configuration.nix-lanfear

# -*- nix -*-

{ config, lib, pkgs, ... }:

let
  net = "172.25.14";
  udpNet = "172.25.15";
in {

  boot = {
    kernelPackages = pkgs.linuxPackages_4_19;
  };

  networking = {
    hostName = "lanfear";
    hostId = "2d75caa8";
    firewall.allowedTCPPorts = [
      80 443 8443
    ];
    firewall.allowedUDPPorts = [
       8443
    ];
    defaultGateway = {
      address = "192.168.2.1";
      interface = "br0";
    };
    nameservers = [ "192.168.2.4" "192.168.2.1" "8.8.8.8" ];
    search = [ "binarin.ru" ];
    domain = "binarin.ru";
    interfaces = {
      br0 = {
        name = "br0";
        ipv4.addresses = [
          { address = "192.168.2.4"; prefixLength = 24; }
        ];
      };
    };
    bridges = {
      br0 = {
        interfaces = [ "eno1" ];
      };
    };

    nat = {
      enable = true;
      internalInterfaces = ["ovpn-server-tcp" "ovpn-server-udp"];
      externalInterface = "br0";
    };

    firewall.extraCommands = ''
      ip46tables -A FORWARD -i ovpn-server-tcp -j ACCEPT || true
      ip46tables -A FORWARD -o ovpn-server-tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT || true

      ip46tables -A FORWARD -p all -i br0 -j ACCEPT || true

      ip46tables -A FORWARD -i ovpn-server-udp -j ACCEPT || true
      ip46tables -A FORWARD -o ovpn-server-udp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT || true
    '';

    firewall.extraStopCommands = ''
      ip46tables -D FORWARD -i ovpn-server-tcp -j ACCEPT || true
      ip46tables -D FORWARD -o ovpn-server-tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT || true

      ip46tables -D FORWARD -p all -i br0 -j ACCEPT || true

      ip46tables -D FORWARD -i ovpn-server-udp -j ACCEPT || true
      ip46tables -D FORWARD -o ovpn-server-udp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT || true
    '';
  };

  imports = [
    <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
    ./hardware/intel.nix
    ./partitions/unencrypted-uefi-ext4.nix
    ./profile/server.nix
    ./users/binarin.nix
    ./profile/emacs.nix
    ./profile/nixops.nix
  ];

  system.fsPackages = [ pkgs.ntfs3g ];

  # services.vault = {
  #   enable = true;
  #   storageBackend = "file";
  # };
  environment.systemPackages = [ pkgs.vault pkgs.virtinst ];
  virtualisation.docker.enable = true;
  virtualisation.libvirtd.enable = true;

  security.pam.services.nginx = {
    name = "nginx";
    unixAuth = true;
  };

  services.nginx.package = pkgs.nginx.override {
    modules = [pkgs.nginxModules.pam];
  };

  users.extraGroups.shadow.gid = 2001;
  users.extraUsers.nginx.extraGroups = [ "shadow" ];
  system.activationScripts.shadowGroup = lib.stringAfter [ "users" ] ''
    chgrp shadow /etc/shadow
    chmod g+r /etc/shadow
  '';

  services.nginx.enable = true;

  services.nginx.virtualHosts."org.binarin.ru" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      root = "/var/www/org/";
      index = "index.html";
      extraConfig = ''
        auth_pam    "Secure Zone";
        auth_pam_service_name   "nginx";
      '';
    };
  };

  services.nginx.upstreams."hass.binarin.ru".servers = {
    "192.168.2.23:8123" = {};
  };

  services.nginx.virtualHosts."hass.binarin.ru" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://hass.binarin.ru";
      extraConfig = ''
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_redirect http:// https://;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
      '';
    };
  };

  systemd.services."org-agenda-render" = let
    script = pkgs.writeScript "org-agenda-render" ''
      #!${pkgs.bash}/bin/bash
      export PATH=/run/current-system/sw/bin:$PATH
      $HOME/.rc/agenda-gen.sh
    '';
  in {
    description = "Pre-render org-mode agendas to .html";
    serviceConfig = {
      Type = "oneshot";
      User = "binarin";
      ExecStart = script;
    };
  };
  systemd.timers."org-agenda-render" = {
    description = "Periodically fetches latest org files and pre-generates .html agenda";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnBootSec = "15min";
      OnUnitActiveSec = "30min";
    };
  };

  services.dnsmasq.enable = false;

