xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-06-18 22:48:58 +02:00
commit 7beeab88cc
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
11 changed files with 82 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

8
flake.lock generated
View file

@ -68,16 +68,16 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1772598333, "lastModified": 1780203844,
"narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=", "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239", "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "NixOS", "owner": "NixOS",
"ref": "nixos-25.11", "ref": "nixos-26.05",
"repo": "nixpkgs", "repo": "nixpkgs",
"type": "github" "type": "github"
} }

5
flake.nix
View file

@ -1,7 +1,7 @@
{ {
description = "CCCB services"; description = "CCCB services";
inputs = { inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
#flake-utils.url = "github:numtide/flake-utils"; #flake-utils.url = "github:numtide/flake-utils";
agenix = { agenix = {
url = "github:ryantm/agenix"; url = "github:ryantm/agenix";
@ -26,6 +26,7 @@
apps.nixos-diff = { apps.nixos-diff = {
type = "app"; type = "app";
program = "${pkgs.writeShellScript "nixos-diff.sh" '' program = "${pkgs.writeShellScript "nixos-diff.sh" ''
${pkgs.git}/bin/git checkout flake.lock
${pkgs.git}/bin/git pull --ff-only ${pkgs.git}/bin/git pull --ff-only
${pkgs.nix}/bin/nix flake update ${pkgs.nix}/bin/nix flake update
${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json
@ -39,7 +40,7 @@
]; ];
}; };
nixosConfigurations."matrix" = nixpkgs.lib.nixosSystem { nixosConfigurations."matrix" = nixpkgs.lib.nixosSystem {
#system = "x86_64-linux"; #system = "x86_64-linux";d
#pkgs = import nixpkgs { inherit system; }; #pkgs = import nixpkgs { inherit system; };
inherit system; inherit system;
modules = [ modules = [

12
hosts/common.nix
View file

@ -88,12 +88,12 @@
# Cache DNS lookups to improve performance # Cache DNS lookups to improve performance
resolved = { resolved = {
enable = true; enable = true;
dnssec = "allow-downgrade"; settings.Resolve = {
dnsovertls = "true"; DNSSEC = "allow-downgrade";
extraConfig = '' DNSOverTLS = true;
Cache=true Cache = true;
CacheFromLocalhost=true CacheFromLocalhost = true;
''; };
}; };
}; };

21
hosts/matrix/default.nix
View file

@ -23,17 +23,16 @@
}; };
}; };
services = { environment.etc."ssh/banner".text = ''
openssh.banner = '' __ __
__ __ /\ \__ __ /\ \
/\ \__ __ /\ \ ___ ___ __ \ \ ,_\ _ __ /\_\ __ _ ___ ___ ___\ \ \____
___ ___ __ \ \ ,_\ _ __ /\_\ __ _ ___ ___ ___\ \ \____ /' __` __`\ /'__`\ \ \ \/ /\`'__\/\ \ /\ \/'\ /'___\ /'___\ /'___\ \ '__`\
/' __` __`\ /'__`\ \ \ \/ /\`'__\/\ \ /\ \/'\ /'___\ /'___\ /'___\ \ '__`\ /\ \/\ \/\ \/\ \L\.\_\ \ \_\ \ \/ \ \ \\/> </ /\ \__//\ \__//\ \__/\ \ \L\ \
/\ \/\ \/\ \/\ \L\.\_\ \ \_\ \ \/ \ \ \\/> </ /\ \__//\ \__//\ \__/\ \ \L\ \ \ \_\ \_\ \_\ \__/.\_\\ \__\\ \_\ \ \_\/\_/\_\ \ \____\ \____\ \____\\ \_,__/
\ \_\ \_\ \_\ \__/.\_\\ \__\\ \_\ \ \_\/\_/\_\ \ \____\ \____\ \____\\ \_,__/ \/_/\/_/\/_/\/__/\/_/ \/__/ \/_/ \/_/\//\/_/ \/____/\/____/\/____/ \/___/
\/_/\/_/\/_/\/__/\/_/ \/__/ \/_/ \/_/\//\/_/ \/____/\/____/\/____/ \/___/ '';
''; services.openssh.settings.Banner = "/etc/ssh/banner";
};
system.stateVersion = "25.05"; system.stateVersion = "25.05";
} }

3
hosts/matrix/draupnir.nix
View file

@ -5,7 +5,8 @@
enable = true; enable = true;
settings = { settings = {
homeserverUrl = "https://matrix.${config.networking.domain}"; homeserverUrl = "https://matrix.${config.networking.domain}";
managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de #managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de
managementRoom = "#cccb-moderators:berlin.ccc.de"; #"!ZYWNuaQBkkenNklCSm:matrix.org";
autojoinOnlyIfManager = true; autojoinOnlyIfManager = true;
recordIgnoredInvites = true; recordIgnoredInvites = true;
roomStateBackingStore.enabled = true; roomStateBackingStore.enabled = true;

