atridad/haschel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cleanup now that I finally got the LSP working... so many warnings.
Some checks failed
Deploy NixOS / deploy (push) Failing after 18s
Details

Browse Source
This commit is contained in:
Atridad Lahiji
2026-02-17 15:19:03 -07:00
parent 38620aba96
commit 08b69bb46a
11 changed files with 319 additions and 417 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
configuration.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { pkgs, ... }:
{ {
imports = [ imports = [
@@ -14,7 +14,10 @@
./modules/fail2ban.nix ./modules/fail2ban.nix
]; ];
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [
"nix-command"
"flakes"
];
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
git git

4
modules/boot.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { pkgs, ... }:
{ {
boot.loader.grub = { boot.loader.grub = {
@@ -9,7 +9,7 @@
boot.kernelPackages = pkgs.linuxPackages_latest; boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelModules = [ "tcp_bbr" ]; boot.kernelModules = [ "tcp_bbr" ];
boot.kernel.sysctl = { boot.kernel.sysctl = {
"net.core.default_qdisc" = "fq"; "net.core.default_qdisc" = "fq";
"net.ipv4.tcp_congestion_control" = "bbr"; "net.ipv4.tcp_congestion_control" = "bbr";

2
modules/fail2ban.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, lib, ... }: { ... }:
{ {
services.fail2ban = { services.fail2ban = {

2
modules/hardware.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { ... }:
{ {
hardware.enableRedistributableFirmware = true; hardware.enableRedistributableFirmware = true;

2
modules/locale.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { ... }:
let let
settings = import ../settings.nix; settings = import ../settings.nix;

34
modules/matrix.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, lib, ... }: { pkgs, ... }:
let let
livekitKeyFile = "/run/livekit.key"; livekitKeyFile = "/run/livekit.key";
@@ -12,13 +12,19 @@ in
settings = { settings = {
global = { global = {
server_name = serverName; server_name = serverName;
address = [ "127.0.0.1" "::1" ]; address = [
"127.0.0.1"
"::1"
];
port = [ 6167 ]; port = [ 6167 ];
max_request_size = 104857600; max_request_size = 104857600;
allow_registration = false; allow_registration = false;
allow_encryption = true; allow_encryption = true;
allow_federation = true; allow_federation = true;
trusted_servers = [ "matrix.org" "chat.blahaj.zone" ]; trusted_servers = [
"matrix.org"
"chat.blahaj.zone"
];
ip_range_denylist = [ ip_range_denylist = [
"127.0.0.0/8" "127.0.0.0/8"
"10.0.0.0/8" "10.0.0.0/8"
@@ -98,9 +104,16 @@ in
systemd.services.livekit.requires = [ "acme-${matrixRtcDomain}.service" ]; systemd.services.livekit.requires = [ "acme-${matrixRtcDomain}.service" ];
systemd.services.livekit-key = { systemd.services.livekit-key = {
before = [ "lk-jwt-service.service" "livekit.service" ]; before = [
"lk-jwt-service.service"
"livekit.service"
];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
path = with pkgs; [ livekit coreutils gawk ]; path = with pkgs; [
livekit
coreutils
gawk
];
script = '' script = ''
echo "Key missing, generating key" echo "Key missing, generating key"
echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}" echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}"
@@ -110,10 +123,17 @@ in
}; };
networking.firewall = { networking.firewall = {
allowedTCPPorts = [ 7880 7881 5349 ]; allowedTCPPorts = [
7880
7881
5349
];
allowedUDPPorts = [ 3478 ]; allowedUDPPorts = [ 3478 ];
allowedUDPPortRanges = [ allowedUDPPortRanges = [
{ from = 50000; to = 60000; } {
from = 50000;
to = 60000;
}
]; ];
}; };
} }

8
modules/networking.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { ... }:
let let
settings = import ../settings.nix; settings = import ../settings.nix;
@@ -10,7 +10,11 @@ in
networking.firewall = { networking.firewall = {
enable = true; enable = true;
allowedTCPPorts = [ 22 80 443 ]; allowedTCPPorts = [
22
80
443
];
allowedUDPPorts = [ ]; allowedUDPPorts = [ ];
}; };
} }

