Skip to content

Commit 2b105dd

Browse files
disassemblerdisassembler
committed
Configure lan.disasm.us and enable wildcard acme SSL
1 parent 7895ce6 commit 2b105dd

File tree

10 files changed

+187
-84
lines changed

10 files changed

+187
-84
lines changed

‎.envrc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
if ! has nix_direnv_version || ! nix_direnv_version 1.4.0; then
2+
source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/1.4.0/direnvrc" "sha256-4XfVDjv75eHMWN4G725VW7BoOV4Vl3vAabK4YXIfPyE="
3+
fi
4+
5+
use flake

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
result*
22
*.qcow2
3+
.direnv

‎flake.lock

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎nixos/optina/configuration.nix

Lines changed: 87 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ in
5555
mpd_pw = { };
5656
mpd_icecast_pw = { };
5757
alertmanager = { };
58+
lego-knot-credentials.owner = "acme";
5859
};
5960
imports =
6061
[
@@ -104,15 +105,15 @@ in
104105

105106
networking = {
106107
hostName = "optina";
107-
domain = "wedlake.lan";
108+
domain = "lan.disasm.us";
108109
hostId = "1768b40b";
109110
interfaces.enp2s0.ipv4.addresses = [{ address = "10.40.33.20"; prefixLength = 24; }];
110111
defaultGateway = "10.40.33.1";
111112
nameservers = [ "10.40.33.1" "8.8.8.8" ];
112113
extraHosts =
113114
''
114115
10.233.1.2 rtorrent.optina.local
115-
10.40.33.20 crate.wedlake.lan
116+
10.40.33.20 crate.lan.disasm.us
116117
'';
117118
nat = {
118119
enable = true;
@@ -157,6 +158,16 @@ in
157158
};
158159
};
159160

161+
security.acme.acceptTerms = true;
162+
security.acme.email = "[email protected]";
163+
security.acme.certs."lan.disasm.us" = {
164+
domain = "*.lan.disasm.us";
165+
postRun = "systemctl reload nginx.service";
166+
group = "nginx";
167+
keyType = "ec384";
168+
dnsProvider = "rfc2136";
169+
credentialsFile = config.sops.secrets.lego-knot-credentials.path;
170+
};
160171
security.pki.certificates = [ shared.wedlake_ca_cert ];
161172

162173
nixpkgs = {
@@ -209,26 +220,28 @@ in
209220
home-assistant = {
210221
enable = true;
211222
package = (pkgs.home-assistant.override {
212-
extraComponents = [ "sense" "roku" "homekit" "sense_energy" ];
223+
extraComponents = [ "sense" "roku" "homekit" ];
213224
}).overrideAttrs (oldAttrs: { doInstallCheck = false; });
214225
config = {
215226
default_config = { };
216227
met = { };
217228
sense = { };
229+
roku = { };
230+
homekit = { };
218231
};
219232
};
220233
matterbridge = {
221234
enable = true;
222235
configPath = "/etc/nixos/matterbridge.toml";
223236
};
224237
minecraft-bedrock-server.enable = true;
225-
#vaultwarden = {
226-
# enable = true;
227-
# config = {
228-
# signupsAllowed = true;
229-
# domain = "http://optina.wedlake.lan:8085";
230-
# };
231-
#};
238+
vaultwarden = {
239+
enable = true;
240+
config = {
241+
signupsAllowed = false;
242+
domain = "https://vw.lan.disasm.us";
243+
};
244+
};
232245
udev.extraRules = ''
233246
ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="74:d4:35:9b:84:62", NAME="enp2s0"
234247
'';
@@ -240,7 +253,7 @@ in
240253
extraProperties = ''
241254
offsets.topic.replication.factor = 1
242255
'';
243-
hostname = "optina.wedlake.lan";
256+
hostname = "optina.lan.disasm.us";
244257
zookeeper = "localhost:2181";
245258
};
246259
elasticsearch = {
@@ -251,7 +264,7 @@ in
251264

