mirror of
https://codeberg.org/gigirassy/nixos-server-config
synced 2026-08-30 15:27:40 +00:00
360 lines
11 KiB
Nix
360 lines
11 KiB
Nix
{ config, pkgs, lib, ... }: {
|
||
|
||
boot.kernel.sysctl."net.core.rmem_max" = 16777216;
|
||
boot.kernel.sysctl."net.core.wmem_max" = 16777216;
|
||
|
||
imports = [
|
||
./hardware-configuration.nix
|
||
./networking.nix # generated at runtime by nixos-infect
|
||
./modules/smart-ipv6-rotator.nix
|
||
./modules/watchdog.nix
|
||
];
|
||
|
||
environment.systemPackages = with pkgs; [
|
||
(lib.hiPrio pkgs.uutils-coreutils-noprefix)
|
||
(lib.hiPrio pkgs.uutils-findutils)
|
||
(lib.hiPrio pkgs.uutils-diffutils)
|
||
fastfetch # fetch stats!
|
||
compose2nix
|
||
btop
|
||
python3Minimal
|
||
git
|
||
gnuplot
|
||
ctop
|
||
starship
|
||
nftables
|
||
];
|
||
|
||
|
||
users.users.nune = {
|
||
isNormalUser = true;
|
||
description = "Admin user";
|
||
createHome = true;
|
||
extraGroups = [ "wheel" "docker" ];
|
||
shell = pkgs.zsh;
|
||
openssh.authorizedKeys.keys = [
|
||
"ssh-ed25519 XXXX"
|
||
];
|
||
};
|
||
|
||
programs.zsh = {
|
||
enable = true;
|
||
shellAliases = {
|
||
ne = "sudo nano /etc/nixos/configuration.nix && sudo nixos-rebuild switch";
|
||
ncg = "sudo nix-collect-garbage";
|
||
};
|
||
};
|
||
|
||
programs.starship.enable = true;
|
||
|
||
environment.memoryAllocator.provider = "jemalloc";
|
||
|
||
# enable sudo; keep password requirement by default
|
||
security.sudo.enable = true;
|
||
security.sudo.wheelNeedsPassword = true;
|
||
|
||
services.snowflake-proxy = {
|
||
enable = true;
|
||
capacity = 50;
|
||
};
|
||
|
||
services.irqbalance.enable = true;
|
||
|
||
services.yggdrasil = {
|
||
enable = true;
|
||
persistentKeys = true;
|
||
|
||
settings = {
|
||
Peers = [
|
||
"tcp://[2a14:1e00:3:15c::]:65535"
|
||
"ws://vpn.itrus.su:7994"
|
||
"tls://23.137.249.65:444"
|
||
"tcp://[2001:470:1f13:e56::64]:39565"
|
||
"tcp://51.15.204.214:12345"
|
||
"tcp://[2a0b:4142:e9e::2]:65535"
|
||
"tcp://[2a0c:b641:ce0::25d8:c5d6]:65535"
|
||
"tls://n.ygg.yt:443"
|
||
"tcp://94.159.110.4:65535"
|
||
"tcp://[2a0b:4142:ce0::2]:65535"
|
||
];
|
||
Listen = [
|
||
"tls://0.0.0.0:32000"
|
||
"tls://[::]:32000"
|
||
]; };
|
||
};
|
||
|
||
services.i2pd = {
|
||
enable = true;
|
||
enableIPv4 = true;
|
||
port = 35252;
|
||
address = "91.98.126.143" ;
|
||
enableIPv6 = true; # if you don’t have IPv6, leave false
|
||
ifname = "eth0"; # change to your interface
|
||
bandwidth = 1000; # limit to 500 KB/s (≈ 4 Mb/s)
|
||
share = 50; # allocate 50% of that to transit
|
||
notransit = false; # allow transit
|
||
floodfill = false; # not acting as floodfill
|
||
nat = true; # if behind NAT
|
||
};
|
||
|
||
networking.firewall.enable = true;
|
||
networking.firewall.trustedInterfaces = [ "lo" ]; # loopback
|
||
networking.firewall.allowedTCPPorts = [ 22 80 443 8080 9091 51413 4001 8013 27905 32000 31311 31312 31313 31314 35252];
|
||
networking.firewall.allowedUDPPorts = [ 51413 ]; # Transmission uses UDP for DHT/peer discovery
|
||
|
||
services.tailscale.enable = true;
|
||
|
||
services.smart-ipv6-rotator = {
|
||
enable = true;
|
||
ipv6range = "2a01:4f8:c2c:c398::/64";
|
||
rev = "master";
|
||
sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY=";
|
||
};
|
||
|
||
|
||
systemd.services.ipfs_restart = {
|
||
description = "Restart ipfs docker container";
|
||
serviceConfig = {
|
||
Type = "oneshot";
|
||
ExecStart = "${pkgs.docker}/bin/docker restart ipfs-ipfs-1";
|
||
};
|
||
};
|
||
|
||
systemd.timers.ipfs_restart = {
|
||
wantedBy = [ "timers.target" ];
|
||
timerConfig = {
|
||
