summaryrefslogtreecommitdiff
path: root/hosts/surtr
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/surtr')
-rw-r--r--hosts/surtr/default.nix2
-rw-r--r--hosts/surtr/dns/default.nix2
-rw-r--r--hosts/surtr/dns/keys/firefly.yggdrasil.li_acme24
-rw-r--r--hosts/surtr/dns/zones/li.yggdrasil.soa10
-rw-r--r--hosts/surtr/firefly.nix66
-rw-r--r--hosts/surtr/tls/tsig_keys/firefly.yggdrasil.li24
6 files changed, 125 insertions, 3 deletions
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index 1b33630a..06d3866f 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -7,7 +7,7 @@ with lib;
7 tmpfs-root qemu-guest openssh rebuild-machines zfs 7 tmpfs-root qemu-guest openssh rebuild-machines zfs
8 ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql 8 ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql
9 ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix 9 ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix
10 ./paperless.nix 10 ./paperless.nix ./firefly.nix
11 ]; 11 ];
12 12
13 config = { 13 config = {
diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 64864272..eb09e296 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -157,7 +157,7 @@ in {
157 ${concatMapStringsSep "\n" mkZone [ 157 ${concatMapStringsSep "\n" mkZone [
158 { domain = "yggdrasil.li"; 158 { domain = "yggdrasil.li";
159 addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; }; 159 addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; };
160 acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li"]; 160 acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li" "firefly.yggdrasil.li"];
161 } 161 }
162 { domain = "nights.email"; 162 { domain = "nights.email";
163 addACLs = { "nights.email" = ["ymir_acme_acl"]; }; 163 addACLs = { "nights.email" = ["ymir_acme_acl"]; };
diff --git a/hosts/surtr/dns/keys/firefly.yggdrasil.li_acme b/hosts/surtr/dns/keys/firefly.yggdrasil.li_acme
new file mode 100644
index 00000000..3bd0df26
--- /dev/null
+++ b/hosts/surtr/dns/keys/firefly.yggdrasil.li_acme
@@ -0,0 +1,24 @@
1{
2 "data": "ENC[AES256_GCM,data:cwnYMc/noE+Cv2Vh2KVJLlYdF9ul5XygFuZEEpd7YsP/r+ls+9gYSMDWmkUBC0F1Pt/SlZlIM/dwHs4Bd21B6g+rBAlHz9IJyA9l7Nl4HKwMxlDU6C0Z/l3YdgLhDIPUARHianJqAfJ3xIMIGYVFIqA0haKCgxS6jMG5Z50+FZa0aeF24fweUea56sD3+A/Hg+YdXfOwmqlwNILADLknv+0ZLgp7bpieZCsi4wluuVg8RSj1kPOvHd8Y7GRe2ooyY1ZOyjqIOT9Gz+pOCTTxEQi5uBV1KLju,iv:hI1pD19VjIG//+qLgfc8UYlhr2OLVkOYq3BRRkC9cSE=,tag:I0xFufqFu4zxYHfehv8cNg==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": [
9 {
10 "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
11 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZG5xaFIzR2s1RUF4aGhx\nb3lwd05nTi81aUJ0T1c4eXFDdmxjQ2pqdEVRCmk5WnhlNm1rc3pDNjJHeEN1YzZ2\nN2sxcHYyaHpBMGo1aXNLSGNuTnhpYjgKLS0tIHdKcGcvYTRuWGxnVGRHa2tTbXVW\nUDhxeHBVVFM1MVdXR05vaE1STlVxaGMKKLG5ZCotuVRYqq1kSgqgA8DfJMg0JqO4\nIEChfbwWc3DQneaLa6393ZWdyDdxLxqvWWTzEOGbK8MFL3rqFW9IFg==\n-----END AGE ENCRYPTED FILE-----\n"
12 },
13 {