252265
kibana = {
253266
enable = false;
254-
listenAddress = "optina.wedlake.lan";
267+
listenAddress = "optina.lan.disasm.us";
255268
elasticsearch.url = "http://localhost:9200";
256269
};
257270

@@ -263,7 +276,7 @@ in
263276
# web = {
264277
# enable = true;
265278
# listenPort = "8002";
266-
# baseURL = "https://hledger.wedlake.lan/";
279+
# baseURL = "https://hledger.lan.disasm.us/";
267280
# };
268281
#};
269282

@@ -280,7 +293,7 @@ in
280293
move_metadata_to_field: journal
281294
default_type: journal
282295
output.kafka:
283-
hosts: ["optina.wedlake.lan:9092"]
296+
hosts: ["optina.lan.disasm.us:9092"]
284297
topic: KAFKA-LOGSTASH-ELASTICSEARCH
285298
'';
286299
};
@@ -323,10 +336,10 @@ in
323336
bitlbee.enable = true;
324337
gitea = {
325338
enable = false;
326-
domain = "git.wedlake.lan";
339+
domain = "git.lan.disasm.us";
327340
appName = "Personal Git Server";
328341
httpAddress = "127.0.0.1";
329-
rootUrl = "https://git.wedlake.lan";
342+
rootUrl = "https://git.lan.disasm.us";
330343
httpPort = 3001;
331344
database = {
332345
type = "postgres";
@@ -446,7 +459,7 @@ in
446459
};
447460
#unifi = {
448461
# enable = false;
449-
# unifiAddress = "https://unifi.wedlake.lan";
462+
# unifiAddress = "https://unifi.lan.disasm.us";
450463
# unifiUsername = "prometheus";
451464
# unifiPassword = secrets.unifi_password_ro;
452465
# openFirewall = true;
@@ -461,7 +474,7 @@ in
461474
scheme = "http";
462475
path_prefix = "/";
463476
static_configs = [{
464-
targets = [ "optina.wedlake.lan:9093" ];
477+
targets = [ "optina.lan.disasm.us:9093" ];
465478
}];
466479
}];
467480
rules = [
@@ -613,18 +626,18 @@ in
613626
static_configs = [
614627
{
615628
targets = [
616-
"portal.wedlake.lan:9100"
629+
"portal.lan.disasm.us:9100"
617630
];
618631
labels = {
619-
alias = "portal.wedlake.lan";
632+
alias = "portal.lan.disasm.us";
620633
};
621634
}
622635
{
623636
targets = [
624-
"optina.wedlake.lan:9100"
637+
"optina.lan.disasm.us:9100"
625638
];
626639
labels = {
627-
alias = "optina.wedlake.lan";
640+
alias = "optina.lan.disasm.us";
628641
};
629642
}
630643
{
@@ -657,7 +670,7 @@ in
657670
# "localhost:9130"
658671
# ];
659672
# labels = {
660-
# alias = "unifi.wedlake.lan";
673+
# alias = "unifi.lan.disasm.us";
661674
# };
662675
# }
663676
# ];
@@ -798,18 +811,49 @@ in
798811
nginx = {
799812
enable = true;
800813
virtualHosts = {
801-
"netboot.wedlake.lan" = {
814+
"netboot.lan.disasm.us" = {
802815
root = netboot_root;
803816
extraConfig = ''
804817
location ~ [^/]\.php(/|$) {
805818
fastcgi_pass unix:${config.services.phpfpm.pools.mypool.socket};
806819
}
807820
'';
808821
};
809-
"hledger.wedlake.lan" = {
822+
"hass.lan.disasm.us" = {
823+
useACMEHost = "lan.disasm.us";
824+
forceSSL = true;
825+
locations."/" = {
826+
proxyPass = "http://optina.lan.disasm.us:8123";
827+
extraConfig = ''
828+
proxy_set_header Host $host;
829+
proxy_set_header X-Forwarded-Proto $scheme;
830+
'';
831+
};
832+
locations."/api/websocket" = {
833+
proxyPass = "http://optina.lan.disasm.us:8123";
834+
extraConfig = ''
835+
proxy_http_version 1.1;
836+