659
modules/nginx.nix
View File

@@ -1,9 +1,13 @@
{ config, pkgs, lib, ... }: {
config,
lib,
...
}:
let let
serverName = "atri.dad"; rootDomain = "atri.dad";
matrixDomain = "matrix.atri.dad"; matrixDomain = "matrix.${rootDomain}";
matrixRtcDomain = "matrixrtc.atri.dad"; matrixRtcDomain = "matrixrtc.${rootDomain}";
wellKnownServer = builtins.toJSON { wellKnownServer = builtins.toJSON {
"m.server" = "${matrixDomain}:443"; "m.server" = "${matrixDomain}:443";
@@ -20,13 +24,34 @@ let
} }
]; ];
}; };
blockAi = "if ($fuckai) { return 444; }";
mkProxyVhost =
{
host,
upstream,
websockets ? false,
extraConfig ? "",
locationExtraConfig ? "",
}:
{
"${host}" = {
enableACME = true;
forceSSL = true;
extraConfig = extraConfig;
locations."/" = {
proxyPass = upstream;
proxyWebsockets = websockets;
extraConfig = lib.concatStringsSep "\n" (
[ blockAi ] ++ lib.optional (locationExtraConfig != "") locationExtraConfig
);
};
};
};
in in
{ {
security.acme = {
acceptTerms = true;
defaults.email = "me@atri.dad";
};
services.nginx = { services.nginx = {
enable = true; enable = true;
@@ -35,7 +60,6 @@ in
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
# Fuck AI
clientMaxBodySize = "3g"; clientMaxBodySize = "3g";
commonHttpConfig = '' commonHttpConfig = ''
@@ -43,407 +67,250 @@ in
more_clear_headers X-Powered-By; more_clear_headers X-Powered-By;
map $http_user_agent $fuckai { map $http_user_agent $fuckai {
default 0; default 0;
"~*GPTBot" 1;
"~*GPTBot" 1; "~*ChatGPT-User" 1;
"~*ChatGPT-User" 1; "~*OAI-SearchBot" 1;
"~*OAI-SearchBot" 1; "~*ChatGPT-Browser" 1;
"~*ChatGPT-Browser" 1; "~*ClaudeBot" 1;
"~*ClaudeBot" 1; "~*Claude-Web" 1;
"~*Claude-Web" 1; "~*anthropic-ai" 1;
"~*anthropic-ai" 1; "~*Anthropic-Claude" 1;
"~*Anthropic-Claude" 1; "~*xAI-Bot" 1;
"~*xAI-Bot" 1; "~*DeepseekBot" 1;
"~*DeepseekBot" 1; "~*Google-Extended" 1;
"~*Google-Extended" 1; "~*Gemini-Ai" 1;
"~*Gemini-Ai" 1; "~*Gemini-Deep-Research" 1;
"~*Gemini-Deep-Research" 1; "~*Google-CloudVertexBot" 1;
"~*Google-CloudVertexBot" 1; "~*Google-NotebookLM" 1;
"~*Google-NotebookLM" 1; "~*GoogleAgent-Mariner" 1;
"~*GoogleAgent-Mariner" 1; "~*Bard-Ai" 1;
"~*Bard-Ai" 1; "~*FacebookBot" 1;
"~*FacebookBot" 1; "~*Meta-ExternalAgent" 1;
"~*Meta-ExternalAgent" 1; "~*meta-webindexer" 1;
"~*meta-webindexer" 1; "~*Applebot-Extended" 1;
"~*Applebot-Extended" 1; "~*bingbot" 1;
"~*bingbot" 1; "~*CCBot" 1;
"~*CCBot" 1; "~*PerplexityBot" 1;
"~*PerplexityBot" 1; "~*Perplexity-User" 1;
"~*Perplexity-User" 1; "~*Bytespider" 1;
"~*Bytespider" 1; "~*Diffbot" 1;
"~*Diffbot" 1; "~*Amazonbot" 1;
"~*Amazonbot" 1; "~*cohere-ai" 1;
"~*cohere-ai" 1; "~*Cohere-Command" 1;
"~*Cohere-Command" 1; "~*YouBot" 1;
"~*YouBot" 1; "~*Omgilibot" 1;
"~*Omgilibot" 1; "~*ImagesiftBot" 1;
"~*ImagesiftBot" 1; "~*AI2Bot" 1;
"~*AI2Bot" 1; "~*Andibot" 1;
"~*Andibot" 1; "~*bigsur.ai" 1;
"~*bigsur.ai" 1; "~*Brightbot" 1;
"~*Brightbot" 1; "~*TerraCotta" 1;
"~*TerraCotta" 1; "~*Character-AI" 1;
"~*Character-AI" 1; "~*Devin" 1;
"~*Devin" 1; "~*Crawlspace" 1;
"~*Crawlspace" 1; "~*DuckAssistBot" 1;
"~*DuckAssistBot" 1; "~*FirecrawlAgent" 1;
"~*FirecrawlAgent" 1; "~*Groq-Bot" 1;
"~*Groq-Bot" 1; "~*HuggingFace-Bot" 1;
"~*HuggingFace-Bot" 1; "~*IbouBot" 1;
"~*IbouBot" 1; "~*MistralAI-User" 1;
"~*MistralAI-User" 1; "~*Replicate-Bot" 1;
"~*Replicate-Bot" 1; "~*RunPod-Bot" 1;
"~*RunPod-Bot" 1; "~*TimpiBot" 1;
"~*TimpiBot" 1; "~*Together-Bot" 1;
"~*Together-Bot" 1; "~*Kangaroo Bot" 1;
"~*Kangaroo Bot" 1; "~*PanguBot" 1;
"~*PanguBot" 1; "~*Cotoyogi" 1;
"~*Cotoyogi" 1; "~*Webzio-Extended" 1;
"~*Webzio-Extended" 1;
} }
''; '';
# Stream Hosts virtualHosts = lib.mkMerge [
streamConfig = '' (mkProxyVhost {
# Port 69 host = rootDomain;
server { upstream = "http://lloyd.tadpole-pain.ts.net:3000";
listen 69; })
listen 69 udp;
proxy_pass lloyd.tadpole-pain.ts.net:69; {
"${rootDomain}".locations."= /.well-known/matrix/server".extraConfig = ''
default_type application/json;
return 200 '${wellKnownServer}';
'';
"${rootDomain}".locations."= /.well-known/matrix/client".extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin "*";
return 200 '${wellKnownClient}';
'';
} }
# Port 420 (mkProxyVhost {
server { host = "analytics.${rootDomain}";
listen 420; upstream = "http://lloyd.tadpole-pain.ts.net:30060";
listen 420 udp; })
proxy_pass lloyd.tadpole-pain.ts.net:420; (mkProxyVhost {
} host = "archive.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30288";
})
(mkProxyVhost {
host = "ascently.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:8838";
})
(mkProxyVhost {
host = "bsky.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:31173";
})
(mkProxyVhost {
host = "chef.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30111";
})
(mkProxyVhost {
host = "democlimb.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:8008";
