From 821d99f17c9dd5660e5c450e4435616178ae4c73 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Fri, 14 Feb 2025 14:34:33 +0100 Subject: ... --- hosts/surtr/default.nix | 1 + hosts/surtr/dns/Gupfile | 2 +- hosts/surtr/dns/default.nix | 2 +- hosts/surtr/dns/key.gup | 2 +- hosts/surtr/dns/keys/paperless.yggdrasil.li_acme | 24 +++++++++ hosts/surtr/dns/zones/li.yggdrasil.soa | 10 +++- hosts/surtr/paperless.nix | 66 ++++++++++++++++++++++++ hosts/surtr/tls/tsig_key.gup | 2 +- hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li | 24 +++++++++ hosts/vidhar/default.nix | 2 +- hosts/vidhar/network/ruleset.nft | 4 ++ hosts/vidhar/paperless/default.nix | 25 +++++++++ hosts/vidhar/paperless/rootpw | 24 +++++++++ 13 files changed, 182 insertions(+), 6 deletions(-) create mode 100644 hosts/surtr/dns/keys/paperless.yggdrasil.li_acme create mode 100644 hosts/surtr/paperless.nix create mode 100644 hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li create mode 100644 hosts/vidhar/paperless/default.nix create mode 100644 hosts/vidhar/paperless/rootpw (limited to 'hosts') diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix index b8a639d5..1b33630a 100644 --- a/hosts/surtr/default.nix +++ b/hosts/surtr/default.nix @@ -7,6 +7,7 @@ with lib; tmpfs-root qemu-guest openssh rebuild-machines zfs ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix + ./paperless.nix ]; config = { diff --git a/hosts/surtr/dns/Gupfile b/hosts/surtr/dns/Gupfile index ac96f620..70674cce 100644 --- a/hosts/surtr/dns/Gupfile +++ b/hosts/surtr/dns/Gupfile @@ -1,2 +1,2 @@ key.gup: - keys/*.yaml \ No newline at end of file + keys/* \ No newline at end of file diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix index ee1d089d..64864272 100644 --- a/hosts/surtr/dns/default.nix +++ b/hosts/surtr/dns/default.nix @@ -157,7 +157,7 @@ in { ${concatMapStringsSep "\n" mkZone [ { domain = "yggdrasil.li"; addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; }; - acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li"]; + acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li"]; } { domain = "nights.email"; addACLs = { "nights.email" = ["ymir_acme_acl"]; }; diff --git a/hosts/surtr/dns/key.gup b/hosts/surtr/dns/key.gup index 32d4f7d6..5b5058b3 100644 --- a/hosts/surtr/dns/key.gup +++ b/hosts/surtr/dns/key.gup @@ -3,4 +3,4 @@ keyName=${${2:t}%.yaml}_key keymgr -t ${keyName} > $1 -sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary --output-type=binary -e -i $1 \ No newline at end of file +sops --input-type=binary --output-type=binary -e -i $1 diff --git a/hosts/surtr/dns/keys/paperless.yggdrasil.li_acme b/hosts/surtr/dns/keys/paperless.yggdrasil.li_acme new file mode 100644 index 00000000..bc4640db --- /dev/null +++ b/hosts/surtr/dns/keys/paperless.yggdrasil.li_acme @@ -0,0 +1,24 @@ +{ + "data": "ENC[AES256_GCM,data:wOl8KLHD0H+btq0A3UreyVF9bOXZsiTwWJkVH8GubyIQDyiDC8vQm+dfv0rz8TwcBWYpC4aMIPPflG2HsdYO4rKGQ/nBmWmxhNXjpnyRo8iKM1BGb5bxNe4eVcUVhI60NuRJDRLmtDp+0rYGT/MVYp0/mHBINsQCXWBPDoaN2PI2GSnRag/x0wcL27xgH6NDd8glcdCN5nCAPDvazA3LialkXXv7/cceA5Q/Ee6HGzPP0w212/UvBm07Z5tXnHiy5cTbAGTUBfIqC8n501jtaQhpMh/yzA1R8KwUrw==,iv:bLzsthCaanNikNS2Es4J1++E5lijEbjyW5hU4zzNBcg=,tag:eWfZ3AtcSAGv8jWXzqlAwQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNYWZKOHd2UmxWYVlIamk4\nZ04zQnAwcDdsSDBDWUZnekNva3BzRERyWXljCmNvUU1Fczc2aUN6VGl6NEJ6MGIx\nWHVpeVluWnRnbjNadGxkSmYyNE1rZzQKLS0tIGpkYVZQRDJGS21ZZHdlRk1MMm02\nQ09aanNXSWltNi9QeUNtUVQ2UEZybmMK6/qcNYLMcyKTmtROX+ZsRqDxMXwkXiAV\ndsdsWJ5+zSJuK5SEIh0fqEZ/t4pxnMcr1WieETgLSd+w0sNQS7EKPQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRjdJOHdjamRHVjlZOTNV\nbTBuam5vNERIWTB6T0JkR2pLUnlQN1BGbUJNClhrZ2hPRWZtT3BERFNwdmNEMmVu\nT0dxcjNkNGIvMVJQWENoUmRhTGd6SXcKLS0tIDV6WDd1bks4K1VuVkgybjdMd0w0\nMHBsT3FmOWU0WnJsM2diQm1sTU1ON2MKtf5HZ0S1cLMx98vDKRKamS7aHIJZ0OnA\nzH4VoeVm+PKsOeqVfY+gMHLdaMEWLKYsz3B8bxIoL5pvnCdT1QAN2A==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-02-13T19:23:42Z", + "mac": "ENC[AES256_GCM,data:o7zNTjkohzAouYpJUGqf8DUfYf4/g3GZgc+4cf+PjI0OF8uc1WDCPvliBFe6pf/8QMhV5DFWd2SfszWnpnQhtiIVG/2BEk5sw3P6r/SUbSErakFYHueVQKp+9rdxK6uKcHUYhO46E332AwIxTuvNeHtSBMxx0kAwQPuuD/u3L4A=,iv:aiM0sGyGMk5lfBOpB2bDFCY+UfWwyUNixieww6eOSLs=,tag:MI7xJ7RsyZgQfF1SBVVmcQ==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.4" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa index face42cf..c77c9b82 100644 --- a/hosts/surtr/dns/zones/li.yggdrasil.soa +++ b/hosts/surtr/dns/zones/li.yggdrasil.soa @@ -1,7 +1,7 @@ $ORIGIN yggdrasil.li. $TTL 3600 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li ( - 2025020900 ; serial + 2025021300 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -77,6 +77,14 @@ _acme-challenge.immich IN NS ns.yggdrasil.li. immich IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::" +paperless IN A 202.61.241.61 +paperless IN AAAA 2a03:4000:52:ada:: +paperless IN MX 0 surtr.yggdrasil.li +paperless IN TXT "v=spf1 redirect=surtr.yggdrasil.li" +_acme-challenge.paperless IN NS ns.yggdrasil.li. + +paperless IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::" + vidhar IN AAAA 2a03:4000:52:ada:4:1:: vidhar IN MX 0 ymir.yggdrasil.li vidhar IN TXT "v=spf1 redirect=yggdrasil.li" diff --git a/hosts/surtr/paperless.nix b/hosts/surtr/paperless.nix new file mode 100644 index 00000000..7bc4397c --- /dev/null +++ b/hosts/surtr/paperless.nix @@ -0,0 +1,66 @@ +{ config, ... }: + +{ + config = { + security.acme.rfc2136Domains = { + "paperless.yggdrasil.li" = { + restartUnits = ["nginx.service"]; + }; + }; + + services.nginx = { + upstreams."paperless" = { + servers = { + "[2a03:4000:52:ada:4:1::]:28981" = {}; + }; + extraConfig = '' + keepalive 8; + ''; + }; + virtualHosts = { + "paperless.yggdrasil.li" = { + kTLS = true; + http3 = true; + forceSSL = true; + sslCertificate = "/run/credentials/nginx.service/paperless.yggdrasil.li.pem"; + sslCertificateKey = "/run/credentials/nginx.service/paperless.yggdrasil.li.key.pem"; + sslTrustedCertificate = "/run/credentials/nginx.service/paperless.yggdrasil.li.chain.pem"; + extraConfig = '' + charset utf-8; + ''; + + locations = { + "/".extraConfig = '' + proxy_pass http://paperless; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_redirect off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Forwarded-Proto $scheme; + + client_max_body_size 0; + proxy_request_buffering off; + proxy_buffering off; + ''; + }; + }; + }; + }; + + systemd.services.nginx = { + serviceConfig = { + LoadCredential = [ + "paperless.yggdrasil.li.key.pem:${config.security.acme.certs."paperless.yggdrasil.li".directory}/key.pem" + "paperless.yggdrasil.li.pem:${config.security.acme.certs."paperless.yggdrasil.li".directory}/fullchain.pem" + "paperless.yggdrasil.li.chain.pem:${config.security.acme.certs."paperless.yggdrasil.li".directory}/chain.pem" + ]; + }; + }; + }; +} diff --git a/hosts/surtr/tls/tsig_key.gup b/hosts/surtr/tls/tsig_key.gup index 825479e5..46a3789e 100644 --- a/hosts/surtr/tls/tsig_key.gup +++ b/hosts/surtr/tls/tsig_key.gup @@ -3,4 +3,4 @@ keyFile=../dns/keys/${2:t}_acme gup -u $keyFile sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1 -sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1 +sops --input-type=binary -e -i $1 diff --git a/hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li b/hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li new file mode 100644 index 00000000..b1029931 --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li @@ -0,0 +1,24 @@ +{ + "data": "ENC[AES256_GCM,data:D9l0pklD2KDZ4/TXHtXg00MmCnjCVVBG0AK9j5OxxBCyYseCTckp2P/iPOng,iv:DjvuKWPr/jldfk0eZ5+jWHN0RurdruR4Md7AMAPzRQg=,tag:h0c4m3hpATzzb6a7DVmi9w==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S05aS0ZEcVU2T3BIOG13\nSDJLTUp4OG9ZYVluK2gxbUJDSFRaQ0xnS0YwClFkKzByanJGOWFwbTlISndyU0Rx\nN1FJb3FVaUZOVDBsWEdHTVNGaGNtMVkKLS0tIDI1RmxaMlhVd1FPL1dNdlRGK0Nq\nMFpJZTNnWncrbkV5YS82ZnhGRld0UG8KIuf7bC7GVxaGeR7gwC7kGu/wtBppjq4H\nyDT05CYJf9/EE3K5aJpIOlxyqowRs2SINvIVkyd5ggYkkxCctmGXjQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUV3ZqTVJkNWdHeTlKK3Vl\nVTdrdzE2Z3YzVmZxelNFMDNMTUJneHNtNzFRCmQxTU84ekV4bFVLajU0ajB6ZzZK\neEpuQTcyS1o4MW9xTU5nMXVUR0gxTmcKLS0tIGVzZC8xYTc1VkU2RzA2NFQ1K2xz\nLzhPVjBUcytWNGRsdnFob3A4aWljelkKFMlmigcEVzelcEiv6WGya1dsIOJYr7YT\naBHgMttV7zzYHLqvIVJSCz+uw2FqDyqN46twmzFC0HSHeiKbvRrHVw==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-02-13T19:23:42Z", + "mac": "ENC[AES256_GCM,data:0Fcgq0pOZtBBSiK8pUr/jadXMdtbZYFhUbSe+7DQpB8Fo2r8cEoT+Cpcy7tu+l9eXUiDk/tXTBJyMXaW4XWwS/Fe6Zcb95UYaYR1Y6OM9JVPYmwd6QSeC13MwzhYaCDlBiWWq69Zn8grEg7npWo/LS9LK7IEbN7EI8o7QYDI6cw=,iv:C+8ZmVTNWySQ+/6j+YirSwZzoMqXRlgstk47Efxmqps=,tag:Be/6Ve6M/Dcm/6QrbF+JTw==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.4" + } +} \ No newline at end of file diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix index b0797d8a..9660931d 100644 --- a/hosts/vidhar/default.nix +++ b/hosts/vidhar/default.nix @@ -4,7 +4,7 @@ with lib; { imports = with flake.nixosModules.systemProfiles; [ - ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix + ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless tmpfs-root zfs initrd-all-crypto-modules default-locale openssh rebuild-machines build-server diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft index 10fd4c51..3ead8fac 100644 --- a/hosts/vidhar/network/ruleset.nft +++ b/hosts/vidhar/network/ruleset.nft @@ -92,6 +92,7 @@ table inet filter { counter tftp-rx {} counter