aboutsummaryrefslogtreecommitdiff
path: root/modules/services
diff options
context:
space:
mode:
Diffstat (limited to 'modules/services')
-rw-r--r--modules/services/nixos/audio.nix5
-rw-r--r--modules/services/nixos/bluetooth.nix12
-rw-r--r--modules/services/nixos/networking/default.nix18
-rw-r--r--modules/services/nixos/networking/networkd.nix7
-rw-r--r--modules/services/nixos/networking/resolved.nix17
-rw-r--r--modules/services/nixos/selfhost/adguard.nix12
-rw-r--r--modules/services/nixos/selfhost/default.nix1
-rw-r--r--modules/services/nixos/selfhost/forgejo.nix15
-rw-r--r--modules/services/nixos/selfhost/headscale.nix75
-rw-r--r--modules/services/nixos/ssh.nix14
-rw-r--r--modules/services/nixos/tailscale.nix12
-rw-r--r--modules/services/options.nix80
12 files changed, 216 insertions, 52 deletions
diff --git a/modules/services/nixos/audio.nix b/modules/services/nixos/audio.nix
index 93f8289..8f2f23e 100644
--- a/modules/services/nixos/audio.nix
+++ b/modules/services/nixos/audio.nix
@@ -12,9 +12,10 @@ in
enable = true;
wireplumber.enable = true;
alsa.enable = true;
-
- pulse.enable = cfg.pulse.enable;
+ pulse.enable = false;
};
+ boot.blacklistedKernelModules = ["snd_seq_dummy"]; # remove extraneous alsa midi devices
+
environment.systemPackages = [pkgs.pwvucontrol];
}
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
index a86b5b3..bdcaa00 100644
--- a/modules/services/nixos/bluetooth.nix
+++ b/modules/services/nixos/bluetooth.nix
@@ -12,6 +12,18 @@ in
powerOnBoot = true;
};
+ # hardening (down to 2.1 OK)
+ systemd.services."bluetooth".serviceConfig = {
+ IPAddressDeny = "any";
+ ProtectHostname = true;
+ ProtectKernelTunables = lib.mkForce true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = lib.mkForce true;
+ RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
+ ProtectClock = true;
+ ProcSubset = "pid";
+ };
+
environment.systemPackages = [
(lib.mkIf cfg.blueman.enable pkgs.blueman)
(lib.mkIf cfg.bluetuith.enable pkgs.bluetuith)
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 2667849..9fa56da 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -3,24 +3,8 @@
./iwd.nix
./networkmanager.nix
./networkd.nix
+ ./resolved.nix
];
networking.firewall.enable = true;
-
- # DNS
- services.resolved = {
- enable = true;
- dnsovertls = "opportunistic";
- fallbackDns = [
- "9.9.9.9#dns.quad9.net"
- "149.112.112.112#dns.quad9.net"
- ];
-
- # disable extra stuff
- llmnr = "false";
- extraConfig = "MulticastDNS=no";
- };
- networking.resolvconf.enable = false;
-
- systemd.network.wait-online.enable = false;
}
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index 9a11129..920b93f 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -25,6 +25,13 @@ in
systemd.network = {
enable = true;
+
+ wait-online = {
+ enable = true;
+ ignoredInterfaces = ["docker0"];
+ anyInterface = true;
+ };
+
networks."11-static-lan" = {
name = "wl*";
diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix
new file mode 100644
index 0000000..b552095
--- /dev/null
+++ b/modules/services/nixos/networking/resolved.nix
@@ -0,0 +1,17 @@
+{
+ networking.resolvconf.enable = false;
+
+ services.resolved = {
+ enable = true;
+ dnsovertls = "opportunistic";
+ dnssec = "allow-downgrade";
+ fallbackDns = [
+ "9.9.9.9#dns.quad9.net"
+ "149.112.112.112#dns.quad9.net"
+ ];
+
+ # disable extra stuff
+ llmnr = "false";
+ extraConfig = "MulticastDNS=no";
+ };
+}
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index c5e93ee..69fb8a4 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -32,16 +32,16 @@ in
DNSStubListener=no
'';
- services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+ services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+
+ services.caddy = lib.mkIf cfg.caddy.enable {
virtualHosts.${cfg.root_url}.extraConfig = ''
${
- if config.collinux.services.networking.tailscale.enable
- then "bind tailscale/adguard"
+ if cfg.caddy.bind_tailscale
+ then "bind tailscale/${cfg.service_name}"
else ""
}
- reverse_proxy localhost:${toString cfg.port}
+ reverse_proxy ${cfg.bind_host}:${toString cfg.port}
'';
};
-
- services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
}
