxc3@I7^egs8WY_A}mHq9)BJP8C^*-NH3a z!R0xCfX-#B_IO3bs@ylNcTV8No9;@_1=f)zL+obQ#fQvf(J`mXsSWyIm(XQ?)Z*)F z0QJL`s5XLSTZ-w0(TDp}HDS1s;p$dvfZae8hEG|^{mW-i*@#k8Uqy7m5G+^D@C5vH z-xYycoQvUeMTq$!i;G8S? zUsW_|GD_Aq8@`*<3dC;Q@IeK5UK=^gV}LXHNBzC(SjAo;D{Th+FtO+ImJ<7PWGE&v2IxduG$AyV=3lp~v7WGu zg!H3DSg*i}mk1BM(Pd}>w_u2B5TlgpFi5697*-?kXUVx zIUZ!6zhCED`OrSPukzU1Sp(xGl?$id`zLaPz}#ug>=v&s6#a9Vog?DAukC}xVO#Rj zRn6I%6sRn?6 zR>uCDx4va@KJ$ax+F(W|4(L7SC*oYn82c(Z8Q)Dg&lQSym4pAjTdE>Ig5 zzwRh2ZTBj!Vc_dWEa-^%wfQvr@t=UQ9&h?WkmY>1D2?nh{irUtHIEy-l4sWHNRiW@ zHIiPbj4^tn<7&dFsDOs|#4-iB_OdwJzTZr`R@-=adjzm_jeq%$5cYo1ow)I~SNW5_ zQiJ*=c2!C=>voL%qv+sMgYZ@8O^?{Aptepf2=-b5w2Mi5$elwkZ169d5}H-mm~9^l zp@l3$_3HvsP61Mgw&WbfEfgJoKVA2@;C#e`6hPj#C*NZ9ya z%E{USi~g~MQMh<_uIM>Bz>jd=ByD;Fo_)IAQN4Rh(5U7bAi0}WQNkb5+0du|KHvxA zz9!f!_|>tpu_tg0BxNI&eEHJ50T9Nm2nUdnSq7;t&M%vCwhoGN_6fs;v#H*qGQ%|% zRfYoL<_0P+lk>+wHuYhVBnOxk5{1J?DY{#5Ml^ulw*U4db5MTN8t0@jq~SU_jLG<) zs^{+VBHbVPqfe%(8(AcQJ?jX#UlV-&{mw!<9aEOqkplUh&xB(1qKLn8zTx#!@1W?_ zkCfoNTUK?vw&vXH3vf&Q8l4n(ozK8>7NmTwD-m16dpbIzX{5e;21Ucgn(B?@fpv_1 z#gI(5whMW$&`^Mfv!h~R7BRq#Czxyd9aGSvgsMoQ7_=l^!gj{K*r$;8!zw0|?B3gp zGzz{u6PY*xYF{3ozO7t(Q?KP4z9bg3PiJ$Zz21h`Xn`RKxvRAo`Sku8M)|3b;Oj}g z*S_P2mjlw4C|)hsMsgOx38&|m*7|uIll}er$cbi)vO!>ssC|AW;RHzs&t;#-q*o3Y z_=E?*jDa|&m>ossckb%aBfv(rFtRQdoy`as0;K$0A{enz<|T<5bCW-q0L)KKj~Z_n3BaPknZPv&v$6c zOEKI*G>J@Xs^O`R37R*`Q)YVffpHgB65$*r?p8oY%4Yd$(Dw>081VV#`7$KLdyncX z;=%HWYlahNHwTe$-uv@+Sz75N@hTm3v=+;5V7E`}54+B;C>nso(c6!w2yfV_mY;vj z_r2d3v_LOBlrQxCk#TyTk zlj8qF9(I#LZkm2Gx;Rjxu7B8>HoEW?RNJnIJUp7rt_zN2vcLNypGS&NmWB5H%~`#| z3Hj6K@gxPE>2puoQtq-$ep^0QDg5J`WcB4gpM>vP*KaL&YpAO2Fwu;<_iZEQZZu^K ze3hrEc3g%CbZvj(g0BKx4le(2m2|O9vGR~%3CiHH)fC>aznn97&@{`imEM7&i~vz{ zdC!De3uo4tmP#3lP6x+P(nrk$pex=2m1_Ec!SJ(RDhe*`G=du>N|PAB=e!33k~@?2%TlCyzmCI49&TWn%6Cx8xZrQkC|UWz2zQymor14ABBK?QzAidm!)EIn`N} z#)&zvtkiho^2H2SqI^yU`yyJdp?w&LMh$e}esBC4fvyr9Kwh}&iu=sVHRIwiq0hoP zHguw@{&0M6f+!dvkjLCT30@9kZJ&QBsWs1-mho8ieF!+&zPX7}rVBmF!_-}*^)Zff z*g1y7Dd)=3tl(Bte#Yb0dT+bkpU{G7xi7tjuXkYsX7lJS&`ij_b{hhW=6S&3PFEr> zPwH%H!`+Ii{a9Mp;o+)zes`nJL_)7T{@GL%2MUt%vV<6kUk77CG=1sH<7QWPzT@<+ z^M%03HohGn_6bSf^c05Tv7Q-rX(|<#+ZRydCGniOgj!DsY!3YWW>tk=kd&_??7(Nb zHe^uW!c`925*7v0(R}^s&rCKkbfUPxly(ebHH-t;3jDr$|KLoHhjwo5) zvEzKA6jWBNLQ+X1cS3G6y)%-hafHlR8WduR*6SAuOkU?NMctV72_p5HA~MMD(=^@& zI?j({=jg>nBRn4Boz=B+b0mPk)Yw6;$LDDMFTLupOeUsNoA;EFJb1?8C6c5FNkX0T zWKWsRSwChmK&k=;UFLrHfA$u`z%0x6xho&7mf(^zkMQpBoWU7sx!#3Us6KzL3QxFi zM<}j}d*QvC+%!`8DG(Lb`FUtYb^A8GmmC#FDup7)9chgOe_!k)`{OWaCzCh>je-Y# zClyAichboNTseS@`7N9Vmzk&(&OQzp$1I?ZY6?73<05iZdRWH|gJO}sL+#p0N{hb^ zgs1L%TyiP}bX5hx_4YorHot_~k+_slqs#mX;Jv>c|4@r;A;yzP@4Z6!svZ%mXBKe; z*UCz$9#E^M9x#cWL@|AeZe8!kAyiIH1O~gZew2e4%2y@KFZvzSYkw>sJbi5W>q)*c z_PLE&5PT(Ok9p8@FzOc>I*A~)Z{^j|Mv$!^ z)XtM9@4UI|Q*pxECh_7!N@`~~%z<>`4)ny1%E|~%iWp683yJ&vyiPQDsuFs9*1W>6 z#vhHKnpES-(58^oyO;Y|#&YW?h6a#o$}b?%lc*(IAWbSruLB}A>3?oeg^T22C&ZY?HiwL-@j z9z8b!+KeWp_9D)UDQaun6qonhgt3>48cPpC0+NxSQrYVLr&hOlEtA#|(D>EycsN;)zbpI=fZe5< z{<vd7AyniZP@1^aA1D5&NUBych~rK>N}adN|iv}4Hu@TIokXFL6m zVsoXrBCj7j5F2sb)3-Kc|qB16!mp!o!2Tw*ER0;1EY%xDUBS1hqEo%H2ezrhI(US=X zU9HQk+O~esMZ$eTiz_!$M7k4gy9;Fe4j=oGX-V%vN|OK)D8g-}OELTe`_o zbMp)^jB_Z;Pvi$fj48XdItNVryaf|Eddjm@fMPQITlD!6@a<&<-@(l)^mq9`T`^VM z1(2*hW`QPml~_MJ!j3O9X43KSf1=A{>~k|(fjVL3EEXy_N6c%7JIVdx$q}cx0Zky# zn)8Q~!=Q7_TcO_c>vy=(tMOr4#vbc_+2DMhpH|U&n+eQgu`7rze?clf7A>wpApVKj zGOVwLnx6c))}wI?ik~PbrVX`Oeoh@sZ3Falu4TMv{1C3VYKYhQEJh?}9DD%B4AEH0 zHoYQ1Ki9^XH{qP#l!t*wAmZmaVjuE_1?61hx!vmzHYLcteNm_y{_#(^b? zyZ*d&Z-^X$$GxlfLa@8^p}VA+pB!?R`kuv&L`_+Rr6c$a!hLzk<+J=V<>pO?_z8)+ zD147#+SjyeUxdT|h@l~i!V(F4a-!?ynFx+Qp$=rNb$SuhRktg!DgjM=w^8X5H|jIv z!2*@t_??ln1Rf*kZkJRSfq*pjKCZt- z?(lwV$G%jWUhC-Bq4xvAG$G*{8aeJ$A>n?abojGHW)gtTbH!RmLj;-Wv;7nc&(Q9e zO+uiY5PWTA)sU{ZhF_%I;`L12o4 z?3`1Ybuf^rdqSTgGpA(U&wDPyc-oqG9m`R_9Dqw<<84YgK6yPY`>U0Gl5kScB=J{< z&~Ui!98lf@_8AegV4hWi>JOlQ77ImkTaXT5mZB}H`Ax9aZw^Y;^^_Wog4jwE{ylxt z8p$72T?pN?Z#8IXy=Oj>xGbo0BJ)6+49KG3A&AP9E&Az$+7Q$q75^UPRA2k2v3{Ci zV`X}`5^TsGweVNyo-1lK`Uf0eZOH*QGVvdnDN3@d?`s6j-iTKe4bZlKpt}@_reUtP z;6H0ZM)PY}_DicyU}Yxrj*uRI0U-Bv4)fXeBy^*lK(A7&G4x$kRUhaovtv$EmMswa zBxe^(&0>M^QVn)a{~f}(dJfU$PtO_Q2Hal1X?-1a5H)iD9K4iJEsV-huU7^4ZlI-7 zv;9E~^RaqITjgvSJSz(qu-0VXCU?7e!$by_5NOU5bj%2DY7j4@X*JNK_$$oagiWP| zI*}|tg~YK2m{beb4uJd4I6S#bojo{4gI*GZ^}Nik!X^k;$Qw(ohf z*gKmoqxnp<(?nlD9JrlR&#IlT<6_Pm65(mekmdDTP&A*MJ}Dml!30!L5m|{Rpz(Hj z5*<8J-HF0Q;PN%F>^Hxaf>;=Q9dJJ!fmGpx$*-&s9Z@&sHWIo$3^J^!65qzQSz# zYJS^?*m$6gW6g77Lx4cZ3h!A~L?8RVpZZ5;mdd0Q=|RTHn1i2i9EfVbcCB6V_HQy^Yb2akrQkeh3+@*$BGaCSlWtMM13jnX_s871O5m2e*k`X@4Wy3 literal 2407 zcmYk7IqUQY0mcQfN#Pe*gqH;c4eutI+^jBSCU+)xCX)n3a^Lqo))qE)b~f8sh>ew{ zf+$v7h?R?lR$7X!EB>+a6Fl%7zbDMo_h}bT=dhH0_fbFP(1rl-KY2IL#rtUv-__iv zz8Jty{x;P%sML~fNshLW|swDIT`^g)@4s4p#6cEsg=ZKoT`x+*6E zsIS}Bi*lJlTCMnAr}~w{8y{n@Yy!>}1@*}=b0w}7RUaO38 z05ieeDtFUbPyQrcfqCFhvaFxYg%f1~^t^gIT=O<9AY+MGPophyrM;Up+TH?yM25#1 zLa{BLf;?DLujG1iwhZk;u3Il=dp5{&D<_??LD?8LL4*aix4QFkmp7VSfOcy6lC*L3 z`DpUn5DTtD6MhtVyTp4rda@;7-^Dx&Wn?j)H}oLtEj#uCs~&AxC@x^OZ1m_IyK5L+ zj;G^Mz=Rnm==97Q;gO{={dDc4a|#P>IUnDstD_XSbZE%H(_UQzqd}#J;COYwX@0VS zW88!*BV&DB_8J#E1uXP4DuPjnHmbluajz7W+W12o<;TmT0B!IOm4}fM6&K@N1rv65 z^$=0Qy1)7B6l=E`!b{WzWOs92e)Cn1qDjCtOaMu=On~gXNwghDxLt=UJiahVI=lX5 z9Y|vETzBPZGEyE7GTw&hxj>8%M=O}OD%6<^))y$STd9EWrOJIeN)Li1ei%+p}4|C1Y zgG{d0vw;QOi~qmJMP+Z*4zPAymYi3lP2@<2$D9Iry6TQ6*T}3v)v%8q4R@-MOBtz# zChc+uaV`l*<+8_JXcxFxR!g~JbJVPZBw6p|udVAy+92k&Qu`7Kcq$h=40qJDfHp^V zc>Sdw>DZ29KBF$6%_qW5qboe_G@&@cEe=ca0X7OQU&DdKnS^pEA5!*bar1nFsK#kA zZv<@w^^L$H2hh*{u~#)dpPkhq;Z=Dad2FXA%<4TmZ%f%?(i*ruJe!z?!{~8cSnhRl z6eM+F-=P4Hj#)&r3%*+nZ7tc(yU(Nb1iZnJiZAoLVLFI#XlBm>9>sd(Hd??k{dg`UlMaf7F1jGnAU z8z9%*k}d=H>M3itxq4Dm@Mw2j+Qm6tl^Axc+d)6rY((WSCn&!*rWlq(7J0$Sy^w%% z7rMKzmj~~Icjc`W+(sW}mj%qNiX+46n&v!h8=Mx@g(Qs(fU0hW zPF_2(V~;fg0Y$gtSljer&!?c;Fv-iB4xbLmNz4f9y9sml!_^j$berR@1VHr0L$7(k zPF#X({laR*iz{r<#0iuT^%f{+^VR`zTxm2MCM@av=7E{eth260QRfPH4(4Fs093bsqi6bQmiZbb34%x zicAdY6M`)8=)G+*3X~NAwU~I;l4&a@TJbw-jfWhJA{++j`oL_Is!NFw<2MOp-c3rm z5PIo@594_`=BBVmX;kPqPRlacko*JQ?|sFV${0$U&~ zdDu(v=Gf>Po{!W3#pmg%n6npt(?j6`c3Vb^Y6vLq+fwfffw!)UtaD(5n-pImK1*_S z8MDifJSSDu6{6ypslw1R8aVvg%3@iU}d#wVn`bIaUZZpVJeK69vNL6D6Lw> zBbF*o3Q;-&zu)H2w-C}Qmk17lh3D}L0PibwT$2o59c@EO7Lc(AK3 z%R5@!zT*S5`^ez5GFk-%D;_JtHCxKF;=C9H>1JISJzEsxqQ&c&-@S7%WzSqqSAo(q z&}PF1?jVQS-i_X%#b;E^yF|p>r~A-lGz$iU6x`5wyn`>jKVHrpc>n(WyID312r~pJ z&_{G?qJksJ>Z0kO+>?r<_&Z^Rb{#Ru69azt$$x(F%k3xs`0Cd``{_Fg{nuaq^p(GU z@w507|F?hs)*rw2qt8FjKKSC(zi~hQ;rD;=lZcWqORR5RveV*U*rgizla?IE7ytmW% zTc@=KPZ;>&Z~wuzH9uUp^atAJJfJsF6h-?L$@BrY!xqYNFUF8dFnHXCBt!Cb;<6o$ z*xZ-2IN@4%^qcBnR3snRcu|eh0N4BE>(3MG>`7L;NH+0@Pb@|o6cW)+~MrgJAt@e%4dmq8EOQQP>Z4Ge*d6&e068 z^Bg8;J7_7~i=Piv0=4+YWXG%Qoh9Qpf>?Nf!B&j7>AI>fflhIVr=20qlTRdkQhldY zo}7@f7l|{=c^r7km5ZQ-`5a%dd0JICTPVsnhD%2}YU=ttu`ke}l~DEGT)I2R&YTcj zN@qagZ2oQAh>Gu_REct z_Co_1C@hLNJ~dh#-KMjW3rwC9C-{?|F9L6O4RR33)*8XXdLK=&h;%rk8q zKpXVX83M?AEzKGj6SB^WXWM3`kb?l&l*<5MeCi`svh&^L!CZJ9q z&Jz|EEwYc=8%jZHug&A&L){EbeDMJzZr11A5`6m6bNmuc{bGPMkh8LHq7$Y!E{@Xi z(afqAf)u<+V3j|0kpAkdTa@xA5XR_$MLG_=oN9!=`k)B`!SX6%q>M zJuqT$5X+!g$GI(Z^Qj^QX)C+vo^vk>gK8*MALu|n&&F2R!ZT_%{CJr9lQ-AC)-9|( z?F^Q`nUFT6z)FhJelHSvd)wR8VEOHN0*-Fw-t9P;LjJV7s+CqQpA?D zI~ntmj7A@ZS{E!77LdWK4>gW^n?ePUmYYmuNNN<3x0-J_=^m zk*7@{mGy2qE-O!X}HbQ+VmsF5J$Ib9d`O$OSbne-` z0WVdO*1%nJFObRHE>q$!y7c@R$`~(eaK_cjP$@Q_qFB8V)h-0>*Sz4ySCINybpcw? zo(~D7{bZ98%g$8zLj>x#GFuF6id0=E`ExyZjMU%bbk!ugeO2SEU*BZD?xK4FVk87x zj)vA-d&YZt^r0<^)QR??b$$Ygd>FzjoqV3;aG{RY1Lp46M%vGr@UaGt05B^uIWtSB z6ds7Q;U=1iW%{FwcDEzd+!0J(@NK}j0+BjFhou6{Z?3|>jr46;+X_5z#S9E1dDG1s zNoAe>Nerq|Mc#-J0rAH1-x2_J&*^%>^p_whiO^aSZRB2O{6?GPy)P43$Zw^N>xN z+M-c>4>XK=-D*giR%XdYrDfIzLxPs%`uvWP@nGvvkrF@;!w_+`^<8vFECe}B7BBrM z)av1#CEw-kfYAlDa+#%mE_s@VXo|IK0A(>BE1aDHKAGm%OD-zh=C+P;;1o;Wa0p|L z4LwD;8~Q>SH<>I?`#TaIR#M(NPDmOUG5$!iH-PoJ;V0diVWJkK5MIV)-WBjn_FfOQxmmtajD#1;EV*$?(!k@{FHs==+0)QV$1YUE{UNrf&3TrwODK zZJ&%A=X#8SrTV6|f-x|*bRfVebV4YIBP_Nf3Ry|(y+G z^_C^Bh&YYjvkb<2kgZQ3WzYGIuS6@)`B%~VjK%F2ILg78u;wV2F9ai+@rY;&Gqfn` zMO$OrY!Ej+oAlc30aaGz{53xdwi${tzhbMdh!+2-uZX1QyGjLR^ZcZ0UR$}&8hA86 zy641D@=(i#aAg4B32*Gn%t`m^IMhIroIkqRq;vWfB8j<7_9GdOH?+`;wF_R}#9lvx z%V%_qy9Krl5KtH7ouB;OzF_UW?E;j_?|QL}KybhjDy?KHMOaU)3hKO=E8vHlpP5p9 zk!O^%84VPHL_MfV(BW=vO5g4!hppVyu+yNGWidYTS3e0MDLu)qcJL+v&8er!Mr-}< zgYYfzP<(_Uv)(BqMpY#j)B}DW!?U8LBE1*g;B5^&i{;9Ehj8%|WLPs5o(0}wZ>nQ# zARa&LV#u zR)_0ti578?5yxp@xT^>D5qhRix|^n>i&6Eml!s1%pbmpBd%yj0$Ti^t7tMSshL`cN zO?Np=i)gjflN==us3U!6c1+IWc`SHyBD8zgC$n+_Z-@@aG4Ta1DVZ#Y z4O|a$L11C#4puJ)>vYAsQ?9*#(Ir)b7ucIG%`(ud;Svik*5jfb(r^zW94CL%ToT|) z?J4tdIw-Qv)BGcVPtqzMi0-Pa9Q7(5dFFc$>nrO&oaY6jGSIbuJiFnoe_Y-MIE#h+Xq6}i=_&nyz2UXbSM45 zb%e2)s*Diys2*P{?)PtyjSyWFOZob!uqUV7wGo9L4!#2p(6XjR2Xsj$WZ6DX<$HL( zD-7}b`eg`IC*&{FdiBE7vFwp}tMRsjDCefUKcHWn=K}BP8tVhd7ta7AudP+lgJm}} zk=W4Vs{ubdnBFxCA!^ueWQH-{bZzpz8UXNle&7M=< z9@egX3g6EkY@r+VLm-DIWFuG6Mo-muPCig>|X;7_n8&ACXKps0Z+D=7mrHS zPCSOYqYj4@!omTcW*LiNls-~51^gv=ivtUrq20jfBtH_J3x7%V{qNd$X_LFuzeSjc z`3U(e<5FNTO!{QRccN&fp_r6=Wxgh9&Cb1u3nVeiE}u$bteX5101&RYKB|)tZ`=R+ z_Dm^7V@D90z6il4tF>iClM1%$JwTsv=i|?5ForOH^!J1Rs45^xB~kE0a$ol|eh8(taJLbiz7Hib#7F-1^?P*- z4x1M!aIRRESoE5uZ|1E50y~={!q)-7t8uX_0|^8HSw4i3a0%isnN{L^FxG5ruth*0 zy)X{h17ZvY^`yUwaB&JkZO?#BEHg~#)mw@YlHPuKw;H;?pl8GuM!hD5~#v0}4M$l<-yB{5b0+%%2YPn(ThWEOVngh$jnD>s+% z=ueMnh3~#$atQzo71B6+V(kqj_}BB>ylz|mc+B>QJ@yNv>-n;;!yhIMb7JOot1_KU z?KWQHS`ISd0j$yh(YVRnE-0J7^>Mk6BG6Yz@Ojf5AK9mw_Ks7usW#|H%?HH6QKgz~%kOx^l~DwuKjlO&97mvM92{sT^?F^akS8(;Rj*Zgd)#HH9 zouhv8(0yj=Pnf@j;l7M)BZAFCI-@JD1IyPoLnoj~inURlzeX5q68?3k36Vq|u;y5< zrxO_@uvD`B`}UjFJ-9N4jOk^C8FkBjrsh~-g~awteU7PSVkqPYnQC0zcmUF^oc9Vv zZJfBf%&UC0NPN`zDx#XB!D&_5)%c1YAByK%xl?r!H{K}x6(YXmiPZstQI~^YQoBY_ z`)6vwUW}Bw{iE7fbV+_>00n<`C>1$7wS3?trhV93au+xz~o;eR>(y|T7rMbR0YB`-?qsk+b9C2p~xHZ9_%)T zd$}(U+kiBM4%~vk>gvmyw&-e%d<#Fcj|N8y*ghv31*rIm zD_;YF8fn=H7a!h?y_XlaqS#0D(k*KA5RVFblK40HnC*m)76~d%0r#xZvZ9;)I5)rHu_NKX9)d3R)2mE*WHzhRPcRA5?%n+ zI^?_B^?YGAeTj6z>e<`ppT}2h_~*0`f^7I1dnux3b;9+aX_+fU-rhqbXM+#}yqk6E zhg0`ywCe7}t@qkHotD54xr5?>D=_LVA-tPnIfILrJ#L2MJn)y&s>DZn`9Qz*My$ds zu77d|vplErC>GKq8bdFt3U-&DWg&f<4UThAEEUCvK$OF06@ENEMYRIUEoED*D31a@ z@H`lJmm-G@>{79^ip-ZwEySrNwGfnrr}>>%Br^u+4%%&z%ICcXS{kwD_h2~jkw|uN zuR;Va7Kl9c5j;ieF_z8^BC0Uo@%-t<_UYvd?5m{D`S`qZ4SAx-zrs!MC`;{+(-hsU_XYqh-t0{=N3!afRpV*%Lq9~LTPq<& z+T6M=+Elk-i!SAmu-CJ^_NwZtyWhW}W|in1;MXZMZvV1jWd-uxV)00rwVWm*bA7re z@=mq{&iKKubg|VRF4rh?q6>ucIkt@I9{^_z_E%WW-3xbZRbFj^i$WY)ms9!G=!Rs* z?aa475R$XwRl)In*)yiu-KFBxPA~yvBqxl8ZPQV6A+D6M)*_*3DpDG?u0D5y#|b&} zES(B^#YLqh{*lhe3j3*cwyn66CYGYJ-yV7-0^O1SQ&% zTQ4>WM>QF=?rqFvv#pGS0vEHVVLk+CCo|%3jeKeCc?m0gD-IosKZ}4@-co=G5fZ6w zryz5m2uG=ZC-GxVtp_BABNGxBdwFeO)~|B7V%jD}E^PP*fYIhIuC&&xPixDFvg*Kqk$HTy z+xFX#kghf>j+{h;vsz&mAG*%LwM-vqo+5??szARUy1i6~NWZ+I=Zo$RinpHPoB zffBK?xwfZhYh)`%qzS?Z9{U}rS#Szg@^u0`h`qS2!cGt)^Ol9hSSSvK1s{}g-VL&Z z+DI?Q;OoyA`_!0geeM>8-JPa*Qq+M2z$i@c_md;d#4XHz z(|Q#?iwd)53+Zu|o*xAxq0u7E3OfqG;(>>fm_tXt{c;i)jZ)!Q#}EB;_{e=0h6F-NO6S{mu~|*? zQeb|)DvE}i<7uwh0^qNuK=F*RQA1cRoafONisd5m{7Z!+CE-%z)#z%$P<4HObD;*1{hcW zRzCztW_hJgk64}B9lOH_?D1wH(Sta?iT1l}p&yYbP_v)4h16*(?JY{K<<$TJ?d}vE zVyf9=F4tUITuzAd^;x<1rRWZjo<=gx1e794D8hs--I4v_sVoXv0=4=sAizYmiD`-W zXIf=e@~s*5t(nF&Ovp7~Z#FLshf!?%X~VwcN;PR`LxO+E{BokuPk{U0s^~($U&cH# zDF|Es@qUhX<5&xn%@P-W5c_W3G9Ed;#rm#!k?j1q%TRTH$z+uQH<2lKu}wc#qT(nO z+AkdHwI{`aPcn_}tm2fO)AudKso(^ZOBmNg5MFUu48Pci*#T2*_XsH~UT2!O2U^?1 zFtqwdwXYSwYk~n;5l_IN@ggcZxPk@jYY!2p%F;--YWaNMT7!La@!&Mj(dJbr$eC)U$?mB-_;jV z-W2g{R|6)7jO^*yB@2_ zcTfPnW1@M4;`!vVsUwY1`t*TpR_l9{I7653h}h^3TyPSxvbPQLWLHC%o^4@-<}$#+ zKF%jLjLftJPV2#!l@F6(7N=N3kbE8S{=^aVApOooqW2AH2_34K*sEp0tJpKDSiYY97y)%Y~I3`s%eI z)#DSsSlSpg+~!b*{zG6)CBcGjLXFwrb4 zPfqic*$&9z4j9v8Jyt1$xTEg&>z&g}R@uBKzqA;L#WqtyWP-oCmW_;UyI<-!#0O4< z;vzSe7=fK8zlSqzw5Lc`UF>Y*pr-$JeR{22%JEA2KsR0bjH?;>}h^N4dDxO9=|@P_49^R{NkC6h3jN-BHN9iPWp2UFyf zy?vT|nDm|eKj+uRb@?Z*aX8mf7Z#EEaGGN2osm(p z)V~d-pL1!xNonraHXeSoYyx}Wo{+HN4esiXV^03ek>_!J)Aiky+|8NA>q$zd)%o6U=4SHi7rtf85fTwP|4+v27TjFXjD1TE< za@lmRpt9DO85_UZ(8qcAH^d_8p=?Rsg=R5VhPF1Uwt>tU2jI)#rk~#dT0E`TcnM ziVbR8OSiC1L>e=h_aWd-a)G&3Adz#FO)z0q$+rOflK5EHo3>^rI5V3LllO!|IDR(o zfv@w0#$U3e%ul$y5k@w2%}(D)tf%Q#w@QC#fQLARm+_Kz$7%$QtrZ(?>#X#3&%z&1 zlysc6_H-RwDuA+lLXv?XVVK|q=RJTH906TAZj7LwF-}M`pUOe(oBjeqDvYd;H7(Zb zz45x_npuNNZJxp9^ma^#Sx_3vFe(LtS8+4@r%mqMWWG7}R!pxa^2r;gcAJ^5FF24N zy?HCnfN1Xn5@M%$$X9$Rh7iHG--~AOd`|1be`&XHuv^6g*i3%4g;1J>)*bXBnN}GEn<9yoZ&{CdOIyF?^d6l3?mI=Q5}CnjJbB zzDE%cjAhxlFan?n%k*Ouj*(QGs?s5?a&km z9vA-JxLo&2ff%QYERRh9(@s+am7bLN}&vJ^~WUVGNgg_?~LJw>i9R0~>FmgFA)#ZDCBC z0O$tJ(jDBY-Vque$xGgKHhiBxVj@@?b|KE-<&> zr(O?ae!wP#lP=U--#l5_QUt~C0H@mn4TQ6=ry=7!HL|wlRpBPuP3=vq$R+`JFL)gN zRgj0)=jd5#c>j9-H}2~NX8Jq(AJ(^d-^w3Ez%9iid1Cx=iMA>Fh13d4sn7RS$2<;oH4%4f=hYLt?8{#*=tCg8DGI@_w zLG1?o$DjDUzaYVX;b;ETPhyXs{_X$rhkxeB{?(uRN914okN@XC{Mmo@YyR>d`8V$W z_V0i4kN(Y{SbyU6n}6=7e)+HejX(XTfBpy2FWUI8_!qB#_jAY(fPeDWfBujC_~#G& z^FJy7Pk;88{jxvtt8D0R{NnY4pZu}^^l$&~pNId(U-`R#=Fk7F|L<@A?!Whsmj8$P zvHukQ+W-8&{?1>p{_I~$l;8EM|HJ>$|0?u%RKNS5|Ed4$XaCTz6o2#2`~&*u{{O%8 zSAWy*`JeyR|7iS%-xL4MfBMJ&@$dhIe`kHjf35xG-~ZpcAOAal;t&1Q|L})@X8vD( w=3o8nPyf1qcFX$T_4|J6|3&}yPyGHrP5;H87B_KblDW(S)vo4D8#T-GAW2^ZC4=*YkRUEP0)@(YW_> z(X~I-jT!iaf!9C#YMS!b;}pD-C-VfYfC=3Q<2g6vOnLLwGgwV+OnQ>RnNsS~xrd|d ziHI!Nr|vq7(1RB!jV$0S!=5S3TnGTHE=RuKNth!O&UMAd)qCC>gBe}C+wF#)OK}e= zvhq1U9?