From c345f4e9371c8a998af6334028e93fc9d302c7d5 Mon Sep 17 00:00:00 2001 From: oddlama Date: Fri, 12 Apr 2024 20:28:27 +0200 Subject: [PATCH] feat: add temporary homepage --- hosts/nom/secrets/host.pub | 2 +- hosts/sentinel/default.nix | 20 +++++++++++++++++- modules/acme-wildcard.nix | 10 ++++++--- ...df8b59d91fcd91-initrd_host_ed25519_key.age | 9 -------- ...ef7af87d9e69ff21-my-gpg-pubkey-yubikey.age | Bin 0 -> 1639 bytes ...7fd06eb73e5636b3-my-gpg-pubkey-yubikey.age | Bin 1518 -> 0 bytes ...c2275747fb21c4-initrd_host_ed25519_key.age | Bin 0 -> 769 bytes 7 files changed, 27 insertions(+), 14 deletions(-) delete mode 100644 secrets/rekeyed/nom/1f37a986a31d7e4d88df8b59d91fcd91-initrd_host_ed25519_key.age create mode 100644 secrets/rekeyed/nom/69289feee2d5937fef7af87d9e69ff21-my-gpg-pubkey-yubikey.age delete mode 100644 secrets/rekeyed/nom/721d8d346921babf7fd06eb73e5636b3-my-gpg-pubkey-yubikey.age create mode 100644 secrets/rekeyed/nom/d1cb656317c735d7c4c2275747fb21c4-initrd_host_ed25519_key.age diff --git a/hosts/nom/secrets/host.pub b/hosts/nom/secrets/host.pub index 3019155..97a005f 100644 --- a/hosts/nom/secrets/host.pub +++ b/hosts/nom/secrets/host.pub @@ -1 +1 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOdYhY/DnXpizajoeLefH6gsc/RX9x3Y6T3C1a+0sb0 +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH64l5nh2ryG+1I2sXvfr7m8kTLP5N3CmnK12MHHKSfr diff --git a/hosts/sentinel/default.nix b/hosts/sentinel/default.nix index 0c62b50..4db9c22 100644 --- a/hosts/sentinel/default.nix +++ b/hosts/sentinel/default.nix @@ -1,4 +1,8 @@ -{config, ...}: { +{ + config, + pkgs, + ... +}: { imports = [ ../../modules/optional/hardware/hetzner-cloud.nix @@ -16,9 +20,23 @@ users.groups.acme.members = ["nginx"]; wireguard.proxy-sentinel.firewallRuleForAll.allowedTCPPorts = [80 443]; + services.nginx.enable = true; services.nginx.recommendedSetup = true; + services.nginx.virtualHosts.${config.repo.secrets.global.domains.me} = { + forceSSL = true; + useACMEWildcardHost = true; + locations."/".root = pkgs.runCommand "index.html" {} '' + mkdir -p $out + cat > $out/index.html < + Not empty soon TM. Until then please go here: oddlama + + EOF + ''; + }; + meta.promtail = { enable = true; proxy = "sentinel"; diff --git a/modules/acme-wildcard.nix b/modules/acme-wildcard.nix index 9652470..318bf28 100644 --- a/modules/acme-wildcard.nix +++ b/modules/acme-wildcard.nix @@ -6,6 +6,7 @@ inherit (lib) assertMsg + elem filter genAttrs hasInfix @@ -37,9 +38,12 @@ in { # If no such domain is found then an assertion is triggered. domain = submod.config._module.args.name; matchingCerts = - filter - (x: !hasInfix "." (removeSuffix ".