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index 876586d..de1078b 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -2,6 +2,7 @@
imports = [
./adguard.nix
./forgejo.nix
+ ./headscale.nix
./caddy.nix
];
}
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index b1a6095..4571dca 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -8,7 +8,7 @@ in
lib.mkIf cfg.enable {
services.forgejo = {
enable = true;
- database.type = "postgres";
+ database.type = "sqlite3";
settings = {
server = {
DOMAIN = "localhost";
@@ -36,14 +36,19 @@ in
};
};
- services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+ systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
+ after = lib.mkAfter ["network-online.target"];
+ wants = lib.mkAfter ["network-online.target"];
+ };
+
+ services.caddy = lib.mkIf cfg.caddy.enable {
virtualHosts.${cfg.root_url}.extraConfig = ''
${
- if config.collinux.services.networking.tailscale.enable
- then "bind tailscale/forgejo"
+ if cfg.caddy.bind_tailscale
+ then "bind tailscale/${cfg.service_name}"
else ""
}
- reverse_proxy localhost:${toString cfg.port}
+ reverse_proxy ${cfg.bind_host}:${toString cfg.port}
'';
};
}
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
new file mode 100644
index 0000000..2bdcca1
--- /dev/null
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -0,0 +1,75 @@
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}: let
+ cfg = config.collinux.services.selfhost.headscale;
+
+ acl_file = (pkgs.formats.json {}).generate "acl.json" {
+ ssh = [
+ {
+ src = ["collin@"];
+ dst = ["collin@"];
+ users = ["autogroup:nonroot" "root"];
+ action = "accept";
+ }
+ ];
+ };
+in
+ lib.mkIf cfg.enable {
+ services.headscale = {
+ enable = true;
+ address = cfg.bind_host;
+ port = cfg.port;
+ settings = {
+ server_url = "https://${cfg.root_url}";
+
+ database.type = "sqlite";
+
+ dns = {
+ magic_dns = true;
+ base_domain = "collinux.tailnet";
+ override_local_dns = true;
+ nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
+ };
+
+ policy.path = "${acl_file}";
+
+ prefixes = {
+ "v4" = "100.100.0.0/16";
+ allocation = "random";
+ };
+
+ # leave tls for caddy to worry about
+ tls_cert_path = null;
+ tls_key_path = null;
+
+ logtail.enabled = false;
+ };
+ };
+
+ # make sure headscale can start before tailscale
+ systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
+ after = lib.mkForce ["network.target"];
+ before = lib.mkForce ["headscale.target"];
+ wants = lib.mkForce ["network.target" "headscale.target"];
+ };
+
+ systemd.targets."headscale" = {
+ description = "Target represents headscale is running. started by headscale.service";
+ };
+
+ environment.systemPackages = [pkgs.headscale];
+
+ services.caddy = lib.mkIf cfg.caddy.enable {
+ virtualHosts.${cfg.root_url}.extraConfig = ''
+ ${
+ if cfg.caddy.bind_tailscale
+ then "bind tailscale/${cfg.service_name}"
+ else ""
+ }
+ reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+ '';
+ };
+ }
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 2867d10..cfe7883 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,18 +8,32 @@ in {
config = lib.mkIf cfg.enable {
services.openssh = {
enable = true;
+ openFirewall = false;
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
+
+ listenAddresses = [
+ {
+ addr = cfg.bind_host;
+ port = 22;
+ }
+ ];
+
settings = {
PermitRootLogin = "prohibit-password";
PasswordAuthentication = false;
};
};
+ systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
+ after = lib.mkAfter ["network-online.target"];
+ wants = lib.mkAfter ["network-online.target"];
+ };
+
services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
};
}
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
index f39fc27..50e35d3 100644
--- a/modules/services/nixos/tailscale.nix
+++ b/modules/services/nixos/tailscale.nix
@@ -18,5 +18,17 @@ in
allowedUDPPorts = [config.services.tailscale.port];
};
+ # don't start tailscale until after headscale starts
+ systemd.services."tailscaled" =
+ if config.collinux.services.selfhost.headscale.enable
+ then {
+ wants = lib.mkForce ["network.target" "headscale.target"];
+ after = lib.mkForce ["network.target" "headscale.target"];
+ }
+ else {
+ wants = lib.mkForce ["network.target"];
+ after = lib.mkForce ["network.target"];
+ };
+
