From 44a4342cd0310aec83a6a03665651db3bbc5639b Mon Sep 17 00:00:00 2001 From: gigirassy Date: Mon, 10 Nov 2025 17:05:16 +0100 Subject: [PATCH] Add nixos/configuration.nix --- nixos/configuration.nix | 282 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 282 insertions(+) create mode 100644 nixos/configuration.nix diff --git a/nixos/configuration.nix b/nixos/configuration.nix new file mode 100644 index 0000000..8e3c42b --- /dev/null +++ b/nixos/configuration.nix @@ -0,0 +1,282 @@ +{ config, pkgs, lib, ... }: { + + imports = [ + ./hardware-configuration.nix + ./networking.nix # generated at runtime by nixos-infect + ./modules/smart-ipv6-rotator.nix # ipv6 rotator + ./modules/watchdog.nix # anubis watchdog to auto-report to abuseipdb + ]; + + environment.systemPackages = with pkgs; [ + (lib.hiPrio pkgs.uutils-coreutils-noprefix) + (lib.hiPrio pkgs.uutils-findutils) + (lib.hiPrio pkgs.uutils-diffutils) + fastfetch # fetch stats! + btop + python3Minimal + git + gnuplot + ctop + starship + nftables + ]; + + + users.users.nune = { + isNormalUser = true; + description = "Admin user"; + createHome = true; + extraGroups = [ "wheel" "docker" ]; + shell = pkgs.zsh; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 XXXXX" # i know its fine to share but im a goober + ]; + }; + + programs.zsh = { + enable = true; + shellAliases = { + ne = "sudo nano /etc/nixos/configuration.nix && sudo nixos-rebuild switch"; + ncg = "sudo nix-collect-garbage"; + }; + }; + + programs.starship.enable = true; + + # enable sudo; keep password requirement by default + security.sudo.enable = true; + security.sudo.wheelNeedsPassword = true; + + services.snowflake-proxy = { + enable = true; + capacity = 50; + }; + + + services.yggdrasil = { + enable = true; + persistentKeys = true; + + settings = { + Peers = [ + "tcp://[2a14:1e00:3:15c::]:65535" + "ws://vpn.itrus.su:7994" + "tls://23.137.249.65:444" + "tcp://[2001:470:1f13:e56::64]:39565" + "tcp://51.15.204.214:12345" + "tcp://[2a0b:4142:e9e::2]:65535" + "tcp://[2a0c:b641:ce0::25d8:c5d6]:65535" + "tls://n.ygg.yt:443" + "tcp://94.159.110.4:65535" + "tcp://[2a0b:4142:ce0::2]:65535" + ]; + Listen = [ + "tls://0.0.0.0:32000" + "tls://[::]:32000" + ]; + }; + }; + + services.i2pd = { + enable = true; + enableIPv4 = true; + port = 35252; + address = "91.98.126.143" ; + enableIPv6 = true; # if you don't have IPv6, leave false + ifname = "eth0"; # change to your interface + bandwidth = 1000; # limit to 500 KB/s (≈ 4 Mb/s) + share = 50; # allocate 50% of that to transit + notransit = false; # allow transit + floodfill = false; # not acting as floodfill + nat = true; # if behind NAT +}; + + networking.firewall.enable = true; + networking.firewall.trustedInterfaces = [ "lo" ]; # loopback + networking.firewall.allowedTCPPorts = [ 22 80 443 8080 9091 51413 4001 8013 27905 32000 31311 31312 31313 31314 35252]; + networking.firewall.allowedUDPPorts = [ 51413 ]; # Transmission uses UDP for DHT/peer discovery + + services.tailscale.enable = true; + + services.smart-ipv6-rotator = { + enable = true; + ipv6range = "2a01:4f8:c2c:c398::/64"; + rev = "master"; + sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY="; + }; + + services.cron = { + enable = true; + systemCronJobs = [ + "* * * * * /root/trafficgen.sh >> /var/log/generate_traffic_png.log 2>&1" + "0 */6 * * * docker restart instafix_proxy" + "0 */12 * * * docker system prune -a -f" + "0 */1 * * * /bin/bash -lc 'for i in {1..10}; do [ -d /srv/arti$i/cache/dir_blobs ] && find /srv/arti$i/cache/dir_blobs -mindepth 1 -maxdepth 1 -exec rm -rf {} +; done'" # clear redlib cache + ]; + }; + + services.caddy = { + enable = true; + logFormat = ''level INFO''; + logDir = ''/var/log/caddy''; + virtualHosts."fan.blitzw.in".extraConfig = '' + reverse_proxy localhost:10417 + ''; + virtualHosts."skylib.blitzw.in".extraConfig = '' + reverse_proxy localhost:5081 + ''; + virtualHosts."tent.blitzw.in".extraConfig = '' + reverse_proxy localhost:5083 + ''; + virtualHosts."small.blitzw.in".extraConfig = '' + reverse_proxy localhost:5084 + ''; + virtualHosts."pinata.blitzw.in".extraConfig = '' + reverse_proxy localhost:4100 + ''; + virtualHosts."tube.blitzw.in".extraConfig = '' + basicauth { + guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC + } + reverse_proxy 100.76.137.52:33020 + ''; + virtualHosts."hooligan.srv.blitzw.in".extraConfig = '' + root * /srv/landing + file_server + ''; + virtualHosts."mirage.blitzw.in".extraConfig= '' + reverse_proxy localhost:35200 { + header_up X-Real-Ip {remote_host} + header_up X-Http-Version {http.request.proto} + header_up X-Forwarded-Host {host} + header_up Host {host} + header_up Referer {>Referer} + } + ''; + virtualHosts."priviblur.blitzw.in".extraConfig= '' + reverse_proxy localhost:24215 { + header_up X-Real-Ip {remote_host} + header_up X-Http-Version {http.request.proto} + header_up X-Forwarded-Host {host} + header_up Host {host} + header_up Referer {>Referer} + } + ''; + virtualHosts."genius.blitzw.in".extraConfig='' + reverse_proxy localhost:2006 { + header_up X-Real-Ip {remote_host} + header_up X-Http-Version {http.request.proto} + header_up X-Forwarded-Host {host} + header_up Host {host} + } + ''; + virtualHosts."pin.blitzw.in".extraConfig= '' + reverse_proxy localhost:6600 + ''; + virtualHosts."search.blitzw.in".extraConfig = '' + reverse_proxy localhost:24999 + ''; + virtualHosts."wikimore.blitzw.in".extraConfig = '' + reverse_proxy localhost:8109 + ''; + virtualHosts."twitch.blitzw.in".extraConfig = '' + reverse_proxy localhost:5600 + ''; + virtualHosts."moz.blitzw.in".extraConfig = '' + reverse_proxy localhost:3012 + ''; + virtualHosts."rl.blitzw.in".extraConfig = '' + respond "301 Moved Permanently" 301 + ''; + virtualHosts."bilder.blitzw.in".extraConfig = '' + basicauth { + guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC + } + reverse_proxy localhost:4243 + ''; + virtualHosts."sc.blitzw.in".extraConfig = '' + basicauth { + guest $2a$08$n0D.stczLfrMFJLleu7i5uAxpmwEs.EvjTlitmEAFvopi5xOqzK4y + } + reverse_proxy localhost:4665 + ''; + virtualHosts."yt2009.blitzw.in".extraConfig = '' + basicauth { + guest $2a$12$o/yxcMasmTKgCJGVmUNZ4OYYDHL4iPOeMgiZvUZrnoxtTWTnOBDke + } + reverse_proxy localhost:2009 + ''; + virtualHosts."ladder.blitzw.in".extraConfig = '' + reverse_proxy localhost:28000 + ''; + virtualHosts."lens.blitzw.in".extraConfig = '' + reverse_proxy localhost:4664 + ''; + virtualHosts."lf.blitzw.in".extraConfig = '' + basicauth { + lf $2a$12$HBepdgYKEdIEJ.bn0F4xUOHWciPK2mbBEAo2C3XDVD03ljnUmmTz6 + } + reverse_proxy localhost:46000 + ''; + virtualHosts."test.blitzw.in".extraConfig = '' + reverse_proxy localhost:28001 + ''; + virtualHosts."fxstagram.com".extraConfig = '' + root * /srv/instafix + + @root path / + handle @root { + file_server + } + + @traffic path /traffic.png + handle @traffic { + file_server + } + + handle { + reverse_proxy localhost:3000 + } + ''; + virtualHosts."fxstagram.com".serverAliases = [ "www.fxstagram.com" "1.fxstagram.com" "2.fxstagram.com" "3.fxstagram.com" ]; + }; + + # ... your other config ... + +services.journald.extraConfig = '' + # keep journals on disk (persistent) instead of only in /run + Storage=persistent + + # keep more log data before rotation / vacuuming + # adjust these to taste (units: K M G) + RuntimeMaxUse=1G + RuntimeMaxFileSize=100M + + SystemMaxUse=4G + SystemMaxFileSize=200M + SystemMaxFiles=100 + + # optionally keep logs for up to a time limit (if your systemd supports it) + # MaxRetentionSec=90d +''; + +# ensure journals are flushed from /run to /var on shutdown so persistence works +systemd.services.systemd-journal-flush.enable = true; + + virtualisation.docker.enable = true; + boot.tmp.cleanOnBoot = true; + zramSwap.enable = true; + networking.hostName = "hooligan"; + networking.domain = ""; + services.openssh = { + enable = true; + permitRootLogin = "no"; # disallow root SSH + passwordAuthentication = false; # disable password auth for SSH entirely + challengeResponseAuthentication = false; + extraConfig = '' + AllowUsers nune + ''; + }; + users.users.root.openssh.authorizedKeys.keys = [ ]; + system.stateVersion = "23.11"; +} \ No newline at end of file