21
hosts/md/default.nix
View file

@ -21,17 +21,16 @@
}; };
}; };
services = { environment.etc."ssh/banner".text = ''
openssh.banner = '' __
__ /\ \
/\ \ ___ ___ \_\ \
___ ___ \_\ \ /' __` __`\ /'_` \
/' __` __`\ /'_` \ /\ \/\ \/\ \/\ \L\ \
/\ \/\ \/\ \/\ \L\ \ \ \_\ \_\ \_\ \___,_\
\ \_\ \_\ \_\ \___,_\ \/_/\/_/\/_/\/__,__/
\/_/\/_/\/_/\/__,_ / '';
''; services.openssh.settings.Banner = "/etc/ssh/banner";
};
system.stateVersion = "25.11"; system.stateVersion = "25.11";
} }

25
hosts/monitoring/default.nix
View file

@ -22,19 +22,18 @@
}; };
}; };
services = { environment.etc."ssh/banner".text = ''
openssh.banner = '' __
__ __/\ \__ __
__/\ \__ __ ___ ___ ___ ___ /\_\ \ ,_\ ___ _ __ /\_\ ___ __
___ ___ ___ ___ /\_\ \ ,_\ ___ _ __ /\_\ ___ __ /' __` __`\ / __`\ /' _ `\/\ \ \ \/ / __`\/\`'__\/\ \ /' _ `\ /'_ `\
/' __` __`\ / __`\ /' _ `\/\ \ \ \/ / __`\/\`'__\/\ \ /' _ `\ /'_ `\ /\ \/\ \/\ \/\ \L\ \/\ \/\ \ \ \ \ \_/\ \L\ \ \ \/ \ \ \/\ \/\ \/\ \L\ \
/\ \/\ \/\ \/\ \L\ \/\ \/\ \ \ \ \ \_/\ \L\ \ \ \/ \ \ \/\ \/\ \/\ \L\ \ \ \_\ \_\ \_\ \____/\ \_\ \_\ \_\ \__\ \____/\ \_\ \ \_\ \_\ \_\ \____ \
\ \_\ \_\ \_\ \____/\ \_\ \_\ \_\ \__\ \____/\ \_\ \ \_\ \_\ \_\ \____ \ \/_/\/_/\/_/\/___/ \/_/\/_/\/_/\/__/\/___/ \/_/ \/_/\/_/\/_/\/___L\ \
\/_/\/_/\/_/\/___/ \/_/\/_/\/_/\/__/\/___/ \/_/ \/_/\/_/\/_/\/___L\ \ /\____/
/\____/ \_/__/
\_/__/ '';
''; services.openssh.settings.Banner = "/etc/ssh/banner";
};
system.stateVersion = "25.11"; system.stateVersion = "25.11";
} }

25
hosts/sql/default.nix
View file

@ -17,19 +17,18 @@
''; '';
}; };
services = { environment.etc."ssh/banner".text = ''
openssh.banner = '' ___
___ /\_ \
/\_ \ ____ __ \//\ \
____ __ \//\ \ /',__\ /'__`\ \ \ \
/',__\ /'__`\ \ \ \ /\__, `\/\ \L\ \ \_\ \_
/\__, `\/\ \L\ \ \_\ \_ \/\____/\ \___, \/\____\
\/\____/\ \___, \/\____\ \/___/ \/___/\ \/____/
\/___/ \/___/\ \/____/ \ \_\
\ \_\ \/_/
\/_/ '';
''; services.openssh.settings.Banner = "/etc/ssh/banner";
};
system.stateVersion = "25.11"; system.stateVersion = "25.11";
} }

17
hosts/www/default.nix
View file

@ -22,15 +22,14 @@
}; };
}; };
services = { environment.etc."ssh/banner".text = ''
openssh.banner = '' __ __ __ __ __ __ __ __ __
__ __ __ __ __ __ __ __ __ /\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \
/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \ \ \ \_/ \_/ \ \ \_/ \_/ \ \ \_/ \_/ \
\ \ \_/ \_/ \ \ \_/ \_/ \ \ \_/ \_/ \ \ \___x___/'\ \___x___/'\ \___x___/'
\ \___x___/'\ \___x___/'\ \___x___/' \/__//__/ \/__//__/ \/__//__/
\/__//__/ \/__//__/ \/__//__/ '';
''; services.openssh.settings.Banner = "/etc/ssh/banner";
};
system.stateVersion = "25.11"; system.stateVersion = "25.11";
} }

15
hosts/www/nginx.nix
View file

@ -10,6 +10,21 @@ in
]; ];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"mta-sts.${config.networking.domain}" = {
quic = true;
kTLS = true;
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security max-age=15768000;
'';
locations."= /.well-known/mta-sts.txt" = {
alias = "/srv/http/mta-sts.txt";
extraConfig = ''
default_type text/plain;
'';
};
};
"www.${config.networking.domain}" = { "www.${config.networking.domain}" = {
default = true; default = true;
serverAliases = [ config.networking.domain ]; serverAliases = [ config.networking.domain ];

BIN
secrets/draupnir_access_token.age
View file

Binary file not shown.