14 "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
15 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArV0RzdS9ZUFhqRDRqZFBJ\naUU2WnV3N0tkdDJIMCtzeUhlN283akVkd0FnClJWc0JPZk83K3RmOUxYZ2VHOWdV\ndXh1VVlvdW52WllMakJnK2dYNnY1TmMKLS0tIHVYWm14LzFWNnhPUm9IMnQwTHBN\nZkRYVkFhNEpLOXFYUDVDdHdmbG8yRFkKq8+CSq0ZxDHDU85SRLtZjss+91VG6bVY\nlj1bmGrvSd+hLqCXmHr6UfwYAr71Z+XhoJCj8GKGAXvA147QnEWgTQ==\n-----END AGE ENCRYPTED FILE-----\n"
16 }
17 ],
18 "lastmodified": "2025-02-18T18:18:41Z",
19 "mac": "ENC[AES256_GCM,data:UTEZfJkycq+nFG1xpshpDu+9ne13DG6fserHespXh7FFJ43rD7CI9azW0O5U88aVxkPEXe3yA27pldxto6AGGSx0o3fvz9CryN56qB6keZAWY78sQJLD8GoZtkNujgsvSa8F+haMJTznRfOtlJ4bMTmfuO9QSyzvwwgre+2hVrQ=,iv:ndAnqBqBxXE1MNDxuUxoSMOJSAxlB+8UXh2EH1gXZE8=,tag:F/opqs+Zm7tZUNf+APoPaQ==,type:str]",
20 "pgp": null,
21 "unencrypted_suffix": "_unencrypted",
22 "version": "3.9.4"
23 }
24} \ No newline at end of file
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index c77c9b82..d77337c6 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
1$ORIGIN yggdrasil.li. 1$ORIGIN yggdrasil.li.
2$TTL 3600 2$TTL 3600
3@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li ( 3@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
4 2025021300 ; serial 4 2025021800 ; serial
5 10800 ; refresh 5 10800 ; refresh
6 3600 ; retry 6 3600 ; retry
7 604800 ; expire 7 604800 ; expire
@@ -85,6 +85,14 @@ _acme-challenge.paperless IN NS ns.yggdrasil.li.
85 85
86paperless IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::" 86paperless IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
87 87
88firefly IN A 202.61.241.61
89firefly IN AAAA 2a03:4000:52:ada::
90firefly IN MX 0 surtr.yggdrasil.li
91firefly IN TXT "v=spf1 redirect=surtr.yggdrasil.li"
92_acme-challenge.firefly IN NS ns.yggdrasil.li.
93
94firefly IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
95
88vidhar IN AAAA 2a03:4000:52:ada:4:1:: 96vidhar IN AAAA 2a03:4000:52:ada:4:1::
89vidhar IN MX 0 ymir.yggdrasil.li 97vidhar IN MX 0 ymir.yggdrasil.li
90vidhar IN TXT "v=spf1 redirect=yggdrasil.li" 98vidhar IN TXT "v=spf1 redirect=yggdrasil.li"
diff --git a/hosts/surtr/firefly.nix b/hosts/surtr/firefly.nix
new file mode 100644
index 00000000..2d9641b0
--- /dev/null
+++ b/hosts/surtr/firefly.nix
@@ -0,0 +1,66 @@
1{ config, ... }:
2
3{
4 config = {
5 security.acme.rfc2136Domains = {
6 "firefly.yggdrasil.li" = {
7 restartUnits = ["nginx.service"];
8 };
9 };
10
11 services.nginx = {
12 upstreams."firefly" = {
13 servers = {
14 "[2a03:4000:52:ada:4:1::]:9000" = {};
15 };
16 extraConfig = ''
17 keepalive 8;
18 '';
19 };
20 virtualHosts = {
21 "firefly.yggdrasil.li" = {
22 kTLS = true;
23 http3 = true;
24 forceSSL = true;
25 sslCertificate = "/run/credentials/nginx.service/firefly.yggdrasil.li.pem";
26 sslCertificateKey = "/run/credentials/nginx.service/firefly.yggdrasil.li.key.pem";
27 sslTrustedCertificate = "/run/credentials/nginx.service/firefly.yggdrasil.li.chain.pem";