+)~z#n(Qtzt|dw(|}}`t>FtcMHE|Bs~oKVlb-} zK_l&zA`Z%BS?kJ*D(R4C_YD|`&}=z_;@cAEiGT&o-CQE@;m<=IO7N6MH#8{MRZ1vw z=endft<922>A}~qcwAzDSzE->K+|20Bb0qAoj7n5nE2_}Gexpm<=ra6>QkpFQU83? z#6gK&97EvIHA+FO0Tyz|r7DVr!*zdM1&NaAWVs$b*`9UR&@5wTPg;>-#xtD6v$TrV zmU=PmUN6c_t0aIA(k0%4NZbx-(@O1fk<^7CWBejv54g0t4QC6g8g^E>-kdNu9S}Wm ze9#)_N@DB<5MoPsc7ru-Aj~Nj@EViPVrL2_>zLGqNKa8}qf6mE>^RAG)0|WK5f^J* z9u}!tVIb5NnIqNPD$k>m5G>UCUQHELa8Ddd!ykmRFFE78k_Vm9bH;*~8~j)Y+ATQ0 z;A9*KuTH6h)_zf}%C=iGzp%RKG}?swYqMu!V4(DZlbxVk*mg9b8FtZn~}f;1n| ztCxFbg3Za)4uVNp(iquWj5&SFcfJ`sI{vZn=4t1{3U4>9E-4*2Yn@d*P?^+?@-WPx zau-JLF6E5UPOaSuKP9->V@os3o%17y$;VJ_Cn9sOBww&g0!WRt3s12>YVGB*0~z*$ zAvU0JC6$9Za~q1PQk@U|1qvOZWyCuI+sZ`4ux4lRIy5&EF(23X?pZ5*Zz>?XSm4vYq&1T>TUZWT- z4dZIf1}1J7$qa-?g|Th`Ax+qXmX`SU!@7DTO#y{2Z@g-;6oa*~?QW5D;r6R0Dyf5~ zdO+>jJl<&gWF^R8)=-0)M+cr7Qm9PZhPW$G@eb`gQ_s7h^8te5Qm1)iii#8dAb(h3>*8c8Z(k8Q2D`eYTw=`s7}%$kRs~!K2AVD|l@ef)VBp zjrIM9fbolhWp_784n`%IK|r3BesdLJrNBos!^r zls__l4Wo`bV-3<1ZoZ3S4Va<^PY+ggz&Xy%oK_Y}wJas{&Hj$VM4iLBQgA^((6{f- zab8-_as{$xTF(aCOvYu7Mz=>uo-f#tYWKCtjve9=^L%EW7q^0tb9KdV{otKcQ%Z@L z`NuN=f+I4>mYQ@zKuA4659*+?v=_pjDOSacxh1u%wAK6KI0Vi=qqoc`lT%=HjBj91 z1TfE#uFh5nH4eyjM96Rx1d(uQ3jIqK2ru*TT$fw2d&we`3gO0_gc+8fApsM2@d5&O zHV!o`4eDa7Y<(8VG9BPE)50D^JyHE2sFSjJ#X69NNO#;lmYswlwdw+foMUq=K-pK4 zKci`7vM(ppk=5eOWUY?RV*_oR=+RDFH-!UtwXYdgszg7JsEsr;aTYj@bATog*R$MW zyIAW40fl>S>R@g4G&EU>$$Tk$F$KP<+C1U zM?IY)ZfEuF!gq5PN0-MCD=p`gWy5S$f36fYejzaM0+NTg6P+Ahh`H?U)6>VFj5t{* z4B3pOyxeHfLOG$1FFuhx#B8&{2EXIT5?t~7b_USOzUm}-TSTdv;8T$ew(2o>qggR} z64Iw4ly2yh#EVmaE1&33LwqFBF>u*KLT*+Auu>MfFmu0N>u~kDnd;ApIc66K%hSZgYY&B+FGFG@ceLOl~W0`c{INN}+&}BWEI|8jXVLz>&plLE|CbnX? z=(K=k{!NvZWu%czR&xdE#f^9WD>p?_%)D z??`o;ACqw&Zd!}!bYKr4&>{IgBKTxA<#37_3GUDwjc&NIp~c>adIC-_64G6JWFQ1)otAQHCYLNRJ5W6>-(;rkyWOx#}O#8Mk{Tcd-_CC{XL9 zs!C7lAe9fQ6wL%6f~!fn9ZEmV^Qv z-jCU;E|BCWxdx?X;(5al?U0fb&w^(_%#EJZVOzQsn5b;H6a(!rja)$ zd9a%{h%Z{1Q7U0tW zVRhjmwt+gM(+viY#IoW1j)MaX;oziEM(;-Vb{}@KzqYdI!nyAzV7czMxDog;(YY3x zg@C>vm5((Ea7(XiaAc5%-21T~y=kxsZOII-kMi@z++>I?VoG72g6@!*}EDtIA2`#N7k@)QdV^#-Ji*-c- zf?_Pn3vv@Y!~JO$kRH-7;gVzbTX%x%F7IGGEf&|h#<4hoP3|&XtH`5Xy*TwsyySo$ z$fB!rkeo0WO8zz>qxp9#cN&j^G`zTlR1wao|4b`Y4!U zs0&-k-rdm|hf0gn1gedmZV@#k*Kmz0-36I&pZe}O+zD}1`Py`l{ptZ&N~$SWKg->Y zcQ6O@nSIe`BtL^|88~@0dwY4X9%;zZfKoCCqK+tYq2uzRpsk_|T$muzM-m;|_Fr*?89Jqk+H z^iz3p)>}YUFg>7Y;yW#_7KK9rtx3Z5wFK<}175#={i=bQz1KE7DfUzVx#ei7ju%ep z-p9VH+0~KP*|S(x34H)`{CWHD|K*+Ue(Q_h{>QKX;hUcdey#Y%Z~o1XIQ7?l=P!d_ ze*0E1_GjLF`!7EI{*Qj>OMmBm8G6^B{ucNHKmU>Z3vU?T`%i!VbN?#8@oDKl-~2)A z)epb_7p3#JzXZM&{5J84_x#mIKK{FB{f~d>0~4Hl&nI91*uQ`DTi^GUfBTtVc{BT} zbo%N4{`8-`^GE;o^;bXpIq{1h`qmfW4}AZZ-~QTr|M|^d_}D-E(WjW7{MFBX;}dT< z|8;#|_02E5`=eif-*5cEd)|K6r@r(bpZxsvozH&o_dopMx89Ne&&NObvHq)H`91%Q b{Kwz^%wNCf{eSlB-~7&d-|_l$MRECGlC%|Q diff --git a/secrets/matrix.age b/secrets/matrix.age index d1413eb3a7bf706a556596a17b5d19767672b0b9..dd559eba05bba6d645d9e850b94f24b18bc12a2d 100644 GIT binary patch literal 11565 zcmY+qxeEkw`ybS(#ehO0!NS6qpNNFv&CY!U4bHuDUpps+WbSL{-Z{l!VX4^oC)int zV8BALiYN-Hgb-}hMvPbpDTA38QoLcCEoNc%`+c70b3I8_{IM9a<(huYIQ+G7sa`t_ z{PA!6VO{G#E^G1!b#*}K0Fuo1SA0*x&CQ$DJ;xjZTS~G8=!IRL++MS$BC1`#Y!s|! zSeZ8hN7P=O8iKWohyY|lAR$dR4!OsVnuvvoRepwroJMBt zU2|Z9EA+Mzd^-wQgxAguPNgF7-J0C#$RgP>8fjuRuZG-xnaR&~JS=7yl3Azu81`C8 zj#Z>jf^{GU$OXC+y7tc33Iq4BI#+1cWt%fensoey>_mc7UYS;9F)SZrbrF1OgXZZU z5yf^(1b9}%cJ9xd`yX;45XOAqAM)lQJ(=Ii*Wo`J%-`8BTivMNNZsR__)~*XjT3Ww zom2}x#Z zp(xbyLVUEKUC=@oIW@4ZFf6D*VMK;U2?nW>&7I8zcZ>D-qKDV=rE7TWeS;OK38tcC zySmfHg2*#)sE_2!t6S>ODgWfTejPki1VV(5sru$Pi9&MvokrkKV&eAQ0)3DY)o!78 zWeh=Auv9Xe5dZ3YT`dSDlr)m3TNYaQZm|6_pd(@4D^Kf0WFGD0I{?)7BF0{Z9NF$Z zXfu7Lun&cWeXA9{(R@4%``USqH5ucd*KsH8`pp2`mqEqs8<<&(o^cS{nJ$?7ndL4S zr)1>AoAN<5n!JMQBa`c0MzPtvhACZ`28S&dQ2Q?vkRpk`o7p(8a{Q5DKUTLQ!kBBD zIc|~kHXw#H+He|PzuY+zi)hh|`%&RJJ<-`p8%)Fuc^9vQ#7EV{dXy;4zB(mOv^yhqFo>0oSzF9HVan9-FY%EFG zXm7d4DN+nMH6us_8M_Hc5Go220P)f%BGxfF^o*IQ^O^idylG?@B2`$7)306N zy+3UmxXn<>vKv|&P~_D(ha6?&NV-_9l9wBn%L-4;I;0~&=+Eo8Zr!~-fN*29^z5-W ze{$Fk4O=@O(7RIg0hyZp^|L=r{NX%>G|^W^Hh$gTy7!@QLR;B@IBB4rGh;JSep3}u z=_B-|cw36gFu&TKewd04Ih`6%kUlgDd$zQBrzv4N3>Y`u5XwEEU0MWjb~?l|(UUes z5%(!_zn1_qXH2{2Q0CCJ+L>&7@km9CVt%1DIU;8{+R^fAU^6+Z>6n#iPFq)6cDU1k z>+PpoPO-7%43;6HAt>|I@I!MQk{>l>_)3WKRd#ex0>E2y!~`ivK8HB}#00J{1*%$m zRGQoivSjStAI1oS*|f{P(1&_?B}sDqD9VT}g)_TqEjN* zx|}FPp-{+B=t>7HJyh~;giZl3WY|Qnm&dASuZQdYxz6m+p220g-$jO(OR*BNZA6iS zGIePtpZb+GP|k!b7IP67ugqi9{WC3XAM>!VPQK4ZS1#)wRd|D4>%GsZEl|-H z*cW>jQ53zqJ-e@=7UR&(ZTCZ*UngWyJ1pdqS%af()S|HK);CTm^R-e@4#)gSE|3q( z)dx`N{KB5vv=iSl?!`#+T|wWceTJs61mtrVaq?y2*@H#xy6GR;r1kV|KMyGE;tI89 z^G!T_fn&Jdy8OTh?Y=(XSLW0hJ(x?i90K*A15&kQPW5z797C6+QfGMxfU4LYi4q7bj$Fnk6JDlI7Pu)PAcW-h0YubS^&$?quLM0nVm^< znCg@stNF3vA}vD7&4Twk9Vdx#Fu&8T!hO@^S5DV``pW3=oP-EOocqooc2(Ozd&!6G zh_+AKe?EPCy;NrgkSe~edPH)*wSO87AqH51NzJ97g#9z^EAz5nDc6dYSeyyEQKs>vmH-FOJos*SIXWQ(gnF;S2sCzxt zdKQX;mA`XAXLn2Xwt2?Xq_p@&Q&|&dJMPOZYDcu%9!KphSrVIRq-*pL3>-*t?IM6d)K58;S9E=| zfgOV(`)y$K@Tlm={+i<>T=BSlt=JTgfseSc>gYET|* zM-CDe4OhydQz8pZeu(*LB4ua&_mr~@6krj7okz^H>&+b$!T@&62va4fWe3_AuSyCg_2rS1*W8Z+_^~`G zH)jps?5jpcQMVa^6u|D0p1DKxKX!bMQ&Sk=jQlc<{44hL5Ns_=rn(qmBjd)WbNER; z)y^jqeIuUpU*WyS0{exSrQQ@%s2S*M0=j6Uqd91R5~Lk_x^hC@8-b{?uW15_*Ukduy@6gIziPv6cKC zsvd0!q#NZ2?`~x$C7mPkbUDs|FqL`791a!3lWouZA{=-{6R`=O=4YNXMmCP}U|&q_ zrc@?4Ve*Yp*rBbV`;N4U1K-r5N}C(1ct(9YAkva=7XRryP+J(Pbkg4-`=DT*2Zw4) z!4C~F;jXb}D;4!0#RG^cz#4-qCLh)X=2QC?gAmPv;Cc8R&X3z8C3_d7Q^oqVvbd26 zuqk;obUAnhO*Ye@mK!Ed=cmE$)?lE0lmX{Wf)&W-Toua1#$-+h(6_ zWa#u*KL`R6?~nBA=OVmM!!<0BF1!NZG*JCo)#UdY8}PfcQ>QC}F24_NkZ>eIrs>}J zSuA);AGxQs<)swU!w7cQ8ANZ}fb~=)UaDiy8)2O$N0=v4J;T$UPJC5s> zvei1e1e@04ZPe8U@~tIsiUJC_e2dAT(Br8&xxkUK5d>;H+x<$QV>!bh8LY>e0O~$yc z$Im!x>iNo`3JAQHiTnt9KS-IEP`TMosEo?9D2$A%#z+6QV%Y=>U2FWGVdo?+ov*|j z!w~K7y@?;QMf<+5LI95pJjKWyiU=T&TEHEe_{-E1@<&z$o_RmVugA+M0!67oi_ zU;(ScKU>LCb$t8Zq+Cw2;x$Q-Rm|>7xardU6hrPNLhus8wFMH0278)$ zs%vdZY4dFR5_>ICxX-4msD>V*)n{1Ajf{lUY);SD@lalIB^s;lWeNpe#c$Bfg7g!7 zv@(;rv$J`-zxMMU1yOHwyU~9i2TiDhg`k-!!7Ub1C>{v%@kP zGivecSa#7#BHg=_S9D2! zcpNl{P6-Xs49glGZkpk8F*RY>e1d^)Io{eOcB0>g_87t64)*Pjxdc-v)s^?=J$JGI z2anyjCk@4{ae*|-$!c|@}UXZxm$-~cT` zVHtKw-<5xI)i>^J5j3$^Y}2gaO7*8J6AO0q;Y&}NSD&vR9I#yqioolUvtbT1vsakd zC%2HfGE^>qIDjK=MZ}xG#6al%y9#1L)m5w|?gzA!(k8zJe|-j16K2VqXZ!#FWb zBtk0~OSS8~X%G1l-qO3AWN}aDz4SshaVuePEzz6d704(d4^+;pzVAa%>e+{_`-IGq zgTL#YDe(hMOu2>bYD<`#<-Oq;!`I;45q$=(kXJxZ>Sx^qkR!&0v9NBLIip1tiTAkU z(&|yKcl3eB0i~KVa~kj1e)`)O@=o5}4NlSkSdqAqC!a0Opg%(jiBZD+F`ji@KThJt zHhOB>YQ$!8<*?;Sk;%VPYB1DLze08+A^;*?u(_Q3IIeHVq4wPow!4F;eW49SdgOOu z8J%l#ijtO`&7|tdRj#oKdeUb$S#X$IyX@p34|=H5 zS$<`ZsU!YOZ_`*@<9>wq*!-0P_QowyLGjiV{$?J>Q({q$2 zdQ}VOjGLZBg)^Zy(Dq;eNA2N?@(=4uc_JS8P;d-JDRW^-3Wxh^cm;V8!o<_4qU zZCU9)Xl_fqAprFrA|^@Qsa43%S0rADCH3Sgj;SrihTnAnRRXGiuA^y|E&12l{d zi+I4!i}sN>&CXP@HxobRDQdgQGD2hG+t3aOMTL`$?QG}~Jis9y3alJ@ovE+rvYSCY4`Z5NRR)Wr5% z26fr!dT48sZXRt|+sp!7A?t&gZTtc@d_07XYY9BBdm79f7()W64<`DVoW@0RIMho` zZ!ZD)E8icR_bmjs0JS5t_VG!OjTDdZnC%3?S_Pja7+S9&LX zLSjgBo{1RvM+roPNj^wrB%^QUO@gPT=b=~Etn5~zvwIO2L&zgE-0Pytzv10jL!llK zFX5sg@RJM#S`u69HM+Pm)DCA^Zqk7QH>0G-CW-Q+dAVqbC!@@Stoq=_TASi@H(6Ht zviyWWz(BLmgI}1FO}D;u*+e&vOo;o>&6n-!g!nbReB>Gfoqa2eYEY$gyb=9NAl8w- z?dusFuH~WDe%(n2*%o3C9j+FEWMr5r8fQfBXGv5|%C1(IfqT-$gu^~l)_a?jJ|{dt z_>V82^4WPWUsy8JM(7+trMu|e=$9C0Ka0kDBz{V<2Z=O842;X*v=C-6c-n;2fhK~{ zfP67*e+E{N<0b!I?Zv%4DB^e%HFDnGzuSs)RqQkyt1egxE#3Jvf`)|WTmZgHdnN{1 z5(ny3>OA~B#X{n8HxToYv18QaWUI z50z+cDCdLs4CUUZ#tawbZ3lc1rx33&Ll$?8NAwA?39@*Q!Rj`J0`{_L`M4}#a*Opo zi`R!6I>k7EZxqr6CrS+UQUoS~<_@6(qC(Vnf*78^K`*p$3k48tJi$TCyd;;SkMN0s zs`Ly%)~x)}8%X{p_u&!*5os8Bc>ONp6K!8AowF>bb$!MGI}}`!C^d&Y4f!)6@BIZz z2Xqanju8Bj-18SV#QGwCn|loGFbXtI6-?+G9M3uSW=#q&rio$M1GIx;s23AgCtIQoJRtSKk0TdY@wM&OH@R(>S_F#wQSK=+ZAH zw!rGn$LQbJI?3&`P{bf_wAW{Q6Q1@v!cQm!9u3tvllpiw(njYLe0I$3WK@Be8k7+6 zi%Uy#m^Sj%-0*InT((VBb9>DwwtM9>7J&TZRRh%fQhd{`l``=CvQNqW)l=zz@j~0! zbH_lYgoOL$AWF$eX(DZYqvOwuYi109emSp$S#%B-rmyo<2TsF+X|`xZc)D*@g9gma zFZZF#FQM>)x`6lo$qq_ng2mfgK!lg<^)A2A6Voe3YLY135yzi%Un@E)f&nINtKG6=}X3fhNmm`U{Q%ImgZ%m>SuEP^1h{NuUI_<`X!4 zJ$=fo^D?-BUo41OjiJ-&`i-~UsBQQ5=5QZ@?a7f%4m3ZZuOzRy1R(ZOARg^j0weO6 zJ6>e_b-_1T3JG?P-+(JQ5mnU8?HH zZY-(&A!QU9Q60Z(?N2tZR3q;~|IHG1z9Y&g3zii@t9+3%Q0~c$+3kp;B|d zI`w#wsCNcWN*Tqt&<^@d))8^NI!kA^>iKshq+Wol9NPJwFXC}=MEl9JD%jx-DYZh= zpKDU__+R#<__p=Q1oL)prcbc?*$nthZ~(fd1IQmJYr`T@1o))Y%23$3ifoPPz(Np| zQnWyrNhzm$vYJ4j9`CDQ8Bp}-Y|YtGz+j-E{X-LE)kw(jyh7#OC|bi0$oyEbc#>(> z?*fzDg0){lgXdysNev&|Z(zx)N(Ykw6b$*P>xmE3YRPB{M|5BCl#5qJ)$P#ZBbVrC zKirYfVs$c|W5%TQH3UC6Tcb;A6+qu>RJLAS1q#Ggqb;4ly<)Z`T5hiPqB4JumF#El zIgB?0$k-+#em=8y_}DVHEgAr9rb}<$h7loPgp<2WF;0o8o?OOihiHSPMtm;!H?C$y$b<$VW>W-tityI$3HBxfS+ zcn{0xlxt2>KA%xZkOgSm-e(;Bmb@1mvbsyL63J1@6PeKF12aTK%(BOlr{v)(tjI5F zN!pqqD@8<%5&FHr?HsBcJy-?Bt@n-eZZp{TM6VE<7xN^l zn`4B_=<=!qAhXJqv-dzWTxN%T9#3Q~*vF{JuUD*=VIaKoR&oovoXhH0pb3(F{E$1J z>7>8EUmwunOI0Yk;U;zF17?G@F!;nP3sU-L`nd%vL!d6yUib|D7kHbDzxleS&=Fja zb8J5z7;Pq7++ABVZCsYk`Cz(Z3Satx&S0gBSg@LHh{URsJ-n6a%X3(a^l`Va@p??f z3V7m+lcOtjmbuJr%uNSz+uRI#yUN^#-I*syWiq02+GXwiNST_VWE`RI&?JK^k_SN8 zTjCMuFXc=E`p!Nv%~)nyuI_W!ktpc7RX?%blYV3m=}fze+~B>z#uE9x=23dC5jA*& z@(4b(4$sn7WcH)>Ovl&tN@fYvqEUT)KK{&nHr13_fB9Z$lt-fXq(&94Z#TdlIF>&P z2TxqkMg+Cv;SZVrIp+aaj$2@WuRQViLE;)*KCb**XXbJ$LNw{@Q2spY8Vj1W22pp- zM(n|>PHPL53gVZ!6neaqx zFzYG#aTa(S&QmbULl%C3Y@n#iaZ5bRWS)-axk&1eucTpDvpdh^gH`j#ru*u_l~l*0 z&0TvA$!DfY9Y^VP0-U4a&GMN**G7+JQ3~!BAF+{*VkIe8^;mM_IJVAcvV@1eMCqnp zD?)r5XWxUp$P-|PjAFAe^!L^X8FY`bivp^c&q@ul^Kl@i%s|_3%|6Q&_n+>Q`0A;; zTAZ3>&mxa4JZp5N(;A&pJxG66nmI9dbldNtk{f9QUv}(3k1acYAip0{lM92~8xM55 z16w0t(SJfS`0G*cGi>X0H$%M%$<~l@7$?M@9FQjvK&_ay?1)HUf6E<(Aco(wsa6q) zo+`~C0zY-?lfrq@>N@z50t1dk(w5-tMrpatxM&6Yn3WMCkX-}As_`wG*`H`vXWk_7 zGzH+HGg8JOMDRCU=5V~8EF1bU|AUC?_#IN?e&-E5{m=G<6%SKvb00HHe>HCHW8Pl^ zIN0NSc~q|Ma3h`{6mmWf;Jv7}m-=7mIE#+yw=nS~axEBj_}}p)_B1K8-|+L7)B~`0 z(&)$=h6u(BL!m=o@C&1~14D;Nz(qOp8~G@pZM?yEAiB3#OI`sUKa#8kBQTBBKX-N2w(Lh9l$fMpGuq!yM1<^xQ6?@ zrm|?i&yEPPB62^xd5&;%^+m!InEgHmZ)Z>3W@t<(vx-eQ7|Cz|3i?FcxkQ5J&)QAv zT-JM_mq}giXHW26Ra{sER$!$2uuu(@#CSNJAK!+GfY{0l>VQ~dubYoBOhu9hrf?f2 zAmh_6k|!5b3Xyg*b7i{fX^Tp9_M;hpJnZVQo+?4G#+iX9MJlMQEki6cF0@TG6via2 zhO}y#=kD7>2m(HX^L2Oft7VwtaS75gvu-~zFdXJ3fbHXc=j(%;En}=_vf^+lhp|(#s6eCNMkq?Ck8^SEZ#0S}7?7n}D6c zDu|FO5F`;i3M&JGSosGC`m^&N_8Ng{@p$f&Y0KQ&S3|Ig>eO2>UrTQDBtBHWbe>%x!lODH zxYz?bTQnr;rEs-V9!ZZq>Wtb@BlIW)cGgjob#t21H*EJ|Lgrrq z&gSufcIiwniANx9^4L})7u8yQ&u+srT~Cfg-I4~q$c&8B%hV{9JFk^nWNI@5WWvY( zAPHqfS=U@E6pa=(*3HsUKtPR-jwk8oPe)`F$~oQ7-H-&0z4BLrDocYyA3#JD#U0O` zGD}5D+Uly1S%!FEl#OSeY%Jy26S7xkM~F@dEZQ4}bI4uaCc7b;LbL%NMU<;+94B33 zv#}-gQ=V}MGV@@1uF>lrG4-0?^ryBra+MADNP-m#GjLbc!$+<0Kp`MTW^ZPZxS+_R zJzldt9kF|Pwrc$edL9lRO3d%c!x(pW&_T9pfH(4LoQDbe`QlvImZwaV zb6S511|;hEyBYKI(5a^|A1Hj5Y+49iqrfsL;7x&&2Lb~!sXgr>3%OktDY-ZBx4g{z z+~`hP%o`$i=SHoaX-#F&|L3@@?WJA;o9a}y;htx7xw2b`UE&j7MFn`dN>Hq|O;x9w zKpK}=W(fV_ZrD)gVR|r%&W6WTl>vL7p_BZQ%frUIlWWs?D(6gb(Wk5I#vSjTP)N8` zcjQ)^dBOUZhpQ8%#nae2D{yK6B2{$xj&}}Pn6j+au0Azpwkkd%-ZGYzwgcBq?pO#t zXj2U96lPhi;o(-Uo^`b!00>{{<9-C>R10G5S9uz?FR=PYqq|Gp%+e)~&%V%_f z#8_R7tHPva!RtM+X_YbXkr(v0bZ8!Ob3WQqsQo-_?e0LmdV$txCr5b3h-!xXE8N

?J{=4wR1lrSYdng#RKXu9#}DzztepESL4 zE>Z^=KuaeiN6=wVc9rNLF^UUo3SauxlO<>%{avTGG-P)kZPPT~J7R9d(-D6y`2yWQ5`sw=;JX-RJOG%#adZXM0P`02Y+uG+3**(R#+k`u1~F<7(VM!TAN#hp7iwnR1RM+sh^I_wk+}_4r>dUu z%)s0cQE+%cFHyY^Sw^ssww#sG3~Ks`Kw0u4+yff3+w2DoQvs2CiMYBiA!`i=HEc2p z#B>W5@ewGMLRxazWhD4ZDImTgp8Xv(`8)=2a(%oLzExUvkLS_b%*Llz|RvIyatS0~vytICg~et+N~qQ7zmpGaD62y_F`kc#P{k zez>z>`5ZZ9E0WK8PfA!