qbit/xin
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

h: enable soju

Browse Source 
tailnet: open up tailnet to laptops/mobile
This commit is contained in:
Aaron Bieber 2024-11-17 06:05:09 -07:00
parent d229fe1f58
commit c652e9902e
No known key found for this signature in database
2 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
configs/tailnet.nix
View File

@ -79,6 +79,11 @@ let
}; };
acls = [ acls = [
{
action = "accept";
src = [ "tag:mobile" "tag:laptop" ];
dst = [ "h:6697" ];
}
{ {
action = "accept"; action = "accept";
src = [ "europa" ]; src = [ "europa" ];

35
hosts/h/default.nix
View File

@ -5,6 +5,7 @@
, ... , ...
}: }:
with pkgs; let with pkgs; let
sojuUser = "soju";
maxUploadSize = "150M"; maxUploadSize = "150M";
gqrss = callPackage ../../pkgs/gqrss.nix { inherit isUnstable; }; gqrss = callPackage ../../pkgs/gqrss.nix { inherit isUnstable; };
icbirc = callPackage ../../pkgs/icbirc.nix { inherit isUnstable; }; icbirc = callPackage ../../pkgs/icbirc.nix { inherit isUnstable; };
@ -149,6 +150,16 @@ in
owner = "root"; owner = "root";
sopsFile = config.xin-secrets.h.secrets.services; sopsFile = config.xin-secrets.h.secrets.services;
}; };
bounce_cert = {
mode = "400";
owner = sojuUser;
sopsFile = config.xin-secrets.h.secrets.services;
};
bounce_key = {
mode = "400";
owner = sojuUser;
sopsFile = config.xin-secrets.h.secrets.services;
};
}; };
networking = { networking = {
@ -195,7 +206,11 @@ in
}; };
firewall = { firewall = {
interfaces = { "tailscale0" = { allowedTCPPorts = [ 9002 config.services.shiori.port ]; }; }; interfaces = {
"tailscale0" = {
allowedTCPPorts = [ 9002 config.services.shiori.port 6697 ];
};
};
allowedTCPPorts = [ 22 80 443 2222 53589 ]; allowedTCPPorts = [ 22 80 443 2222 53589 ];
allowedUDPPorts = [ 7122 ]; allowedUDPPorts = [ 7122 ];
allowedUDPPortRanges = [ allowedUDPPortRanges = [
@ -236,14 +251,25 @@ in
}; };
users = { users = {
groups.${sojuUser} = {};
users = { users = {
root = userBase; root = userBase;
qbit = userBase; qbit = userBase;
"${sojuUser}" = {
isSystemUser = true;
group = sojuUser;
};
}; };
}; };
systemd = { systemd = {
services = { services = {
soju = {
serviceConfig = {
User = sojuUser;
Group = sojuUser;
};
};
mcchunkie = { mcchunkie = {
serviceConfig = { serviceConfig = {
ExecStart = lib.mkForce "${pkgs.mcchunkie}/bin/mcchunkie -db /var/lib/mcchunkie/db"; ExecStart = lib.mkForce "${pkgs.mcchunkie}/bin/mcchunkie -db /var/lib/mcchunkie/db";
@ -305,6 +331,13 @@ in
}; };
services = { services = {
soju = {
enable = true;
listen = [ "100.83.77.133:6697" ];
hostName = "bounce.bold.daemon";
tlsCertificate = config.sops.secrets.bounce_cert.path;
tlsCertificateKey = config.sops.secrets.bounce_key.path;
};
postfix.extraConfig = '' postfix.extraConfig = ''
smtputf8_enable = no smtputf8_enable = no
''; '';