fixing fail2ban and set up ssh + tor on chungus
This commit is contained in:
parent
cc5d655ef7
commit
26aaec9101
12 changed files with 52 additions and 27 deletions
|
@ -11,7 +11,6 @@ with types;
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
#./avahi.nix
|
#./avahi.nix
|
||||||
./fail2ban.nix
|
|
||||||
./hosts.nix
|
./hosts.nix
|
||||||
./nginx.nix
|
./nginx.nix
|
||||||
./sshd
|
./sshd
|
||||||
|
|
|
@ -11,7 +11,6 @@ let
|
||||||
echo "${config.networking.hostName}" | boxes -d ansi -s 80x1 -a r > $out
|
echo "${config.networking.hostName}" | boxes -d ansi -s 80x1 -a r > $out
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
|
||||||
|
@ -31,10 +30,6 @@ in
|
||||||
default = [ ];
|
default = [ ];
|
||||||
description = "keys to root login";
|
description = "keys to root login";
|
||||||
};
|
};
|
||||||
sshguard.enable = mkOption {
|
|
||||||
type = bool;
|
|
||||||
default = config.components.network.sshd.enable;
|
|
||||||
};
|
|
||||||
onlyTincAccess = mkOption {
|
onlyTincAccess = mkOption {
|
||||||
type = bool;
|
type = bool;
|
||||||
default = false;
|
default = false;
|
||||||
|
@ -71,12 +66,6 @@ in
|
||||||
|
|
||||||
})
|
})
|
||||||
|
|
||||||
(mkIf cfg.sshguard.enable {
|
|
||||||
environment.systemPackages = [ pkgs.ipset ];
|
|
||||||
services.sshguard.enable = lib.mkDefault true;
|
|
||||||
#boot.kernelModules = ["xt_set"];
|
|
||||||
})
|
|
||||||
|
|
||||||
(mkIf (cfg.onlyTincAccess && cfg.enable) {
|
(mkIf (cfg.onlyTincAccess && cfg.enable) {
|
||||||
networking.firewall.extraCommands = ''
|
networking.firewall.extraCommands = ''
|
||||||
iptables --table nat --append PREROUTING ! --in-interface tinc.+ --protocol tcp --match tcp --dport 22 --jump REDIRECT --to-ports 0
|
iptables --table nat --append PREROUTING ! --in-interface tinc.+ --protocol tcp --match tcp --dport 22 --jump REDIRECT --to-ports 0
|
||||||
|
|
|
@ -9,9 +9,6 @@ let
|
||||||
(machine:
|
(machine:
|
||||||
{
|
{
|
||||||
hostNames = [
|
hostNames = [
|
||||||
"[${machine}]:2222"
|
|
||||||
"[${machine}.${tld}]:2222"
|
|
||||||
"[${machine}.private]:2222"
|
|
||||||
"${machine}"
|
"${machine}"
|
||||||
"${machine}.${tld}"
|
"${machine}.${tld}"
|
||||||
"${machine}.private"
|
"${machine}.private"
|
||||||
|
@ -19,6 +16,19 @@ let
|
||||||
publicKey = publicKey machine;
|
publicKey = publicKey machine;
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
|
bootMachines = clanLib.readFactFromAllMachines "ssh.boot.id_ed25519.pub";
|
||||||
|
knownBootHosts = lib.mapAttrs'
|
||||||
|
(machine: publicKey: nameValuePair
|
||||||
|
"boot_${machine}"
|
||||||
|
{
|
||||||
|
inherit publicKey;
|
||||||
|
hostNames = [
|
||||||
|
"[${machine}]:2222"
|
||||||
|
"[${machine}.public]:2222"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
)
|
||||||
|
bootMachines;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
|
||||||
|
@ -30,6 +40,6 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf config.components.network.zerotier.enable {
|
config = mkIf config.components.network.zerotier.enable {
|
||||||
services.openssh.knownHosts = knownHosts;
|
services.openssh.knownHosts = knownHosts // knownBootHosts;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -21,6 +21,7 @@ with types;
|
||||||
# ssh host key
|
# ssh host key
|
||||||
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
|
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
|
||||||
|
|
||||||
|
# todo: maybe put this in a component
|
||||||
# boot
|
# boot
|
||||||
boot.initrd.systemd.enable = true;
|
boot.initrd.systemd.enable = true;
|
||||||
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
|
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
|
||||||
|
|
|
@ -1,3 +1,6 @@
|
||||||
{
|
{
|
||||||
imports = [ ./boot ];
|
imports = [
|
||||||
|
./boot
|
||||||
|
./network
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
6
features/network/default.nix
Normal file
6
features/network/default.nix
Normal file
|
@ -0,0 +1,6 @@
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./fail2ban.nix
|
||||||
|
./sshguard.nix
|
||||||
|
];
|
||||||
|
}
|
|
@ -1,14 +1,14 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
with lib;
|
with lib;
|
||||||
{
|
{
|
||||||
options.components.network.fail2ban.enable = mkOption {
|
options.features.network.fail2ban.enable = mkOption {
|
||||||
type = lib.types.bool;
|
type = lib.types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkMerge [
|
config = mkMerge [
|
||||||
(mkIf config.components.network.fail2ban.enable {
|