&qzkT!VuYL5- ssh-rsa KsR+0w -VMaTGFrR/XXf3I5UpvEE0w0Om0TlRl7TsqCQjQXKbk13R35Y7C0Lz9fm7XPIhZje -9Uh52TZMuh5prWP5f5NBLhp0n22ASAY2zdyv/eR5QU9kV0ai8opsT/Bx79Ocuk6N -bAhlyAOfrT/o1wJuTxTXCU+6a2XmJnbrYwYQVsERiGT08RV7xL6awAT3Dk4b9ucF -2kYGdx9egq0dIp2qE5Ws8bo9LBuE8NjncK4H3vbne1g37gEBFpa4oicuK4PvVsWk -TsdfizPDA7NI4avaMNL7izCxYWIdSb25dTu9NUtQXfVQxvgAC71pVDcOXUO4iau8 -jS4Nh4/PB/2UNLhxBZ/a2Xc1HfHBxlENHDRy4VyhjhwDvzy6EFj85KEQdfC5BKiF -yo2BTHlRJJVLGkdF6oeG/rCMtRqjr6QPYPBRis/Lziz4DhGvBb0rpaG47CZfGyCo -Ev5yZGJssiNIfm38zfNmpN/xsd9K/kQjZMMpjd121CMDs0XV/sifANmPcvL0l9Sy -kzbbJjN+Tu7sN1PU01J/DpntEX8na4B/xJktP/LMwIkhyPWEz9L8qwKlZMzKQ3is -8n34BcHnmJHyVSTVrYgKUned+Wnhan4luWZD0S8RdCmnCRoR2U7ikuSTRRadatgl -8AxZCqNd+OnjNj5nsm4wBdbIixiMiAynHymyUx/hx0w +uEe6nhDJEfOSY/zDBYqjdSpx075qbgQSTWYNv+3t6/Nw8Ia/0LK/ZZEfO7TUFZO+ +EpckZuNUMiEyrxwlOFZGvvxZbu0lDZPRRgd1knl8mIGwyRUf5Q/BR3pOfNw/NuxL +pQErJLAezFoZtk8XW7wVXY/raZhlwMkVcjsUYWk3IgY3QdZjsrXqyMHsqv5Qifhx +l9lo7lB8KLWVwnsOthqWjelIJ4CMYpGZuixQBYTptMuEb/Lf8PMIGqpO71F0DxXh +4lXFC/d3PD1O6frRIt2OHNFk8R8F0awpMO+rJe9teUNNBcG4QZ5WLI+keFVzDyy9 +AAma8rY5OH1eP/KXuGKV9t8Ddbp/ekPErudNvIvm7gjtae4j8uLnm5iy3e/mkhFN +qktlm/IIZAhHTHqkaF+zxT5sqyqlqO0CKrDvXOGLdEeAoteQxlqT7rD/6eAl/nm4 +Uw0Vtei4uPGSo7lTyCPl8/52IZEdB5dF2K4LWtha58CMc2VVHe/yQ/jOlmqrCamj +e0MXjBIfpxsQs8xdBeA4ud7gD1vNAgt12GwwT98RRKz4nSvX6OIchvnoRCB1+oqf +OaqHddHAMX1S913LnUgfxg7adCLT4mcNvVIuIQKRC/trkirS5hvPyZvYzWmLAQn1 +LEFRXv0zg4fN+Auk6nYxN6Ofr4q/SOays0jklRLfeYo +-> ssh-rsa kEvMzA +M0KEYcUKnV12kLX1PSy+eSWHt1aWE9B0P0FGFsKguqgNvtVcbNQJ2mVKDBgDDBQJ +TFU4HgK7MeAv3wm7kPFzFm4330wYjQQi+9kofA/Da9BdhGsnhcYdQ1uFPW5ahIgm +xbw5Dmx82Ja/04zZgLAxJ6FNwP+z6n0OXqZ78hAQeGa34HQ3urNc50UxTtGFpPDp +w11jSGtoeS0MGxYursGkmcyotcZL8mrnppYqUYJEoRsjeg269mF5wpQYyfPlufxH +9bGdI0AisRpZ7bQNQJdQeK3obp3rpjEHOubJ5XrK3xFgUULqtcQOm516UnGUb4G1 ++t+zk3gTDkYUm5C0tFyhAeVQajtr/3PL3dQlRza7aNz7bgSmxAkqWHc5SiW9bOw1 +sqghGCd0loZmzCvNUxZ5dB62/vvXW99EG8uFQjC7p3LHKb/XArYDH9Qip8FqQHiC +s9yBgxl9rmyKRba/9iilNwBtwDYxUF+tzILebw3eSXuEwJVl95793Mw3Ccz4CUE9 +FdpIJoXls5lAUGyoQuPQnzP/x5iKFW06yb2ibpE+wF6lVWKW/aA5mw9jO3juRllI +3rihlWKSf43egZGN/EGscDPBDIqCeVPbyiHb8p9WgtKyCUdbYpavp/GANP6f4rb+ +9uOge0tLuaMArg2WAwE4lfnUNlQHY/CSZ18NbCIaXj8 -> ssh-rsa hjSvjw -EVfVhO2sgOqRtoLuJZKAzLpHzw3iqNBqrklOuXtev6no1uvK91eaNWarry6M21BA -ukGeN089MdvWZ+ZuooQT1iOd1uNmuauwKtERR1306rRFBRnrhIIsEPYMxqPif2r9 -qX6+XjoEUTXO/nKjQExmipknORiXMQTpU0/PPmy2syRu0f1hizEpc8/aMTkve0f4 -2hoC5sieprQPOojmwyxGfAp9dT5ierKs7/PRH2ln2rOFg5569kOIheEDrfMblbVi -CrhbqcJ9ewqfjEC7pZiPtRUUarwlUnVZ3pLul99QKALDIFYwcprz4l9VFr6lqUwn -3qtWKmjKEzN2jw2mB2RvymKRl50auOreH8GMOk7pvL8T6bAhvU9ApYZsHPN9Z/1B -AHzgCmyM4p3l5w3o0N14jkDbUB5ev9T7QiCcvrUCRvjLc8ZSX3V61mElAzNQcTP/ -3wWHOL8Wq8l8L73kRmn/My/lgn/s4cL09g2TElmcJ2RWfeFs+gmPF0wH7HZJpBqp -BoHQ5YUi1ixQXilYr+Ix8swhFL9PnrVoJ3Ln/gkG2fqG+bjknGzOlTsyl4u1xjua -X18XsYkJ9cl4K9R+ArL3fWxXg5SRJNhpJUYenedySvngnBjVkF0NgbkzZMIR9y89 -mh0hVmSxidbUUKZZ2v3x8Oez/OIz67Qn9oEFEgr0XwKPD9uK1nnRlDOEs+NTiN2R -G4laxV7VjCCVOEJrQMNQp9TivhHLFO5VFq9JCJkdA15iGwRR304QHv2RvBAxJ0Fl -NHOqSX0zw07BTjKaaDng8phlC/2Eou3hxOz9i2lrxKAFtoq3wuo4Uz743Yp3QkcU -DTNAp+XNFcqWvfgDa1s8pMWD0ayyWFhu9E3LyGYswWtB1eeow1oBGY3i3vn3ddjr -3StEhwoH9wFo+luYYYha7lZexbwEkwTs3ZFiGA8d0vU7NsLdwtd7YlFueVmqCLc6 -rjQMuhcSMedLq0ACNP0X+PCLfGiHRXPrfx0UQRZFMhaF7Wb4B5gsQkssco02BY5H -4AJyAxArafltEmtCPW6lPU0lQKKm/u6NrdwuwMln9KJfMZwRXiVdeyVxiLxznpls -0LU7rMhjMVVodZyHRRur3oIGb96X1w5uzY64BPLOZx94vXKFCVCKFC7BfKb563tb -99VzH5t0jsD1z51HcN8QtAUhvaPTtZP4w82xgy3nuefx3R3D0ns1ylI7logU1VzG -el/j5TYbQiDN7fGvBK7/YlLV02XDSI6wI/AmzerosDKLxe7/lvJJk/87pzFx5X/2 -mRDHHHaPT3j49K9PIqzYhjmXMkfNDF1F8wzBZ8uuB+cu2JQ4USbI8UiZCF1kh1mI -hZMXOKtC/tkEQMBHIFjepQ --> QD-grease -IGsXeglI2u+sj7bs5NoSeG+LplglQrYvp2skjHaNOIgXGA9bi00 ---- LTL5VCdJPqJku3MXXoRRIXVDuog2iimLW6CbFeL/Hz0 -q60ðf*fÀ ›˜"&Ë™T!@áãÑU%ÈÙnXŒu"$m”–1¤œ \ No newline at end of file +IR4b7UJ4OqdagwLN5lReaUj4Z8+iRNGc4Amwj00SBedn06st0K8EOfwbFG4OeNgZ +PfvpDUy4vnpzUkhmCHnqdUqg+gD7h+8Flv41rHQN+LoBEcaHO86eFK92oVzmcYuF +sQi3Q85rHydXjhebJ+1oVwc/LPIo9EM1k2+Jv5EJ6uuZmL7iNKDYc1H7ECX+cwxp +TlcZBcoeQYf+dmWKfxOocKjviOA0036NUJUBAOLCIjYA5ZueCjiR2f2WUe1IC4fe +rSazUqKshR/ZVtrG/AabkL/kN96KxIEMe0sdX/NXjNpY+noS0/CLCR7NPklUpC5B +LjbeSiBmcmygNvDx8HWjROSmmLyiHiI52QziyqFyLo6wW9bOMXRFv5L4foPuQ/3G +GQb9xDhkAQu21ukRD2eVOfaBmxYHIUyz1pIXFqQsEyrFheBYJdsoP6emtiOYXlmF +ToJ0Ie7ChPJoBHUJSxBLeHSQ4/KSNR1Mkk7KBrzn5bD/v6ALvTsSrxbejX6f1tWR +p4teVvgLCLev/I0INZLc0hR35g/Jdz6Qg4hcEBqINFbDQR7NggOfdSRRloyYmbZi +kvMfnGcxzOciCh42m68yo8nm+yOkOvb1OxKM/fVXzpXZCknir0tTMZd0lIonAvMg +yd4Y6QsqpAb7yy51abXQe7grOEH2F8kMdDH5bFKLASrcX3kKyblscwkftaza4H/f +yFRCimnHjvVoQZPG9w6heOkgDJCGIH3Ai2NnRnAMV+jOt2CGG6MWO3kwqmP+vpOj +WrYUhgN1HhQkCAq59VdJkEXa95sfRHwpa/7ES4YwYmk8YZE2SvwKA22eLJB4XQ9f +3LcO13O0BNuIpMJq+JOrmabCp3qEeY48ZsCZdJTvHUvV9RvR4GafXIN1KNeGDbiV +knNILYzRxfWA71nNHtAXv2KjOZsEqtxuTl8aQjnxVztTLe6g6woNtHy5fgJLVoAH +5rr3Z6XjcWe/4WJmQf2kjpfrbqu4ex4b/+W/zg+GKmKNhLmyGEeUgGPwF7TeyfzK +Dx6zzx8ijnVBFRlq2fvFqWYlspmOagKvN7WvPK0h3LESVw+mOVLqypaZ5NQI5A0X +vAnmJq/2wXrabETLHYPDAJE6Zr+PWaJr3fVoW6tr74/kxMXtuV+EsHmTDrqmZUQp +Yj/pQLeaT9VtSk5MqwBq709cBtNipsXFE5DJFUuB1H2OHKzVP8TkgiqKWkEuX1V+ +llUi6vq2ZHl4VXImx9/bi6GZ3aKkBvz/Kei6aFCflujrh4xs5TJdmbMnw735fQgC +Emo8wwMCr4DQab/6C3pAgRKMQ33x01jXIwpnQ9Ni9ECVnpWgUQl/Ipm5vc/QdW9d +nbQNg9BQwBX5JSPKIw82Jw +-> ssh-rsa mMfKqA +eNHzuaUhRLdB654cTcLuFvWH2wFrihTASYUJbIEBfi/VpqGeozYBbg7eG2FBjKgI +WGWodtYdK9kakyX28QAvil6XAj1FM63yJVXApfaljKPc58yfaA1QLx1U1D5PmoWk +08H2Q5OmwFIfHweLbrRn5mWVNYvpD+dblS/dvsPSi3MIVfa8rRS1Ex5wVmUENsAW +v0GQkRXheRP4OTF7brC7W629eGpfkVxR2Pepv94zzBQgt7ODb7oCOtgesEyDElCH +64XXCnZrLc83IeCTqUig+JU3uHOkNYmKhBCd/Qd7ODILEVD9WKBZbi7vDyqsv6uc +/USCBU8T01rT4hYcgQbz6olVA1Vf41edinnzD3f3nVZafo08LEBQDmlToEjdJAIW ++lcnXIDMZg0t6NUr+ePQ3so9wom8Se8azITnkv/df213KzX3T3ujEv+oE882PmL/ +bapT+TleeIj7e1YAsWNGzbG2VPpWHGfwra97LpGplcsusEtj2URxuMiiP3X8tAxv +PC4JXfxuK+icDf1pdtHTb1TUxbgy/cuASGJzjgjmPsv00RPGWt6y2zMuLCGKa4va +0UN5UXwXNtl6IzK3TnPkvWbwydon8cUxoi9OBHOljt4pvZuwl3fCAQkTxSlHlVS/ +6GZSmb/J2HMFh7iELJK0jmulRWwAlS72xc+BuRSv2Z2I1vLSxBWoZL3Znw4Wxy8c ++zJkTKN5VjfJ4fhmDUjRZlFgvyu3YIFV1oD0DYZWSM7QKxQWDJMSBzP3zodalBp/ +CI2b/yjDpEhmXvo/wWRazz8u5eBBGAi3H43H7wUXU2f7WST50S76AA9c09jg3XK3 +iG57BvlMnJGVceCQQIpdOGxZ0bNlGLJW9uBisMTmhQ2K4BiTU5bmoTe9jeKwtUv2 +QcGJCuTFjM6sxQSaIWTBjkXUmNBUlMQNmpTB+t68lNBGAhmMHMpzoz/NDF50NqIH +fTHMAU8eC/8euMRGR8dums4FSq97AFMlrybcnnPLPktM/tDEIsfvSkix/wtpDfUw +Tnpsj14j0tUl0yq557dmC87NZNR9q4iH4NhtUdMKUBV5LpeW7zZxuGQd70p3XTOx +6Z11+Sz2Jp/xsALytPds0SAWEss2c5vTX4sp79qk0ACbBOiGG0r3YN0BqNE/ajPj +W+nKdTc+3ncZhOt+tcipGRtIaM3+5GHs5tE7BN75NwKygYXywvQZgXhN29Lhtr4T +OUDaakNt4uSiCuA7rAwVt9Z+RppBRalU03YoAJgAbvThVI4kveJURDLEOLneivOv +gVaIpQphCmHZgYauo3hgTTxYohqvqafP3FWfHWk/z369e3WySvtNC+KCue5qMFOF +Egmx2Mu5c2Heui/55KqSHQ +-> ssh-rsa hjSvjw +R1dwwXod6s4y+gIe0pmHb7d+f4zTRZVUyvZZqiMp6f7udSWwwpTACW0+ygt8CAHh +9F7Xmlz6o1eXVvpgbFZI1s85aK9lgeljOk+tqKHk6D/0l4u0r3rex3cTTXgkslL9 +57AvNoXOSUdLgka7k3AlaNiPW9sppyeTydRd9ROQAcOdd4o9rc/q8XlrK2FdyJnX +rxhBEmdMXkkDrlA7gKHHBC2JK4vq+zSYPFnqJgqYmKm5m7VaxJSE18GoWEBVv/jr +s2xY0RPr/y8QTUo66vFVZLJ8dcMG3nv4wj7cbM1wBV3gepdo6ZXN1RwFyXxB2piG +0S8PubnoeVUr7PRMtUraEsv6yEyxcsX0QnFPUiHsWNVBbr5Cj1lGCQTVseecORrO +tAikxVPMrmTWWBWp2ddSjgLicz32ry7bQcshFrNU+GoGXofr6eVGu7OnMj6aKmRe +ie8pfLodJBLPtCB8g+WXhSQrOsKf9ACro6cMcfo4dFhi07V/zbOhlvwUk+K/cOI7 +DqFtYwvItsKK/uahJd+gjBEORGjS3jri7PG9LabVVBWeg/w64ZTq781jcnJY/9rP +zOZpGu9w2BYnH5x1SCqbUaC4yLS5RIkW3C3Vj4+ZmyQTxCcErkwJiTlDQfoDZb2L +Vv7wQx+fn/EQzeTnhWhhDCHMiTjjzYEr1mg9Wub+SMvyX8bDemgTP+OJxhxAjXcV +HsO/AI+Fm7nVF6zDf0WvqKv1wDOEmpg2EYeirEE2q/xDAUo0+K4AXtbS5YEUsUFs +p4HvmoCCpriuEZY7q9a7i91IgSVeCrfKrH7slC15eXw0IjqqRY63zceGVS+FtDHV +gTduM6CpDx/f4OLKY0YXgeDgSKZsG4Qkeb1++db7tv/q/SeIS62LgTpaUUSxVnHZ +WaBASxJO8iutgSg6OichMNFiIwfIuioCQNW/P2PYXB8Y0uD00zTJp0/gOPwxNzIp +wJKy6DFMIKBh3yQx7wSy50Mcl3Lp0oiIFc6lt5v0PJPLOGWf6/ebsjglfgtCWc79 +HKeGIUPiILEs3y4NIS7k3JVSlfm17WSSRH4ogq6nDiKUOzIl/2P9tI6KHQ7Hm5lI +gmH6yGoarBodxf1vbbeVMTNjvTxTC5rbfDAeXubTJ8gAOrPVgCGi9el4BWu9yw1+ +PekATy/O9BPDp/LN9GUi6cJgz2NDAH5Q1j1pl+lhBd5TmJASx/809K8dvpoTWP0h +njLKgufW+8wVcpBitDvCaJLulkgerzZP9uUvGCT3rMjMj4ac3S//fVaYWAwc7Cxs +qyaBz2x6Kz06AF3LpZV2d2k56YmdaIKAdd+2cnU/2eD2GBcFIKBjP9nFE+KIJVZf +4xYWuJQovYbejkBfqWHiIA +-> ssh-rsa FS7DnA +kGER2nVJY1PFXepVRgmrFtfq6xRCIFHtPgFqz+VPudvDiQaW6eIflQSDFKpwr1rQ +wf6I1yXJY1Mm4+rlYWuWze3qslONFSes5FoFHNjD9pmZ6IBiGV3HYPmeCPIO+PMR +CXHnLMDl4dKBnl7QtEZwX9E7ez2cBGq7IRs79pCpRRpARYjjbQRQVcnmmBk0Ze5l +WgqYJeTWnBo/4OywKtVtYhY5/LqfkjLcdPrslMdGriraDK8YiDpv2YbNgxY7DrZE +VXq5qTjabYQ0oU93QbIc9XTtn1UGvoaAKb7VV6o+kPNU8MwXfEzdCbyd73ZwlPOp +wdVOuiQRnL3I2M2Yy0dezlof2GIgQ7BHJpxgbKLSH835NlFky67Ooz5GDg0C1eqI +dpbIeDCHG5b/TZGeGlkPsLccblLAvekZ98CRTsBN3h/LMzSgD5Ysgi+M39W4kE+4 +7Y1OwO8TQ9KU0CBe7njtiGhtcMaT2+QpCocXeNGKJOXDjneYX9yPWx6N1jL/U3rf +yM/9COD/09bDNDkn+aWqWR1M0GS0+z4WUjxqjjDuQcwu2LI1rYBcPs6Ys8/iWIY9 +vQ4qf0kBkoDrS2gPnSSxfu1/HEE1Y3i6YGmOAZvrdtK1/OVJl16WposmVlPpYlp4 +dIG3zuQeQSYSyGvGsXPmv+WKYIz92NyFTn8tiV1jE92rnZzsCux0VP09N0hOSlmv +B+QLHh9LsnJwhTYZElZfgeXB/C+5RwLWgL1jnql7/eJhjp342zlVE8CLcUOfe902 +A89ECYN+mg4Mhp9WFRG29LkTsy7HYyl1PkP4TZOMiRIQaqndTbm1Ld+3OQ6Pfgz7 +ksOLdfJSeoX09WBP/k3cevbm908hnU7KUC1WpDN9MsSf1lE1kYMWM9IR6OrfRDlW +NmyWHpU8824iX1clFNTZMLCIDiJmkbALeezuQqO0EXCrgNyCP2r3tJsv/BD6aXzu +h+wTiGv0maHZXlYeU5BtdMRcKZ6I4dNHgo2Mf8h+xxv0XuJHPHQfQSpbVxkNK26A +oEt4onSPvM4LXdyEQJ7iHWSuebN1vY/r+0f5GxC9qavL4DDiPR8S2WXEXoHnKgnp +b/SmPluBITVGSYEB9k7Z72r1MNpOcDN+nAD7Jn5CBsWVEtKoCGy7qpdlYHwdoSDb +6sdqk372RAOyiH6o1WtN2xmM4OccUJYdh18N2tXmjtXfxm2QOLCNZmw5iz56figG +VOrkybTDXUm3dBvCvefhgR8nhcTsI/XrDo1BK9jAIax+SnnYvEwOsmzZsmvY9reX +7EtWVU45O7yHLvZyuSZFXS8XpW41yTSXMlXGLS/CwTnCZdTFGFNaHfbH3gryyw8W +wm2iPDhrbSLjpmWywyvkGQ +-> ssh-rsa mMfKqA +o6dPmyM7WB12mXdpK5MPXjsuzCevVhlo7Ud2vIAsAWf8SErATIF4/59rVZGIusu0 +RM1+P/ZagI13L4VdC4OOfdEU6cOw5zpYzRRacI/uaG9By2i9ohqSvqAzyg7Rf3/z +DKQjiVwDDv/kyTzzAGRhAIuw7ZfuXgkYkeM11H3wpNUuFjPg4P5Inef5g/MEYijQ +sckJDxZ1xFuX0SfkOOR9XUQcUkVMHT3V6/tEYfNPbSoaN1txH7NA0aLTI12yGFgr +6OnlVV30Accdn/zmj0sP893ockGoAs7PgE281vRpljlHyzcygEU+luRjR0vY8Hy2 +J1q3TDXBAG4Is9aVUFBc3nwWFpB839qQTu8HNGfg14oYcm1ctB8aMEMMPMCbtrCm +ToiF2LSsSMQ7V5wqyKPra5jHc1KurjQ/vNvWZW2vvZHrh0indOyI291/H8xT8YlT +RUPZUBKuZZH/xbuzSpbEJvaO8ui2TZIQvYc+2JOGHjzIkoO8CaC/WY9yGKBOdjx+ +RD1MYKR6CPEoFxGGiYz9kIkJYVUfcySxCcMgs/L0YhnEbNMjS7h4YWIfRJjoTFCz +fm4mfvFqzAqdrn2acUrYgd6G2ZuKNIuey0Bgs9IGwL3S9o1VXSDenP7ON7iF7y4q +jiXw84u5hG6F1kEJkI9oqbxDtzBt2r5nemiGxWBFVnpKKv/R6i4eP5Y3zyTyDhN8 +IKgjVSU35q7ZwpbN6w+IivQIrEEMGMhU0Xz5UJkAQRzTG8+t2vvod70EgOIkuV2J +KSbwOlAlLuMt2g+IbVwHGYefEYWe3qU5irrcELwzgV93VFJIwf9sy8h42RbsnI4C +9nKGRmfNn/aYv0CI87NlpxsUgN8swzLq6jU6JKT9xPjw3LojON0kk4Dp5TsRVHoH +yH5sugIzLpfjJ7ERR+j1S25l6GXR0Tpz1VGZ85vy0sMIU22lvSe/TPTjvHkbK/E5 +wOAahiGXN1z2f/P2jHxhxb6CaCJRWEEW1W9fnUbo6fgLAlWyRPVkm8sSOrssxgea +Q5ZivuosfkTMtr0AXpJdXK5Lzy9TCyK5H+fpc0TYlnvWkZgpX6X4meIJqAGkf+rf +Q5TOrK9o0pROm2i9WTXoHyBSe7IuvcFSgaZSAl688tnS2aQTICrRqBIC1m//EYDS +M8AA1lo6d/Ub6lUFcSxif1qwiMreOGGtEJldTJ3kxSS6+uGQMMvzbBRjezXTTMAR +59FU1zUPZL4R4RAxv86wY4qjEOMnWHQf7+OZKd5scwxSLIIyZPVf+SSGY3B9nj7V +/HQoi8wAaBuJzTHEIFay1eDR/137yea+6/z2e71HfPLCoLwlMNyCkangnp+ycQ8w +QHHpovjPt0f3L8Ue1yX83Q +-> ssh-rsa PYwg6A +PhfZacWUEX4MoBjBMeBJF/78ayDslWIC1cV9XY0fvrr5h+Hof2rkitZHBDr45Mb1 +tpoLMGrMtAYKS7Ea1qz64SPJAjQLYmXJzWoGxy1p++ym/kPr3QyalO1OLK3vuaon +oCgguT0vs0dZ4hurDa4n3BWYy5lhmVo7x2jkJp3+LRxMA7JJZhY9oVbyp0sw0xWz +jRn4QRfdZyt3XDN/bHvNViplYslzSLlEILaZtn24eojIAvFc7RoyxV1oAwIRpvSi +kMgWTRTglNG9pKB5XtJ3hxFCQilIIRLrio46Aj6BCj6xkkT7wwGqZ6gWXqJYqu74 +e8nkGm2/+A0NtDQr1ocpWq6x51pL4rBj2ZBE4PphAs431yxPkqKnPiS5/cR84ldo +7opm3Zd4PvP/nM+sed/VUblatlgS6MN8QwxxEMdKr9giMZJvhkcBf6f+EAS06Hs3 +bITY9k0rVL+DwNvk7aVjxWyp3vpJcd0CQigJhjVNtgveKMit4alEY13SkVA0sHdH +iBOx9o4dxP/QziBL/M6sRpXQ0edxriUU0ehoIkWg2Jwzxii1hAlCYjGpyhr5ksOn +QWRYhYfTc+JXaXASHoTO8IlsSIHUh5ydrcn/5pJhpENQY4nqtrc+7+gfSBPOUWfH +wD0l7WdCaRbVNSEaFV5JUGtFiNwVg21rqBiFeCqlNiMADEyOAc0scLmroeqk0Unx +vXykd6GtBu0ep9WzZwOYXmjXPe0nNMl8wtazNJC5MfXPv5lh2eF9fqST1BjxHQyz +8R+20ZC73qilLvr2BqWbPV6mcKXPyTrweV66anUhmXkayWUOv/UbtvMhiLgcoZjN +q0MSrmVy1cOC1gx3CpDkGroExq8LntMlJVbHvlrnb3dt5wpNuoWd+CfNS68nz2s2 +FxESRM62huXR/GeSG4isOKWCSTer0kYL1GtIUaYTTjhXYiT1YBaJUtJol6q1UBje +blWJ+kwnCdzVCOzFrKlsnFO2JVwrLNfSm0tagXephy05+hrHMx5e1x8RA97z8kYV +dG+cu5n1t9FmyCoZzj5OC4xHqF2jdp66trRdvhps8nBCzsCWEl+s4mcG2VOePbrd +L1lV9aIys7UrOkzUDvl+DhT6ykyl6oV4tYiuumcmFwE8Q+uj1RDXlNsNOq1Y40S6 +oX1kyuiq4D2IxuIfG99DLSvjKbn95NX1UMwOJeKpghihdH4MfEyTtqGs/2AJka00 +SQme2RkTNi+ze9Aif4MbZPHKbQ1pR4FgwZZWOryXfo7mxJUizF0CTlWGuC1EN+VX +m0xrS7cFlH3eRoNgWBUI6m4WqbhFzUFeIErnk7FOGq1/uBvi8pGFt+CV6wu/AykA +b3HINkLMTvhgEHn/XnzkDA +-> ssh-rsa 5JwzEA +BCKJDtQfy2AME+ll1rpcnxxJK7yM6lQxBM8TyruNBNxyk6bK3OPRUoUE1otOt7O5 +IB9HexflFpMlEH+uTy9Z/k9wQBbPWNKtDlEGl73jWpC7gp9rjGtwNbeVvckSSt0D +ia/T2ctUmLVozZMskYgWPkra7M+anGVp5FCTg/kNg71AIc7umLrbBj8aKiQKzXEF +GgMD+fdLgXsJeNC3kYRpBgG3PE/PGirfja2rEs5XXjo8RkXpXyVoQ/MYqAxY+daR +OgCW2GHMT8F5lwCFlFLGsEKCaHrNgFCnrp3nTc0Yz+qjoekCi35OCGVxC1+jVew2 +vCHNhsOitFveBfjLgkblVl9EK4uGOaSRdPlgIZbWOO4WgrQGHGo7nlTr45khUOq1 +P5VxMdqovseIlCeFIYBKmCDaS+cCvMejKsREOgR4+QFGp7U72fDwg1uY3yxubBvg +FIm45kS9vsR/ae6pWi2OKzqAkCWuI/mLy1Wv2UhHrVpbElaZ98L7o/2/+vu2hZtG +uLS2mZNrkiz1Cy/JVRn8eW/7yO28M+e+mOzNiLa3eZoRdI7ClER53L+H8QQ/X+GT +XIHGaRntGnOiHmROgGkfn6smaaF+ZoT7kC6Y1G9X1tUqIvRVKT57JyRagYICGHyj +QCv/S+9VGiFMagnsOviO1EjvcimKk4XI1rgNWIfpVsXHQlWcO9VaXHl/iN24If0S +sU72NFbAMPiuNCnt0I1wsgz+DSbA+pvZmGPrO96PAPgOej15w8gxp8OYUKirUGu0 +FACXZeLWiInIr7yJ+ahtaKuwVqgN7WtYnxndXL+/AGq0qajo90+0X/by9Es8dQfW +M1IMQC3hIuGckq5dwZ+sVbn5kyrw8FweAM5pp9WOZg1S+0kVUm6EC3RMUZrva+rg +NPdYCsb/ng57I0dq6C0PJ5317mNhfS9IPE8H3Ul8lLjHSlLLT3v7gMATHof8wxuz +y7HFH7RKkvxOsXkCqizMuEYiDOUVVywR6ezojpxhrhovZIRh3BBFBlkKrbRcus7w +l+iaJJeWsB2b0H+L4kj1IaeeJoKBMaio6OFIPcatJorv2GVGm0wkSxuHLet/1svu +IYb3Nfz4iqLhvjeh46vO983K+x54MX8fsvRWFhTZ4WT2Hrr/+mqldgDBvh1Dg/uJ +Uy+LN6o4Gbu+EsNCm/biM3EvXVSmpKeLhSzSswx3itdOD3caODvNJKRxKGJ6E2Wt +FQiSFGywF3DJSgjs5+psZj9spFlt2jzoZnLSLkLNj3zbYBTc2DkijJ66juPLkXHx +NEym3rdK5XZS28LlivJ5gzfrQN+J2YaL0U/oV5yau3p7m+GyJNVr+ruVeK76tPCD +GhpPN+LjVbVItTBme+x/tQ +-> Wh4shPrk-grease 3Z?p +vDyeBSBkunx5fJuQUvG8rXbnafBfDg3vZofg1EZir+HBwSQhhUCTiCNAZJwqv6f6 +x12Lk29wt/Q+h+ru +--- D/xNQTu3lbJG4bmFx3SCwjSyWexKLAarsbuOa0fqAzk +,üí ¾Ž¡ñ46 +3ÑPKvoõ®*v'Æ)dˆd­+ÚÎ-=¿ëÏ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index dba5232..ce865f6 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -5,7 +5,22 @@ let