lots of changes, including revamp of network services boot chain on mercury

19 files changed, 188 insertions, 36 deletions

diff --git a/flake.lock b/flake.lock
index 63739b2..b4d9b39 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,6 +150,24 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1765835352,
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -283,6 +301,21 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -316,7 +349,8 @@
         "lanzaboote": "lanzaboote",
         "nixos-facter-modules": "nixos-facter-modules",
         "nixpkgs": "nixpkgs",
-        "tmux-tsunami": "tmux-tsunami"
+        "tmux-tsunami": "tmux-tsunami",
+        "tsnsrv": "tsnsrv"
       }
     },
     "rust-overlay": {
@@ -451,6 +485,27 @@
         "type": "github"
       }
     },
+    "tsnsrv": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767001347,
+        "narHash": "sha256-uRm4oWMFUBSmXgofOngMWIyA/yUmLlon6f3XoFTWvBA=",
+        "owner": "boinkor-net",
+        "repo": "tsnsrv",
+        "rev": "8f3fbf69e1517612c0fde9be27522e12c2ddc238",
+        "type": "github"
+      },
+      "original": {
+        "owner": "boinkor-net",
+        "repo": "tsnsrv",
+        "type": "github"
+      }
+    },
     "utils": {
       "inputs": {
         "systems": "systems_2"
diff --git a/flake.nix b/flake.nix
index 6958a06..6f71eb4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,11 @@
       url = "github:MrOtherGuy/firefox-csshacks";
       flake = false;
     };
+
+    tsnsrv = {
+      url = "github:boinkor-net/tsnsrv";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = inputs: let
diff --git a/hosts/ganymede/caddy-env.age b/hosts/ganymede/caddy-env.age
index 79d7b91..ecfc05a 100644
--- a/hosts/ganymede/caddy-env.age
+++ b/hosts/ganymede/caddy-env.age
@@ -1,6 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 Jg4yWQ cVxgS8Sy6bB9lQVeDBQVhmCaD437YxPAZduSzFA6WHE
-KV9ZrAEH3z8cT0IeaIfkqMYhU/4LS2St0ySK030Ie1c
---- pUeKTMwZf3FARqVLl9TARgItjcr1O82hUKaZ9YtjFRM
-�a_v1BRg��ʫ*�������+r֘0�}���ܨ��d`��˟��ϞJ�<�3h�i�1�|�G��jl3
���!���7r	��3X�p=�d��`7����1�ݻѲh<H��d�������y����;�V�˜�N�iGN
�^@`�OnT���y�q��>FW���5/2̞?���[���H��Z� -�	�S�d�:F��C�G��q����%-���#�W~�����Wz�_��X����F���)Z�S��~M�h�CF!C�)N*�ٟ������
-R
\ No newline at end of file
+-> ssh-ed25519 Jg4yWQ t4jtOOcuC4v735Yi4FzdDnvjQFNYVgzMluuH7H3oxx4
+qLKbZ3wA3kk7UXqwUJN2HH+6Wr3qgzINNwLx+dbgsIg
+--- im4dvpbhdvB7fwa8QJ7clFZ+5aVIaXld/gPlhUalc14
+�>�u���4�B�E���C��Q�D:��3k��k����K���ļc}}}��m�K)�HM�3v}ܣ�I�9�I��kxr��1�s��?��"8����������Д�>J{�����ua������fϚ��}�.��3�Oa�9��m�2�-�@C�0�b
�X��|]��:�������9��`�W������X�1�b��a�|��W2=�l�]C�w��U&~"�0! 
+�6
+�����MF�ίp	D˅��+����q�
`��-R6/���L�	4
\ No newline at end of file
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix
index e6f18ab..6ad32cf 100644
--- a/hosts/ganymede/caddy.nix
+++ b/hosts/ganymede/caddy.nix
@@ -19,12 +19,6 @@
       }
     '';
 
-    virtualHosts."https://web.tail7cca06.ts.net".extraConfig = ''
-      bind tailscale/web
-      root * /var/www
-      file_server
-    '';
-
     virtualHosts."https://williamsfam.us.com".extraConfig = ''
       root * /var/www
       file_server
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index c2b312f..3adf620 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -1,5 +1,5 @@
 {config, ...}: let
-  tailscaleIP = "100.69.180.89";
+  tailscaleIP = "100.100.218.182";
 in {
   collinux = {
     user.name = "collin";
@@ -7,6 +7,7 @@ in {
     secrets = {
       "williams-psk".file = ./williams-psk.age;
       "caddy-env".file = ./caddy-env.age;
+      "tsnsrv-authkey".file = ./tsnsrv-authkey.age;
     };
 