proxy_set_header Host $host;
837+
proxy_set_header X-Forwarded-Proto $scheme;
838+
proxy_set_header Upgrade $http_upgrade;
839+
proxy_set_header Connection "Upgrade";
840+
'';
841+
};
842+
};
843+
"vw.lan.disasm.us" = {
844+
useACMEHost = "lan.disasm.us";
845+
forceSSL = true;
846+
locations."/" = {
847+
proxyPass = "http://optina.lan.disasm.us:8000";
848+
extraConfig = ''
849+
proxy_set_header Host $host;
850+
proxy_set_header X-Forwarded-Proto $scheme;
851+
'';
852+
};
853+
};
854+
"hledger.lan.disasm.us" = {
855+
useACMEHost = "lan.disasm.us";
810856
forceSSL = true;
811-
sslCertificate = "/data/ssl/hledger.wedlake.lan.crt";
812-
sslCertificateKey = "/data/ssl/hledger.wedlake.lan.key";
813857
locations."/api".extraConfig = ''
814858
proxy_pass http://localhost:8001/api;
815859
proxy_set_header Host $host;
@@ -825,33 +869,14 @@ in
825869
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
826870
'';
827871
};
828-
"crate.wedlake.lan" = {
872+
"stg.lan.disasm.us" = {
873+
useACMEHost = "lan.disasm.us";
829874
forceSSL = true;
830-
sslCertificate = "/data/ssl/nginx.crt";
831-
sslCertificateKey = "/data/ssl/nginx.key";
832-
locations."/".extraConfig = ''
833-
proxy_pass http://localhost:8089/;
834-
proxy_set_header Host $host;
835-
proxy_set_header X-Forwarded-Proto $scheme;
836-
proxy_set_header X-Real-IP $remote_addr;
837-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
838-
'';
839-
#locations."/weechat" = {
840-
# proxyPass = "http://127.0.0.1:9001/weechat";
841-
# proxyWebsockets = true;
842-
# extraConfig = ''
843-
# proxy_read_timeout 4h;
844-
# '';
845-
#};
846-
};
847-
"storage.wedlake.lan" = {
848-
forceSSL = false;
849875
root = "/var/storage";
850876
};
851-
"unifi.wedlake.lan" = {
877+
"unifi.lan.disasm.us" = {
878+
useACMEHost = "lan.disasm.us";
852879
forceSSL = true;
853-
sslCertificate = "/data/ssl/unifi.wedlake.lan.crt";
854-
sslCertificateKey = "/data/ssl/unifi.wedlake.lan.key";
855880
locations."/".extraConfig = ''
856881
proxy_set_header Referer "";
857882
proxy_pass https://localhost:8443/;
@@ -863,18 +888,18 @@ in
863888
proxy_set_header Connection "upgrade";
864889
'';
865890
};
866-
"git.wedlake.lan" = {
867-
forceSSL = true;
868-
sslCertificate = "/data/ssl/git.wedlake.lan.crt";
869-
sslCertificateKey = "/data/ssl/git.wedlake.lan.key";
870-
locations."/".extraConfig = ''
871-
proxy_pass http://localhost:3001/;
872-
proxy_set_header Host $host;
873-
proxy_set_header X-Forwarded-Proto $scheme;
874-
proxy_set_header X-Real-IP $remote_addr;
875-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
876-
'';
877-
};
891+
#"git.lan.disasm.us" = {
892+
# forceSSL = true;
893+
# sslCertificate = "/data/ssl/git.lan.disasm.us.crt";
894+
# sslCertificateKey = "/data/ssl/git.lan.disasm.us.key";
895+
# locations."/".extraConfig = ''
896+
# proxy_pass http://localhost:3001/;
897+
# proxy_set_header Host $host;
898+
# proxy_set_header X-Forwarded-Proto $scheme;
899+
# proxy_set_header X-Real-IP $remote_addr;
900+
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
901+
# '';
902+
#};
878903
};
879904
};
880905

