summary refs log tree commit diff stats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--npins/sources.json28
m---------packages0
m---------private0
-rw-r--r--secrets/acme.agebin641 -> 708 bytes
-rw-r--r--system/linde.nix106
-rw-r--r--system/mba.nix8
-rwxr-xr-xsystem/nanopi.nix47
-rw-r--r--system/prefect.nix18
-rw-r--r--system/settings/dev.nix62
-rw-r--r--system/settings/services/git-server.nix2
-rw-r--r--user/settings/development/golang.nix3
11 files changed, 242 insertions, 32 deletions
diff --git a/npins/sources.json b/npins/sources.json
index d7b43684..ad19dd7f 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -32,9 +32,9 @@
         "repo": "emacs-overlay"
       },
       "branch": "master",
-      "revision": "dc376600483aae0272de58ea9b2d06c9f4e132eb",
-      "url": "https://github.com/nix-community/emacs-overlay/archive/dc376600483aae0272de58ea9b2d06c9f4e132eb.tar.gz",
-      "hash": "15b1w9vg1g7zih56lh198yi8si6m7b4yxxfsn4dxffdzal415vbl"
+      "revision": "012409732a53433d75db7bb2e06dd0bdaf8ca7ea",
+      "url": "https://github.com/nix-community/emacs-overlay/archive/012409732a53433d75db7bb2e06dd0bdaf8ca7ea.tar.gz",
+      "hash": "1rsxi3xlrll0s3brwr1s1yb6zjzzkjzm704j4dzf05ss0m4pzc0d"
     },
     "home-manager": {
       "type": "Git",
@@ -44,9 +44,9 @@
         "repo": "home-manager"
       },
       "branch": "master",
-      "revision": "cd886711998fe5d9ff7979fdd4b4cbd17b1f1511",
-      "url": "https://github.com/nix-community/home-manager/archive/cd886711998fe5d9ff7979fdd4b4cbd17b1f1511.tar.gz",
-      "hash": "1kvww9d28nlz2gawbrasvgpk172vzxlxdbhh1b8c41m1x7rrvqk8"
+      "revision": "7e68e55d2e16d3a1e92a679430728c35a30fd24e",
+      "url": "https://github.com/nix-community/home-manager/archive/7e68e55d2e16d3a1e92a679430728c35a30fd24e.tar.gz",
+      "hash": "1qxshjyx38i6sqg8x3a2hxxgpzajspzf95991iwgv04m33ry4k83"
     },
     "nix-index-database": {
       "type": "Git",
@@ -68,15 +68,15 @@
         "repo": "nixos-hardware"
       },
       "branch": "master",
-      "revision": "e8232c132a95ddc62df9d404120ad4ff53862910",
-      "url": "https://github.com/NixOS/nixos-hardware/archive/e8232c132a95ddc62df9d404120ad4ff53862910.tar.gz",
-      "hash": "0w6d2nk498i0hqiimfxhxj7i9zhija9sybnhbyknwl7pkc4b7lkp"
+      "revision": "231274268ff2250d4730e274b808f66ef91b6381",
+      "url": "https://github.com/NixOS/nixos-hardware/archive/231274268ff2250d4730e274b808f66ef91b6381.tar.gz",
+      "hash": "1rpxx6ymqvbdfzfi2qqyl63lgvz7jipwx48pwn0krprp0jlzzx9s"
     },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixos-unstable",
-      "url": "https://releases.nixos.org/nixos/unstable/nixos-24.11pre642660.a71e967ef369/nixexprs.tar.xz",
-      "hash": "0km1smh73aqa9syc3pd6f8l8rz6jb87x8a4qx7d6x1b8932z3is2"
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-24.11pre644565.b2852eb9365c/nixexprs.tar.xz",
+      "hash": "0jykdcs08z1cfjaqgdaqf5dadsx9sj3lr0nsfkz2ydp9rx5vhb7i"
     },
     "nur": {
       "type": "Git",
@@ -86,9 +86,9 @@
         "repo": "NUR"
       },
       "branch": "master",
-      "revision": "88407857c90e39f2654a0ef347c2c920c25f453c",
-      "url": "https://github.com/nix-community/NUR/archive/88407857c90e39f2654a0ef347c2c920c25f453c.tar.gz",
-      "hash": "1gn8lbgrcqx4i13p2jjqqp3n2pkrmxn8rliz53x0vdmlg4vvzrjk"
+      "revision": "a0498a771e9d6d3f66dba3bd166a9ebf3cc3cb8c",
+      "url": "https://github.com/nix-community/NUR/archive/a0498a771e9d6d3f66dba3bd166a9ebf3cc3cb8c.tar.gz",
+      "hash": "037cmcrhcrjypnrvazvg531jkp3y8wxa5hl8zy1c88vbw2q4fabx"
     }
   },
   "version": 3
diff --git a/packages b/packages
-Subproject 1155711309d6e54ec6d6cfdbaee2160bab94000
+Subproject b8ac79d7ead214f96cc8b642fa7ce085a2ee204
diff --git a/private b/private
-Subproject 442aa5d4590153b95817b1f102510e87639d60a
+Subproject b9a288b3c757997afe2399ca10a877bffd8eba6
diff --git a/secrets/acme.age b/secrets/acme.age
index 0a7be3b7..efd8bf3a 100644
--- a/secrets/acme.age
+++ b/secrets/acme.age
Binary files differdiff --git a/system/linde.nix b/system/linde.nix
index 067d4dad..c0af9144 100644
--- a/system/linde.nix
+++ b/system/linde.nix
@@ -13,15 +13,18 @@ let
   net-gw = "172.31.1.1";
   net-ip6 = "2a01:4f8:c012:23a4::1";
   net-rdnsip = "2a01:4f8:c012:23a4::53";
+  net-acmeip = "2a01:4f8:c012:23a4::715";
   net-mask6 = "64";
   net-gw6 = "fe80::1";
+  domain = "alanpearce.eu";
   ts-domain = "hydra-pinecone.ts.net";
   golink = (builtins.getFlake (toString <golink>)).nixosModules.default;
 in
 {
   imports =
     [
-      <personal/modules/laminar.nix>
+      <personal/modules/nixos/laminar.nix>
+      <personal/modules/nixos/goatcounter.nix>
       <home-manager/nixos>
       <agenix/modules/age.nix>
       <searchix/nix/modules>
@@ -155,6 +158,7 @@ in
 
