summaryrefslogtreecommitdiff
path: root/accounts/gkleen@skadhi/rzm
diff options
context:
space:
mode:
Diffstat (limited to 'accounts/gkleen@skadhi/rzm')
-rw-r--r--accounts/gkleen@skadhi/rzm/default.nix270
-rw-r--r--accounts/gkleen@skadhi/rzm/wgrz.priv18
2 files changed, 288 insertions, 0 deletions
diff --git a/accounts/gkleen@skadhi/rzm/default.nix b/accounts/gkleen@skadhi/rzm/default.nix
new file mode 100644
index 00000000..2ca9b68c
--- /dev/null
+++ b/accounts/gkleen@skadhi/rzm/default.nix
@@ -0,0 +1,270 @@
1{ config, pkgs, lib, ... }:
2let
3 mwnSubnetsPublic =
4 [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16"
5 "192.68.211.0/24" "192.68.212.0/24" "192.68.213.0/24" "192.68.214.0/24" "192.68.215.0/24"
6 "193.174.96.0/22"
7 "194.95.59.0/24"
8 ];
9 mwnSubnetsPrivate =
10 [ "10.153.0.0/16" "10.162.0.0/16" "10.156.0.0/16"
11 ];
12in {
13 config = {
14 systemd.network = {
15 config.routeTables.wgrz = 1025;
16 netdevs = {
17 wgrz = {
18 netdevConfig = {
19 Name = "wgrz";
20 Kind = "wireguard";
21 MTUBytes = "1558";
22 };
23 wireguardConfig = {
24 PrivateKeyFile = "/run/credentials/systemd-networkd.service/wgrz.priv";
25 ListenPort = 51822;
26 # FirewallMark = 1;
27 };
28 wireguardPeers = [
29 { AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic;
30 PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI=";
31 PersistentKeepalive = 25;
32 Endpoint = "wg.math.lmu.de:51820";
33 }
34 ];
35 };
36 };
37 networks = {
38 wgrz = {
39 name = "wgrz";
40 matchConfig = {
41 Name = "wgrz";
42 };
43 address = ["10.200.116.131/24"];
44 routes = map (Destination: {
45 inherit Destination;
46 Gateway = "10.200.116.1";
47 GatewayOnLink = true;
48 Table = "wgrz";
49 }) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]);
50 routingPolicyRules = [
51 { Table = "main";
52 # FirewallMark = 1;
53 To = "129.187.111.225";
54 Priority = 100;
55 }
56 { Table = "main";
57 To = "10.153.91.204";
58 Priority = 100;
59 }
60 { Table = "wgrz";
61 From = "10.200.116.131";
62 Priority = 200;
63 }
64 { Table = "wgrz";
65 To = "10.163.88.40";
66 Priority = 200;
67 }
68 ] ++ map (To: { Table = "wgrz";
69 inherit To;
70 Priority = 200;
71 }) (mwnSubnetsPrivate ++ mwnSubnetsPublic);
72 linkConfig = {
73 RequiredForOnline = false;
74 };
75 networkConfig = {
76 LLMNR = false;
77 MulticastDNS = false;
78 DNS = ["10.153.88.9" "129.187.111.202" "10.156.33.53"];
79 # Tunnel = "rz-gre-1";
80 };
81 };
82 };
83 };
84 networking.networkmanager.unmanaged = ["wgrz"];
85 sops.secrets.wgrz = {
86 format = "binary";
87 sopsFile = ./wgrz.priv;
88 };
89 systemd.services."systemd-networkd".serviceConfig.LoadCredential = [
90 "wgrz.priv:${config.sops.secrets.wgrz.path}"
91 ];
92
93 environment.etc."NetworkManager/dnsmasq.d/wgrz.conf" = {
94 text = ''
95 server=/mathinst.loc/10.153.88.9@wgrz
96 server=/cipmath.loc/10.153.88.9@wgrz
97 '';
98 };
99
100 home-manager.users.gkleen = { sysConfig, config, lib, ... }: {
101 home.persistence."/persistent" = {
102 directories = [
103 ".config/Element-lmu" ".config/worktime"
104 ".config/chromium-kimai" ".config/chromium-rainbow"
105 ];
106 };
107
108 xdg.desktopEntries = {
109 element-lmu = {
110 name = "Element (LMU)";
111 exec = "element-desktop --profile=lmu %u";
112 icon = "element";
113 genericName = "Matrix Client";
114 categories = [ "Network" "InstantMessaging" "Chat" ];
115 settings = {
116 StartupWMClass = "Element";
117 };
118 };
119 thunderbird-lmu = {
120 name = "Thunderbird (LMU)";