     terminal = {
@@ -33,7 +34,10 @@ in {
             gateway = "192.168.50.1";
           };
         };
-        tailscale.enable = true;
+        tailscale = {
+          enable = true;
+          tailnet = "collinux.tailnet";
+        };
         sshd = {
           enable = true;
           bind_host = tailscaleIP;
@@ -41,10 +45,12 @@ in {
       };
 
       selfhost = {
-        adguard = {
-          enable = true;
-          bind_host = tailscaleIP;
-        };
+        magic_caddy.enable = false;
+
+        # adguard = {
+        #   enable = true;
+        #   bind_host = tailscaleIP;
+        # };
         forgejo = {
           enable = true;
           bind_host = tailscaleIP;
diff --git a/hosts/ganymede/minecraft.nix b/hosts/ganymede/minecraft.nix
index cff5de2..c244868 100644
--- a/hosts/ganymede/minecraft.nix
+++ b/hosts/ganymede/minecraft.nix
@@ -1,6 +1,6 @@
 {config, ...}: {
   networking.firewall.allowedUDPPorts = [19132];
-  virtualisation.oci-containers.backend = "podman";
+  virtualisation.oci-containers.backend = "docker";
 
   virtualisation.oci-containers.containers."Minecraft" = {
     environment = {
@@ -9,16 +9,14 @@
 
       SERVER_NAME = "YServer";
       TZ = config.time.timeZone;
-      VERSION = "1.21.81.2";
-      CONTENT_LOG_FILE_ENABLED = "true";
+      VERSION = "1.21.131.1";
+      CONTENT_LOG_FILE_ENABLED = "false";
 
       ALLOW_CHEATS = "false";
       DIFFICULTY = "1";
     };
     image = "itzg/minecraft-bedrock-server";
     ports = ["0.0.0.0:19132:19132/udp"];
-    volumes = ["/srv/minecraft/:/data"];
-
-    podman.sdnotify = "conmon"; # avoid nasty errors about healthcheck (idk, the service runs fine)
+    volumes = ["/var/lib/minecraft/:/data"];
   };
 }
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 863032f..ce30973 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -1,8 +1,16 @@
-{inputs, ...}: {
+{
+  config,
+  lib,
+  inputs,
+  ...
+}: {
   imports = [
     inputs.disko.nixosModules.disko
+    inputs.tsnsrv.nixosModules.default
     ./disks.nix
 
+    ./minecraft.nix
+
     ./iwlwifi.nix
     ./caddy.nix
   ];
@@ -15,6 +23,24 @@
     networkConfig.DHCP = "yes";
   };
 
+  services.openssh.settings.PasswordAuthentication = lib.mkForce true;
+
+  # services.tsnsrv = {
+  #   enable = true;
+  #   defaults = {
+  #     authKeyPath = config.collinux.secrets."tsnsrv-authkey".path;
+  #     ephemeral = true;
+  #     loginServerUrl = "https://williamsfam.us.com";
+  #   };
+
+  #   services = {
+  #     "adguard" = {
+  #       listenAddr = ":80";
+  #       toURL = "http://localhost:8001";
+  #     };
+  #   };
+  # };
+
   nixpkgs.hostPlatform = "x86_64-linux";
   system.stateVersion = "25.05";
 }
diff --git a/hosts/ganymede/tsnsrv-authkey.age b/hosts/ganymede/tsnsrv-authkey.age
new file mode 100644
index 0000000..d0e6eb1
--- /dev/null
+++ b/hosts/ganymede/tsnsrv-authkey.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Jg4yWQ NYO6CUksU6appmdib7CER3YYbcKoyn0wmB4YGTCeTE0
+tizx14UdvQftYrkDa3iXQYDp6JPWHfjDmFwjr11FBxQ
+-> ssh-ed25519 azBilg 3PYXHVdB2y2Y42ijOiv8LJ9c4WmeB5ivEPcehfS3Wns
+tP/xCHzd31DydF5aCn1tJGudanXLl+DIPod7KFtglXQ
+--- nbch7DRt1CYKBqzE9CeUIJgTMKIUCEA/CXVQZjkywfI
+��~������}���H������	�<42��)U{����QK�3%����G^�����FW3��G�J���y
 �1�
\ No newline at end of file
diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix
index 1db654f..6eba4c9 100644
--- a/hosts/mercury/hjem.nix
+++ b/hosts/mercury/hjem.nix
@@ -6,6 +6,7 @@
     kdePackages.kleopatra
     mpv
     musescore
+    zed-editor # experimenting
 
     kew # music player
     prismlauncher
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
index a86b5b3..bdcaa00 100644
--- a/modules/services/nixos/bluetooth.nix
+++ b/modules/services/nixos/bluetooth.nix
@@ -12,6 +12,18 @@ in
       powerOnBoot = true;
     };
 