   networking = {
     hostName = hostname;
+    inherit domain;
     useDHCP = false;
     dhcpcd.enable = false;
     nameservers = [
@@ -167,6 +171,7 @@ in
       ${net-ip4} = [ "${hostname}.alanpearce.eu" hostname ];
       ${net-ip6} = [ "${hostname}.alanpearce.eu" hostname ];
       ${net-rdnsip} = [ "dns" ];
+      ${net-acmeip} = [ "acme" ];
     };
     firewall = {
       enable = true;
@@ -224,6 +229,7 @@ in
         address = [
           "${net-ip6}/${net-mask6}"
           "${net-rdnsip}/${net-mask6}"
+          "${net-acmeip}/${net-mask6}"
         ];
         addresses = [{
           Address = "${net-ip4}/${net-mask4}";
@@ -344,6 +350,19 @@ in
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "23.05"; # Did you read the comment?
 
+  services.goatcounter = {
+    enable = true;
+    listenAddress = "localhost";
+    port = 8082;
+    package = (import <personal> { inherit pkgs; }).goatcounter;
+    settings = {
+      tls = "proxy";
+      websocket = true;
+      automigrate = true;
+      smtp = "smtp://localhost:25";
+    };
+  };
+
   services.powerdns =
     let
       inherit (lib.lists) flatten;
@@ -445,6 +464,24 @@ in
     };
   };
 