121 exec = "thunderbird --name thunderbird -P lmu %U";
122 icon = "thunderbird";
123 genericName = "Email Client";
124 categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
125 settings = {
126 StartupWMClass = "thunderbird";
127 StartupNotify = "true";
128 };
129 };
130 rainbow = {
131 name = "Rainbow";
132 exec = toString (pkgs.writeShellScript "rainbow" ''
133 exec -- \
134 ${lib.getExe' sysConfig.systemd.package "systemd-run"} --wait --user --slice-inherit \
135 --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
136 -E DSCP=46 -E NIXOS_OZONE_WL \
137 -- ${lib.getExe pkgs.dscp} ${lib.getExe config.programs.chromium.package} \
138 --class=Rainbow \
139 --app="https://web.openrainbow.com" \
140 --user-data-dir=''${HOME}/.config/chromium-rainbow
141 '');
142 icon = pkgs.fetchurl {
143 url = "https://web.openrainbow.com/rb/2.174.21/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
144 hash = "sha256-5fmo8rDqVDpzkGaPjk4Y+SsSZpAsY7VUQSFW6WdHwuU=";
145 };
146 settings = {
147 StartupWMClass = "Rainbow";
148 };
149 };
150 kimai = {
151 name = "Kimai";
152 exec = toString (pkgs.writeShellScript "kimai" ''
153 exec -- \
154 ${lib.getExe config.programs.chromium.package} \
155 --class=Kimai \
156 --app="https://kimai.yggdrasil.li" \
157 --user-data-dir=''${HOME}/.config/chromium-kimai
158 '');
159 icon = pkgs.fetchurl {
160 url = "https://www.kimai.org/images/kimai_logo.png";
161 hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
162 };
163 settings = {
164 StartupWMClass = "Kimai";
165 StartupNotify = "true";
166 };
167 };
168 };
169
170 programs.zsh.dirHashes = {
171 u2w = "$HOME/projects/uni2work";
172 rz = "$HOME/projects/rz";
173 pro = "$HOME/projects/pro";
174 };
175
176 programs.ssh.settings = {
177 "repo-apt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
178 User = "root";
179 Hostname = "repo-apt01.mathinst.loc";
180 inherit (config.programs.ssh.autosshProxies."mgmt01") ProxyCommand;
181 };
182 "mgmt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
183 User = "root";
184 Hostname = "mgmt01.mathinst.loc";
185 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
186 };
187 "mathw0e" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
188 Hostname = "mathw0e.mathinst.loc";
189 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
190 };
191 "cip04" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
192 Hostname = "cip04.cipmath.loc";
193 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
194 };
195 "mathw0h" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
196 Hostname = "mathw0h.mathinst.loc";
197 inherit (config.programs.ssh.autosshProxies."ssh.math.lmu.de") ProxyCommand;
198 };
199 "math05" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
200 Hostname = "math05.mathinst.loc";
201 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
202 KexAlgorithms = "+diffie-hellman-group1-sha1";
203 };
204 "dhcp01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
205 Hostname = "dhcp01.mathinst.loc";
206 User = "root";
207 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
208 };
209 "dhcp02" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
210 Hostname = "dhcp02.mathinst.loc";
211 User = "root";
212 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
213 };
214 "u2w-www01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
215 Hostname = "u2w-www01.mathinst.loc";
216 User = "root";
217 inherit (config.programs.ssh.autosshProxies."mgmt01") ProxyCommand;
218 };