28 extraConfig = ''
29 charset utf-8;
30 '';
31
32 locations = {
33 "/".extraConfig = ''
34 proxy_pass http://firefly;
35
36 proxy_http_version 1.1;
37 proxy_set_header Upgrade $http_upgrade;
38 proxy_set_header Connection "upgrade";
39
40 proxy_redirect off;
41 proxy_set_header Host $host;
42 proxy_set_header X-Real-IP $remote_addr;
43 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
44 proxy_set_header X-Forwarded-Host $server_name;
45 proxy_set_header X-Forwarded-Proto $scheme;
46
47 client_max_body_size 0;
48 proxy_request_buffering off;
49 proxy_buffering off;
50 '';
51 };
52 };
53 };
54 };
55
56 systemd.services.nginx = {
57 serviceConfig = {
58 LoadCredential = [
59 "firefly.yggdrasil.li.key.pem:${config.security.acme.certs."firefly.yggdrasil.li".directory}/key.pem"
60 "firefly.yggdrasil.li.pem:${config.security.acme.certs."firefly.yggdrasil.li".directory}/fullchain.pem"
61 "firefly.yggdrasil.li.chain.pem:${config.security.acme.certs."firefly.yggdrasil.li".directory}/chain.pem"
62 ];
63 };
64 };
65 };
66}
diff --git a/hosts/surtr/tls/tsig_keys/firefly.yggdrasil.li b/hosts/surtr/tls/tsig_keys/firefly.yggdrasil.li
new file mode 100644
index 00000000..d03f25c1
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/firefly.yggdrasil.li
@@ -0,0 +1,24 @@
1{
2 "data": "ENC[AES256_GCM,data:zpfz2m+93X9kSbUeF8BVJtznD1jGT6yyybCW3PbSzzVLYRUNrKZkkoaCQoKA,iv:sXo1hDebOr1bGlkazvjc29RHuPHu8ihtKj4+EeKgeHU=,tag:nexS/rIUS79Ui63Tg4KFrw==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": [
9 {
10 "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
11 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0eElJT1A2dVNhRVRWaFRk\nelF6d2FJRzVEdGk3SzFYWUVSSWZ2blFZYWdvCkMrRnl1d0picFA0R2lpWFprSU84\nYVJDNy80MW9IUnk3YTB6bVNrcXJVMXMKLS0tIGxLN0pWQ0VUbXJrV1RGME9XKzdT\nckFObDg0UnA4amJuSEpHWE83ck1NVFkK1u5xi1utsa6vEXeF+PT4Fe2o2eAi8G+Z\nOZNQ5JcmGEZbqOdlf2VEkOAjzG1OZvAKF2RMCTtx9ABKiR7FThhRwg==\n-----END AGE ENCRYPTED FILE-----\n"
12 },
13 {
14 "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
15 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoU1g3M0VyWVE4QjN4KzFY\nVExjcE5qdExDMS9lT0VnTTQ4RGNSZGxKSWswCi9FWW83OUhIZEZIczhMV21iejVK\nNmVJa1IxMUs1bEIxOUZxbys0aU85Rm8KLS0tIGpxd2FzeVFJQ2JHOTgzWXJzYzVt\nOC9wSGRyeHVqSEhWSVJyU1V1WjhQVDAKUOQMKzwRJ9IYGCNa+KwgIMWzxGNE1wtX\n8yM1XYlEKAc38koZF8K6ZD9jK9pzZZXcHJMYOrwsBUw6+hOl4+Ezug==\n-----END AGE ENCRYPTED FILE-----\n"
16 }
17 ],
18 "lastmodified": "2025-02-18T18:18:42Z",
19 "mac": "ENC[AES256_GCM,data:L6xMl54Cq0HTDHpgzwwSyh1Kex2o78n+NT/iyGxxXj7ats3Vv/XIbtVIwS7ZHfoccyldl/kmeqdThTXEp5yT/FyhXDcfVrjrlZiHZ6j8xNH9Tp7gcVeHTrLXy/8JtrsvFRNmtF9rXXceaDSRTfQIY3sgyQF+JKTKeoO2HNo87CI=,iv:wBM1hwPMJJYH1NNtIAp9pfOro9wB2oI3g8fcJU/jkQY=,tag:dkLojSIuZnOGsGVHwHcAng==,type:str]",
20 "pgp": null,
21 "unencrypted_suffix": "_unencrypted",
22 "version": "3.9.4"
23 }
24} \ No newline at end of file
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-26 17:22:30 +0000