${x}" domain)) - config.security.acme.wildcardDomains; + if elem domain config.security.acme.wildcardDomains + then [domain] + else + filter + (x: !hasInfix "." (removeSuffix ".${x}" domain)) + config.security.acme.wildcardDomains; in mkIf submod.config.useACMEWildcardHost { useACMEHost = assert assertMsg (matchingCerts != []) "No wildcard certificate was defined that matches ${domain}"; diff --git a/secrets/rekeyed/nom/1f37a986a31d7e4d88df8b59d91fcd91-initrd_host_ed25519_key.age b/secrets/rekeyed/nom/1f37a986a31d7e4d88df8b59d91fcd91-initrd_host_ed25519_key.age deleted file mode 100644 index 6ca7d9f..0000000 --- a/secrets/rekeyed/nom/1f37a986a31d7e4d88df8b59d91fcd91-initrd_host_ed25519_key.age +++ /dev/null @@ -1,9 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 grkLKQ wT/F1RZNRPv/nEpRO2K6uaaUgblmQ+Snl0l0oaQ8biQ -l2Spr1bBxZ780TqPyzLu8e+Bu/V7wHGVEOnht6obgm4 --> a-grease ajoj }}yuQ_]d ]\g' -WsHmUGNgl8O1jJaoW2mHzJtxngWIQWUngA0y/Q ---- yG/0WUD+R7eWZv+DNiH24Y8GW3FvYgHDftlFi8ngpdA -o)8!X?r%JنRq9_]jr;C?,vLF5Dx&.1/vN;H47\V>6L9! >:*U5b[h/nSo - '(i҈y5D.]IcJFY_-Z !L0V^3O)3Q.?wnJ|JF5G**6AC?YLqa%Ew2 zWgs+hFCZc{HzP|5SxiJ|SZHiTOLRw2I81tMNl|r2MQK<|S#U!yG&5{%S4nk4XKGX{ zb5}1hbT3wKSweL-S$AYeRxo00MObq*3OGo0Y&LLhSVuE9Yga^hX)iKKF*asmba7L5 zdU-TvXhk+dNNZIuP+?d|cvmn;K|wcHOF2nFQA9xsEiEk|bX74+F*aB+S4MX-cw~7t zWiMfRD??0Ia58N+F-16HOl3iHFIie}Q%+|JfFgzr%S(TY-$VIlwbGK;kF+B7T0n-nUh6$mq?(5Ggm@%*E-~2z2uj4JxQ_)=hQuf%g;GKN&hfFo$ z_d+~ea~^1JS#83GgJY1MUhAP6bis|0`r?`GI;v}V!`1#p-wL}1d?Ig%@_hwJ*+CY_iz;GN0Gn?$P)b0Y`)o?E0ou{GHZQCWrL| zaA^b;#pC&x7qb7f{`DiLUcL2R7@3dAU#5GbZ9{qRE>ck|yjFb)-O{6;%VuSzn@%YL zdKDY0QNrHXIJ;?>8DIvkmZw6iv??oGK1aX9>g*!--1D8ApB=2^L51C!cv9^5CGMFi zMkXj&l2^Bc=)1eHfsE-_Im5{~SzZf%qQ4Imr{AMmDiZfVlYfzba>RoT>F`g=h$9_A z=JyE?%$2jS9x~el0Xl3dGm=(LKDv|B2adzaheO?X#`_Q- zkh_NV^Q35Vqw03p_P1Z0Zobjc5*S}?PSeO};&$gi7XhY^-jgN3BSl1T-3rYa#zg&Z zmV-fdtQ4Cl^&YRNVW34Ppfkuz{x{Gm9C#45w_ND;OUo3<6d71ED&7U+W>M3sBQ!Lq z(pl;69%N5V{>tROQFpKo#jO1T-Uy!pjuJxWQ29G5Dswr{G3u#+L+pyuzkaB5*z-G> z39tahKqro86?o-Dt%<5_eQcuX5nBsUg1#Twpsd};a9~srgjGgz7u>IM`|;R^(5mzt zw6Lu^w^qI|5Mz2EG|94dZ0ry92KatA08+N8Mol)RbU_Tk?z_-36$vE5h z<4%tTmbk9bF|pa%y`qg@2}>xxpBL*Dn(gzAF+N}k`%-oDHfAbH5rPN528vgw@i zKRu#v;n|6){D+z`MmY*}$6h^B?h>9Eb9b4Wvo z2^ixxM;8ntQ2A~0jLTPQ&UG)OG-3sLpN0`Mso@+J|KN_c2G?