# run roughly every 6 hours after previous run
|
||
OnUnitActiveSec = "6h";
|
||
Persistent = true;
|
||
};
|
||
};
|
||
|
||
systemd.services.instafix_proxy_restart = {
|
||
description = "Restart instafix_proxy docker container";
|
||
serviceConfig = {
|
||
Type = "oneshot";
|
||
ExecStart = "${pkgs.docker}/bin/docker restart instafix_proxy";
|
||
};
|
||
};
|
||
|
||
systemd.timers.instafix_proxy_restart = {
|
||
wantedBy = [ "timers.target" ];
|
||
timerConfig = {
|
||
# run roughly every 6 hours after previous run
|
||
OnUnitActiveSec = "6h";
|
||
Persistent = true;
|
||
};
|
||
};
|
||
|
||
systemd.services.docker_system_prune = {
|
||
description = "Prune docker system";
|
||
serviceConfig = {
|
||
Type = "oneshot";
|
||
ExecStart = "${pkgs.docker}/bin/docker system prune -a -f";
|
||
};
|
||
};
|
||
|
||
systemd.timers.docker_system_prune = {
|
||
wantedBy = [ "timers.target" ];
|
||
timerConfig = { OnUnitActiveSec = "12h"; Persistent = true; };
|
||
};
|
||
|
||
services.caddy = {
|
||
enable = true;
|
||
logFormat = ''level INFO'';
|
||
logDir = ''/var/log/caddy'';
|
||
virtualHosts."fan.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:10417
|
||
'';
|
||
virtualHosts."quora.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:21490
|
||
'';
|
||
virtualHosts."ms.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:28019
|
||
'';
|
||
virtualHosts."rss.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:34141
|
||
'';
|
||
virtualHosts."transfer.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:8105
|
||
'';
|
||
virtualHosts."tracker.transfer.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:8106
|
||
'';
|
||
virtualHosts."stirlingpdf.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:24160
|
||
'';
|
||
virtualHosts."skylib.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:5081
|
||
'';
|
||
virtualHosts."tent.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:5083
|
||
'';
|
||
virtualHosts."small.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:5084
|
||
'';
|
||
virtualHosts."rimgo.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:43000
|
||
'';
|
||
virtualHosts."pinata.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:4100
|
||
'';
|
||
virtualHosts."tube.blitzw.in".extraConfig = ''
|
||
basicauth {
|
||
guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
|
||
}
|
||
reverse_proxy 100.76.137.52:33020
|
||
'';
|
||
virtualHosts."hooligan.srv.blitzw.in".extraConfig = ''
|
||
root * /srv/landing
|
||
file_server
|
||
'';
|
||
virtualHosts."mirage.blitzw.in".extraConfig= ''
|
||
reverse_proxy localhost:35200 {
|
||
header_up X-Real-Ip {remote_host}
|
||
header_up X-Http-Version {http.request.proto}
|
||
header_up X-Forwarded-Host {host}
|
||
header_up Host {host}
|
||
header_up Referer {>Referer}
|
||
}
|
||
'';
|
||
virtualHosts."priviblur.blitzw.in".extraConfig= ''
|
||
reverse_proxy localhost:24215 {
|
||
header_up X-Real-Ip {remote_host}
|
||
header_up X-Http-Version {http.request.proto}
|
||
header_up X-Forwarded-Host {host}
|
||
header_up Host {host}
|
||
header_up Referer {>Referer}
|
||
}
|
||
'';
|
||
virtualHosts."genius.blitzw.in".extraConfig=''
|
||
reverse_proxy localhost:2006 {
|
||
header_up X-Real-Ip {remote_host}
|
||
header_up X-Http-Version {http.request.proto}
|
||
header_up X-Forwarded-Host {host}
|
||
header_up Host {host}
|
||
}
|
||
'';
|
||
virtualHosts."pin.blitzw.in".extraConfig= ''
|
||
redir https://pinata.blitzw.in
|
||
'';
|
||
virtualHosts."search.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:24999
|
||
'';
|
||
virtualHosts."wikimore.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:8109
