xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-06-18 22:48:58 +02:00
commit 7beeab88cc
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
11 changed files with 82 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

12
hosts/common.nix
View file

@ -88,12 +88,12 @@
# Cache DNS lookups to improve performance
resolved = {
enable = true;
dnssec = "allow-downgrade";
dnsovertls = "true";
extraConfig = ''
Cache=true
CacheFromLocalhost=true
'';
settings.Resolve = {
DNSSEC = "allow-downgrade";
DNSOverTLS = true;
Cache = true;
CacheFromLocalhost = true;
};
};
};

21
hosts/matrix/default.nix
View file

@ -23,17 +23,16 @@
};
};
services = {
openssh.banner = ''
__ __
/\ \__ __ /\ \
___ ___ __ \ \ ,_\ _ __ /\_\ __ _ ___ ___ ___\ \ \____
/' __` __`\ /'__`\ \ \ \/ /\`'__\/\ \ /\ \/'\ /'___\ /'___\ /'___\ \ '__`\
/\ \/\ \/\ \/\ \L\.\_\ \ \_\ \ \/ \ \ \\/> </ /\ \__//\ \__//\ \__/\ \ \L\ \
\ \_\ \_\ \_\ \__/.\_\\ \__\\ \_\ \ \_\/\_/\_\ \ \____\ \____\ \____\\ \_,__/
\/_/\/_/\/_/\/__/\/_/ \/__/ \/_/ \/_/\//\/_/ \/____/\/____/\/____/ \/___/
'';
};
environment.etc."ssh/banner".text = ''
__ __
/\ \__ __ /\ \
___ ___ __ \ \ ,_\ _ __ /\_\ __ _ ___ ___ ___\ \ \____
/' __` __`\ /'__`\ \ \ \/ /\`'__\/\ \ /\ \/'\ /'___\ /'___\ /'___\ \ '__`\
/\ \/\ \/\ \/\ \L\.\_\ \ \_\ \ \/ \ \ \\/> </ /\ \__//\ \__//\ \__/\ \ \L\ \
\ \_\ \_\ \_\ \__/.\_\\ \__\\ \_\ \ \_\/\_/\_\ \ \____\ \____\ \____\\ \_,__/
\/_/\/_/\/_/\/__/\/_/ \/__/ \/_/ \/_/\//\/_/ \/____/\/____/\/____/ \/___/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.05";
}

3
hosts/matrix/draupnir.nix
View file

@ -5,7 +5,8 @@
enable = true;
settings = {
homeserverUrl = "https://matrix.${config.networking.domain}";
managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de
#managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de
managementRoom = "#cccb-moderators:berlin.ccc.de"; #"!ZYWNuaQBkkenNklCSm:matrix.org";
autojoinOnlyIfManager = true;
recordIgnoredInvites = true;
roomStateBackingStore.enabled = true;

21
hosts/md/default.nix
View file

@ -21,17 +21,16 @@
};
};
services = {
openssh.banner = ''
__
/\ \
___ ___ \_\ \
/' __` __`\ /'_` \
/\ \/\ \/\ \/\ \L\ \
\ \_\ \_\ \_\ \___,_\
\/_/\/_/\/_/\/__,_ /
'';
};
environment.etc."ssh/banner".text = ''
__
/\ \
___ ___ \_\ \
/' __` __`\ /'_` \
/\ \/\ \/\ \/\ \L\ \
\ \_\ \_\ \_\ \___,_\
\/_/\/_/\/_/\/__,__/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11";
}

25
hosts/monitoring/default.nix
View file

@ -22,19 +22,18 @@
};
};
services = {
openssh.banner = ''
__
__/\ \__ __
___ ___ ___ ___ /\_\ \ ,_\ ___ _ __ /\_\ ___ __
/' __` __`\ / __`\ /' _ `\/\ \ \ \/ / __`\/\`'__\/\ \ /' _ `\ /'_ `\
/\ \/\ \/\ \/\ \L\ \/\ \/\ \ \ \ \ \_/\ \L\ \ \ \/ \ \ \/\ \/\ \/\ \L\ \
\ \_\ \_\ \_\ \____/\ \_\ \_\ \_\ \__\ \____/\ \_\ \ \_\ \_\ \_\ \____ \
\/_/\/_/\/_/\/___/ \/_/\/_/\/_/\/__/\/___/ \/_/ \/_/\/_/\/_/\/___L\ \
/\____/
\_/__/
'';
};
environment.etc."ssh/banner".text = ''
__
__/\ \__ __
___ ___ ___ ___ /\_\ \ ,_\ ___ _ __ /\_\ ___ __
/' __` __`\ / __`\ /' _ `\/\ \ \ \/ / __`\/\`'__\/\ \ /' _ `\ /'_ `\
/\ \/\ \/\ \/\ \L\ \/\ \/\ \ \ \ \ \_/\ \L\ \ \ \/ \ \ \/\ \/\ \/\ \L\ \
\ \_\ \_\ \_\ \____/\ \_\ \_\ \_\ \__\ \____/\ \_\ \ \_\ \_\ \_\ \____ \
\/_/\/_/\/_/\/___/ \/_/\/_/\/_/\/__/\/___/ \/_/ \/_/\/_/\/_/\/___L\ \
/\____/
\_/__/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11";
}

25
hosts/sql/default.nix
View file

@ -17,19 +17,18 @@
'';
};
services = {
openssh.banner = ''
___
/\_ \
____ __ \//\ \
/',__\ /'__`\ \ \ \
/\__, `\/\ \L\ \ \_\ \_
\/\____/\ \___, \/\____\
\/___/ \/___/\ \/____/
\ \_\
\/_/
'';
};
environment.etc."ssh/banner".text = ''
___
/\_ \
____ __ \//\ \
/',__\ /'__`\ \ \ \
/\__, `\/\ \L\ \ \_\ \_
\/\____/\ \___, \/\____\
\/___/ \/___/\ \/____/
\ \_\
\/_/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11";
}

17
hosts/www/default.nix
View file

@ -22,15 +22,14 @@
};
};
services = {
openssh.banner = ''
__ __ __ __ __ __ __ __ __
/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \
\ \ \_/ \_/ \ \ \_/ \_/ \ \ \_/ \_/ \
\ \___x___/'\ \___x___/'\ \___x___/'
\/__//__/ \/__//__/ \/__//__/
'';
};
environment.etc."ssh/banner".text = ''
__ __ __ __ __ __ __ __ __
/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \
\ \ \_/ \_/ \ \ \_/ \_/ \ \ \_/ \_/ \
\ \___x___/'\ \___x___/'\ \___x___/'
\/__//__/ \/__//__/ \/__//__/
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11";
}

15
hosts/www/nginx.nix
View file

@ -10,6 +10,21 @@ in
];
services.nginx.virtualHosts = {
"mta-sts.${config.networking.domain}" = {
quic = true;
kTLS = true;
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security max-age=15768000;
'';
locations."= /.well-known/mta-sts.txt" = {
alias = "/srv/http/mta-sts.txt";
extraConfig = ''
default_type text/plain;
'';
};
};
"www.${config.networking.domain}" = {
default = true;
serverAliases = [ config.networking.domain ];