%XL4m>b7df7 zQ7JbHRZ47hS9nlGQBevlEiE8uG+AsfLRDB)WH@>>D_1pmF>Etta!^T5RcKK~G(%BD zQF>ZMN^UuHZCMJbo2)d5z9UwnQ)wGjx^f+wtEUcwbrJ$BF(Uj@1}2AAYw?H}I^nxb zr2E(mu&2S_L87YyOFE|&3O%pt&sEGQLBH9vcZ9yi&%64;@x8a6lUs#N;*6^RS>Uw6 zc39`dbm4hx^^^d~IWsE|c^fcXwgo_^1+y7cz_YoVmlvUH)<|$dVeS?X;UyX~SJYp$ z_T-|SzEfi9XJdB4`&(+N92mT&rU+XL>BgkjQ0gY|XG8GVtcpY1K(&*A(*b=ao?rl5 zfmeL+CB$}zv?&PWAmbfj{8hNjJ))ZAhZlw%kytB-STUY6+)gR&klVgGq`UV~k&{eB z%s&S4exHWD+Iy_uCL&8G%jd7P-^>4h3=Uh6L^Kdrt5?0}Is@pEv(3dodjR&kRXjTp z`Fj;lVd@UFPvvq`bHZ|{CxSg+abdJn_UF80B&k{Ip_s7+E&IvU4#er`fz8`@{yv~C zgko}-5BkAH!@|7N-6-`TW`=RV?}Qw2Q*oHecnS`CWl?KZvK>%{=XqEaHM(M6ljUak ztk#59dL13r)`g``dG!C}dbF^+4u>Bi?!IT2oRrUD%E8ei;H!JLVz7TqCB=V#(_xki zRyh2iU=2uX7zTgxWC%IxMekAijbzn+f_M5bPiQGaFoWna`xf59fIPlnpjlWmEz+?!wql*qo@h+; zzr?`DKH)xdw2{jRgkPM)ukYZb}NU20Gdm_#28rNjj zl|t$TFjiaaeA~bsH234+X;swGjA_nAkgq4&)c zsm3C-#9)oKR57|0;Uv2}I35{`s{{aae26#dQFaZ2dbyL=?X`KD!@L>m>qZI;LVwJ@ zfOXuYU2i}#_EZ(xzgcOJzn=%kxMM?yk*lW9Hg}s!jz=ikOkfp5^MH^3T$ZZ5Z1BRn zz=Xi4eQ|W7*=+-+wRj=$LFpip!EDRvcPr>1T!b8j@rSp(h9Ola4Xlr49v4Tf)pz9$`q7qCB2qr zjty;S=0j$49I@;FLj0c@#N$Tza?N3CP$+#`pE+@TN!o8upNMG%ncW@?pa`JPDvE8W z*nKm5gS_Ruton#Rf1)+Fp1=XCwT)4pUory?i=1^qs+l`$o?F8!spVpf+JXxSiQid) U&~65ZZnk9I%2(Tt$$uW-Ivi=wa{vGU diff --git a/secrets/rekeyed/nom/d1cb656317c735d7c4c2275747fb21c4-initrd_host_ed25519_key.age b/secrets/rekeyed/nom/d1cb656317c735d7c4c2275747fb21c4-initrd_host_ed25519_key.age new file mode 100644 index 0000000000000000000000000000000000000000..32220c2f89329299cdcc408d5e5fbe9e7cb5301f GIT binary patch literal 769 zcmV+c1OEJBXJsvAZewzJaCB*JZZ2mRA*T)b53k(Z&6NiP-Zl3LsL*hGcXE8dNemqHb+!U zM0aLwW@~tKSz<^+Vo+;hR%AsnVNgp~W_VL%X-PL{ZAA(#J|Jf;XL4m>b7cxnK|yFj zXE`xwc~L?~W;Rt+F)=tsN@H?aPGm$WHO;SNgbWK=BMR7B1V{1uOD|k^jFg7b! zV@7URR7PcvnzwF;YV@3U^3B3N0-yAaXNnQDsqfb8m23Mm9@TWi>c9bXjII zHCbg?R7Gh@Xh?8tQ#EmLVrMu_3cnKvcsfIVPy=>fI{G|{4>LRnehkf~$p_PQL7kN6 zG;QsJegx{14;mg%Dz}548T~9&v`6d$yR9D1(T)DIzuUAF1Mvk|Sh_`v;*$cNkBk_| zT(0DsS9k38{3)89jARbsTd_m%cJg|jp94{BoZ|kHm3x6Qd_q{TU|!SG2#!&_)9NBv065O&$$jT9AP|$R#JKU*25}dpF2Wd0(c+jpqfm9i?hY5R_6}wz!`^r> zL(Nhh&kC3IIS=YLbuFJLw}59*^^3Mpo^KioLq{1oyNB>-8W)pD!