+    # hardening (down to 2.1 OK)
+    systemd.services."bluetooth".serviceConfig = {
+      IPAddressDeny = "any";
+      ProtectHostname = true;
+      ProtectKernelTunables = lib.mkForce true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = lib.mkForce true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
+      ProtectClock = true;
+      ProcSubset = "pid";
+    };
+
     environment.systemPackages = [
       (lib.mkIf cfg.blueman.enable pkgs.blueman)
       (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith)
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 2667849..62b9146 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -11,6 +11,7 @@
   services.resolved = {
     enable = true;
     dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
     fallbackDns = [
       "9.9.9.9#dns.quad9.net"
       "149.112.112.112#dns.quad9.net"
@@ -21,6 +22,4 @@
     extraConfig = "MulticastDNS=no";
   };
   networking.resolvconf.enable = false;
-
-  systemd.network.wait-online.enable = false;
 }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index 9a11129..470bcec 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -25,6 +25,12 @@ in
 
     systemd.network = {
       enable = true;
+
+      wait-online = {
+        enable = true;
+        ignoredInterfaces = ["docker0"];
+      };
+
       networks."11-static-lan" = {
         name = "wl*";
 
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index c5e93ee..73c6caf 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -32,7 +32,8 @@ in
       DNSStubListener=no
     '';
 
-    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable
+      && config.collinux.services.selfhost.magic_caddy.enable) {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
           if config.collinux.services.networking.tailscale.enable
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index b1a6095..e499e64 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -36,7 +36,12 @@ in
       };
     };
 
-    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+    systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+
+    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable && config.collinux.services.selfhost.magic_caddy.enable) {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
           if config.collinux.services.networking.tailscale.enable
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
index 9319691..9989742 100644
--- a/modules/services/nixos/selfhost/headscale.nix
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -7,12 +7,14 @@
   cfg = config.collinux.services.selfhost.headscale;
 
   acl_file = (pkgs.formats.json {}).generate "acl.json" {
-    ssh = {
-      src = ["*"];
-      dst = ["*"];
-      users = ["autogroup:nonroot" "root"];
-      action = "accept";
-    };
+    ssh = [
+      {
+        src = ["collin@"];
+        dst = ["collin@"];
+        users = ["autogroup:nonroot" "root"];
+        action = "accept";
+      }
+    ];
   };
 in
   lib.mkIf cfg.enable {
@@ -47,6 +49,17 @@ in
       };
     };
 
+    # make sure headscale can start before tailscale
+    systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
+      after = lib.mkForce ["network.target"];
+      before = lib.mkForce ["headscale.target"];
+      wants = lib.mkForce ["network.target" "headscale.target"];
+    };
+
+    systemd.targets."headscale" = {
+      description = "Target represents headscale is running. started by headscale.service";
+    };
+
     services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable ''
       reverse_proxy localhost:8080
     '';
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 2867d10..cfe7883 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,18 +8,32 @@ in {
   config = lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
+      openFirewall = false;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
           type = "ed25519";
         }
       ];
+
+      listenAddresses = [
+        {
+          addr = cfg.bind_host;
+          port = 22;
+        }
+      ];
+
       settings = {
         PermitRootLogin = "prohibit-password";
         PasswordAuthentication = false;
       };
     };
 
+    systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+
     services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
   };
 }
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
index f39fc27..6af3c1c 100644
--- a/modules/services/nixos/tailscale.nix
+++ b/modules/services/nixos/tailscale.nix
@@ -18,5 +18,11 @@ in
       allowedUDPPorts = [config.services.tailscale.port];
     };
 
+    # don't start tailscale until after headscale starts
+    systemd.services."tailscaled" = lib.mkIf config.collinux.services.selfhost.headscale.enable {
+      wants = lib.mkForce ["network.target" "headscale.target"];
+      after = lib.mkForce ["network.target" "headscale.target"];
+    };
+
     environment.systemPackages = [pkgs.tailscale];
   }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 2084c45..8be7c42 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -76,11 +76,13 @@ in {
             type = lib.types.str;
             default = with config.collinux.services.networking.tailscale;
               if enable
-              then "https://${service_name}.${tailnet}"
+              then "http://${service_name}.${tailnet}"
               else null;
           };
         };
       in {
+        magic_caddy.enable = mkEnableOption "Automatically create caddy configurations for services";
+
         adguard = selfhostOptions {
           service_name = "adguard";
           default_port = 8001;
diff --git a/secrets.nix b/secrets.nix
index 3dc8491..d0a5ffb 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -5,6 +5,7 @@ let
   ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9";
 in {
   "caddy-env.age".publicKeys = [ganymede];
+  "tsnsrv-authkey.age".publicKeys = [ganymede mercury];
   "williams-psk.age".publicKeys = [ganymede];
   "github-ssh-key.age".publicKeys = [mercury jupiter];
 }