environment.systemPackages = [pkgs.tailscale];
}
diff --git a/modules/services/options.nix b/modules/services/options.nix
index e87ecb3..085895e 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -17,27 +17,48 @@ in {
networkmanager.enable = mkEnableOption "heavier wifi daemon";
networkd = {
- enable = mkEnableOption "set static IP (systemd-networkd)";
- ssid = mkOption {type = lib.types.str;};
- pskFile = mkOption {type = lib.types.str;};
+ enable = mkEnableOption "use systemd-networkd";
+ ssid = mkOption {
+ description = "SSID for this network";
+ type = lib.types.str;
+ };
+ pskFile = mkOption {
+ description = "Absolute path to a file containing the pre-shared key for this network";
+ type = lib.types.str;
+ example = "/run/secrets.d/wifi-psk";
+ };
static = lib.mkOption {
+ description = "Set a static IP address for this device on this network. Set to null to use DHCP";
type = lib.types.nullOr (lib.types.submodule {
options = {
- ip = mkOption {type = ip_addr_cidr;};
- gateway = mkOption {type = ip_addr;};
+ ip = mkOption {
+ description = "IP address";
+ type = ip_addr_cidr;
+ };
+ gateway = mkOption {
+ description = "default gateway";
+ type = ip_addr;
+ };
};
});
default = null;
};
};
+
tailscale.enable = mkEnableOption "tailscale";
- sshd.enable = mkEnableOption "OpenSSH server";
- };
- audio = {
- enable = mkEnableOption "pipewire + wireplumber";
- pulse.enable = mkEnableOption "pipewire-pulse";
+ sshd = {
+ enable = mkEnableOption "OpenSSH server";
+ bind_host = mkOption {
+ description = "The IP address on which OpenSSH will listen for incomming connections. The default, `0.0.0.0`, means 'all interfaces'";
+ type = ip_addr;
+ default = "0.0.0.0";
+ };
+ };
};
+
+ audio.enable = mkEnableOption "pipewire and wireplumber";
+
bluetooth = {
enable = mkEnableOption "bluetooth";
blueman.enable = mkEnableOption "graphical bluetooth manager";
@@ -48,27 +69,33 @@ in {
selfhostOptions = {
service_name,
default_port ? null,
- ...
}: {
- enable = mkEnableOption "";
+ enable = mkEnableOption "${service_name} selfhosted service";
+
+ service_name = mkOption {
+ type = lib.types.str;
+ internal = true;
+ };
+
bind_host = mkOption {
+ description = "The IP address on which ${service_name} will listen for incoming connections. The default, `0.0.0.0`, means 'all interfaces'";
type = ip_addr;
- default =
- if config.collinux.services.networking.tailscale.enable
- then "100.69.160.89"
- else "0.0.0.0";
+ default = "0.0.0.0";
};
port = mkOption {
+ description = "The port on which ${service_name} will listen for incomming connections";
type = lib.types.port;
default = default_port;
};
root_url = mkOption {
- type = lib.types.str;
- default =
- if config.collinux.services.networking.tailscale.enable
- then "https://${service_name}.tail7cca06.ts.net"
- else null;
+ description = "The final url that this service will be hosted on. Required for caddy, otherwise optional";
+ type = lib.types.nullOr lib.types.str;
+ };
+
+ caddy = {
+ enable = mkEnableOption "Automatically create caddy configurations for this service";
+ bind_tailscale = mkEnableOption "Bind the service to ${service_name}.{tailnet}";
};
};
in {
@@ -76,14 +103,23 @@ in {
service_name = "adguard";
default_port = 8001;
};
+
forgejo = selfhostOptions {
service_name = "forgejo";
default_port = 8010;
};
+
+ headscale = selfhostOptions {
+ service_name = "headscale";
+ default_port = 8080;
+ };
+
caddy = {
enable = mkEnableOption "caddy https server";
envFile = mkOption {
+ description = "Absolute path to file that contains environment variables for caddy operations";
type = lib.types.str;
+ example = "/run/secrets.d/caddy-env";
};
};
};
@@ -94,7 +130,7 @@ in {
assertions = [
{
assertion = with config.collinux.services.networking; (iwd.enable && !networkmanager.enable && !networkd.enable) || (!iwd.enable && networkmanager.enable && !networkd.enable) || (!iwd.enable && !networkmanager.enable && networkd.enable);
- message = "only one networking method (iwd, networkmanager, static) can be active";
+ message = "only one networking method (iwd, networkmanager, networkd) can be active";
}
{
assertion = with config.collinux.services.networking; !(wireguard.enable && tailscale.enable);