From 3fb3df6f59da4605af5abe4d6cd4960170ac667c Mon Sep 17 00:00:00 2001 From: mups Date: Fri, 20 Sep 2024 13:51:35 +0000 Subject: [PATCH 1/4] Disable photoprism --- hosts/mups/configuration.nix | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/hosts/mups/configuration.nix b/hosts/mups/configuration.nix index ffdd5b9..a7f3f81 100644 --- a/hosts/mups/configuration.nix +++ b/hosts/mups/configuration.nix @@ -1,12 +1,9 @@ { config, lib, pkgs, inputs, system, ... }: -let - cfg = config.mods; +let cfg = config.mods; in { # Hardware - imports = [ - ./hardware-configuration.nix - ]; + imports = [ ./hardware-configuration.nix ]; # System mods.user.name = "muon"; @@ -30,8 +27,8 @@ in { mods.server.sync.address = "100.85.27.29"; mods.server.sync.port = "8385"; - mods.server.media.enable = true; - mods.server.photoprism.enable = true; + mods.server.media.enable = false; + mods.server.photoprism.enable = false; mods.server.wireguard.enable = true; mods.server.headscale.enable = false; @@ -40,10 +37,12 @@ in { boot.loader.grub.enable = true; boot.loader.grub.device = "/dev/vda"; boot.initrd.checkJournalingFS = false; - + users.users.muon = { - openssh.authorizedKeys.keys = - [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon'' ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is'' ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is" + ]; }; # services.static-web-server = { @@ -59,8 +58,10 @@ in { # Enable the OpenSSH daemon. services.openssh.enable = true; - users.users.root.openssh.authorizedKeys.keys = - [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon'' ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is'' ]; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is" + ]; networking.firewall = { enable = true; From d8893f82093b2a78a50e16f1325b2ea547b63814 Mon Sep 17 00:00:00 2001 From: mups Date: Fri, 20 Sep 2024 15:00:45 +0000 Subject: [PATCH 2/4] Fix dnsmasq --- modules/nixos/server/wireguard.nix | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/modules/nixos/server/wireguard.nix b/modules/nixos/server/wireguard.nix index ca61000..087615a 100644 --- a/modules/nixos/server/wireguard.nix +++ b/modules/nixos/server/wireguard.nix @@ -6,9 +6,8 @@ }; }; - config = lib.mkIf config.mods.server.wireguard.enable { - networking.nat = { + networking.nat = { enable = true; enableIPv6 = true; externalInterface = "ens3"; @@ -45,22 +44,23 @@ ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o ens3 -j MASQUERADE ''; - peers = [ - { # peer0 - publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg="; - presharedKeyFile = "/home/muon/wireguard-keys/psk-muon"; - allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ]; - } - # More peers can be added here. - ]; + peers = [{ # peer0 + publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg="; + presharedKeyFile = "/home/muon/wireguard-keys/psk-muon"; + allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ]; + } + # More peers can be added here. + ]; }; }; services.dnsmasq = { enable = true; - extraConfig = '' - interface=wg0 - ''; + settings.bind-interfaces = true; + settings.interface = "wg0"; + # extraConfig = '' + # interface=wg0 + # ''; }; # networking.wireguard.interfaces = { From a130d322d52452472da93467b6f1ec507d623fa9 Mon Sep 17 00:00:00 2001 From: mups Date: Thu, 28 Nov 2024 16:30:10 +0000 Subject: [PATCH 3/4] Add muho to ssh --- hosts/mups/configuration.nix | 2 ++ modules/nixos/server/nginx.nix | 21 +++++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 modules/nixos/server/nginx.nix diff --git a/hosts/mups/configuration.nix b/hosts/mups/configuration.nix index a7f3f81..01984dc 100644 --- a/hosts/mups/configuration.nix +++ b/hosts/mups/configuration.nix @@ -32,6 +32,7 @@ in { mods.server.wireguard.enable = true; mods.server.headscale.enable = false; + mods.server.nginx.enable = true; # Use the GRUB 2 boot loader. boot.loader.grub.enable = true; @@ -42,6 +43,7 @@ in { openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILmAOd9VbhyJeibt6Vrb101MNTk5W8+rh94Djv/C+pyu muon@muho" ]; }; diff --git a/modules/nixos/server/nginx.nix b/modules/nixos/server/nginx.nix new file mode 100644 index 0000000..831a27e --- /dev/null +++ b/modules/nixos/server/nginx.nix @@ -0,0 +1,21 @@ +{ pkgs, lib, config, ... }: { + options.mods.server.nginx = { + enable = lib.mkEnableOption { + default = false; + description = "enables nginx reverse proxy"; + }; + }; + + config = lib.mkIf config.mods.server.nginx.enable { + services.nginx = { + recommendedProxySettings = true; + virtualHosts."