user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; linode_user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDUd5LQVl/spIfJ3mh/MERlCfSIHCh3jXnaNVnyHY2AVD2dFVgFX+Q+1adA64plXqXHEQVb3q2EMzVW14QAMP9VJspnODgpyMHwpxp6ZNUsZIH83RN8kauVHgW2LRDCZ4DLRzbqaeDm92rntapoUB74Vjto00AE3gWyGQp/v6BeAUhqE0J2p6T6xDgsuyJ+Tzm2YEUozFW8w8LSGDgaoTKzjq0WVkAo9rNaxGLr/ez8P3SUHgb2VSUrL1qrHE99KL8rravOjP0aQmGGWu/MOjgvh7icQuqYlBF6MHfxeSd7/FZApVNKzEXD9TKBg5IaCOjHH2GHnxthSC0mcjKmF2EVAXuWYDARqxmtIfV/9YdeECEFxzB6X+t6b3RYxA0/oa5Zt70WH2LILmc3U5EfiRf88x4WcsdmbcsKQ74/julgg7vYlTlndBxvl8Nd1IKd6ZD3nJBMMMKrDOYbME5r6x2VTzm/RQkpp+SHarCMXxjukhguYY3Iz9CTO2hdGaQ/41ftlOhpb3I1Gai9GymTPFDt9n3JCEVyQ1+a97ELVr+Ky1L3hMewE8nqZFIoXUB2RFMu2pD9GggDO2e6bXdN3SIHLL/8amoDK62iYgVEp1XBkzHJ7U6hhIYbkFji0KK8A7Cwg8+gOKdovycJIAWndHjaDcLmWDlBktqHIRQvLMTzE9f935faTcrSTpnrCLK/pR3f7ir7HGpD8lUug8m7DfxhH3am1Fz7uY9iNI1GLctexC7espXq/xEA/+j7JRVVKbpIubXcmJjNlKs6jOx849SpdWvLlnJpqo1PIjxE9ZDa7zlPSLMTKGTuY0ekKvvbuaOhcOBuYg1RfbdN1QIX5ba86U7giFMZb7wGh7Pbsy0PhFgO7ANgNZy81RKp45G8ozHLnXCj/qhstqjcEgUICDkT/CGnNkreu023kqOaix0nELBLwWBVM/5iWmKQZnpiBhHHDNJ3Q6DsCkIUdfOWZNCIRwGDPuV8uMOEHJIemg25Z282QqWUIfWzGOO1f0ylVmhTQooZIfjhyGXxKa6AV+/tAXQtkF5B1Z8rB5A3pYYLDmnY1E007sWpvm2L/HKV7cWUX7bkuS+qBXZyHxEn+cc6YvalJbDi5/bE5kFQudZFgKInwFiMLhX/8BpbgBUv+6MvvCn79o9qnoOnkI36A9bEOdQKpjwPdg9tkVWr0RotXfP62tIAQsxS05J7yxprC5Uitf+Bhp+Hph0tS/hyxTbN1h30vfdABouvQpcqbgUlp6psyTT17efeNbGcs9l4gkg4HOGpmF60alA1+PBZ1l7ba6bglp+CZoeA5qsCTmMxT5yLaWcEck/8WR3NHQqkER5ZyH1204Kci35kNon69y1/ greg@linode"; - users = [ user linode_user ]; + + user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; + user2 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCgg6FGmtWPjw5iYTlxJLz1WBCE7zhYhXgmfPvFRt6cd+sPdBdD3axkYPwuUxIa1dxwLEHn8BY9ZajFNrbD+Y0C82stxbBGLRhScj9phGP6LPJhNJsqeuU1rXcnUS127GlFayBb92UajpgMBVlQVJVgOikdK0GZWS4LMsTafkldS5leYr4o8pJ94ZQUk04m9Y2AhkLOMWDdLqqbVS7rFDKsfNDm6YUIrc4fCFvMwo2IhKb3VMv/CqPBFWx9YWFnLoNRAUhVTbcpDWBprvgAirf1rI9jXihX78gBLYqaI0shZg3mldIfQPaPudxXAYXZBFxZkcdnlEwOIL3jvR1bQKfRroAsLs4Nz66RDMIEC6cYm6QEIppFzx5pAXmjBHk8RPYPV0Z7gHxlp2yL0C3K6E1XN/A6cvK719VxEI8Sqmzl7Dd9/wikuyZhA/ZJfShpGTFX7M4wWKd9ZB6F01ATqAqACs4BHIIakl01C+lad2WQwxCXZo3dxGTMGoUrWTlTcAIKYHA0uun0k3oU0KRcSojpGMFCedR/HfLXZ/3TxeUHAZzSFKAQqZPE+6AZMoDSqVgWW6gPvRqVbtgG17qf6kPXM7XQRw/mNnjUWYrqSzDU4eEyN0AcfWhAN7defp+ERNlDyIdvYSiTniONuBMR5nz5xhLctKosJ1DaQcyNxYok9kGhG92pShRW11JmU/AmM3K6svD2tMRNRg2sJUNYHVzr/P65vZ43jXFV9hn5VTvhNofiDmAgTiPP+4Xo25FHtzu2CDwd7ve1zZZ8WyunmHx5kevdCQBcscKnpHO5MK1EBG2acThWD3HbfzncLkP6w5ZkLngGieIB1C3UjpzbbcBTeQ2NJnra59ZpouZ/ivqoxr/xqCakKlRmi201PV4DzB3HEYhODnmieykZcpSU77EuQb5H5w4k/YY0I9ZVrwyBuMfEducUPV8ghV6HRuZYUNWhOOr+rSmPSvi24kH8kkuoG7D+6aZbLpezyl6u6RvFuwGC784nr1nLXFSMOQpjND23SuGWn6iAcSCqxJ5eBIh50U2ZylsavBjaMDp94esBEG/YyWKcFO5b3xPr75/cwaeLGttdrnMfyWFG6Iz1yFxiMvTNqLKRlGNduK6OPTet89ymu1Gau+l5kfn9YE22gvwCRWU2GuCyTk/PigFyrAKmKduglUecW+Wgylh2OQ6YLJkE3nnJ2u+ujEJsqNdoQBJRFYm4efPFp0WK6DrAmOT/fAD6TyLitWwH+1XFgDR3IKynHgTVaG5SVhjBrT9NA59b90FDmQJmKiVMItDFTn6Ir2+qMw3mvl/xHoXJ6QRuNEOTWtqh8QeJIU5+tjr0pfW+Dz4/fydmOYX3khVZADR9 greg@jude"; + user3 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDUd5LQVl/spIfJ3mh/MERlCfSIHCh3jXnaNVnyHY2AVD2dFVgFX+Q+1adA64plXqXHEQVb3q2EMzVW14QAMP9VJspnODgpyMHwpxp6ZNUsZIH83RN8kauVHgW2LRDCZ4DLRzbqaeDm92rntapoUB74Vjto00AE3gWyGQp/v6BeAUhqE0J2p6T6xDgsuyJ+Tzm2YEUozFW8w8LSGDgaoTKzjq0WVkAo9rNaxGLr/ez8P3SUHgb2VSUrL1qrHE99KL8rravOjP0aQmGGWu/MOjgvh7icQuqYlBF6MHfxeSd7/FZApVNKzEXD9TKBg5IaCOjHH2GHnxthSC0mcjKmF2EVAXuWYDARqxmtIfV/9YdeECEFxzB6X+t6b3RYxA0/oa5Zt70WH2LILmc3U5EfiRf88x4WcsdmbcsKQ74/julgg7vYlTlndBxvl8Nd1IKd6ZD3nJBMMMKrDOYbME5r6x2VTzm/RQkpp+SHarCMXxjukhguYY3Iz9CTO2hdGaQ/41ftlOhpb3I1Gai9GymTPFDt9n3JCEVyQ1+a97ELVr+Ky1L3hMewE8nqZFIoXUB2RFMu2pD9GggDO2e6bXdN3SIHLL/8amoDK62iYgVEp1XBkzHJ7U6hhIYbkFji0KK8A7Cwg8+gOKdovycJIAWndHjaDcLmWDlBktqHIRQvLMTzE9f935faTcrSTpnrCLK/pR3f7ir7HGpD8lUug8m7DfxhH3am1Fz7uY9iNI1GLctexC7espXq/xEA/+j7JRVVKbpIubXcmJjNlKs6jOx849SpdWvLlnJpqo1PIjxE9ZDa7zlPSLMTKGTuY0ekKvvbuaOhcOBuYg1RfbdN1QIX5ba86U7giFMZb7wGh7Pbsy0PhFgO7ANgNZy81RKp45G8ozHLnXCj/qhstqjcEgUICDkT/CGnNkreu023kqOaix0nELBLwWBVM/5iWmKQZnpiBhHHDNJ3Q6DsCkIUdfOWZNCIRwGDPuV8uMOEHJIemg25Z282QqWUIfWzGOO1f0ylVmhTQooZIfjhyGXxKa6AV+/tAXQtkF5B1Z8rB5A3pYYLDmnY1E007sWpvm2L/HKV7cWUX7bkuS+qBXZyHxEn+cc6YvalJbDi5/bE5kFQudZFgKInwFiMLhX/8BpbgBUv+6MvvCn79o9qnoOnkI36A9bEOdQKpjwPdg9tkVWr0RotXfP62tIAQsxS05J7yxprC5Uitf+Bhp+Hph0tS/hyxTbN1h30vfdABouvQpcqbgUlp6psyTT17efeNbGcs9l4gkg4HOGpmF60alA1+PBZ1l7ba6bglp+CZoeA5qsCTmMxT5yLaWcEck/8WR3NHQqkER5ZyH1204Kci35kNon69y1/ greg@linode"; + user4 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCoGGV3eD1oF0O62JZfCWNxmViRjRGQsfOhRkQfzQROkwDlFZ7S1+02fudD9t7mPtZE6dQ4yS2+6Q3NIfGW8NBbZAlWwsQ6PnrpuAhWpWc+ng/IDQd9CH/rBCt5bWSLL8AGHa4c+qde7iyoFGK0l9jXVD9wATBFQ274WTmPacVQVHmIAmJS6ISmR6vlq9eaDj1fX8wixao6WvzfwAUvXIs8nhPEfmtyu4T/1Eev9rVIxOw3ODQjk/E0VWV4Koeptsyc+V+j+XMyA91v8f20T4Uwe5LGnJHSQS0WavHnCMWHb1tzkmiKdaNCymoDUcUF2rywMYry7JN0kZo2mp2d7OzE/RP3bz/IsAI33+DwRlDYDNzgeLsLVmOJij61AtqBZque6WDcyCF8HN0ZaY0KJPOtNlN92+GUBRF/Faei0MXZ7wW2BZL5Bc7qnXc9USyhPNsm2vQ7LLhh/NtBGqB88+C+AidTTZ/xiIHKWZJXPkWLPRcK5cfaFqHFqcVMk4U+b0FYB95vYPKmjURlAZ6WrU6dNaNaMH9hJSE6/03is4hb4t8RCRiNaR41pEACDZbATjY0DInFn1LxxpUV66xfpOVg5hKm5ScIks3KxWJ8i3v4/cX7WvbDC/UzWb2UygpsqR7/1n5LV1SNPl+/qxFfdaOyZ8WVvx7DKGxkKfkPBgGwdpSthdv7BY+SC4sT9WXQAPGnvOIk6HwKhHjJYX7AIKK64ACfGZbjBC2gg7Ocl4HkgwpYYlUWLRJdJUhHOCi3VhPZDspYhw/UxPnUhYa8lxq5l7kgkks/tFe1qHOvPe3QRW6brg3EdJNkwtMrlrstW4/nph/KFqSshzNVDlEqTAnhE1cjbBZNmlHt1Un4ixcW1b8b86mE+472pSsIEfO8vxP26brQhxepJFZGOFv2vs3XDrrtn6IMJok4e+AQSCCY0kCcgfG5nMYXUoWpGyTpN/JLG0joJuhPWt58OaOzzKNPq2+rCVAbS7/UmDCqkwxjCywxOZRwluBsEWbZaLEdOwQOfIZQGwSDBM0hfHJJxMSaLN3rCe6VZb+c/5mFXUZ46L5mOGkRlO1TOEAe4jqawAQnuGaHN8mMWSw1gKM+UBXTKa0tBR6Aj/OSfPW0jU+mz/YzzJkzNnlRFiSrLxWvL4eXaBsMZvgKdpA41+E4JG8Vu+9D9KNGRnLASOCxRknV18MubZlEEyKby9A6TaKoPrz7GVQZP+36V9DtAJAza74nHSDNAQG/4w2BLOw9+VrDNdXwjMbgG+SN4f1K+e554OirtSMVB73VXjdwoH/FyX+7+dcUZRQ7V2n37jIVOE6CcuEPjzdnkvKSqBsdTO3Bt66+QtS9BwGHu5c01+Q7jvIl greg@nixos"; + user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; + user6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; + users = [ + user + linode_user + user1 + user2 + user3 + user4 + user5 + ]; everyone = systems ++ users; in @@ -21,5 +36,5 @@ in "3proxy.age".publicKeys = everyone; - "dendrite.age".publicKeys = everyone; + #"dendrite.age".publicKeys = everyone; } From 64834c6f8383440ee06f4d9e1559563806a2a63f Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 29 Jun 2023 00:27:30 -0500 Subject: [PATCH 09/19] Add Genesis --- home/ssh/authorized_keys | 1 + hosts/default.nix | 10 ++- hosts/genesis/default.nix | 43 +++++++++++ hosts/genesis/dnsmasq.nix | 80 +++++++++++++++++++++ hosts/genesis/hardware-configuration.nix | 42 +++++++++++ hosts/genesis/home-assistant.nix | 90 ++++++++++++++++++++++++ hosts/genesis/networking.nix | 75 ++++++++++++++++++++ hosts/genesis/vhosts.nix | 15 ++++ 8 files changed, 355 insertions(+), 1 deletion(-) create mode 100644 hosts/genesis/default.nix create mode 100644 hosts/genesis/dnsmasq.nix create mode 100644 hosts/genesis/hardware-configuration.nix create mode 100755 hosts/genesis/home-assistant.nix create mode 100644 hosts/genesis/networking.nix create mode 100644 hosts/genesis/vhosts.nix diff --git a/home/ssh/authorized_keys b/home/ssh/authorized_keys index a657b83..e388d30 100644 --- a/home/ssh/authorized_keys +++ b/home/ssh/authorized_keys @@ -4,3 +4,4 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDUd5LQVl/spIfJ3mh/MERlCfSIHCh3jXnaNVnyHY2A ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCoGGV3eD1oF0O62JZfCWNxmViRjRGQsfOhRkQfzQROkwDlFZ7S1+02fudD9t7mPtZE6dQ4yS2+6Q3NIfGW8NBbZAlWwsQ6PnrpuAhWpWc+ng/IDQd9CH/rBCt5bWSLL8AGHa4c+qde7iyoFGK0l9jXVD9wATBFQ274WTmPacVQVHmIAmJS6ISmR6vlq9eaDj1fX8wixao6WvzfwAUvXIs8nhPEfmtyu4T/1Eev9rVIxOw3ODQjk/E0VWV4Koeptsyc+V+j+XMyA91v8f20T4Uwe5LGnJHSQS0WavHnCMWHb1tzkmiKdaNCymoDUcUF2rywMYry7JN0kZo2mp2d7OzE/RP3bz/IsAI33+DwRlDYDNzgeLsLVmOJij61AtqBZque6WDcyCF8HN0ZaY0KJPOtNlN92+GUBRF/Faei0MXZ7wW2BZL5Bc7qnXc9USyhPNsm2vQ7LLhh/NtBGqB88+C+AidTTZ/xiIHKWZJXPkWLPRcK5cfaFqHFqcVMk4U+b0FYB95vYPKmjURlAZ6WrU6dNaNaMH9hJSE6/03is4hb4t8RCRiNaR41pEACDZbATjY0DInFn1LxxpUV66xfpOVg5hKm5ScIks3KxWJ8i3v4/cX7WvbDC/UzWb2UygpsqR7/1n5LV1SNPl+/qxFfdaOyZ8WVvx7DKGxkKfkPBgGwdpSthdv7BY+SC4sT9WXQAPGnvOIk6HwKhHjJYX7AIKK64ACfGZbjBC2gg7Ocl4HkgwpYYlUWLRJdJUhHOCi3VhPZDspYhw/UxPnUhYa8lxq5l7kgkks/tFe1qHOvPe3QRW6brg3EdJNkwtMrlrstW4/nph/KFqSshzNVDlEqTAnhE1cjbBZNmlHt1Un4ixcW1b8b86mE+472pSsIEfO8vxP26brQhxepJFZGOFv2vs3XDrrtn6IMJok4e+AQSCCY0kCcgfG5nMYXUoWpGyTpN/JLG0joJuhPWt58OaOzzKNPq2+rCVAbS7/UmDCqkwxjCywxOZRwluBsEWbZaLEdOwQOfIZQGwSDBM0hfHJJxMSaLN3rCe6VZb+c/5mFXUZ46L5mOGkRlO1TOEAe4jqawAQnuGaHN8mMWSw1gKM+UBXTKa0tBR6Aj/OSfPW0jU+mz/YzzJkzNnlRFiSrLxWvL4eXaBsMZvgKdpA41+E4JG8Vu+9D9KNGRnLASOCxRknV18MubZlEEyKby9A6TaKoPrz7GVQZP+36V9DtAJAza74nHSDNAQG/4w2BLOw9+VrDNdXwjMbgG+SN4f1K+e554OirtSMVB73VXjdwoH/FyX+7+dcUZRQ7V2n37jIVOE6CcuEPjzdnkvKSqBsdTO3Bt66+QtS9BwGHu5c01+Q7jvIl greg@nixos ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCXP9nxL5Hg1R1AtT78zJl+ObCDZsnWWAqAYhTVjpRvYpiTbODvCf2IImvUsLGMdgo/xdSSzNqQcK6+KZVeNbvRSsw0ssWw7ggYnhw/yyv/KDZwnqXsppeucicnwpQNvts154yOqAvuuMaOYCTTQoOVvecDdgtA3svIpfxL3vVB/Mq/Ns/NwoE9XKz3NBYlWytqDcvSwR6Les7RzbMIs6axSfMVNwm9w41dG1NqDMteLjKlQ8bFfrtWXZ4QHKlnEWatOgJIzbP1hU91JvvzfypjleGuE9EBCSayqhu9PuxJ1/yxMJKSMaXUl8SoPMLsPNr1ZS5ZNjkNCvZK4fI+CqyAXtbgeSGKIKqZhg9z6/fR9SG0l3Gh3Prtw+AEuE+Xzb99Bi4IAe8lTaL+lw+z+CmsXR+kcJ4nnNrmf1fnDsI4l1EctVGb3Yt3tutV6GjB4mDjIYKwNBxuIx8hlugmZIy3oEUGrh85o5wnXlJQzmhszS4eas99dj1L5tj5dF4O/ED7SyQI5e7V9Pb5AgolcvLLXcFzDuy43oU8kWvQJMMvbEIFr6qPXWmp8MvrSTucRQCCzWJVudhrYhodXA56tRoJvFIRs0s12p/YXzsmJbKxPiVwLGOlCd2CqbdM2rCqN2LkUeOAQitb/8wv4njRKZ4lgqhjyXnBtoD2Nm/NmuIERoUY9J21dOhc2tg0zLvH120xVKa+WN5HVOOG9LyKl7koyc8nqdSDKFhcN4joYmnZKfyJUJzQIhiQayEfvWfTNJiNVkMIE2OqQ4O64s/7QzOHeHSMzY4TCO7+5bK9ecOqPxCDHLHhO0xVA3/w4FscRkObjkQ6zv3UCFJTSbr4YkdUIk8OtRR2KN9y9txrt/OS1l1DigVyuYUdz/L83+Y8E8d3l0hq/S1YLMwlkCbHE8hm0HxlLuyTA3OqXizRxNk7w4ku9OC4+nHrj03i2apNG0Z/ojcGsJxSBLhPGlPWbDJ2h7YL+lkDZFitdhBZHjIQKC2dNoretA8zEzNk48Pi829NFRuXqjSsq3iOJ1sXP/lMAZvdzbZOQ8CrH5SWb9GDeWR0uh76RXzKXvv5UTtu1PpYj/BHToApc8kUAxpUh3ypjt6bS7XLYtk74PEZHD3HXbpBYBnMNPUp2ecDw6rxpLxq3rnzROriX4Uvy0sOx8Q13ZgrZwxLeEWImlK9qQT4SYytGGxt4vwG0R2B8zS1xNiNC/B8jnBrK4GwnYSuJwNMrJ8vk1u9gn1pCj51RslBsldVzVB30jxNU74iD/WQGJudJrUAYkQ5EpArKZK0GQfaRXM6VzsvyLBA02CZJkeIU0jUc6Q1Nms+C8teKrP8+EKXONT/igsLXwfLMiR2CqVP greg@nixos diff --git a/hosts/default.nix b/hosts/default.nix index 9311317..00c6e45 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -36,7 +36,15 @@ let ] ++ extraMods; }; in { - "2maccabees" = unstable { name = "2maccabees"; system = "aarch64-linux"; }; + "2maccabees" = unstable { + system = "aarch64-linux"; + name = "2maccabees"; + }; + genesis = unstable { + name = "genesis"; + gnome = true; + gui = true; + }; jude = unstable { name = "jude"; gnome = true; diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix new file mode 100644 index 0000000..955543c --- /dev/null +++ b/hosts/genesis/default.nix @@ -0,0 +1,43 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ./dnsmasq.nix + ./hardware-configuration.nix + ./home-assistant.nix + ./networking.nix + ./vhosts.nix + ]; + + greg.home = true; + greg.gnome.enable = true; + + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + boot.loader.efi.efiSysMountPoint = "/boot/efi"; + + networking.hostName = "genesis"; # Define your hostname. + + # Enable sound with pipewire. + sound.enable = true; + hardware.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; +} diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix new file mode 100644 index 0000000..578cab0 --- /dev/null +++ b/hosts/genesis/dnsmasq.nix @@ -0,0 +1,80 @@ +{ config, pkgs, ... }: + +let + extraHosts = builtins.concatStringsSep "\n" [ + # Local hosts + "10.42.0.1 switch" + "10.42.1.1 router" + "10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.3 printer" + "10.42.1.4 chronicles nas" + "10.42.1.12 tv" + + # Tailscale hosts + "100.90.74.19 jude.me.ts" + "100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts" + "100.119.228.115 chronicles.me.ts nas.me.ts" + "100.115.57.8 linode.me.ts" + + # Dev hosts + "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" + ]; + + extraConfig = builtins.concatStringsSep "\n" [ + ]; +in +{ + # Enable the service with its own configuration + services.dnsmasq = { + enable = true; + # Public AdGuard DNS servers + settings = { + domain = "thehellings.lan"; + dhcp-range = [ + # "eth0,10.42.0.1,10.42.1.255,255.255.0.0,static" + "eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h" + "vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h" + "vlan67@eth0,192.168.67.3,192.168.67.150,12h" + ]; + dhcp-option = [ + "eth0,option:router,10.42.1.1" + "eth0,option:dns-server,10.42.1.2,1.1.1.1" + "eth0,option:domain-search,thehellings.lan" + + "vlan66@eth0,option:router,192.168.66.1" + "vlan66@eth0,option:dns-server,192.168.66.2" + + "vlan67@eth0,option:router,192.168.67.1" + "vlan67@eth0,option:dns-server,192.168.67.2" + ]; + expand-hosts = true; + log-dhcp = true; + log-queries = true; + addn-hosts = "/etc/adblock_hosts"; + server = [ + "94.140.14.14" + "94.140.15.15" + ]; + }; + extraConfig = "${extraConfig}"; + }; + environment.systemPackages = [ pkgs.curl ]; + + # Regularly update DNS block list + services.cron = { + enable = true; + systemCronJobs = [ + "* * * * * root ( ${pkgs.curl}/bin/curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts && systemctl restart dnsmasq ) 2>&1 > /var/log/adblock.log" + ]; + }; + + # Allow traffic through + networking.firewall = { + enable = true; + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 67 ]; + }; + + # Custom host addition + networking.extraHosts = "${extraHosts}"; +} diff --git a/hosts/genesis/hardware-configuration.nix b/hosts/genesis/hardware-configuration.nix new file mode 100644 index 0000000..e8f467d --- /dev/null +++ b/hosts/genesis/hardware-configuration.nix @@ -0,0 +1,42 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; + + fileSystems."