+  services.postfix =
+    let
+      localUser = "alan";
+      forwardingAddress = "alan@alanpearce.eu";
+    in
+    {
+      enable = true;
+      destination = [ ];
+      domain = config.networking.domain;
+      virtual = ''
+        @${config.networking.hostName}.${config.networking.domain} ${localUser}
+        ${localUser} ${forwardingAddress}
+      '';
+      config = {
+        inet_interfaces = "loopback-only";
+      };
+    };
+
   services.kresd = {
     enable = true;
     # package = pkgs.knot-resolver.override { extraFeatures = true; };
@@ -580,11 +617,37 @@ in
     };
   };
 
+  services.acme-dns = {
+    enable = true;
+    settings =
+      let
+        me = "acme.${domain}";
+      in
+      {
+        general = {
+          listen = "[${net-acmeip}]:53";
+          protocol = "both6";
+          domain = me;
+          nsname = me;
+          nsadmin = builtins.replaceStrings [ "@" ] [ "." ] config.security.acme.defaults.email;
+          records = [
+            "${me}. AAAA ${net-acmeip}"
+            "${me}. NS ${me}."
+          ];
+        };
+        api = {
+          ip = "[${net-acmeip}]";
+          tls = "letsencrypt";
+          port = 443;
+          notification-email = config.security.acme.defaults.email;
+        };
+      };
+  };
+
   security.acme = {
     defaults = {
       email = "alan@alanpearce.eu";
-      dnsProvider = "pdns";
-      dnsResolver = "1.1.1.1:53";
+      dnsProvider = "acme-dns";
       credentialsFile = config.age.secrets.acme.path;
       reloadServices = [ "caddy" ];
       validMinDays = 32;
@@ -597,6 +660,9 @@ in
       reloadServices = map (x: "kresd@${toString x}") (range 1 config.services.kresd.instances);
       group = "knot-resolver";
     };
+    certs."stats.alanpearce.eu" = {
+      extraDomainNames = [ "*.stats.alanpearce.eu" ];
+    };
   };
   users.groups.acme.members = [
     "caddy"
@@ -716,6 +782,7 @@ in
             ns = config.services.nix-serve;
           in
           {
+            useACMEHost = "alanpearce.eu";
             extraConfig = ''
               reverse_proxy ${ns.bindAddress}:${toString ns.port}
             '';
@@ -725,10 +792,31 @@ in
             srv = config.services.laminar;
           in
           {
+            useACMEHost = "alanpearce.eu";
             extraConfig = ''
               reverse_proxy ${srv.settings.bindHTTP}
             '';
           };
+        "stats.alanpearce.eu" =
+          let
+            srv = config.services.goatcounter;
+          in
+          {
+            useACMEHost = "stats.alanpearce.eu";
+            serverAliases = [ "*.stats.alanpearce.eu" ];
+            extraConfig = ''
+              reverse_proxy ${srv.listenAddress}:${toString srv.port}
+            '';
+          };
+        "go.alanpearce.eu" = {
+          useACMEHost = "alanpearce.eu";
+          extraConfig = ''
+            encode zstd gzip
+            ${security-headers {}}
+            root * /srv/http/go
+            file_server
+          '';
+        };
       };
   };
   systemd.services.caddy.serviceConfig = {
@@ -926,17 +1014,17 @@ in
             {
               script-src = [
                 (baseURL + "/static/")
-                "https://gc.zgo.at"
+                "https://searchix.stats.alanpearce.eu"
                 "https://js-de.sentry-cdn.com"
                 "https://browser.sentry-cdn.com"
               ];
               img-src = [
                 self
-                "https://gc.zgo.at"
+                "https://searchix.stats.alanpearce.eu"
               ];
               connect-src = [
                 self
-                "https://searchix.goatcounter.com/count"
+                "https://searchix.stats.alanpearce.eu/count"
                 "*.sentry.io"
               ];
               worker-src = [
@@ -947,8 +1035,8 @@ in
             <script async
               src="https://js-de.sentry-cdn.com/d735e99613a86e1625fb85d0e8e762de.min.js"
               crossorigin="anonymous"></script>
-            <script data-goatcounter="https://searchix.goatcounter.com/count"
-                    async src="//gc.zgo.at/count.v4.js"
+            <script data-goatcounter="https://searchix.stats.alanpearce.eu/count"
+                    async src="//searchix.stats.alanpearce.eu/count.v4.js"
                     crossorigin="anonymous"
                     integrity="sha384-nRw6qfbWyJha9LhsOtSb2YJDyZdKvvCFh0fJYlkquSFjUxp9FVNugbfy8q1jdxI+"></script>
           '';
@@ -997,7 +1085,7 @@ in
     enable = true;
     path = with pkgs; [
       bash
-      stdenv
+      coreutils
       git
       cached-nix-shell
       nix
diff --git a/system/mba.nix b/system/mba.nix
index ca1b76d8..cc8c81da 100644
--- a/system/mba.nix
+++ b/system/mba.nix
@@ -1,10 +1,16 @@
 { ... }: {
   imports = [
     ./settings/darwin.nix
-    ./settings/programs/base.nix
+    ./settings/dev.nix
     ./settings/programs/shell.nix
+    <personal/modules/darwin/caddy>
   ];
 