*.muon.host" = { + locations."/" = { + proxyPass = "http://100.112.114.27:443"; + proxyWebsockets = true; # needed if you need to use WebSocket + extraConfig = "proxy_ssl_server_name on;"; + }; + }; + }; + }; +} From 62833663ad4f9ec20a009ae65a1725eb88e77070 Mon Sep 17 00:00:00 2001 From: mups Date: Fri, 29 Nov 2024 16:09:24 +0000 Subject: [PATCH 4/4] Add nginx --- modules/nixos/server/default.nix | 1 + modules/nixos/server/nginx.nix | 58 +++++++++++++++++++++++++++--- modules/nixos/server/wireguard.nix | 20 +++++++---- 3 files changed, 67 insertions(+), 12 deletions(-) diff --git a/modules/nixos/server/default.nix b/modules/nixos/server/default.nix index 54f7544..b480da3 100644 --- a/modules/nixos/server/default.nix +++ b/modules/nixos/server/default.nix @@ -9,5 +9,6 @@ ./wireguard.nix ./headscale.nix ./photoprism.nix + ./nginx.nix ]; } diff --git a/modules/nixos/server/nginx.nix b/modules/nixos/server/nginx.nix index 831a27e..fe792ae 100644 --- a/modules/nixos/server/nginx.nix +++ b/modules/nixos/server/nginx.nix @@ -7,14 +7,62 @@ }; config = lib.mkIf config.mods.server.nginx.enable { + # ACME won't be able to authenticate your domain + # if ports 80 & 443 aren't open in your firewall. + networking.firewall = { allowedTCPPorts = [ 443 80 ]; }; + security.acme.defaults.email = "acme@muon.host"; + security.acme.acceptTerms = true; + services.nginx = { + enable = true; + + recommendedGzipSettings = true; + recommendedOptimisation = true; recommendedProxySettings = true; - virtualHosts."*.muon.host" = { - locations."/" = { - proxyPass = "http://100.112.114.27:443"; - proxyWebsockets = true; # needed if you need to use WebSocket - extraConfig = "proxy_ssl_server_name on;"; + recommendedTlsSettings = true; + + # Only allow PFS-enabled ciphers with AES256 + # sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; + + appendHttpConfig = '' + # Add HSTS header with preloading to HTTPS requests. + # Adding this header to HTTP requests is discouraged + # map $scheme $hsts_header { + # https "max-age=31536000; includeSubdomains; preload"; + # } + # add_header Strict-Transport-Security $hsts_header; + + # Enable CSP for your services. + #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; + + # Minimize information leaked to other domains + add_header 'Referrer-Policy' 'origin-when-cross-origin'; + + # Disable embedding as a frame + add_header X-Frame-Options DENY; + + # Prevent injection of code in other mime types (XSS Attacks) + add_header X-Content-Type-Options nosniff; + + # This might create errors + # proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict"; + + # required when the server wants to use HTTP Authentication + proxy_pass_header Authorization; + ''; + + virtualHosts = let + base = locations: { + inherit locations; + + forceSSL = true; + enableACME = true; }; + proxy = port: + base { "/".proxyPass = "http://10.0.0.3:" + toString (port) + "/"; }; + in { + # Define example.com as reverse-proxied service on 127.0.0.1:3000 + "photos.muon.host" = proxy 2283 // { default = true; }; }; }; }; diff --git a/modules/nixos/server/wireguard.nix b/modules/nixos/server/wireguard.nix index 087615a..f49d998 100644 --- a/modules/nixos/server/wireguard.nix +++ b/modules/nixos/server/wireguard.nix @@ -44,13 +44,19 @@ ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o ens3 -j MASQUERADE ''; - peers = [{ # peer0 - publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg="; - presharedKeyFile = "/home/muon/wireguard-keys/psk-muon"; - allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ]; - } - # More peers can be added here. - ]; + peers = [ + { # peer0 + publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg="; + presharedKeyFile = "/home/muon/wireguard-keys/psk-muon"; + allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ]; + } + { # peer1 + publicKey = "ohf/tGV9bjDDh/i9U5+DNvFtn+Glm8Wy1ieHoPvXfCo="; + presharedKeyFile = "/home/muon/wireguard-keys/psk-muho"; + allowedIPs = [ "10.0.0.3/32" "fdc9:281f:04d7:9ee9::3/128" ]; + } + # More peers can be added here. + ]; }; };