xengi/infra
0
1
Fork 0
Code Pull requests Activity Actions

Compare commits

base: xengi:0f0d8c43c821499d314cde95a64a887b24518ca5
Branches Tags
xengi:main
xengi:wip
...
compare: xengi:b6f86709f07ff663ec6a2e619ddc3a4bf0ca2146
Branches Tags
xengi:main
xengi:wip

2 commits
0f0d8c43c8 ... b6f86709f0

Author SHA1 Message Date
Ricardo (XenGi) Band
b6f86709f0
add fw 2026-02-17 23:56:53 +01:00
Ricardo (XenGi) Band
b5b1dbf3fe
fix www 2026-02-17 23:56:46 +01:00
2 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hosts/www/openssh.nix
View file

@ -4,19 +4,20 @@
users = {
users.deploy = {
description = "deploys static websites from forgejo";
shell = "/run/current-system/sw/bin/nologin";
shell = pkgs.dash; # gets restricted by authorized_keys
isSystemUser = true;
group = "deploy";
packages = [
pkgs.rsync
];
openssh.authorizedKeys.keys = [
#"command='rsync --server --daemon . /srv/http/www/',restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPtN5miFqjb585xuM89PXo3yxtY7WS159BvYS26HbZxC git.berlin.ccc.de/cccb/www"
"command='rsync --server --daemon . /srv/http/www-staging/',restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPtN5miFqjb585xuM89PXo3yxtY7WS159BvYS26HbZxC git.berlin.ccc.de/cccb/www"
"command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35LG+xuDaoHQ2bYD4eRc3P6Cl3JVYntoP5Gu9R+mZC deploy@www.berlin.ccc.de production"
"command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjjLtnGf7w5D/ON+P2HpMZ5HA2fWp5YSQMGMuu5CjUt deploy@www.berlin.ccc.de staging"
];
#extraGroups = ["nginx"];
};
groups.deploy = {};
};
services.openssh.extraConfig = ''
Match User deploy
Banner none
'';
}

2
services/prometheus-node.nix
View file

@ -3,7 +3,7 @@
{
services.prometheus.exporters.node = {
enable = true;
#listenAddress = "0.0.0.0";
openFirewall = true;
firewallRules = ''
ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.der"
ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.der"