+  services.caddy = {
+    user = "root";
+    group = "wheel";
+  };
+
   networking = {
     hostName = "mba";
   };
diff --git a/system/nanopi.nix b/system/nanopi.nix
index 5083f9e7..1e7411fa 100755
--- a/system/nanopi.nix
+++ b/system/nanopi.nix
@@ -504,11 +504,9 @@ in
         "/ts.net/tailscale"
       ];
       localise-queries = true;
-      cname = [
-        "ha,home-assistant"
-      ];
       interface-name = [
         "nanopi.${domain},bridge0"
+        "ca.${domain},bridge0"
         "wan.${domain},wan0"
         "wlan.${domain},wlan0"
       ];
@@ -525,10 +523,6 @@ in
       # ];
       bind-interfaces = true;
 
-      # if this is false, a remote query for nanopi returns 127.0.0.2, because that's in /etc/hosts
-      no-hosts = false;
-      expand-hosts = true;
-
       dnssec = true;
       trust-anchor = ".,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
 
@@ -610,6 +604,45 @@ in
     };
   };
 
+  services.caddy = {
+    enable = true;
+    globalConfig = ''
+      pki {
+        ca home {
+          name "Home CA"
+        }
+      }
+    '';
+    virtualHosts = {
+      "nanopi.${domain}" = {
+        serverAliases = [ "nanopi.${ts_domain}" ];
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+          root /var/lib/caddy/ca
+          file_server browse
+        '';
+      };
+      "ca.${domain}" = {
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+          acme_server {
+            allow {
+              domains *.test *.${domain}
+            }
+          }
+        '';
+      };
+    };
+  };
+
   system.stateVersion = "23.05";
 
   programs.fish = {
diff --git a/system/prefect.nix b/system/prefect.nix
index 801692e3..e145c304 100644
--- a/system/prefect.nix
+++ b/system/prefect.nix
@@ -23,6 +23,7 @@
     ./settings/programs/kde.nix
     ./settings/programs/shell.nix
     ./settings/programs/docker.nix
+    ./settings/dev.nix
     ./settings/gaming.nix
     <nixos-hardware/common/cpu/amd>
     <nixos-hardware/common/cpu/amd/pstate.nix>
@@ -150,6 +151,7 @@
     };
     hosts = {
       "fd7a:115c:a1e0::53" = [ "tailscale" "ts" ];
+      "::1" = [ "alanpearce.test" "alanpearce.localhost" ];
     };
 
     nftables = {
@@ -178,6 +180,22 @@
 
   system.stateVersion = "23.05";
 