})
(mkProxyVhost {
host = "fedi.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:8181";
})
(mkProxyVhost {
host = "gist.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:1227";
})
(mkProxyVhost {
host = "git.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30010";
})
(mkProxyVhost {
host = "links.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30243";
})
# Minecraft / Game Ports (mkProxyVhost {
server { host = "media.${rootDomain}";
listen 25565; upstream = "http://lloyd.tadpole-pain.ts.net:30013";
listen 25565 udp; websockets = true;
proxy_pass lloyd.tadpole-pain.ts.net:25565;
}
server {
listen 25566;
listen 25566 udp;
proxy_pass lloyd.tadpole-pain.ts.net:25566;
}
server {
listen 25567;
listen 25567 udp;
proxy_pass lloyd.tadpole-pain.ts.net:25567;
}
'';
# Proxy Hosts
virtualHosts = {
# atri.dad hosts
"atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:3000";
extraConfig = "if ($fuckai) { return 444; }";
};
locations."= /.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
return 200 '${wellKnownServer}';
'';
};
locations."= /.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin "*";
return 200 '${wellKnownClient}';
'';
};
};
"analytics.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30060";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"archive.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30288";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"ascently.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:8838";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"bsky.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:31173";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"chef.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30111";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"democlimb.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:8008";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"fedi.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:8181";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"gist.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:1227";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"git.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30010";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"links.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30243";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"media.atri.dad" = {
enableACME = true;
forceSSL = true;
extraConfig = '' extraConfig = ''
client_max_body_size 0; client_max_body_size 0;
''; '';
locations."/" = { locationExtraConfig = ''
proxyPass = "http://lloyd.tadpole-pain.ts.net:30013"; proxy_buffering off;
proxyWebsockets = true; proxy_request_buffering off;
extraConfig = '' proxy_read_timeout 86400s;
if ($fuckai) { return 444; } proxy_send_timeout 86400s;
proxy_buffering off; send_timeout 86400s;
proxy_request_buffering off; '';
proxy_read_timeout 86400s; })
proxy_send_timeout 86400s;
send_timeout 86400s;
'';
};
};
"memos.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30311";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"mermaid.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:8280";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"msrc.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:3311";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"n8n.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30109";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"ocr.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30070";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"openclimb.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:1337";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"photos.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30041";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"pods.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:8828";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"requests.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30042";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"ripkyle.org" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:4321";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"s3.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30188";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"search.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30053";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"sync.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:20910";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"travel.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30251";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"travelapi.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30250";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"vault.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://lloyd.tadpole-pain.ts.net:30032";