pgbackrest-rx {} counter immich-rx {} + counter paperless-rx {} counter established-rx {} @@ -121,6 +122,7 @@ table inet filter { counter tftp-tx {} counter pgbackrest-tx {} counter immich-tx {} + counter paperless-tx {} counter tx {} @@ -197,6 +199,7 @@ table inet filter { tcp dport 8432 counter name pgbackrest-rx accept iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept + iifname bifrost tcp dport 28981 ip6 saddr $bifrost_surtr counter name paperless-rx accept ct state { established, related } counter name established-rx accept @@ -246,6 +249,7 @@ table inet filter { tcp sport 8432 counter name pgbackrest-tx accept iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept + iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name paperless-tx accept counter name tx diff --git a/hosts/vidhar/paperless/default.nix b/hosts/vidhar/paperless/default.nix new file mode 100644 index 00000000..34cd18c4 --- /dev/null +++ b/hosts/vidhar/paperless/default.nix @@ -0,0 +1,25 @@ +{ config, ... }: + +{ + config = { + services.paperless = { + enable = true; + address = "[2a03:4000:52:ada:4:1::]"; + passwordFile = config.sops.secrets."paperless-rootpw".path; + settings = { + PAPERLESS_OCR_LANGUAGE = "deu+eng"; + PAPERLESS_URL = "https://paperless.yggdrasil.li"; + PAPERLESS_FILENAME_FORMAT = "{{ created_year }}/{{ document_type }}/{{ correspondent }}/{{ created }}_{{ doc_pk }}_{{ title }}"; + PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = "true"; + PAPERLESS_TASK_WORKERS = "3"; + PAPERLESS_THREADS_PER_WORKER = "4"; + }; + database.createLocally = true; + }; + + sops.secrets."paperless-rootpw" = { + format = "binary"; + sopsFile = ./rootpw; + }; + }; +} diff --git a/hosts/vidhar/paperless/rootpw b/hosts/vidhar/paperless/rootpw new file mode 100644 index 00000000..11f48fcb --- /dev/null +++ b/hosts/vidhar/paperless/rootpw @@ -0,0 +1,24 @@ +{ + "data": "ENC[AES256_GCM,data:Bsns3bLs7aA++eTf2Vh4g2iAXhmrMRTF,iv:zQ6hgXEvgHAloN6UMW54f2nYCvEhHPXQSBVSihHFiC0=,tag:uiGTEs07dpx12PcAjmbr9Q==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVUJjdEdIZGd6UDJBRXlL\nODFyWDhHOU9oTEVCVlFiUXVXNm9XZmVuampVCkJ0YkFXTlZXVnRldmtlVkJaR3R2\nMFhpaHB5M3pLeDFkUkkzMUFydGNnOFEKLS0tIEJtNWc0V2JaaWYvQlp6TGxVdVZO\neVpzQzB5Um82TUZOeHBHeE50MGlqNWsKj1P54Fc+c5n35+Og9DwBWkvW947hgFsp\ni/G2QcaLHHJMTexTCZYsr1naSVa/cMBAbrZmtjz0HV4Q1kCJtvlrIg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1UG1QSWtXcFZoQVRBOC9D\nT2VnTW9pcTRCMForcHdZVld0c1NmNFZpWUNBCkRkMERKUVliYXRqb25saWxyb2JN\nbC9YL2ZQbytRM0ZjNmlQOTlTZTQrV2sKLS0tIFZyUWtRcXNqZUZxMGN5d0tHUng2\nVXNSdFEwMmtIVEdVRVlWeVU1YmJVSkUKRJa42k551QtiC6S0tmMv7eVN7GRqpXWz\nvzNh+BM9TOJNaTMmVesr4vXNDLOSFS3PxYv95xuOBzVg3zOHuai72g==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-02-13T19:20:33Z", + "mac": "ENC[AES256_GCM,data:mG6AC3L8MMeZ0Ajr7zV1mzPcHviQw2adtGjSbrbPRw1xqN7siu6svoybv8xkahP2Grq/xKAiyfXFOFo7Uyc3ub5fSovAEolNazqybZYsyam5vHpeC23dXcEkZUJSPJ9/CSB5uI9nX3NPC64QUjCxHZ7qfH5gcXT9D12H8LSqKlQ=,iv:4Skdj8l9jlTX9Unc2xE2hCKVawHBnHR8L4kZA6H8xNw=,tag:zJsJ3S//faAn7AGwLefNoA==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.4" + } +} \ No newline at end of file -- cgit v1.2.3