+  security.pki.certificates = [
+    ''
+      -----BEGIN CERTIFICATE-----
+      MIIBozCCAUqgAwIBAgIRAJ1slNK3lsucmYYUbtGRUvswCgYIKoZIzj0EAwIwMDEu
+      MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNCBFQ0MgUm9vdDAe
+      Fw0yNDA2MjYxNTM3MTJaFw0zNDA1MDUxNTM3MTJaMDAxLjAsBgNVBAMTJUNhZGR5
+      IExvY2FsIEF1dGhvcml0eSAtIDIwMjQgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq
+      hkjOPQMBBwNCAAR1fc1TOhp9oNy/p40BfUd+E13b1/URwwocuZ5w0SKHTE/t8Hp+
+      7Zd9ZTYvQ7WxFfaVxmBCcFMUJsTm7bbYTEvlo0UwQzAOBgNVHQ8BAf8EBAMCAQYw
+      EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUcnlbpAM2ZCRsiCzdFiM5EjCm
+      aoEwCgYIKoZIzj0EAwIDRwAwRAIgcKf3vRiF87G0r2+vgBbyfWo4D2TDQWkSrfek
+      Q0f1Q5UCIEmyeqrifbp5JnZqtm3IlGVIEQcUeVygqnV/xW3xCAgT
+      -----END CERTIFICATE-----
+    ''
+  ];
+
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
   nix.settings.trusted-users = [ "root" "nixremote" ];
   services.displayManager.hiddenUsers = [ "nixremote" ];
diff --git a/system/settings/dev.nix b/system/settings/dev.nix
new file mode 100644
index 00000000..7d2e6193
--- /dev/null
+++ b/system/settings/dev.nix
@@ -0,0 +1,62 @@
+{ ... }: {
+  services.caddy = {
+    enable = true;
+    globalConfig = ''
+      auto_https disable_redirects
+    '';
+    virtualHosts =
+      let
+        local_tls = ''
+          tls {
+            issuer internal {
+              ca local
+            }
+          }
+        '';
+      in
+      {
+        "localhost" = {
+          logFormat = "output discard";
+          extraConfig = ''
+            ${local_tls}
+            acme_server {
+              allow {
+                domains *.test *.localhost
+              }
+            }
+          '';
+        };
+        # need to test forwarding behaviour
+        "https://alanpearce.localhost" = {
+          logFormat = "output discard";
+          serverAliases = [
+            "http://alanpearce.localhost"
+
+            # remember to update /etc/hosts
+            "https://alanpearce.test"
+            "http://alanpearce.test"
+          ];
+          extraConfig = ''
+            ${local_tls}
+            reverse_proxy http://alanpearce.test:8080 {
+              transport http {
+                dial_timeout 1s
+                compression off
+              }
+            }
+          '';
+        };
+        "searchix.localhost" = {
+          logFormat = "output discard";
+          extraConfig = ''
+            reverse_proxy http://localhost:7331 {
+              transport http {
+                dial_timeout 1s
+                compression off
+              }
+            }
+          '';
+        };
+      };
+  };
+}
diff --git a/system/settings/services/git-server.nix b/system/settings/services/git-server.nix
index 54e8560c..e8fe6360 100644
--- a/system/settings/services/git-server.nix
+++ b/system/settings/services/git-server.nix
@@ -4,7 +4,7 @@
 , ...
 }:
 let
-  inherit (lib) pipe flatten concatMapAttrs mergeAttrsList mapAttrsToList;
+  inherit (lib) pipe flatten concatMapAttrs mapAttrsToList;
   inherit (import ../../../lib/caddy.nix { inherit lib; }) security-headers;
   repos = "${config.services.gitolite.dataDir}/repositories";
 
diff --git a/user/settings/development/golang.nix b/user/settings/development/golang.nix
index a9293a31..39baf910 100644
--- a/user/settings/development/golang.nix
+++ b/user/settings/development/golang.nix
@@ -12,6 +12,9 @@
     golangci-lint-langserver
     personal.prettier-plugin-go-template
   ];
+  home.sessionPath = [
+    "$HOME/go/bin"
+  ];
   programs.emacs.extraPackages = epkgs: (with epkgs; [
     go-eldoc
     go-tag
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-01 13:40:24 +0000