1 files changed, 248 insertions, 0 deletions

diff --git a/accounts/gkleen@skadhi/rzm/default.nix b/accounts/gkleen@skadhi/rzm/default.nix
new file mode 100644
index 00000000..a545bae9
--- /dev/null
+++ b/accounts/gkleen@skadhi/rzm/default.nix
@@ -0,0 +1,248 @@
+{ config, pkgs, lib, ... }:
+let
+  mwnSubnetsPublic =
+    [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16"
+      "192.68.211.0/24" "192.68.212.0/24" "192.68.213.0/24" "192.68.214.0/24" "192.68.215.0/24"
+      "193.174.96.0/22"
+      "194.95.59.0/24"
+    ];
+  mwnSubnetsPrivate =
+    [ "10.153.0.0/16" "10.162.0.0/16" "10.156.0.0/16"
+    ];
+in {
+  config = {
+    systemd.network = {
+      config.routeTables.wgrz = 1025;
+      netdevs = {
+        wgrz = {
+          netdevConfig = {
+            Name = "wgrz";
+            Kind = "wireguard";
+            MTUBytes = "1558";
+          };
+          wireguardConfig = {
+            PrivateKeyFile = "/run/credentials/systemd-networkd.service/wgrz.priv";
+            ListenPort = 51822;
+            # FirewallMark = 1;
+          };
+          wireguardPeers = [
+            { AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic;
+              PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI=";
+              PersistentKeepalive = 25;
+              Endpoint = "wg.math.lmu.de:51820";
+            }
+          ];
+        };
+      };
+      networks = {
+        wgrz = {
+          name = "wgrz";
+          matchConfig = {
+            Name = "wgrz";
+          };
+          address = ["10.200.116.131/24"];
+          routes = map (Destination: {
+            inherit Destination;
+            Gateway = "10.200.116.1";
+            GatewayOnLink = true;
+            Table = "wgrz";
+          }) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]);
+          routingPolicyRules = [
+            { Table = "main";
+              # FirewallMark = 1;
+              To = "129.187.111.225";
+              Priority = 100;
+            }
+            { Table = "main";
+              To = "10.153.91.204";
+              Priority = 100;
+            }
+            { Table = "wgrz";
+              From = "10.200.116.131";
+              Priority = 200;
+            }
+            { Table = "wgrz";
+              To = "10.163.88.40";
+              Priority = 200;
+            }
+          ] ++ map (To: { Table = "wgrz";
+                          inherit To;
+                          Priority = 200;
+                        }) (mwnSubnetsPrivate ++ mwnSubnetsPublic);
+          linkConfig = {
+            RequiredForOnline = false;
+          };
+          networkConfig = {
+            LLMNR = false;
+            MulticastDNS = false;
+            DNS = ["10.153.88.9" "129.187.111.202" "10.156.33.53"];
+            # Tunnel = "rz-gre-1";
+          };
+        };
+      };
+    };
+    networking.networkmanager.unmanaged = ["wgrz"];
+    sops.secrets.wgrz = {
+      format = "binary";
+      sopsFile = ./wgrz.priv;
+    };
+    systemd.services."systemd-networkd".serviceConfig.LoadCredential = [
+      "wgrz.priv:${config.sops.secrets.wgrz.path}"
+    ];
+
+    environment.etc."NetworkManager/dnsmasq.d/wgrz.conf" = {
+      text = ''
+        server=/mathinst.loc/10.153.88.9@wgrz
+        server=/cipmath.loc/10.153.88.9@wgrz
+      '';
+    };
+
+    home-manager.users.gkleen = { sysConfig, config, lib, ... }: {
+      home.persistence."/persistent" = {
+        files = [
+          "rz.kdbx"
+        ];
+        directories = [
+          ".config/Element-lmu" ".config/worktime"
+          ".config/chromium-kimai" ".config/chromium-rainbow"
+        ];
+      };
+
+      xdg.desktopEntries = {
+        element-lmu = {
+          name = "Element (LMU)";
+          exec = "element-desktop --profile=lmu %u";
+          icon = "element";
+          genericName = "Matrix Client";
+          categories = [ "Network" "InstantMessaging" "Chat" ];
+          settings = {
+            StartupWMClass = "Element";
+          };
+        };
+        thunderbird-lmu = {
+          name = "Thunderbird (LMU)";
+          exec = "thunderbird --name thunderbird -P lmu %U";
+          icon = "thunderbird";
+          genericName = "Email Client";
+          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
+          settings = {
+            StartupWMClass = "thunderbird";
+            StartupNotify = "true";
+          };
+        };
+        rainbow = {
+          name = "Rainbow";
+          exec = toString (pkgs.writeShellScript "rainbow" ''
+            exec -- \