219 "mail-mi01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
220 Hostname = "mail-mi01.mathinst.loc";
221 User = "root";
222 inherit (config.programs.ssh.autosshProxies."mathw0h") ProxyCommand;
223 };
224 "gitlab-ce.lrz.de" = {
225 User = "git";
226 IdentityFile = "~/.ssh/gkleen@gitlab-ce.lrz.de";
227 };
228 "gitlab.lrz.de" = {
229 User = "git";
230 IdentityFile = "~/.ssh/gkleen@gitlab.lrz.de";
231 };
232 "Match host vrt-kvm*" = {
233 User = "root";
234 inherit (config.programs.ssh.autosshProxies."mathw0e") ProxyCommand;
235 PasswordAuthentication = "yes";
236 };
237 "*.mathinst.loc" = {
238 header = "Match host *.mathinst.loc,*.cipmath.loc,*.math.lmu.de";
239 IdentityFile = "~/.ssh/gkleen@mathinst.loc";
240 HostKeyAlgorithms = "+ssh-rsa";
241 PubkeyAcceptedAlgorithms = "+ssh-rsa";
242 PasswordAuthentication = "yes";
243 GlobalKnownHostsFile = toString (pkgs.writeText "ssh_known_hosts" ''
244 @cert-authority *.mathinst.loc,*.math.lmu.de,*.cipmath.loc ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUTFpVCdETCXiDSDl7YGbR1J4BLTsoBzjDtflHJGO/z ssh-pki@mgmt01
245 '');
246 };
247 };
248
249 programs.ssh.autosshProxies = {
250 "mgmt01" = { port = 8129; sshpassSecret = "root@mgmt01.mathinst.loc"; };
251 "mathw0e" = { port = 8125; sshpassSecret = "gkleen@mathw0e.mathinst.loc"; };
252 "mathw0h" = { port = 8123; sshpassSecret = "gkleen@mathw0h.mathinst.loc"; };
253 "cip04" = { port = 8127; sshpassSecret = "gkleen@cip04.cipmath.loc"; };
254 "ssh.math.lmu.de" = { port = 8119; sshpassSecret = "gkleen@ssh.math.lmu.de"; };
255 };
256
257 home.file = {
258 ".cups/client.conf".text = ''
259 ServerName cups.mathinst.loc
260 '';
261 };
262
263 home.packages = with pkgs; [
264 cups
265 ];
266
267 fonts.lmu-hausschrift.enable = true;
268 };
269 };
270}
diff --git a/accounts/gkleen@skadhi/rzm/wgrz.priv b/accounts/gkleen@skadhi/rzm/wgrz.priv
new file mode 100644
index 00000000..d34e96ee
--- /dev/null
+++ b/accounts/gkleen@skadhi/rzm/wgrz.priv
@@ -0,0 +1,18 @@
1{
2 "data": "ENC[AES256_GCM,data:HbX+Vd4IpVcWIH/llV3BWnuWwOzNw/bZfjisD38CFNbd/RCPEnuIb2XCNi+4,iv:at3CY0GIDSSQSmiXlnNgLMIGIT5V8CYOCuFyThjMmGE=,tag:ZAttUMhZV56G5A54a8YXbg==,type:str]",
3 "sops": {
4 "age": [
5 {
6 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRU1GNkZtbXgwMjVvVlo2\nMXkvc24rcEgyVEpyMVZwL25QTGYrZzBjT25ZCldraUhhNkFveXhLQ09ibjNUOVJl\nSUkzL0MwbkVQQXgzZkNiQjEwM05BVTAKLS0tIE5rSFRJalJqbERwdzFGeHdrTXFG\nWFdPU21PUEtxbGdibXNVZnYxMUdPaTQKw83yVaRBy4d2YLchQJM5ucZrdTpe0PUZ\nM9SdUP1eGbOIWkeUttG/qsKrLfHT2+GDhydxU6gwKiAfwDr9I3IGCA==\n-----END AGE ENCRYPTED FILE-----\n",
7 "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866"
8 },
9 {
10 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMDVCaTFYZVpmeUg1dWZs\nRHNYM3BSL2liemlaSGRWRTcya3VJUDd2akNNCjQ0N0V1ZTI1ZDhOZTBYMlBWZDdY\nQU1WSVNoMUhrUkgxQVhwL2VNZFVIeTgKLS0tIFhONzNXOXJoUjhOVFYrZWRPeEZJ\ncnpvblRDMDBKbXJjL2JpVUEwZ2NaRTQKNGtFm9ObnEPUHKKsTJaaALHsqFLPr5oO\nlCYIucEMFOYkM7o5wJCtLs5fsigQT6pAkeI3+N/rSz1hhDWuBB+PrQ==\n-----END AGE ENCRYPTED FILE-----\n",
11 "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e"
12 }
13 ],
14 "lastmodified": "2026-09-27T10:18:59Z",
15 "mac": "ENC[AES256_GCM,data:BIHCMFB0oMcaByiALqgTaKBd1cNJZlFu3FnB7U0oTtw3Q65mFqrsLsphesuPxZxtD8eAdubT/YIC2rZ5ZCAZz/9eM1nt8tvBkO6ZGXmHeWUGlTpA7K2EAEK4D+8Bo8Xgf8afaTCmbrfKjn64iNQjUrmv8NMoY2Od8sYfIfRdYSs=,iv:d/Jt+ub2VcnJd9n7qwO6/j044D1fNtAmEQtZQrCNeEg=,tag:R7TPkPXyVV5UDsl9x1pboA==,type:str]",
16 "version": "3.13.3"
17 }
18}
generated by cgit v1.2.3 (git 2.25.1) at 2026-11-13 12:51:00 +0000