(mkIf config.features.network.fail2ban.enable {
|
||||||
environment.systemPackages = [ pkgs.fail2ban pkgs.ipset ];
|
environment.systemPackages = [ pkgs.fail2ban ];
|
||||||
services.fail2ban = {
|
services.fail2ban = {
|
||||||
enable = true;
|
enable = true;
|
||||||
#package = pkgs.legacy_2311.fail2ban;
|
#package = pkgs.legacy_2311.fail2ban;
|
||||||
|
@ -19,7 +19,7 @@ with lib;
|
||||||
# custom defined jails
|
# custom defined jails
|
||||||
# --------------------
|
# --------------------
|
||||||
# https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf
|
# https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf
|
||||||
(mkIf config.components.network.fail2ban.enable {
|
(mkIf config.features.network.fail2ban.enable {
|
||||||
services.fail2ban.jails.nginx-git-not-found.settings = {
|
services.fail2ban.jails.nginx-git-not-found.settings = {
|
||||||
port = "http,https";
|
port = "http,https";
|
||||||
logpath = "%(nginx_error_log)s";
|
logpath = "%(nginx_error_log)s";
|
||||||
|
@ -33,7 +33,7 @@ with lib;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
})
|
})
|
||||||
(mkIf config.components.network.fail2ban.enable {
|
(mkIf config.features.network.fail2ban.enable {
|
||||||
services.fail2ban.jails.nginx-git-bad-request.settings = {
|
services.fail2ban.jails.nginx-git-bad-request.settings = {
|
||||||
port = "http,https";
|
port = "http,https";
|
||||||
logpath = "%(nginx_error_log)s";
|
logpath = "%(nginx_error_log)s";
|
18
features/network/sshguard.nix
Normal file
18
features/network/sshguard.nix
Normal file
|
@ -0,0 +1,18 @@
|
||||||
|
{ pkgs, config, lib, assets, ... }:
|
||||||
|
with lib;
|
||||||
|
with types;
|
||||||
|
{
|
||||||
|
|
||||||
|
options.features.network.sshguard = {
|
||||||
|
enable = mkOption {
|
||||||
|
type = bool;
|
||||||
|
default = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf config.features.network.sshguard.enable {
|
||||||
|
environment.systemPackages = [ pkgs.ipset ];
|
||||||
|
services.sshguard.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
|
@ -43,7 +43,6 @@
|
||||||
components.media.enable = true;
|
components.media.enable = true;
|
||||||
components.media.tts-client.enable = false;
|
components.media.tts-client.enable = false;
|
||||||
components.network.enable = true;
|
components.network.enable = true;
|
||||||
components.network.sshd.sshguard.enable = false;
|
|
||||||
components.network.wifi.enable = true;
|
components.network.wifi.enable = true;
|
||||||
components.terminal.enable = true;
|
components.terminal.enable = true;
|
||||||
|
|
||||||
|
|
|
@ -55,7 +55,9 @@
|
||||||
components.network.wifi.enable = false;
|
components.network.wifi.enable = false;
|
||||||
components.terminal.enable = true;
|
components.terminal.enable = true;
|
||||||
|
|
||||||
|
features.boot.ssh.enable = true;
|
||||||
features.boot.ssh.kernelModules = [ "e1000e" ];
|
features.boot.ssh.kernelModules = [ "e1000e" ];
|
||||||
|
features.boot.tor.enable = true;
|
||||||
|
|
||||||
components.monitor.enable = true;
|
components.monitor.enable = true;
|
||||||
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
|
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
|
||||||
|
@ -68,7 +70,6 @@
|
||||||
|
|
||||||
networking.hostName = "chungus";
|
networking.hostName = "chungus";
|
||||||
|
|
||||||
|
|
||||||
hardware.graphics.enable = true;
|
hardware.graphics.enable = true;
|
||||||
hardware.graphics.enable32Bit = true;
|
hardware.graphics.enable32Bit = true;
|
||||||
hardware.graphics.extraPackages = with pkgs; [
|
hardware.graphics.extraPackages = with pkgs; [
|
||||||
|
|
|
@ -7,6 +7,7 @@
|
||||||
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
|
||||||
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
|
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
|
||||||
|
|
||||||
boot.supportedFilesystems = [ "zfs" ];
|
boot.supportedFilesystems = [ "zfs" ];
|
||||||
|
|
|
@ -47,9 +47,7 @@
|
||||||
components.network.nginx.landingpage.enable = false;
|
components.network.nginx.landingpage.enable = false;
|
||||||
components.network.wifi.enable = false;
|
components.network.wifi.enable = false;
|
||||||
|
|
||||||
components.network.fail2ban.enable = true;
|
features.network.fail2ban.enable = true;
|
||||||
components.network.sshd.sshguard.enable = false;
|
|
||||||
|
|
||||||
features.boot.ssh.enable = true;
|
features.boot.ssh.enable = true;
|
||||||
|
|
||||||
components.monitor.enable = true;
|
components.monitor.enable = true;
|
||||||
|
|
Loading…
Reference in a new issue