+              ${lib.getExe' sysConfig.systemd.package "systemd-run"} --wait --user --slice-inherit \
+              --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
+              -E DSCP=46 -E NIXOS_OZONE_WL \
+              -- ${lib.getExe pkgs.dscp} ${lib.getExe config.programs.chromium.package} \
+              --class=Rainbow \
+              --app="https://web.openrainbow.com" \
+              --user-data-dir=''${HOME}/.config/chromium-rainbow
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://web.openrainbow.com/rb/2.174.21/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
+            hash = "sha256-5fmo8rDqVDpzkGaPjk4Y+SsSZpAsY7VUQSFW6WdHwuU=";
+          };
+          settings = {
+            StartupWMClass = "Rainbow";
+          };
+        };
+        kimai = {
+          name = "Kimai";
+          exec = toString (pkgs.writeShellScript "kimai" ''
+            exec -- \
+              ${lib.getExe config.programs.chromium.package} \
+              --class=Kimai \
+              --app="https://kimai.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-kimai
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.kimai.org/images/kimai_logo.png";
+            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
+          };
+          settings = {
+            StartupWMClass = "Kimai";
+            StartupNotify = "true";
+          };
+        };
+      };
+
+      programs.zsh.dirHashes = {
+        u2w = "$HOME/projects/uni2work";
+        rz = "$HOME/projects/rz";
+        pro = "$HOME/projects/pro";
+      };
+
+      programs.ssh.settings = {
+        "repo-apt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          User = "root";
+          Hostname = "repo-apt01.mathinst.loc";
+          inherit (config.programs.ssh.autosshProxies."mgmt01") ProxyCommand;
+        };
+        "mgmt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          User = "root";
+          Hostname = "mgmt01.mathinst.loc";
+          inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
+        };
+        "mathw0e" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          Hostname = "mathw0e.mathinst.loc";
+          inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
+        };
+        "cip04" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          Hostname = "cip04.cipmath.loc";
+          inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
+        };
+        "mathw0h" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          Hostname = "mathw0h.mathinst.loc";
+          inherit (config.programs.ssh.autosshProxies."ssh.math.lmu.de") ProxyCommand;
+        };
+        "math05"  = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          Hostname = "math05.mathinst.loc";
+          inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
+          KexAlgorithms = "+diffie-hellman-group1-sha1";
+        };
+        "dhcp01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          Hostname = "dhcp01.mathinst.loc";
+          User = "root";
+          inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
+        };
+        "dhcp02" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          Hostname = "dhcp02.mathinst.loc";
+          User = "root";
+          inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
+        };
+        "*.mathinst.loc" = {
+          header = "Match host *.mathinst.loc,*.cipmath.loc,*.math.lmu.de";
+          IdentityFile = "~/.ssh/gkleen@mathinst.loc";
+          HostKeyAlgorithms = "+ssh-rsa";
+          PubkeyAcceptedAlgorithms = "+ssh-rsa";
+          PasswordAuthentication = "yes";
+          GlobalKnownHostsFile = toString (pkgs.writeText "ssh_known_hosts" ''
+            @cert-authority *.mathinst.loc,*.math.lmu.de,*.cipmath.loc ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUTFpVCdETCXiDSDl7YGbR1J4BLTsoBzjDtflHJGO/z ssh-pki@mgmt01
+          '');
+        };
+      };
+
+      programs.ssh.autosshProxies = {
+        "mgmt01" = { port = 8129; sshpassSecret = "root@mgmt01.mathinst.loc"; };
+        "mathw0e" = { port = 8125; sshpassSecret = "gkleen@mathw0e.mathinst.loc"; };
+        "mathw0h" = { port = 8123; sshpassSecret = "gkleen@mathw0h.mathinst.loc"; };
+        "cip04" = { port = 8127; sshpassSecret = "gkleen@cip04.cipmath.loc"; };
+        "ssh.math.lmu.de" = { port = 8119; sshpassSecret = "gkleen@ssh.math.lmu.de"; };
+      };
+
+      home.file = {
+        ".cups/client.conf".text = ''
+          ServerName cups.mathinst.loc
+        '';
+      };
+
+      home.packages = with pkgs; [
+        cups
+      ];
+    };
+  };
+}