diff --git a/flake.nix b/flake.nix index 1b3c544..9e746d8 100644 --- a/flake.nix +++ b/flake.nix @@ -25,8 +25,11 @@ nixosConfigurations = { distrust = lib.nixosSystem { system = "x86_64-linux"; - modules = [./system ./services ./helpers/services.nix nixos-mailserver.nixosModules.default agenix.nixosModules.default]; + modules = [./system/distrust ./services/distrust ./helpers/services.nix nixos-mailserver.nixosModules.default agenix.nixosModules.default { networking.hostName = "distrust"; }]; }; + distrust-mini = lib.nixosSystem { + system = "x86_64-linux"; + modules = [./system/distrust-mini ./services/distrust-mini ./helpers/services.nix { networking.hostName = "distrust-mini"; }]; }; }; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 46101a8..f864335 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -4,8 +4,9 @@ let users = [user]; # Current host - system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEVvvjL4XXn6z0fOZnr1v0twoVBINi1FOES15JL/3vU4 root@distrust"; - systems = [system]; + distrust = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEVvvjL4XXn6z0fOZnr1v0twoVBINi1FOES15JL/3vU4 root@distrust"; + distrust-mini = ""; + systems = [distrust distrust-mini]; all = users ++ systems; in { @@ -27,5 +28,6 @@ in { "hidden_service/microbin".publicKeys = all; "hidden_service/nextcloud".publicKeys = all; "hidden_service/site".publicKeys = all; + "hidden_service/uptime-kuma".publicKeys = all; "hidden_service/vaultwarden".publicKeys = all; } diff --git a/services/distrust-mini/default.nix b/services/distrust-mini/default.nix new file mode 100644 index 0000000..1b4c13c --- /dev/null +++ b/services/distrust-mini/default.nix @@ -0,0 +1,10 @@ +{ + imports = [ + ../shared + + # TOR bridge + ./tor.nix + # Status page in diff. data center for redundancy/resilience + ./uptime-kuma.nix + ] +} \ No newline at end of file diff --git a/services/distrust-mini/tor.nix b/services/distrust-mini/tor.nix new file mode 100644 index 0000000..304738b --- /dev/null +++ b/services/distrust-mini/tor.nix @@ -0,0 +1,16 @@ +{ + services.tor = { + enable = true; + relay = { + enable = true; + role = "bridge"; + }; + settings = { + Nickname = "Distrust Mini"; + ContactInfo = "root@distrust.network"; + ORPort = 8080; + }; + }; + + networking.firewall.allowedTCPPorts = [8080]; +} diff --git a/services/distrust-mini/uptime-kuma.nix b/services/distrust-mini/uptime-kuma.nix new file mode 100644 index 0000000..dc9d31a --- /dev/null +++ b/services/distrust-mini/uptime-kuma.nix @@ -0,0 +1,28 @@ +let + kumaPort = 3001; +in +{ + services.uptime-kuma = { + enable = true; + settings = { + PORT = kumaPort; + }; + }; + + distrust.services."uptime-kuma" = { + url = "http://uptime.distrust.network"; + onion = { + url = "http://uxp5y2l7g3jv2x7f4j5zv3j5x7z5z7z5z5z5z5z5z5z5z5z5z5z5z5z5z5.onion"; + secretKey = null; + }; + virtualHostConfig = '' + reverse_proxy localhost:${toString kumaPort} + ''; + backup = { + enable = true; + paths = [ + "/var/lib/uptime-kuma" + ]; + }; + }; +} \ No newline at end of file diff --git a/services/akkoma.nix b/services/distrust/akkoma.nix similarity index 100% rename from services/akkoma.nix rename to services/distrust/akkoma.nix diff --git a/services/caddy.nix b/services/distrust/caddy.nix similarity index 100% rename from services/caddy.nix rename to services/distrust/caddy.nix diff --git a/services/default.nix b/services/distrust/default.nix similarity index 95% rename from services/default.nix rename to services/distrust/default.nix index 909096a..6b7a3f7 100644 --- a/services/default.nix +++ b/services/distrust/default.nix @@ -1,7 +1,8 @@ { imports = [ + ../shared + # Core System - ./borg.nix ./caddy.nix # Non-stateful services diff --git a/services/forgejo.nix b/services/distrust/forgejo.nix similarity index 100% rename from services/forgejo.nix rename to services/distrust/forgejo.nix diff --git a/services/ipfs.nix b/services/distrust/ipfs.nix similarity index 100% rename from services/ipfs.nix rename to services/distrust/ipfs.nix diff --git a/services/lldap.nix b/services/distrust/lldap.nix similarity index 100% rename from services/lldap.nix rename to services/distrust/lldap.nix diff --git a/services/mailserver.nix b/services/distrust/mailserver.nix similarity index 100% rename from services/mailserver.nix rename to services/distrust/mailserver.nix diff --git a/services/nextcloud.nix b/services/distrust/nextcloud.nix similarity index 100% rename from services/nextcloud.nix rename to services/distrust/nextcloud.nix diff --git a/services/paste.nix b/services/distrust/paste.nix similarity index 100% rename from services/paste.nix rename to services/distrust/paste.nix diff --git a/services/prosody.nix b/services/distrust/prosody.nix similarity index 100% rename from services/prosody.nix rename to services/distrust/prosody.nix diff --git a/services/site.nix b/services/distrust/site.nix similarity index 100% rename from services/site.nix rename to services/distrust/site.nix diff --git a/services/tor.nix b/services/distrust/tor.nix similarity index 100% rename from services/tor.nix rename to services/distrust/tor.nix diff --git a/services/vaultwarden.nix b/services/distrust/vaultwarden.nix similarity index 100% rename from services/vaultwarden.nix rename to services/distrust/vaultwarden.nix diff --git a/services/borg.nix b/services/shared/borg.nix similarity index 100% rename from services/borg.nix rename to services/shared/borg.nix diff --git a/services/shared/default.nix b/services/shared/default.nix new file mode 100644 index 0000000..49dc657 --- /dev/null +++ b/services/shared/default.nix @@ -0,0 +1,5 @@ +{ + imports = [ + ./borg.nix + ]; +} \ No newline at end of file diff --git a/system/configuration.nix b/system/configuration.nix index 016fb9e..59aed38 100644 --- a/system/configuration.nix +++ b/system/configuration.nix @@ -16,7 +16,7 @@ in { # Necessary for flake support nix.settings.experimental-features = ["nix-command" "flakes"]; - networking.hostName = "distrust"; + # General / Perf zramSwap.enable = true; boot.tmp.cleanOnBoot = true; diff --git a/system/default.nix b/system/distrust-mini/default.nix similarity index 91% rename from system/default.nix rename to system/distrust-mini/default.nix index c03eb4d..bb1e87a 100644 --- a/system/default.nix +++ b/system/distrust-mini/default.nix @@ -4,7 +4,7 @@ ... }: { imports = [ - ./configuration.nix + ../configuration.nix # Auto generated, do not edit. Replace per host ./hardware-configuration.nix diff --git a/system/distrust/default.nix b/system/distrust/default.nix new file mode 100644 index 0000000..bb1e87a --- /dev/null +++ b/system/distrust/default.nix @@ -0,0 +1,16 @@ +{ + lib, + modulesPath, + ... +}: { + imports = [ + ../configuration.nix + + # Auto generated, do not edit. Replace per host + ./hardware-configuration.nix + ./networking.nix + + "${modulesPath}/profiles/hardened.nix" + {environment.memoryAllocator.provider = lib.mkForce "libc";} + ]; +} diff --git a/system/hardware-configuration.nix b/system/distrust/hardware-configuration.nix similarity index 100% rename from system/hardware-configuration.nix rename to system/distrust/hardware-configuration.nix diff --git a/system/networking.nix b/system/distrust/networking.nix similarity index 100% rename from system/networking.nix rename to system/distrust/networking.nix