extraConfig = "if ($fuckai) { return 444; }";
};
};
"matrix.atri.dad" = { (mkProxyVhost {
enableACME = true; host = "memos.${rootDomain}";
forceSSL = true; upstream = "http://lloyd.tadpole-pain.ts.net:30311";
})
(mkProxyVhost {
host = "mermaid.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:8280";
})
(mkProxyVhost {
host = "msrc.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:3311";
})
(mkProxyVhost {
host = "n8n.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30109";
})
(mkProxyVhost {
host = "ocr.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30070";
})
(mkProxyVhost {
host = "openclimb.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:1337";
})
(mkProxyVhost {
host = "photos.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30041";
})
(mkProxyVhost {
host = "pods.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:8828";
})
(mkProxyVhost {
host = "requests.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30042";
})
(mkProxyVhost {
host = "s3.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30188";
})
(mkProxyVhost {
host = "search.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30053";
})
(mkProxyVhost {
host = "sync.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:20910";
})
(mkProxyVhost {
host = "travel.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30251";
})
(mkProxyVhost {
host = "travelapi.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30250";
})
(mkProxyVhost {
host = "vault.${rootDomain}";
upstream = "http://lloyd.tadpole-pain.ts.net:30032";
})
locations."/" = { {
proxyPass = "http://[::1]:6167"; "${matrixDomain}" = {
proxyWebsockets = true; enableACME = true;
extraConfig = '' forceSSL = true;
client_max_body_size 100M;
'';
};
locations."^~ /livekit/jwt/" = { locations."/" = {
priority = 400; proxyPass = "http://[::1]:6167";
proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/"; proxyWebsockets = true;
}; extraConfig = ''
}; client_max_body_size 100M;
'';
};
"matrixrtc.atri.dad" = { locations."^~ /livekit/jwt/" = {
enableACME = true; priority = 400;
forceSSL = true; proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
};
};
}
# livekit {
locations."/" = { "${matrixRtcDomain}" = {
proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}"; enableACME = true;
proxyWebsockets = true; forceSSL = true;
extraConfig = '' locations."/" = {
proxy_send_timeout 120; proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
proxy_read_timeout 120; proxyWebsockets = true;
proxy_buffering off; extraConfig = ''
proxy_set_header Accept-Encoding gzip; proxy_send_timeout 120;
''; proxy_read_timeout 120;
proxy_buffering off;
proxy_set_header Accept-Encoding gzip;
'';
};
}; };
}; }
"atash.dev" = { (mkProxyVhost {
enableACME = true; host = "ripkyle.org";
forceSSL = true; upstream = "http://lloyd.tadpole-pain.ts.net:4321";
locations."/" = { })
proxyPass = "http://lloyd.tadpole-pain.ts.net:6969"; (mkProxyVhost {
extraConfig = "if ($fuckai) { return 444; }"; host = "atash.dev";
}; upstream = "http://lloyd.tadpole-pain.ts.net:6969";
}; })
"chronus.atash.dev" = { (mkProxyVhost {
enableACME = true; host = "chronus.atash.dev";
forceSSL = true; upstream = "http://lloyd.tadpole-pain.ts.net:7337";
locations."/" = { })
proxyPass = "http://lloyd.tadpole-pain.ts.net:7337"; ];
extraConfig = "if ($fuckai) { return 444; }";
};
};
};
}; };
# Open Ports
networking.firewall.allowedTCPPorts = [ 80 443 69 420 25565 25566 25567 ];
networking.firewall.allowedUDPPorts = [ 69 420 25565 25566 25567 ];
} }

2
modules/services.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { ... }:
{ {
services.openssh = { services.openssh = {

10
modules/users.nix
View File

@@ -1,4 +1,4 @@
{ config, pkgs, ... }: { ... }:
let let
settings = import ../settings.nix; settings = import ../settings.nix;
@@ -8,10 +8,14 @@ in
isNormalUser = true; isNormalUser = true;
description = settings.userDescription; description = settings.userDescription;
extraGroups = settings.userGroups; extraGroups = settings.userGroups;
openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ]; openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
];
}; };
users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ]; users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
];
security.sudo.execWheelOnly = true; security.sudo.execWheelOnly = true;
} }

6
settings.nix
View File

@@ -4,5 +4,9 @@
userDescription = "Atridad Lahiji"; userDescription = "Atridad Lahiji";
timezone = "America/Edmonton"; timezone = "America/Edmonton";
locale = "en_CA.UTF-8"; locale = "en_CA.UTF-8";
userGroups = [ "networkmanager" "wheel" "docker" ]; userGroups = [
"networkmanager"
"wheel"
"docker"
];
} }