mirror of
https://codeberg.org/gigirassy/nixos-server-config
synced 2026-08-30 15:27:40 +00:00
Add nixos/configuration.nix
This commit is contained in:
gigirassy
@@ -0,0 +1,282 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./networking.nix # generated at runtime by nixos-infect
|
||||
./modules/smart-ipv6-rotator.nix # ipv6 rotator
|
||||
./modules/watchdog.nix # anubis watchdog to auto-report to abuseipdb
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
(lib.hiPrio pkgs.uutils-coreutils-noprefix)
|
||||
(lib.hiPrio pkgs.uutils-findutils)
|
||||
(lib.hiPrio pkgs.uutils-diffutils)
|
||||
fastfetch # fetch stats!
|
||||
btop
|
||||
python3Minimal
|
||||
git
|
||||
gnuplot
|
||||
ctop
|
||||
starship
|
||||
nftables
|
||||
];
|
||||
|
||||
|
||||
users.users.nune = {
|
||||
isNormalUser = true;
|
||||
description = "Admin user";
|
||||
createHome = true;
|
||||
extraGroups = [ "wheel" "docker" ];
|
||||
shell = pkgs.zsh;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 XXXXX" # i know its fine to share but im a goober
|
||||
];
|
||||
};
|
||||
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
shellAliases = {
|
||||
ne = "sudo nano /etc/nixos/configuration.nix && sudo nixos-rebuild switch";
|
||||
ncg = "sudo nix-collect-garbage";
|
||||
};
|
||||
};
|
||||
|
||||
programs.starship.enable = true;
|
||||
|
||||
# enable sudo; keep password requirement by default
|
||||
security.sudo.enable = true;
|
||||
security.sudo.wheelNeedsPassword = true;
|
||||
|
||||
services.snowflake-proxy = {
|
||||
enable = true;
|
||||
capacity = 50;
|
||||
};
|
||||
|
||||
|
||||
services.yggdrasil = {
|
||||
enable = true;
|
||||
persistentKeys = true;
|
||||
|
||||
settings = {
|
||||
Peers = [
|
||||
"tcp://[2a14:1e00:3:15c::]:65535"
|
||||
"ws://vpn.itrus.su:7994"
|
||||
"tls://23.137.249.65:444"
|
||||
"tcp://[2001:470:1f13:e56::64]:39565"
|
||||
"tcp://51.15.204.214:12345"
|
||||
"tcp://[2a0b:4142:e9e::2]:65535"
|
||||
"tcp://[2a0c:b641:ce0::25d8:c5d6]:65535"
|
||||
"tls://n.ygg.yt:443"
|
||||
"tcp://94.159.110.4:65535"
|
||||
"tcp://[2a0b:4142:ce0::2]:65535"
|
||||
];
|
||||
Listen = [
|
||||
"tls://0.0.0.0:32000"
|
||||
"tls://[::]:32000"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.i2pd = {
|
||||
enable = true;
|
||||
enableIPv4 = true;
|
||||
port = 35252;
|
||||
address = "91.98.126.143" ;
|
||||
enableIPv6 = true; # if you don't have IPv6, leave false
|
||||
ifname = "eth0"; # change to your interface
|
||||
bandwidth = 1000; # limit to 500 KB/s (≈ 4 Mb/s)
|
||||
share = 50; # allocate 50% of that to transit
|
||||
notransit = false; # allow transit
|
||||
floodfill = false; # not acting as floodfill
|
||||
nat = true; # if behind NAT
|
||||
};
|
||||
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.trustedInterfaces = [ "lo" ]; # loopback
|
||||
networking.firewall.allowedTCPPorts = [ 22 80 443 8080 9091 51413 4001 8013 27905 32000 31311 31312 31313 31314 35252];
|
||||
networking.firewall.allowedUDPPorts = [ 51413 ]; # Transmission uses UDP for DHT/peer discovery
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
services.smart-ipv6-rotator = {
|
||||
enable = true;
|
||||
ipv6range = "2a01:4f8:c2c:c398::/64";
|
||||
rev = "master";
|
||||
sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY=";
|
||||
};
|
||||
|
||||
services.cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"* * * * * /root/trafficgen.sh >> /var/log/generate_traffic_png.log 2>&1"
|
||||
"0 */6 * * * docker restart instafix_proxy"
|
||||
"0 */12 * * * docker system prune -a -f"
|
||||
"0 */1 * * * /bin/bash -lc 'for i in {1..10}; do [ -d /srv/arti$i/cache/dir_blobs ] && find /srv/arti$i/cache/dir_blobs -mindepth 1 -maxdepth 1 -exec rm -rf {} +; done'" # clear redlib cache
|
||||
];
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
logFormat = ''level INFO'';
|
||||
logDir = ''/var/log/caddy'';
|
||||
virtualHosts."fan.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:10417
|
||||
'';
|
||||
virtualHosts."skylib.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:5081
|
||||
'';
|
||||
virtualHosts."tent.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:5083
|
||||
'';
|
||||
virtualHosts."small.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:5084
|
||||
'';
|
||||
virtualHosts."pinata.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:4100
|
||||
'';
|
||||
virtualHosts."tube.blitzw.in".extraConfig = ''
|
||||
basicauth {
|
||||
guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
|
||||
}
|
||||
