xengi/infra
0
1
Fork 0
Code Pull requests Activity Actions

Compare commits

base: xengi:b6f86709f07ff663ec6a2e619ddc3a4bf0ca2146
Branches Tags
xengi:main
xengi:wip
..
compare: xengi:0f0d8c43c821499d314cde95a64a887b24518ca5
Branches Tags
xengi:main
xengi:wip

No commits in common. "b6f86709f07ff663ec6a2e619ddc3a4bf0ca2146" and "0f0d8c43c821499d314cde95a64a887b24518ca5" have entirely different histories.
b6f86709f0 ... 0f0d8c43c8

2 changed files with 9 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hosts/www/openssh.nix
View file

@ -4,20 +4,19 @@
users = { users = {
users.deploy = { users.deploy = {
description = "deploys static websites from forgejo"; description = "deploys static websites from forgejo";
shell = pkgs.dash; # gets restricted by authorized_keys shell = "/run/current-system/sw/bin/nologin";
isSystemUser = true; isSystemUser = true;
group = "deploy"; group = "deploy";
openssh.authorizedKeys.keys = [ packages = [
"command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35LG+xuDaoHQ2bYD4eRc3P6Cl3JVYntoP5Gu9R+mZC deploy@www.berlin.ccc.de production" pkgs.rsync
"command=\"${pkgs.rsync}/bin/rsync --server -vlogDtpre.iLsfxCIvu . /srv/http/www-staging/\",restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjjLtnGf7w5D/ON+P2HpMZ5HA2fWp5YSQMGMuu5CjUt deploy@www.berlin.ccc.de staging"
]; ];
openssh.authorizedKeys.keys = [
#"command='rsync --server --daemon . /srv/http/www/',restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPtN5miFqjb585xuM89PXo3yxtY7WS159BvYS26HbZxC git.berlin.ccc.de/cccb/www"
"command='rsync --server --daemon . /srv/http/www-staging/',restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPtN5miFqjb585xuM89PXo3yxtY7WS159BvYS26HbZxC git.berlin.ccc.de/cccb/www"
];
#extraGroups = ["nginx"];
}; };
groups.deploy = {}; groups.deploy = {};
}; };
services.openssh.extraConfig = ''
Match User deploy
Banner none
'';
} }

2
services/prometheus-node.nix
View file

@ -3,7 +3,7 @@
{ {
services.prometheus.exporters.node = { services.prometheus.exporters.node = {
enable = true; enable = true;
openFirewall = true; #listenAddress = "0.0.0.0";
firewallRules = '' firewallRules = ''
ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.der" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.der"
ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.der" ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.der"