/boot/efi" = + { device = "/dev/disk/by-uuid/5AC6-50D7"; + fsType = "vfat"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; + # networking.interfaces.eth2.useDHCP = lib.mkDefault true; + + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix new file mode 100755 index 0000000..bb014d8 --- /dev/null +++ b/hosts/genesis/home-assistant.nix @@ -0,0 +1,90 @@ +{ config, pkgs, ... }: + +let + service_list = [ "podman-home-assistant.service" ]; +in +{ + virtualisation.podman.enable = true; + + services.home-assistant = { + enable = true; + configDir = "/var/lib/hass"; + package = (pkgs.home-assistant.override { + extraComponents = [ + "accuweather" + "calendar" + "cast" + "eufy" + "lovelace" + "nextcloud" + "smart_meter_texas" + "solaredge" + "tplink" + "wiz" + "zwave_js" + ]; + }).overrideAttrs (oldAttrs: { + doInstallCheck = false; + }); + + config = { + default_config = {}; + esphome = {}; # Get these things loaded, even if not configured + met = {}; + tts = [ { platform = "google_translate"; } ]; + http = { + use_x_forwarded_for = true; + trusted_proxies = [ "127.0.0.1" "::1" ]; + server_host = "127.0.0.1"; + }; + #"automation manual" = *nix config here* and so on + "automation ui" = "!include automations.yaml"; + "script ui" = "!include scripts.yaml"; + "scene ui" = "!include scenes.yaml"; + }; + }; + + # Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream + # is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here + # and avoid any potential messes from that + virtualisation.oci-containers = { + backend = "podman"; + + # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up + # its container and map the ZWave device into it + containers.zwave = { + image = "zwavejs/zwavejs2mqtt:latest"; + ports = [ "8091:8091" "3000:3000" ]; + volumes = [ "/var/lib/zwave:/usr/src/app/store" ]; + extraOptions = [ + "--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave" + "--pull=newer" + ]; + }; + }; + + # Both of the above container need storage for their configuration and devices, but it is not created correctly by + # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files + systemd.services = { + "podman-zwave".serviceConfig = { + StateDirectory = "zwave"; + StateDirectoryMode = pkgs.lib.mkForce "0777"; + }; + }; + + + greg.proxies."smart.thehellings.lan".target = "http://127.0.0.1:8123"; + + # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect + # directly for troubleshooting Nginx configuration + networking.firewall = { + enable = true; + allowedTCPPorts = [ 80 443 8091 8123 ]; + }; + + greg.backup.jobs.zwave = { + src = "/var/lib/zwave"; + dest = "zwave"; + user = "root"; + }; +} diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix new file mode 100644 index 0000000..c2234f2 --- /dev/null +++ b/hosts/genesis/networking.nix @@ -0,0 +1,75 @@ +{ ... }: + +{ + greg.tailscale.enable = true; + + networking = { + # This value is deprecated, you now set it per interface + useDHCP = false; + defaultGateway = "10.42.1.1"; + # 100.100.100.100 is the tailscale DNS + nameservers = [ "100.100.100.100" "127.0.0.1" ]; + interfaces = { + eth0.ipv4.addresses = [ { + address = "10.42.1.2"; + prefixLength = 16; + } ]; + wlan0.useDHCP = true; + + vlan66.ipv4.addresses = [ { + address = "192.168.66.2"; + prefixLength = 24; + } ]; + }; + + vlans = { + vlan66 = { + id = 66; + interface = "eth0"; + }; + }; + }; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + fileSystems."/media" = { + device = "10.42.1.4:/volume1/video/"; + fsType = "nfs"; + options = [ "ro" ]; + }; + + services.jellyfin = { + enable = true; + openFirewall = true; + }; + + greg.proxies."jellyfin.thehellings.lan".target = "http://localhost:8096"; + greg.proxies."jellyfin.me.ts".target = "http://localhost:8096"; + + ######### + # Blind service proxy behind the walls of the VPN + ######## + services._3proxy = { + enable = true; + services = [ { + type = "socks"; + auth = [ "strong" ]; + bindPort = 3128; + acl = [ { + rule = "allow"; + users = [ "greg" ]; + } ]; + } ]; + usersFile = "/run/agenix/3proxy"; + denyPrivate = false; + }; + age.secrets."3proxy" = { + file = ../../secrets/3proxy.age; + mode = "777"; + }; + networking.firewall.allowedTCPPorts = [ 3128 ]; +} diff --git a/hosts/genesis/vhosts.nix b/hosts/genesis/vhosts.nix new file mode 100644 index 0000000..1a2fd22 --- /dev/null +++ b/hosts/genesis/vhosts.nix @@ -0,0 +1,15 @@ +# Virtual hosts that don't seem to have any better place to live should go in here. +# There are others that are specific to their own purposese scattered about in the +# configuration in places where they more naturally live. This is more of a catchall +# for ones that do not have a better place to live +{ ... }: + +{ + greg.proxies."dns.thehellings.lan" = { + target = "http://127.0.0.1:8384/"; + path = "/sync/"; + }; + + # The module doesn't handle this + services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ]; +} From 2714146e1c85543c9c2473c4033f983c14827bb5 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 29 Jun 2023 00:46:20 -0500 Subject: [PATCH 10/19] Add genesis secrets --- secrets/secrets.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/secrets/secrets.nix b/secrets/secrets.nix index ce865f6..250b604 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -4,6 +4,7 @@ let systems = [ linode macca2 ]; user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; + genesis_user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCXP9nxL5Hg1R1AtT78zJl+ObCDZsnWWAqAYhTVjpRvYpiTbODvCf2IImvUsLGMdgo/xdSSzNqQcK6+KZVeNbvRSsw0ssWw7ggYnhw/yyv/KDZwnqXsppeucicnwpQNvts154yOqAvuuMaOYCTTQoOVvecDdgtA3svIpfxL3vVB/Mq/Ns/NwoE9XKz3NBYlWytqDcvSwR6Les7RzbMIs6axSfMVNwm9w41dG1NqDMteLjKlQ8bFfrtWXZ4QHKlnEWatOgJIzbP1hU91JvvzfypjleGuE9EBCSayqhu9PuxJ1/yxMJKSMaXUl8SoPMLsPNr1ZS5ZNjkNCvZK4fI+CqyAXtbgeSGKIKqZhg9z6/fR9SG0l3Gh3Prtw+AEuE+Xzb99Bi4IAe8lTaL+lw+z+CmsXR+kcJ4nnNrmf1fnDsI4l1EctVGb3Yt3tutV6GjB4mDjIYKwNBxuIx8hlugmZIy3oEUGrh85o5wnXlJQzmhszS4eas99dj1L5tj5dF4O/ED7SyQI5e7V9Pb5AgolcvLLXcFzDuy43oU8kWvQJMMvbEIFr6qPXWmp8MvrSTucRQCCzWJVudhrYhodXA56tRoJvFIRs0s12p/YXzsmJbKxPiVwLGOlCd2CqbdM2rCqN2LkUeOAQitb/8wv4njRKZ4lgqhjyXnBtoD2Nm/NmuIERoUY9J21dOhc2tg0zLvH120xVKa+WN5HVOOG9LyKl7koyc8nqdSDKFhcN4joYmnZKfyJUJzQIhiQayEfvWfTNJiNVkMIE2OqQ4O64s/7QzOHeHSMzY4TCO7+5bK9ecOqPxCDHLHhO0xVA3/w4FscRkObjkQ6zv3UCFJTSbr4YkdUIk8OtRR2KN9y9txrt/OS1l1DigVyuYUdz/L83+Y8E8d3l0hq/S1YLMwlkCbHE8hm0HxlLuyTA3OqXizRxNk7w4ku9OC4+nHrj03i2apNG0Z/ojcGsJxSBLhPGlPWbDJ2h7YL+lkDZFitdhBZHjIQKC2dNoretA8zEzNk48Pi829NFRuXqjSsq3iOJ1sXP/lMAZvdzbZOQ8CrH5SWb9GDeWR0uh76RXzKXvv5UTtu1PpYj/BHToApc8kUAxpUh3ypjt6bS7XLYtk74PEZHD3HXbpBYBnMNPUp2ecDw6rxpLxq3rnzROriX4Uvy0sOx8Q13ZgrZwxLeEWImlK9qQT4SYytGGxt4vwG0R2B8zS1xNiNC/B8jnBrK4GwnYSuJwNMrJ8vk1u9gn1pCj51RslBsldVzVB30jxNU74iD/WQGJudJrUAYkQ5EpArKZK0GQfaRXM6VzsvyLBA02CZJkeIU0jUc6Q1Nms+C8teKrP8+EKXONT/igsLXwfLMiR2CqVP greg@genesis"; linode_user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDUd5LQVl/spIfJ3mh/MERlCfSIHCh3jXnaNVnyHY2AVD2dFVgFX+Q+1adA64plXqXHEQVb3q2EMzVW14QAMP9VJspnODgpyMHwpxp6ZNUsZIH83RN8kauVHgW2LRDCZ4DLRzbqaeDm92rntapoUB74Vjto00AE3gWyGQp/v6BeAUhqE0J2p6T6xDgsuyJ+Tzm2YEUozFW8w8LSGDgaoTKzjq0WVkAo9rNaxGLr/ez8P3SUHgb2VSUrL1qrHE99KL8rravOjP0aQmGGWu/MOjgvh7icQuqYlBF6MHfxeSd7/FZApVNKzEXD9TKBg5IaCOjHH2GHnxthSC0mcjKmF2EVAXuWYDARqxmtIfV/9YdeECEFxzB6X+t6b3RYxA0/oa5Zt70WH2LILmc3U5EfiRf88x4WcsdmbcsKQ74/julgg7vYlTlndBxvl8Nd1IKd6ZD3nJBMMMKrDOYbME5r6x2VTzm/RQkpp+SHarCMXxjukhguYY3Iz9CTO2hdGaQ/41ftlOhpb3I1Gai9GymTPFDt9n3JCEVyQ1+a97ELVr+Ky1L3hMewE8nqZFIoXUB2RFMu2pD9GggDO2e6bXdN3SIHLL/8amoDK62iYgVEp1XBkzHJ7U6hhIYbkFji0KK8A7Cwg8+gOKdovycJIAWndHjaDcLmWDlBktqHIRQvLMTzE9f935faTcrSTpnrCLK/pR3f7ir7HGpD8lUug8m7DfxhH3am1Fz7uY9iNI1GLctexC7espXq/xEA/+j7JRVVKbpIubXcmJjNlKs6jOx849SpdWvLlnJpqo1PIjxE9ZDa7zlPSLMTKGTuY0ekKvvbuaOhcOBuYg1RfbdN1QIX5ba86U7giFMZb7wGh7Pbsy0PhFgO7ANgNZy81RKp45G8ozHLnXCj/qhstqjcEgUICDkT/CGnNkreu023kqOaix0nELBLwWBVM/5iWmKQZnpiBhHHDNJ3Q6DsCkIUdfOWZNCIRwGDPuV8uMOEHJIemg25Z282QqWUIfWzGOO1f0ylVmhTQooZIfjhyGXxKa6AV+/tAXQtkF5B1Z8rB5A3pYYLDmnY1E007sWpvm2L/HKV7cWUX7bkuS+qBXZyHxEn+cc6YvalJbDi5/bE5kFQudZFgKInwFiMLhX/8BpbgBUv+6MvvCn79o9qnoOnkI36A9bEOdQKpjwPdg9tkVWr0RotXfP62tIAQsxS05J7yxprC5Uitf+Bhp+Hph0tS/hyxTbN1h30vfdABouvQpcqbgUlp6psyTT17efeNbGcs9l4gkg4HOGpmF60alA1+PBZ1l7ba6bglp+CZoeA5qsCTmMxT5yLaWcEck/8WR3NHQqkER5ZyH1204Kci35kNon69y1/ greg@linode"; user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; @@ -13,8 +14,9 @@ let user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; user6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; users = [ - user + genesis_user linode_user + user user1 user2 user3 @@ -35,6 +37,4 @@ in "drone.age".publicKeys = everyone; "3proxy.age".publicKeys = everyone; - - #"dendrite.age".publicKeys = everyone; } From 70b76382ec5860113df1cba1ba387ec2b3a952e9 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 18 Aug 2023 20:46:37 -0500 Subject: [PATCH 11/19] Basic network server setup --- hosts/genesis/default.nix | 76 +++++++++++++----------- hosts/genesis/dnsmasq.nix | 26 ++++---- hosts/genesis/hardware-configuration.nix | 73 ++++++++++++----------- hosts/genesis/networking.nix | 42 ++++++++----- hosts/genesis/vhosts.nix | 5 -- 5 files changed, 120 insertions(+), 102 deletions(-) diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 955543c..f00a13d 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -5,39 +5,45 @@ { config, pkgs, ... }: { - imports = - [ # Include the results of the hardware scan. - ./dnsmasq.nix - ./hardware-configuration.nix - ./home-assistant.nix - ./networking.nix - ./vhosts.nix - ]; - - greg.home = true; - greg.gnome.enable = true; - - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - boot.loader.efi.efiSysMountPoint = "/boot/efi"; - - networking.hostName = "genesis"; # Define your hostname. - - # Enable sound with pipewire. - sound.enable = true; - hardware.pulseaudio.enable = false; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - # If you want to use JACK applications, uncomment this - #jack.enable = true; - - # use the example session manager (no others are packaged yet so this is enabled by default, - # no need to redefine it in your config for now) - #media-session.enable = true; - }; + imports = [ + # Include the results of the hardware scan. + ./dnsmasq.nix + ./hardware-configuration.nix + ./home-assistant.nix + ./networking.nix + ./vhosts.nix + ]; + + greg.home = true; + greg.gnome.enable = true; + + # Bootloader. + boot.loader = { + systemd-boot.enable = true; + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot/efi"; + }; + }; + + networking.hostName = "genesis"; # Define your hostname. + + # Enable sound with pipewire. + sound.enable = true; + hardware.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa = { + enable = true; + support32Bit = true; + }; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; } diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix index 578cab0..98769ee 100644 --- a/hosts/genesis/dnsmasq.nix +++ b/hosts/genesis/dnsmasq.nix @@ -22,35 +22,37 @@ let extraConfig = builtins.concatStringsSep "\n" [ ]; + + lanDevice = "enp1s0"; in { # Enable the service with its own configuration services.dnsmasq = { enable = true; - # Public AdGuard DNS servers settings = { domain = "thehellings.lan"; dhcp-range = [ - # "eth0,10.42.0.1,10.42.1.255,255.255.0.0,static" - "eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h" - "vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h" - "vlan67@eth0,192.168.67.3,192.168.67.150,12h" + # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" + "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" + "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" ]; dhcp-option = [ - "eth0,option:router,10.42.1.1" - "eth0,option:dns-server,10.42.1.2,1.1.1.1" - "eth0,option:domain-search,thehellings.lan" + "${lanDevice},option:router,10.42.1.1" + "${lanDevice},option:dns-server,10.42.1.2,1.1.1.1" + "${lanDevice},option:domain-search,thehellings.lan" - "vlan66@eth0,option:router,192.168.66.1" - "vlan66@eth0,option:dns-server,192.168.66.2" + "vlan66@${lanDevice},option:router,192.168.66.1" + "vlan66@${lanDevice},option:dns-server,192.168.66.2" - "vlan67@eth0,option:router,192.168.67.1" - "vlan67@eth0,option:dns-server,192.168.67.2" + "vlan67@${lanDevice},option:router,192.168.67.1" + "vlan67@${lanDevice},option:dns-server,192.168.67.2" ]; expand-hosts = true; log-dhcp = true; log-queries = true; addn-hosts = "/etc/adblock_hosts"; + # Public AdGuard DNS servers server = [ "94.140.14.14" "94.140.15.15" diff --git a/hosts/genesis/hardware-configuration.nix b/hosts/genesis/hardware-configuration.nix index e8f467d..8c1e016 100644 --- a/hosts/genesis/hardware-configuration.nix +++ b/hosts/genesis/hardware-configuration.nix @@ -4,39 +4,42 @@ { config, lib, pkgs, modulesPath, ... }: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9"; - fsType = "btrfs"; - options = [ "subvol=@" ]; - }; - - fileSystems."