‎nixos/optina/secrets.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,15 @@ gitea_dbpass: ENC[AES256_GCM,data:QqWVLBLqdg+2G1HGf84qmg==,iv:MD5LRy0o5Kwe2/pcxC
22
mpd_pw: ENC[AES256_GCM,data:1Ee1,iv:k1mNPPTCA8Foe1B2rnf5u9v0Jc3Vf/wHiUgQ3gL4cHI=,tag:e5HcloSzNAkl6Fpd1VETVw==,type:str]
33
mpd_icecast_pw: ENC[AES256_GCM,data:bb8l,iv:gzIH3mfjBxO5pn1k1rTD+dBNKQFEt7unBXMb/kjMk68=,tag:77Li7/5R6apqearBiAhCXA==,type:str]
44
alertmanager: ENC[AES256_GCM,data:0We2OipaHQyyb5z1oGY+BkZ0TzDpL1f/V8z/MeIrHn0Z1nhPesdAk/XiDjspaag3uMmdNV9uk/YteW0D7JoV1+cAHqV4It+O8ug=,iv:Eb9CcYJkHWTJ5ktquNjxr86a9Kf4LM7TjWxE3VVlWcQ=,tag:fFnSjEb+ZXZVMh8Atyxjwg==,type:str]
5+
lego-knot-credentials: ENC[AES256_GCM,data:h92JPrEPu8KHz1H6lEOowXukFBwzrxW958nABKQwoNZdKBpaldrOGHRlSGrMQGCxbUVhTzFsPtZnmZshVTUsdTgdHKWu3XpLj/LuwFzFTpae3kENnyLWg2zBVLugpnYSArFoMbZlVQqBkUkDgnNMkymVL/3X2AHq/ZSIqJ6HC1AzhB6EigGUAS5aR7dV0hgCFvZdV5ijZiZZBE1/voLur5Z0ZwDcBNsIbCYWGZWlcTqf8Q==,iv:TqpTzZmglFnW97opog8S/OvtIWoM4UzbkQ065kiwbFc=,tag:mF8uQHjE/R7NtfY4W/xTPg==,type:str]
56
sops:
67
kms: []
78
gcp_kms: []
89
azure_kv: []
910
hc_vault: []
1011
age: []
11-
lastmodified: "2022-01-19T16:45:27Z"
12-
mac: ENC[AES256_GCM,data:W481I7O6sDC7HaNLLnKegD0jWBn39gzR5OIrujPs+JB21tbeHCxypMpQ5Aq4/GGChGJvWIp/k5HI6h8JwOjcawe2HmxLkZyMcFyAHaFtn/+MNJ/SgqH32yxmul1Kd4L3dvhZXHM1zvvZKVUCnV7M4Jx0vSNO2Oos+rWGhrB9Wes=,iv:vvyFhPt1ABEfZTQHv0alyncvxixru6sI4hUvhH6mppo=,tag:rBhOUcaPvvZoF+lYVofEmA==,type:str]
12+
lastmodified: "2022-01-28T17:04:45Z"
13+
mac: ENC[AES256_GCM,data:Vvj299eiIaPkAqta2wkn+u1SSoi14jTbUoLhIMZ5UJMf9msZ283XU4nMKNPa7QFPvC6E/PFghEN017LDZjYcmRiKB093zjO3J1LhdQQIQ5BSwo/ErzdMXJIZjwUQGACmhyWhZTWifNwVL4Ml2kU1RaAbdXFJkvwXPAzrrSL+Qv8=,iv:LB1y38AlDrtpXiVa0kgPrkYmS/z/ZU6kyXTkzMLKnXo=,tag:ETkLNbFKFWVDgLRtrIKJSQ==,type:str]
1314
pgp:
1415
- created_at: "2022-01-19T04:05:43Z"
1516
enc: |-

0 commit comments

Comments
 (0)