  systemd.services."pi-hole" = let
    stateDir = "/var/lib/pihole/";
    serverIP = "192.168.2.4";
    script = pkgs.writeScript "pi-hole-in-docker" ''
      #!${pkgs.bash}/bin/bash
      docker run --rm -t \
      --name pihole \
      -p ${serverIP}:53:53/tcp -p ${serverIP}:53:53/udp \
      -p 30080:80 \
      -p 30443:443 \
      -v "${stateDir}/pihole/:/etc/pihole/" \
      -v "${stateDir}/dnsmasq.d/:/etc/dnsmasq.d/" \
      --cap-add=NET_ADMIN \
      --dns=127.0.0.1 --dns=1.1.1.1 \
      pihole/pihole:latest
    '';
  in {
    description = "Starts pi-hole docker container";
    after = [ "docker.service "];
    wants = [ "wants.service "];
    wantedBy = [ "default.target" ];
    path = [ pkgs.docker ];
    serviceConfig = {
      ExecStart = script;
    };
  };

  services.openvpn.servers.udp-server-with-password = {
    config = ''
      mode server
      dh none
      tls-server
      dev-type tun
      dev ovpn-server-udp
      port 8443
      proto udp
      cert /var/lib/acme/org.binarin.ru/fullchain.pem
      key /var/lib/acme/org.binarin.ru/key.pem
      ca /etc/ssl/certs/ca-bundle.crt
      plugin openvpn-plugin-auth-pam.so "login login USERNAME password PASSWORD"
      verify-client-cert none

      cipher AES-128-CBC
      client-to-client

      ifconfig ${udpNet}.1 ${udpNet}.2
      ifconfig-pool ${udpNet}.128 ${udpNet}.254

      keepalive 5 30
      tun-mtu 1300

      push "redirect-gateway"
      push "route ${udpNet}.0 255.255.255.0"
      push "topology net30"

      route ${udpNet}.0 255.255.255.0
    '';
  };

  services.openvpn.servers.tcp-server-with-password = {
    config = ''
      mode server
      dh none
      tls-server
      dev-type tun
      dev ovpn-server-tcp
      port 8443
      proto tcp-server
      cert /var/lib/acme/org.binarin.ru/fullchain.pem
      key /var/lib/acme/org.binarin.ru/key.pem
      ca /etc/ssl/certs/ca-bundle.crt
      plugin openvpn-plugin-auth-pam.so "login login USERNAME password PASSWORD"
      verify-client-cert none

cipher AES-128-CBC
client-to-client

ifconfig ${net}.1 ${net}.2
ifconfig-pool ${net}.128 ${net}.254

keepalive 5 30
tun-mtu 1300

push "route ${net}.0 255.255.255.0"
push "topology net30"

route ${net}.0 255.255.255.0

push "route 0.0.0.0 248.0.0.0"
push "route 8.0.0.0 254.0.0.0"
push "route 11.0.0.0 255.0.0.0"
push "route 12.0.0.0 252.0.0.0"
push "route 16.0.0.0 240.0.0.0"
push "route 32.0.0.0 224.0.0.0"
push "route 64.0.0.0 192.0.0.0"
push "route 128.0.0.0 224.0.0.0"
push "route 160.0.0.0 248.0.0.0"
push "route 168.0.0.0 252.0.0.0"
push "route 172.0.0.0 255.240.0.0"
push "route 172.32.0.0 255.224.0.0"
push "route 172.64.0.0 255.192.0.0"
push "route 172.128.0.0 255.128.0.0"
push "route 173.0.0.0 255.0.0.0"
push "route 174.0.0.0 254.0.0.0"
push "route 176.0.0.0 240.0.0.0"
push "route 192.0.0.0 255.128.0.0"
push "route 192.128.0.0 255.224.0.0"
push "route 192.160.0.0 255.248.0.0"
push "route 192.169.0.0 255.255.0.0"
push "route 192.170.0.0 255.254.0.0"
push "route 192.172.0.0 255.252.0.0"
push "route 192.176.0.0 255.240.0.0"
push "route 192.192.0.0 255.192.0.0"
push "route 193.0.0.0 255.0.0.0"
push "route 194.0.0.0 254.0.0.0"
push "route 196.0.0.0 252.0.0.0"
push "route 200.0.0.0 248.0.0.0"
push "route 208.0.0.0 240.0.0.0"
    '';
  };

}