/boot/efi" = - { device = "/dev/disk/by-uuid/5AC6-50D7"; - fsType = "vfat"; - }; - - swapDevices = - [ { device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; } - ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; - # networking.interfaces.eth2.useDHCP = lib.mkDefault true; - - powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot = { + initrd = { + availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; + kernelModules = [ ]; + }; + kernelModules = [ "kvm-intel" ]; + extraModulePackages = [ ]; + }; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; + + fileSystems."/boot/efi" = { + device = "/dev/disk/by-uuid/5AC6-50D7"; + fsType = "vfat"; + }; + + swapDevices = [ { + device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; + } ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; + # networking.interfaces.eth2.useDHCP = lib.mkDefault true; + + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index c2234f2..29d5463 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -4,17 +4,27 @@ greg.tailscale.enable = true; networking = { - # This value is deprecated, you now set it per interface - useDHCP = false; - defaultGateway = "10.42.1.1"; + enableIPv6 = false; + #defaultGateway = "10.42.1.1"; # 100.100.100.100 is the tailscale DNS - nameservers = [ "100.100.100.100" "127.0.0.1" ]; + nameservers = [ + "1.1.1.1" + #"100.100.100.100" + "127.0.0.1" + ]; interfaces = { - eth0.ipv4.addresses = [ { - address = "10.42.1.2"; + # This is our WAN port + enp2s0 = { + useDHCP = true; + name = "wan"; + }; + + # This is our LAN port + enp1s0.ipv4.addresses = [ { + address = "10.43.1.1"; prefixLength = 16; } ]; - wlan0.useDHCP = true; + wlan0.useDHCP = false; vlan66.ipv4.addresses = [ { address = "192.168.66.2"; @@ -25,7 +35,7 @@ vlans = { vlan66 = { id = 66; - interface = "eth0"; + interface = "enp2s0"; }; }; }; @@ -47,8 +57,10 @@ openFirewall = true; }; - greg.proxies."jellyfin.thehellings.lan".target = "http://localhost:8096"; - greg.proxies."jellyfin.me.ts".target = "http://localhost:8096"; + greg.proxies = { + "jellyfin.thehellings.lan".target = "http://localhost:8096"; + "jellyfin.me.ts".target = "http://localhost:8096"; + }; ######### # Blind service proxy behind the walls of the VPN @@ -64,12 +76,12 @@ users = [ "greg" ]; } ]; } ]; - usersFile = "/run/agenix/3proxy"; + #usersFile = "/run/agenix/3proxy"; denyPrivate = false; }; - age.secrets."3proxy" = { - file = ../../secrets/3proxy.age; - mode = "777"; - }; + #age.secrets."3proxy" = { + # file = ../../secrets/3proxy.age; + # mode = "776"; + #}; networking.firewall.allowedTCPPorts = [ 3128 ]; } diff --git a/hosts/genesis/vhosts.nix b/hosts/genesis/vhosts.nix index 1a2fd22..e899089 100644 --- a/hosts/genesis/vhosts.nix +++ b/hosts/genesis/vhosts.nix @@ -5,11 +5,6 @@ { ... }: { - greg.proxies."dns.thehellings.lan" = { - target = "http://127.0.0.1:8384/"; - path = "/sync/"; - }; - # The module doesn't handle this services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ]; } From ad20ca1856a14d6c168593e7663b134c61512b4a Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 10:20:24 -0500 Subject: [PATCH 12/19] Finer grained home-manager hosts --- darwin/default.nix | 3 ++- darwin/ivr/default.nix | 3 +++ home/home.nix | 12 ++---------- home/hosts/ivr/default.nix | 12 ++++++++++++ home/most/default.nix | 6 ++++++ hosts/jude/virt.nix | 1 + 6 files changed, 26 insertions(+), 11 deletions(-) create mode 100644 home/hosts/ivr/default.nix create mode 100644 home/most/default.nix diff --git a/darwin/default.nix b/darwin/default.nix index 2124885..30d6d49 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -23,8 +23,9 @@ let extraSpecialArgs = { inherit inputs; gnome = false; - gui = true; + gui = false; home = "/Users/gregory.hellings"; + host = name; }; }; users.users."gregory.hellings".home = "/Users/gregory.hellings"; diff --git a/darwin/ivr/default.nix b/darwin/ivr/default.nix index 9c79196..0ad1ba5 100644 --- a/darwin/ivr/default.nix +++ b/darwin/ivr/default.nix @@ -31,5 +31,8 @@ in { } "virt-manager" ]; + casks = [ + "synology-drive" + ]; }; } diff --git a/home/home.nix b/home/home.nix index 04ccc2d..5946ae1 100644 --- a/home/home.nix +++ b/home/home.nix @@ -1,5 +1,6 @@ { pkgs, lib, gui, gnome, inputs, + host ? "most", ...}: { @@ -14,6 +15,7 @@ ./templates.nix ./vim.nix ./xonsh.nix + ./hosts/${host} ] ++ ( if gui then [ ./gui ] else []); @@ -31,21 +33,11 @@ ]); }; - home.file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ - "[global]" - "retries = 1" - "index-url = https://pypi.python.org/simple" - "extra-index-url =" - " https://pypi.ivrtechnology.com/simple/" - " https://pypidev.ivrtechnology.com/simple/" - ]); - home.stateVersion = "23.05"; home.packages = with pkgs; [ bitwarden-cli brew diffutils - dmidecode findutils gimp git diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix new file mode 100644 index 0000000..73791fc --- /dev/null +++ b/home/hosts/ivr/default.nix @@ -0,0 +1,12 @@ +{ pkgs, lib, ...}: + +{ + home.file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ + "[global]" + "retries = 1" + "index-url = https://pypi.python.org/simple" + "extra-index-url =" + " https://pypi.ivrtechnology.com/simple/" + " https://pypidev.ivrtechnology.com/simple/" + ]); +} diff --git a/home/most/default.nix b/home/most/default.nix new file mode 100644 index 0000000..5ca3073 --- /dev/null +++ b/home/most/default.nix @@ -0,0 +1,6 @@ +# Put home configuration here that will affect most boxes +{ pkgs, ... }: + +{ + +} diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index ade6429..a5cbeda 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -2,6 +2,7 @@ { environment.systemPackages = with pkgs; [ + dmidecode guestfs-tools libguestfs ovftool From 8c0a5cac2a383ca5ab8a361aef57e3ae00d8bc68 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 10:28:23 -0500 Subject: [PATCH 13/19] Try to merge with compass branch --- darwin/work/default.nix | 21 ++++++++++++--------- home/gui/default.nix | 11 ----------- home/home.nix | 1 + home/hosts/jude/default.nix | 12 ++++++++++++ home/xonsh.nix | 1 + 5 files changed, 26 insertions(+), 20 deletions(-) create mode 100644 home/hosts/jude/default.nix diff --git a/darwin/work/default.nix b/darwin/work/default.nix index 7992605..6cf2e8d 100644 --- a/darwin/work/default.nix +++ b/darwin/work/default.nix @@ -1,13 +1,16 @@ { pkgs, ... }: { - #greg.pypackages = with pkgs; [ - # dateutil - # ipython - # pyyaml - # responses - # ruamel-yaml - # typing-extensions - # virtualenv - #]; + homebrew = { + enable = true; + brews = [ + "packer" + ]; + casks = [ + "gnucash" + "onlyoffice" + "postman" + "vagrant" + ]; + }; } diff --git a/home/gui/default.nix b/home/gui/default.nix index b8dff15..1af3bcd 100644 --- a/home/gui/default.nix +++ b/home/gui/default.nix @@ -15,11 +15,6 @@ in home.packages = with pkgs; [ cdrtools dconf2nix - ffmpeg - gnucash - handbrake - libtheora - makemkv vlc x265 ] ++ @@ -34,12 +29,6 @@ in nextcloud-client ]) ++ - # Items that just cannot be outside of x86_64 at all - ( excludes ["aarch64-darwin" "aarch64-linux"] - [ - synology-drive-client - ]) ++ - # Items that are not supported on ARM/Linux ( excludes ["aarch64-linux"] [ diff --git a/home/home.nix b/home/home.nix index 5946ae1..324dad4 100644 --- a/home/home.nix +++ b/home/home.nix @@ -48,6 +48,7 @@ inetutils jq nano + nix-prefetch nmap openssl setup-ssh diff --git a/home/hosts/jude/default.nix b/home/hosts/jude/default.nix new file mode 100644 index 0000000..4f00ad3 --- /dev/null +++ b/home/hosts/jude/default.nix @@ -0,0 +1,12 @@ +{ pkgs, ... }: + +{ + home.packages = with pkgs; [ + gnucash + ffmpeg + handbrake + libtheora + makemkv + synology-drive-client + ]; +} diff --git a/home/xonsh.nix b/home/xonsh.nix index 3d03530..14d65ce 100644 --- a/home/xonsh.nix +++ b/home/xonsh.nix @@ -39,6 +39,7 @@ crun = "compass workspace run"; ctest = "compass workspace test"; cylint = "./scripts/run_yaml_lint.py"; + cpip = "compass workspace run src/python3/uc/tools:run_pip_compile"; cleanup = "nix-collect-garbage --delete-older-than 30d && nix store optimise"; d = "vox deactivate"; From 48cd5962073624ca9cad960a03b601578dc6e346 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 10:34:42 -0500 Subject: [PATCH 14/19] Add defaults --- home/home.nix | 3 --- home/hosts/2maccabees/default.nix | 5 +++++ home/hosts/icdm-root/default.nix | 5 +++++ home/hosts/iso/default.nix | 5 +++++ home/hosts/ivr/default.nix | 3 +++ home/hosts/jude/default.nix | 2 ++ home/hosts/lappy/default.nix | 5 +++++ home/hosts/linode/default.nix | 5 +++++ home/hosts/linodeeu/default.nix | 5 +++++ home/hosts/mm/default.nix | 5 +++++ home/hosts/work/default.nix | 7 +++++++ home/hosts/wsl/default.nix | 5 +++++ hosts/default.nix | 1 + 13 files changed, 53 insertions(+), 3 deletions(-) create mode 100644 home/hosts/2maccabees/default.nix create mode 100644 home/hosts/icdm-root/default.nix create mode 100644 home/hosts/iso/default.nix create mode 100644 home/hosts/lappy/default.nix create mode 100644 home/hosts/linode/default.nix create mode 100644 home/hosts/linodeeu/default.nix create mode 100644 home/hosts/mm/default.nix create mode 100644 home/hosts/work/default.nix create mode 100644 home/hosts/wsl/default.nix diff --git a/home/home.nix b/home/home.nix index 324dad4..4b15aa6 100644 --- a/home/home.nix +++ b/home/home.nix @@ -36,10 +36,8 @@ home.stateVersion = "23.05"; home.packages = with pkgs; [ bitwarden-cli - brew diffutils findutils - gimp git gnupatch gregpy @@ -56,7 +54,6 @@ transcrypt tree unzip - vagrant wget ]; } diff --git a/home/hosts/2maccabees/default.nix b/home/hosts/2maccabees/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/2maccabees/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/icdm-root/default.nix b/home/hosts/icdm-root/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/icdm-root/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/iso/default.nix b/home/hosts/iso/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/iso/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix index 73791fc..83b3b28 100644 --- a/home/hosts/ivr/default.nix +++ b/home/hosts/ivr/default.nix @@ -1,6 +1,9 @@ { pkgs, lib, ...}: { + home.packages = with pkgs; [ + brew + ]; home.file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ "[global]" "retries = 1" diff --git a/home/hosts/jude/default.nix b/home/hosts/jude/default.nix index 4f00ad3..25e1a0f 100644 --- a/home/hosts/jude/default.nix +++ b/home/hosts/jude/default.nix @@ -2,11 +2,13 @@ { home.packages = with pkgs; [ + gimp gnucash ffmpeg handbrake libtheora makemkv synology-drive-client + vagrant ]; } diff --git a/home/hosts/lappy/default.nix b/home/hosts/lappy/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/lappy/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/linode/default.nix b/home/hosts/linode/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/linode/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/linodeeu/default.nix b/home/hosts/linodeeu/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/linodeeu/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/mm/default.nix b/home/hosts/mm/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/mm/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/home/hosts/work/default.nix b/home/hosts/work/default.nix new file mode 100644 index 0000000..7c60c06 --- /dev/null +++ b/home/hosts/work/default.nix @@ -0,0 +1,7 @@ +{ pkgs, ... }: + +{ + home.packages = with pkgs; [ + brew + ]; +} diff --git a/home/hosts/wsl/default.nix b/home/hosts/wsl/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/wsl/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/hosts/default.nix b/hosts/default.nix index 9311317..4239ec1 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -26,6 +26,7 @@ let home-manager.extraSpecialArgs = { inherit gnome gui inputs overlays; home = "/home/greg"; + host = name; }; } inputs.agenix.nixosModules.default From 8446d1405ee10161ea18a997a9d9db468698505e Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 10:41:08 -0500 Subject: [PATCH 15/19] Update darwin input --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index 5cfc0da..97926ea 100644 --- a/flake.lock +++ b/flake.lock @@ -49,11 +49,11 @@ ] }, "locked": { - "lastModified": 1689516967, - "narHash": "sha256-sFAa33wkQHanmij/uhfGduIDK8z4dJAita/rK6u9pvE=", + "lastModified": 1692248770, + "narHash": "sha256-tZeFpETKQGbgnaSIO1AGWD27IyTcBm4D+A9d7ulQ4NM=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "61662a63bfe1726588c1da6b412df86d8ca94d63", + "rev": "511177ffe8226c78c9cf6a92a7b5f2df3684956b", "type": "github" }, "original": { From 51460f901f378951297afc3e73358e0fce51b34b Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 11:21:04 -0500 Subject: [PATCH 16/19] Add aacs config script --- darwin/ivr/default.nix | 2 ++ home/hosts/ivr/default.nix | 1 + overlays/aacs.nix | 10 ++++++++++ overlays/default.nix | 3 +-- 4 files changed, 14 insertions(+), 2 deletions(-) create mode 100644 overlays/aacs.nix diff --git a/darwin/ivr/default.nix b/darwin/ivr/default.nix index 0ad1ba5..3678a92 100644 --- a/darwin/ivr/default.nix +++ b/darwin/ivr/default.nix @@ -25,6 +25,7 @@ in { brews = [ "qemu" "gcc" + "libaacs" { name = "libvirt"; restart_service = true; @@ -33,6 +34,7 @@ in { ]; casks = [ "synology-drive" + "handbrake" ]; }; } diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix index 83b3b28..fe4e7cb 100644 --- a/home/hosts/ivr/default.nix +++ b/home/hosts/ivr/default.nix @@ -2,6 +2,7 @@ { home.packages = with pkgs; [ + aacs brew ]; home.file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ diff --git a/overlays/aacs.nix b/overlays/aacs.nix new file mode 100644 index 0000000..cf123a6 --- /dev/null +++ b/overlays/aacs.nix @@ -0,0 +1,10 @@ +{ pkgs, ... }: + +pkgs.writeShellScriptBin "aacs" '' +set -ex +[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs" +cd "''${HOME}/.config/aacs" +[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip +curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng" +${pkgs.unzip}/bin/unzip KEYDB.cfg.zip +mv keydb.cfg KEYDB.cfg'' diff --git a/overlays/default.nix b/overlays/default.nix index e1c9ca1..970ed45 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -54,8 +54,8 @@ in rec { }) ]; + aacs = prev.callPackage ./aacs.nix {}; brew = prev.callPackage ./homebrew.nix {}; - enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; hms = prev.callPackage ./hms.nix { pkgs = final.pkgs; @@ -64,7 +64,6 @@ in rec { setup-ssh = prev.callPackage ./setup-ssh.nix { pkgs = final.pkgs; }; - xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; propagatedBuildInputs = with final.gregpy.pkgs; old.propagatedBuildInputs ++ [ From 51b2cff831405d43ee52fe6f4bfb72222ec460fe Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 13:14:51 -0500 Subject: [PATCH 17/19] Video and Nix GC options Add Nix gc options to keep the store reasonably cleaned up Add GStreamer to Jude build Add libbluray overlay with AACS support --- hosts/jude/default.nix | 12 ++++++++++++ modules-all/default.nix | 6 ++++++ overlays/default.nix | 14 +++++++++----- 3 files changed, 27 insertions(+), 5 deletions(-) diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index 8401320..35ee182 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -17,6 +17,18 @@ greg.kde.enable = false; environment.systemPackages = with pkgs; [ + # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ... + gst_all_1.gstreamer + # Common plugins like "filesrc" to combine within e.g. gst-launch + gst_all_1.gst-plugins-base + # Specialized plugins separated by quality + gst_all_1.gst-plugins-good + gst_all_1.gst-plugins-bad + gst_all_1.gst-plugins-ugly + # Plugins to reuse ffmpeg to play almost every video format + gst_all_1.gst-libav + # Support the Video Audio (Hardware) Acceleration API + gst_all_1.gst-vaapi oathToolkit ]; fileSystems = { diff --git a/modules-all/default.nix b/modules-all/default.nix index 57d8458..ecbdcad 100644 --- a/modules-all/default.nix +++ b/modules-all/default.nix @@ -16,6 +16,12 @@ } ]; + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 30d"; + }; + settings = { auto-optimise-store = true; experimental-features = "nix-command flakes"; diff --git a/overlays/default.nix b/overlays/default.nix index 970ed45..44aa352 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -61,6 +61,10 @@ in rec { pkgs = final.pkgs; }; inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; + libbluray = prev.libbluray.override { + withAACS = true; + withBDplus = true; + }; setup-ssh = prev.callPackage ./setup-ssh.nix { pkgs = final.pkgs; }; @@ -73,9 +77,9 @@ in rec { ]; }); - bitwarden = macOver ./mac/bitwarden.nix "bitwarden"; - gnucash = macOver ./mac/gnucash.nix "gnucash"; - handbrake = macOver ./mac/handbrake.nix "handbrake"; - onlyoffice-bin = macOver ./mac/onlyoffice-bin.nix "onlyoffice-bin"; - vlc = macOver ./mac/vlc.nix "vlc"; + #bitwarden = macOver ./mac/bitwarden.nix "bitwarden"; + #gnucash = macOver ./mac/gnucash.nix "gnucash"; + #handbrake = macOver ./mac/handbrake.nix "handbrake"; + #onlyoffice-bin = macOver ./mac/onlyoffice-bin.nix "onlyoffice-bin"; + #vlc = macOver ./mac/vlc.nix "vlc"; } From 88c28ed0f2ae7808518b10847fd0052c1501be23 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 21:22:26 -0500 Subject: [PATCH 18/19] Genesis buttoned up Removed lots of overlays that are redundant now Added copier to home tools Added static DHCP leases to dnsmasq Improved router Added ability to read Jinja2 template files --- home/home.nix | 2 +- hosts/default.nix | 2 +- hosts/genesis/default.nix | 2 +- hosts/genesis/dnsmasq.nix | 46 +++++++++++++++----- hosts/genesis/home-assistant.nix | 1 - hosts/genesis/networking.nix | 67 ++++++++++++++++++++--------- hosts/genesis/nftables.nft | 47 ++++++++++++++++++++ modules-linux/router.nix | 4 ++ overlays/copier.nix | 57 ------------------------ overlays/default.nix | 24 ++++------- overlays/iteration-utilities.nix | 23 ---------- overlays/jinja2-ansible-filters.nix | 34 --------------- overlays/jinja2-cli.nix | 39 +++++++++++++++++ overlays/pyyaml-include.nix | 42 ------------------ overlays/template.nix | 15 +++++++ 15 files changed, 199 insertions(+), 206 deletions(-) create mode 100644 hosts/genesis/nftables.nft delete mode 100644 overlays/copier.nix delete mode 100644 overlays/iteration-utilities.nix delete mode 100644 overlays/jinja2-ansible-filters.nix create mode 100644 overlays/jinja2-cli.nix delete mode 100644 overlays/pyyaml-include.nix create mode 100644 overlays/template.nix diff --git a/home/home.nix b/home/home.nix index 04ccc2d..d8fa832 100644 --- a/home/home.nix +++ b/home/home.nix @@ -44,10 +44,10 @@ home.packages = with pkgs; [ bitwarden-cli brew + copier diffutils dmidecode findutils - gimp git gnupatch gregpy diff --git a/hosts/default.nix b/hosts/default.nix index 00c6e45..143961f 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -16,7 +16,7 @@ let }; in channel.lib.nixosSystem { inherit system; - specialArgs = { inherit nixpkgs; }; + specialArgs = { inherit nixpkgs inputs; }; modules = [ { nixpkgs.overlays = overlays; diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index f00a13d..1f0d378 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -15,7 +15,7 @@ ]; greg.home = true; - greg.gnome.enable = true; + greg.gnome.enable = false; # Bootloader. boot.loader = { diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix index 98769ee..891c0c5 100644 --- a/hosts/genesis/dnsmasq.nix +++ b/hosts/genesis/dnsmasq.nix @@ -4,17 +4,17 @@ let extraHosts = builtins.concatStringsSep "\n" [ # Local hosts "10.42.0.1 switch" - "10.42.1.1 router" - "10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + #"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" "10.42.1.3 printer" "10.42.1.4 chronicles nas" "10.42.1.12 tv" # Tailscale hosts - "100.90.74.19 jude.me.ts" - "100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts" - "100.119.228.115 chronicles.me.ts nas.me.ts" - "100.115.57.8 linode.me.ts" + "100.90.74.19 jude.shire-zebra.ts.net" + "100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net" + "100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net" + "100.115.57.8 linode.shire-zebra.ts.net" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" @@ -33,13 +33,13 @@ in domain = "thehellings.lan"; dhcp-range = [ # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" - "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h" "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" ]; dhcp-option = [ - "${lanDevice},option:router,10.42.1.1" - "${lanDevice},option:dns-server,10.42.1.2,1.1.1.1" + "${lanDevice},option:router,10.43.1.1" + "${lanDevice},option:dns-server,10.43.1.2,1.1.1.1" "${lanDevice},option:domain-search,thehellings.lan" "vlan66@${lanDevice},option:router,192.168.66.1" @@ -48,6 +48,33 @@ in "vlan67@${lanDevice},option:router,192.168.67.1" "vlan67@${lanDevice},option:dns-server,192.168.67.2" ]; + dhcp-host = [ + # Static IPs for things in the IOT range + "98:da:c4:77:7f:4d,192.168.66.102" + "28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch + "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome + "28:87:ba:0e:c9:fd,192.168.66.75" + "4c:a1:61:05:cd:52,192.168.66.61" + "8c:85:80:1c:f9:d1,192.168.66.104" + "48:d6:d5:5d:81:21,192.168.66.65" # Google Home + "ac:84:c6:5e:4b:28,192.168.66.100" + "d8:0d:17:19:60:62,192.168.66.112" + "0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch + "0c:80:63:41:74:73,192.168.66.106" + "0c:80:63:41:6e:0f,192.168.66.90" + "98:da:c4:20:f3:64,192.168.66.6" + "98:da:c4:21:1b:2e,192.168.66.85" + "98:da:c4:20:ea:db,192.168.66.107" # HS220 switch + "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba + "98:da:c4:77:80:18,192.168.66.84" + "98:da:c4:77:82:7b,192.168.66.105" + "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini + "b4:b0:24:9a:14:0e,192.168.66.131" + "6c:29:90:3e:e2:02,192.168.66.66" # wiz + "54:af:97:83:ed:33,192.168.66.80" + "54:af:97:c2:0f:a1,192.168.66.76" + "b4:b0:24:9a:12:53,192.168.66.130" # KL125 + ]; expand-hosts = true; log-dhcp = true; log-queries = true; @@ -72,7 +99,6 @@ in # Allow traffic through networking.firewall = { - enable = true; allowedTCPPorts = [ 53 ]; allowedUDPPorts = [ 53 67 ]; }; diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index bb014d8..1068f2b 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -78,7 +78,6 @@ in # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect # directly for troubleshooting Nginx configuration networking.firewall = { - enable = true; allowedTCPPorts = [ 80 443 8091 8123 ]; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 29d5463..8374c66 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -1,10 +1,22 @@ -{ ... }: - -{ +{ pkgs, config, ... }: +let + lan = "enp1s0"; + wan = "enp2s0"; + iot = "vlan66"; +in { greg.tailscale.enable = true; + # Really, why do I still have to force-disable this crap? + boot.kernel.sysctl = { + "net.ipv6.conf.${lan}.disable_ipv6" = true; + "net.ipv6.conf.${wan}.disable_ipv6" = true; + "net.ipv6.conf.${iot}.disable_ipv6" = true; + "net.ipv6.conf.lo.disable_ipv6" = true; + }; + networking = { enableIPv6 = false; + networkmanager.enable = pkgs.lib.mkForce false; #defaultGateway = "10.42.1.1"; # 100.100.100.100 is the tailscale DNS nameservers = [ @@ -14,37 +26,52 @@ ]; interfaces = { # This is our WAN port - enp2s0 = { + "${wan}" = { useDHCP = true; - name = "wan"; }; # This is our LAN port - enp1s0.ipv4.addresses = [ { - address = "10.43.1.1"; - prefixLength = 16; - } ]; + "${lan}" = { + ipv4.addresses = [ { + address = "10.42.1.1"; + prefixLength = 16; + } ]; + useDHCP = false; + }; wlan0.useDHCP = false; - vlan66.ipv4.addresses = [ { - address = "192.168.66.2"; - prefixLength = 24; - } ]; + "${iot}" = { + useDHCP = false; + ipv4.addresses = [ { + address = "192.168.66.2"; + prefixLength = 24; + } ]; + }; }; vlans = { - vlan66 = { + "${iot}" = { id = 66; - interface = "enp2s0"; + interface = lan; }; }; + + firewall.enable = false; + # Router portion here + nftables = let + myvars = { + lanInterfaces = [ lan ]; + wanInterface = wan; + limitedLan = [ iot ]; + tcpPorts = config.networking.firewall.allowedTCPPorts; + udpPorts = config.networking.firewall.allowedUDPPorts; + }; + in { + enable = true; + rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft; + }; }; - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; fileSystems."/media" = { device = "10.42.1.4:/volume1/video/"; diff --git a/hosts/genesis/nftables.nft b/hosts/genesis/nftables.nft new file mode 100644 index 0000000..19fe0be --- /dev/null +++ b/hosts/genesis/nftables.nft @@ -0,0 +1,47 @@ +#!/usr/bin/env nft -f + +table ip filter { + chain output { + type filter hook output priority 100; policy accept; + } + + chain input { + type filter hook input priority 0; policy drop; + + iifname lo accept + + # Open the specific ports that we allow + {% for port in tcpPorts %} + iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept + {% endfor %} + {% for port in udpPorts %} + iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept + {% endfor %} + + iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing" + iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections" + iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic" + iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much" + } + chain forward { + type filter hook forward priority 0; policy drop; + iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN" + iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic" + } +} + +table ip nat { + chain postrouting { + type nat hook postrouting priority 100; policy accept; + oifname { {{ wanInterface }} } masquerade + } +} + +table ip6 filter { + chain input { + type filter hook input priority 0; policy drop; + } + chain forward { + type filter hook forward priority 0; policy drop; + } +} diff --git a/modules-linux/router.nix b/modules-linux/router.nix index 0a7f561..b483587 100644 --- a/modules-linux/router.nix +++ b/modules-linux/router.nix @@ -17,6 +17,10 @@ let udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; in lib.strings.concatStringsSep "\n" [ "table ip filter {" + " chain output {" + " type filter hook output priority 100; policy accept;" + " }" + " chain input {" " type filter hook input priority 0; policy drop;" diff --git a/overlays/copier.nix b/overlays/copier.nix deleted file mode 100644 index 82fa817..0000000 --- a/overlays/copier.