reverse_proxy 100.76.137.52:33020
|
||||
'';
|
||||
virtualHosts."hooligan.srv.blitzw.in".extraConfig = ''
|
||||
root * /srv/landing
|
||||
file_server
|
||||
'';
|
||||
virtualHosts."mirage.blitzw.in".extraConfig= ''
|
||||
reverse_proxy localhost:35200 {
|
||||
header_up X-Real-Ip {remote_host}
|
||||
header_up X-Http-Version {http.request.proto}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up Host {host}
|
||||
header_up Referer {>Referer}
|
||||
}
|
||||
'';
|
||||
virtualHosts."priviblur.blitzw.in".extraConfig= ''
|
||||
reverse_proxy localhost:24215 {
|
||||
header_up X-Real-Ip {remote_host}
|
||||
header_up X-Http-Version {http.request.proto}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up Host {host}
|
||||
header_up Referer {>Referer}
|
||||
}
|
||||
'';
|
||||
virtualHosts."genius.blitzw.in".extraConfig=''
|
||||
reverse_proxy localhost:2006 {
|
||||
header_up X-Real-Ip {remote_host}
|
||||
header_up X-Http-Version {http.request.proto}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up Host {host}
|
||||
}
|
||||
'';
|
||||
virtualHosts."pin.blitzw.in".extraConfig= ''
|
||||
reverse_proxy localhost:6600
|
||||
'';
|
||||
virtualHosts."search.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:24999
|
||||
'';
|
||||
virtualHosts."wikimore.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:8109
|
||||
'';
|
||||
virtualHosts."twitch.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:5600
|
||||
'';
|
||||
virtualHosts."moz.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:3012
|
||||
'';
|
||||
virtualHosts."rl.blitzw.in".extraConfig = ''
|
||||
respond "301 Moved Permanently" 301
|
||||
'';
|
||||
virtualHosts."bilder.blitzw.in".extraConfig = ''
|
||||
basicauth {
|
||||
guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
|
||||
}
|
||||
reverse_proxy localhost:4243
|
||||
'';
|
||||
virtualHosts."sc.blitzw.in".extraConfig = ''
|
||||
basicauth {
|
||||
guest $2a$08$n0D.stczLfrMFJLleu7i5uAxpmwEs.EvjTlitmEAFvopi5xOqzK4y
|
||||
}
|
||||
reverse_proxy localhost:4665
|
||||
'';
|
||||
virtualHosts."yt2009.blitzw.in".extraConfig = ''
|
||||
basicauth {
|
||||
guest $2a$12$o/yxcMasmTKgCJGVmUNZ4OYYDHL4iPOeMgiZvUZrnoxtTWTnOBDke
|
||||
}
|
||||
reverse_proxy localhost:2009
|
||||
'';
|
||||
virtualHosts."ladder.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:28000
|
||||
'';
|
||||
virtualHosts."lens.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:4664
|
||||
'';
|
||||
virtualHosts."lf.blitzw.in".extraConfig = ''
|
||||
basicauth {
|
||||
lf $2a$12$HBepdgYKEdIEJ.bn0F4xUOHWciPK2mbBEAo2C3XDVD03ljnUmmTz6
|
||||
}
|
||||
reverse_proxy localhost:46000
|
||||
'';
|
||||
virtualHosts."test.blitzw.in".extraConfig = ''
|
||||
reverse_proxy localhost:28001
|
||||
'';
|
||||
virtualHosts."fxstagram.com".extraConfig = ''
|
||||
root * /srv/instafix
|
||||
|
||||
@root path /
|
||||
handle @root {
|
||||
file_server
|
||||
}
|
||||
|
||||
@traffic path /traffic.png
|
||||
handle @traffic {
|
||||
file_server
|
||||
}
|
||||
|
||||
handle {
|
||||
reverse_proxy localhost:3000
|
||||
}
|
||||
'';
|
||||
virtualHosts."fxstagram.com".serverAliases = [ "www.fxstagram.com" "1.fxstagram.com" "2.fxstagram.com" "3.fxstagram.com" ];
|
||||
};
|
||||
|
||||
# ... your other config ...
|
||||
|
||||
services.journald.extraConfig = ''
|
||||
# keep journals on disk (persistent) instead of only in /run
|
||||
Storage=persistent
|
||||
|
||||
# keep more log data before rotation / vacuuming
|
||||
# adjust these to taste (units: K M G)
|
||||
RuntimeMaxUse=1G
|
||||
RuntimeMaxFileSize=100M
|
||||
|
||||
SystemMaxUse=4G
|
||||
SystemMaxFileSize=200M
|
||||
SystemMaxFiles=100
|
||||
|
||||
# optionally keep logs for up to a time limit (if your systemd supports it)
|
||||
# MaxRetentionSec=90d
|
||||
'';
|
||||
|
||||
# ensure journals are flushed from /run to /var on shutdown so persistence works
|
||||
systemd.services.systemd-journal-flush.enable = true;
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
zramSwap.enable = true;
|
||||
networking.hostName = "hooligan";
|
||||
networking.domain = "";
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
permitRootLogin = "no"; # disallow root SSH
|
||||
passwordAuthentication = false; # disable password auth for SSH entirely
|
||||
challengeResponseAuthentication = false;
|
||||
extraConfig = ''
|
||||
AllowUsers nune
|
||||
'';
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keys = [ ];
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
Reference in New Issue
Block a user