|
||
'';
|
||
virtualHosts."twitch.blitzw.in".extraConfig = ''
|
||
respond "404 Not Found" 404
|
||
'';
|
||
virtualHosts."moz.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:3012
|
||
'';
|
||
virtualHosts."rl.blitzw.in".extraConfig = ''
|
||
respond "301 Moved Permanently" 301
|
||
'';
|
||
virtualHosts."bilder.blitzw.in".extraConfig = ''
|
||
basicauth {
|
||
guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
|
||
}
|
||
reverse_proxy localhost:4243
|
||
'';
|
||
virtualHosts."sc.blitzw.in".extraConfig = ''
|
||
basicauth {
|
||
guest $2a$08$n0D.stczLfrMFJLleu7i5uAxpmwEs.EvjTlitmEAFvopi5xOqzK4y
|
||
}
|
||
reverse_proxy localhost:4665
|
||
'';
|
||
virtualHosts."yt2009.blitzw.in".extraConfig = ''
|
||
basicauth {
|
||
guest $2a$12$o/yxcMasmTKgCJGVmUNZ4OYYDHL4iPOeMgiZvUZrnoxtTWTnOBDke
|
||
}
|
||
reverse_proxy localhost:2009
|
||
'';
|
||
virtualHosts."ladder.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:28000
|
||
'';
|
||
virtualHosts."lens.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:4664
|
||
'';
|
||
virtualHosts."lf.blitzw.in".extraConfig = ''
|
||
basicauth {
|
||
lf $2a$12$HBepdgYKEdIEJ.bn0F4xUOHWciPK2mbBEAo2C3XDVD03ljnUmmTz6
|
||
}
|
||
reverse_proxy localhost:46000
|
||
'';
|
||
virtualHosts."test.blitzw.in".extraConfig = ''
|
||
reverse_proxy localhost:28001
|
||
'';
|
||
virtualHosts."fxstagram.com".extraConfig = ''
|
||
root * /srv/instafix
|
||
|
||
@root path /
|
||
handle @root {
|
||
file_server
|
||
}
|
||
|
||
@traffic path /traffic.png
|
||
handle @traffic {
|
||
file_server
|
||
}
|
||
|
||
handle {
|
||
reverse_proxy localhost:3000
|
||
}
|
||
'';
|
||
virtualHosts."fxstagram.com".serverAliases = [ "www.fxstagram.com" "1.fxstagram.com" "2.fxstagram.com" "3.fxstagram.com" ];
|
||
};
|
||
|
||
# ... your other config ...
|
||
|
||
services.journald.extraConfig = ''
|
||
# keep journals on disk (persistent) instead of only in /run
|
||
Storage=persistent
|
||
|
||
# keep more log data before rotation / vacuuming
|
||
# adjust these to taste (units: K M G)
|
||
RuntimeMaxUse=1G
|
||
RuntimeMaxFileSize=100M
|
||
|
||
SystemMaxUse=4G
|
||
SystemMaxFileSize=200M
|
||
SystemMaxFiles=100
|
||
|
||
# optionally keep logs for up to a time limit (if your systemd supports it)
|
||
# MaxRetentionSec=90d
|
||
'';
|
||
|
||
# ensure journals are flushed from /run to /var on shutdown so persistence works
|
||
systemd.services.systemd-journal-flush.enable = true;
|
||
|
||
virtualisation.docker.enable = true;
|
||
|
||
virtualisation.docker.daemon.settings = {
|
||
ipv6 = true;
|
||
# Pick an IPv6 subnet for your containers; e.g. fd00::/80 or something from your network
|
||
fixed-cidr-v6 = "fd00:dead:beef::/80";
|
||
# Optionally, configure default address pools to include both IPv4 and IPv6
|
||
default-address-pools = [
|
||
{ base = "172.17.0.0/12"; size = 24; } # IPv4 pool
|
||
{ base = "10.10.0.0/16"; size = 24; } # optional extra pool (more /24s)
|
||
{ base = "fd00:dead:beef::/48"; size = 64; } # IPv6 pool — adjust prefix & size as needed
|
||
];
|
||
};
|
||
|
||
boot.tmp.cleanOnBoot = true;
|
||
zramSwap.enable = true;
|
||
networking.hostName = "hooligan";
|
||
networking.domain = "";
|
||
services.openssh = {
|
||
enable = true;
|
||
permitRootLogin = "no"; # disallow root SSH
|
||
passwordAuthentication = false; # disable password auth for SSH entirely
|
||
challengeResponseAuthentication = false;
|
||
extraConfig = ''
|
||
AllowUsers nune
|
||
'';
|
||
};
|
||
users.users.root.openssh.authorizedKeys.keys = [ ];
|
||
system.stateVersion = "23.11";
|
||
} |