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs, -colorama, -dunamai, -iteration-utilities, -jinja2, -jinja2-ansible-filters, -packaging, -pathspec, -plumbum, -pydantic, -pygments, -pyyaml, -pyyaml-include, -questionary, -setuptools, -wheel}: - -let - pydeps = [ - colorama - dunamai - iteration-utilities - jinja2 - jinja2-ansible-filters - packaging - pathspec - plumbum - pydantic - pygments - pyyaml - pyyaml-include - questionary - setuptools - wheel - ]; -in buildPythonPackage rec { - pname = "copier"; - version = "6.2.0"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-eSxm7Rpu3dhWkLoSA1/b8IemWxjIsHwlJ+NYEpbilkk="; - }; - - meta = with lib; { - description = "A library and CLI app for rendering templates"; - homepage = "https://github.com/copier-org/copier"; - license = licenses.mit; - maintainers = []; - }; - - doCheck = false; - - propagatedBuildInputs = pydeps; - - buildInputs = []; -} diff --git a/overlays/default.nix b/overlays/default.nix index e1c9ca1..6ee8c09 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -3,7 +3,6 @@ final: prev: let myPackages = pypackages: with pypackages; [ black - copier dateutil flake8 ipython @@ -42,28 +41,21 @@ in rec { xonsh-apipenv = cp ./xonsh-apipenv.nix {}; xonsh-direnv = cp ./xonsh-direnv.nix {}; xontrib-vox = cp ./xonsh-vox.nix {}; - copier = cp ./copier.nix { - inherit (python-final) - iteration-utilities - jinja2-ansible-filters - pyyaml-include; - }; - iteration-utilities = cp ./iteration-utilities.nix {}; - jinja2-ansible-filters = cp ./jinja2-ansible-filters.nix {}; - pyyaml-include = cp ./pyyaml-include.nix {}; }) ]; brew = prev.callPackage ./homebrew.nix {}; - - enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; - hms = prev.callPackage ./hms.nix { - pkgs = final.pkgs; - }; - inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; setup-ssh = prev.callPackage ./setup-ssh.nix { pkgs = final.pkgs; }; + hms = prev.callPackage ./hms.nix { + pkgs = final.pkgs; + }; + jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {}; + template = prev.callPackage ./template.nix { }; + + enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; + inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; diff --git a/overlays/iteration-utilities.nix b/overlays/iteration-utilities.nix deleted file mode 100644 index cb272ca..0000000 --- a/overlays/iteration-utilities.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs}: - -buildPythonPackage rec { - pname = "iteration-utilities"; - version = "0.11.0"; - - src = fetchPypi { - inherit version; - pname = "iteration_utilities"; - sha256 = "sha256-+R9BolSemn5A/1Rg/fkDO27lswXZvneUO2OlVFNMKnc="; - }; - - meta = with lib; { - description = "Utilities based on Pythons iterators and generators."; - homepage = "https://github.com/MSeifert04/iteration_utilities"; - license = licenses.afl20; - maintainers = []; - }; - - propagatedBuildInputs = []; - - doCheck = false; -} diff --git a/overlays/jinja2-ansible-filters.nix b/overlays/jinja2-ansible-filters.nix deleted file mode 100644 index c6eacad..0000000 --- a/overlays/jinja2-ansible-filters.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs}: - -let - pydeps = pypkgs: with pypkgs; [ - ansible-core - setuptools - wheel - ]; -in buildPythonPackage rec { - pname = "jinja2-ansible-filters"; - version = "1.3.2"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs="; - }; - - meta = with lib; { - description = "A port of the Jinja2 filters from Ansible"; - homepage = "https://gitlab.com/dreamer-labs/libraries/jinja2-ansible-filters"; - license = licenses.gpl3; - maintainers = []; - }; - - doCheck = false; - - buildInputs = with pkgs; [ - (python3.withPackages pydeps) - ]; - - nativeBuildInputs = with pkgs; [ - (python3.withPackages pydeps) - ]; -} diff --git a/overlays/jinja2-cli.nix b/overlays/jinja2-cli.nix new file mode 100644 index 0000000..4cca67b --- /dev/null +++ b/overlays/jinja2-cli.nix @@ -0,0 +1,39 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + + flake8, + jinja2, + pytestCheckHook, + setuptools, +}: + +buildPythonPackage { + pname = "jinja2-cli"; + version = "0.8.2"; + + src = fetchFromGitHub { + owner = "mattrobenolt"; + repo = "jinja2-cli"; + rev = "0.8.2"; + hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0="; + }; + + propagatedBuildInputs = [ + jinja2 + setuptools + ]; + + checkInputs = [ + flake8 + pytestCheckHook + ]; + + meta = with lib; { + description = "A CLI interface for Jinja2 templates"; + homepage = "https://github.com/mattrobenolt/jinja2-cli"; + license = licenses.bsd2; + maintainers = [ lib.maintainers.greg ]; + }; +} diff --git a/overlays/pyyaml-include.nix b/overlays/pyyaml-include.nix deleted file mode 100644 index 4a6213f..0000000 --- a/overlays/pyyaml-include.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs, -pyyaml, -setuptools, -setuptools-scm, -setuptools-scm-git-archive, -wheel -}: - -let - pydeps = [ - pyyaml - ]; -in buildPythonPackage rec { - pname = "pyyaml-include"; - version = "1.3"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E="; - }; - - meta = with lib; { - description = "A PyYAML extension to allow includes."; - homepage = "https://github.com/tanbro/pyyaml-include"; - license = licenses.gpl3; - maintainers = []; - }; - - doCheck = false; - - propagatedBuildInputs = pydeps; - - buildInputs = [ - setuptools - setuptools-scm - setuptools-scm-git-archive - wheel - ]; - - nativeBuildInputs = with pkgs; [ - ]; -} diff --git a/overlays/template.nix b/overlays/template.nix new file mode 100644 index 0000000..e4bfcde --- /dev/null +++ b/overlays/template.nix @@ -0,0 +1,15 @@ +{ stdenv, jinja2-cli }: + +name: vars: template: +(stdenv.mkDerivation { + inherit name; + + passAsFile = [ "varsData" ]; + varsData = builtins.toJSON vars; + + nativeBuildInputs = [ jinja2-cli ]; + phases = [ "buildPhase" "installPhase" ]; + + buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result''; + installPhase = "cp result $out"; +}) From dbf3579b4b35fbd5580e79832e089bc65c764ee6 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 22 Aug 2023 00:40:32 -0500 Subject: [PATCH 19/19] Get Genesis buttoned up Stop building Gnome stuff for it Fix up DHCP responses to the new topology Make Home Assistant Work Again Complete changeover --- home/home.nix | 1 + home/hosts/genesis/default.nix | 5 +++++ hosts/default.nix | 6 +----- hosts/genesis/dnsmasq.nix | 12 ++++++------ hosts/genesis/home-assistant.nix | 16 ++++++++++------ hosts/genesis/networking.nix | 7 +++++-- hosts/genesis/nftables.nft | 29 +++++++++++++++++++++-------- 7 files changed, 49 insertions(+), 27 deletions(-) create mode 100644 home/hosts/genesis/default.nix diff --git a/home/home.nix b/home/home.nix index c1a0520..a546d97 100644 --- a/home/home.nix +++ b/home/home.nix @@ -36,6 +36,7 @@ home.stateVersion = "23.05"; home.packages = with pkgs; [ bitwarden-cli + busybox copier diffutils findutils diff --git a/home/hosts/genesis/default.nix b/home/hosts/genesis/default.nix new file mode 100644 index 0000000..d8147ea --- /dev/null +++ b/home/hosts/genesis/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + +} diff --git a/hosts/default.nix b/hosts/default.nix index 43c10a2..c3792c5 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -41,11 +41,7 @@ in { system = "aarch64-linux"; name = "2maccabees"; }; - genesis = unstable { - name = "genesis"; - gnome = true; - gui = true; - }; + genesis = unstable { name = "genesis"; }; jude = unstable { name = "jude"; gnome = true; diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix index 891c0c5..86a6fe7 100644 --- a/hosts/genesis/dnsmasq.nix +++ b/hosts/genesis/dnsmasq.nix @@ -33,20 +33,20 @@ in domain = "thehellings.lan"; dhcp-range = [ # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" - "${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h" + "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" ]; dhcp-option = [ - "${lanDevice},option:router,10.43.1.1" - "${lanDevice},option:dns-server,10.43.1.2,1.1.1.1" - "${lanDevice},option:domain-search,thehellings.lan" + "${lanDevice},option:router,10.42.1.1" + "${lanDevice},option:dns-server,10.42.1.1,1.1.1.1" + "${lanDevice},option:domain-search,thehellings.lan,shire-zebra.ts.net" "vlan66@${lanDevice},option:router,192.168.66.1" - "vlan66@${lanDevice},option:dns-server,192.168.66.2" + "vlan66@${lanDevice},option:dns-server,192.168.66.1" "vlan67@${lanDevice},option:router,192.168.67.1" - "vlan67@${lanDevice},option:dns-server,192.168.67.2" + "vlan67@${lanDevice},option:dns-server,192.168.67.1" ]; dhcp-host = [ # Static IPs for things in the IOT range diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index 1068f2b..357a5b8 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -29,8 +29,6 @@ in config = { default_config = {}; - esphome = {}; # Get these things loaded, even if not configured - met = {}; tts = [ { platform = "google_translate"; } ]; http = { use_x_forwarded_for = true; @@ -38,9 +36,9 @@ in server_host = "127.0.0.1"; }; #"automation manual" = *nix config here* and so on - "automation ui" = "!include automations.yaml"; - "script ui" = "!include scripts.yaml"; - "scene ui" = "!include scenes.yaml"; + "automation ui" = ""; + "script ui" = ""; + "scene ui" = ""; }; }; @@ -73,7 +71,13 @@ in }; - greg.proxies."smart.thehellings.lan".target = "http://127.0.0.1:8123"; + greg.proxies = { + "smart.thehellings.lan".target = "http://127.0.0.1:8123"; + "genesis.shire-zebra.ts.net" = { + target = "http://127.0.0.1:8123"; + path = "/smart/"; + }; + }; # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect # directly for troubleshooting Nginx configuration diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 8374c66..d4d040e 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -43,7 +43,7 @@ in { "${iot}" = { useDHCP = false; ipv4.addresses = [ { - address = "192.168.66.2"; + address = "192.168.66.1"; prefixLength = 24; } ]; }; @@ -86,7 +86,10 @@ in { greg.proxies = { "jellyfin.thehellings.lan".target = "http://localhost:8096"; - "jellyfin.me.ts".target = "http://localhost:8096"; + "jellyfin.shire-zebra.ts.net" = { + target = "http://localhost:8096"; + genAliases = false; + }; }; ######### diff --git a/hosts/genesis/nftables.nft b/hosts/genesis/nftables.nft index 19fe0be..2c82f5e 100644 --- a/hosts/genesis/nftables.nft +++ b/hosts/genesis/nftables.nft @@ -1,6 +1,15 @@ #!/usr/bin/env nft -f table ip filter { + define FRIENDS = { {{ '\"' + ( lanInterfaces | join('\", \"') ) + '\"' }} , "tailscale0" } + define SUS = { {{ limitedLan | join(", ") }} } + define LAN = { $FRIENDS, $SUS } + + counter tcp_dns {} + counter udp_dns {} + counter catchall {} + counter sus {} + chain output { type filter hook output priority 100; policy accept; } @@ -9,24 +18,28 @@ table ip filter { type filter hook input priority 0; policy drop; iifname lo accept + iifname $SUS counter name sus + # Router needs to yield up DNS and DHCP for itself, in my case + iifname $LAN tcp dport { 53, 67 } counter name tcp_dns accept + iifname $LAN udp dport { 53, 67 } counter name udp_dns accept # Open the specific ports that we allow {% for port in tcpPorts %} - iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept + iifname $FRIENDS tcp dport {{ port }} accept {% endfor %} {% for port in udpPorts %} - iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept + iifname $FRIENDS udp dport {{ port }} accept {% endfor %} - iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing" - iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections" - iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic" - iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much" + iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing" + iifname {{ wanInterface }} ct state { established, related } accept comment "Allows existing connections" + iifname {{ wanInterface }} icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic" + iifname {{ wanInterface }} counter drop comment "Drop other incoming traffic, and count how much" } chain forward { type filter hook forward priority 0; policy drop; - iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN" - iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic" + iifname $LAN oifname {{ wanInterface }} accept comment "Forward LAN to WAN" + iifname {{ wanInterface }} oifname $LAN ct state established, related accept comment "Allow incoming established traffic" } }