Add manuela to Wireguard peers

This reverts commit 6d9a883361.

README.org

@@ -0,0 +1,17 @@
+* Unit
+
+Declarative configuration for the main server, using [[https://nixos.org][NixOS]]
+
+** Modules
+
+ The configuration is sliced into different files, per category:
+
+ - ZFS pool configuration: hardware-configuration.nix
+ - Network configuration: networking.nix
+ - Synchronization and backup services: datasync.nix
+ - Web services and reverse proxy: webstack.nix
+ - Smartd: monitoring.nix
+ - Systemd services and timers: periodic.nix
+ - Virtual machines: virtualization.nix
+
+ All the modules are imported in *configuration.nix*

configuration.nix

@@ -17,12 +17,15 @@
     timeout = 3;
   };
 
+  # Packages
+  environment.systemPackages = with pkgs; [ htop vim zip unzip ];
+
   # Run Nix garbage collector, while avoiding compiling
   nix = {
     autoOptimiseStore = true;
     gc = {
       automatic = true;
-      options = "--delete-older-than 7d";
+      options = "--delete-older-than 14d";
     };
     extraOptions = ''
       keep-outputs = true
@@ -37,9 +40,6 @@
   # Rotate logs after 14 days
   services.journald.extraConfig = "SystemMaxFiles=14";
 
-  # Allow propietary software and build packages with Pulseaudio support
-  nixpkgs.config.allowUnfree = true;
-
   # Scrub zpool monthly
   services.zfs.autoScrub = {
     enable = true;
@@ -48,12 +48,32 @@
 
   # Set timezone and synchronize NTP
   time.timeZone = "Europe/Brussels";
-  services.chrony.enable = true;
+  services.timesyncd.enable = true;
 
   # NixOS version
   system.stateVersion = "20.09";
 
-  # Create coolneng user
+  # Configure basic SSH access
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "yes";
+    macs = [
+      "hmac-sha2-512-etm@openssh.com"
+      "hmac-sha2-256-etm@openssh.com"
+      "umac-128-etm@openssh.com"
+      "hmac-sha2-512"
+      "hmac-sha2-256"
+      "umac-128@openssh.com"
+      "hmac-sha1"
+    ];
+    kexAlgorithms = [
+      "curve25519-sha256@libssh.org"
+      "diffie-hellman-group-exchange-sha256"
+      "diffie-hellman-group1-sha1"
+    ];
+  };
+
+  # Create coace user
   users.users.coace = {
     isNormalUser = true;
     home = "/home/coace";
@@ -61,6 +81,7 @@
     shell = pkgs.fish;
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAbHBpW1JgArO7XFr3mqMD8nCf3RjkHzso+mpNjR8iZi coolneng@panacea"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAstGGn6Ri+LtR6ffPrRgFcLF1fJFRIyz2WrbYMjQRNGdYyr/01TSmh0N2DLapDPhHAiKk7M5qHc9ltSZxWS4zQIkKAVWhyeGbvc/Yya/T8Yy04ltm2XZQEKx92dFhQMBUhDKc/Sp/JQy+jmvzWDL/bt7tmAOzXvVElEaeapvlhaihlwrH1EqTgV44x08MVlOcDJLSEJqCwj1OsD6zT1D58TCc/VawNh9DXJm7MK/1OhesziRFXKR9Wzr0zYcTjYe78ISpILZeilxFA08TQrua51kHIEL/BznXN+IRRIXrhDqQIWkdJTEMIC83//jbOoePvJ7sjrrS2VZwEOg0N+zt+Q== root@sica"
     ];
   };
 
@@ -83,6 +104,10 @@
     ./modules/hardware-configuration.nix
     ./modules/networking.nix
     ./modules/datasync.nix
+    ./modules/virtualization.nix
+    ./modules/monitoring.nix
+    ./modules/periodic.nix
+    ./modules/webstack.nix
   ];
 
 }

modules/datasync.nix

@@ -1,30 +1,72 @@
 { config, lib, pkgs, ... }:
 
 {
+  # Samba configuration
+  environment.systemPackages = with pkgs; [ samba ];
+
   services.samba = {
     enable = true;
-    securityType = "share";
     nsswins = true;
     extraConfig = ''
       workgroup = WORKGROUP
-      server string = samba
+      server string = unit
-      netbios name = samba
+      netbios name = unit
-      security = ${config.services.samba.securityType}
-      hosts allow = 192.168.1  localhost
-      hosts deny = 0.0.0.0/0
       guest account = nobody
       map to guest = bad user
+      load printers=no
+      smb encrypt = required
+      server min protocol = SMB2_10
+      client min protocol = SMB2
+      client max protocol = SMB3
+      ntlm auth = yes
     '';
     shares.public = {
-      # FIXME Change path accordingly
+      path = "/vault/samba/CSD";
-      sharepath = "/mnt/Shares/Public";
       browseable = "yes";
       "read only" = "no";
       "guest ok" = "yes";
       "create mask" = "0644";
       "directory mask" = "0755";
-      "force user" = "nobody";
+      "force user" = "coace";
-      "force group" = "nobody";
     };
   };
+
+  # ZFS automatic backup solution
+  services.znapzend = {
+    enable = true;
+    pure = true;
+    zetup."vault" = {
+      plan = "1h=>10min,1d=>1h,1w=>1d,1m=>1w,1y=>1m";
+      recursive = true;
+      destinations.backup = {
+        host = "10.0.1.4";
+        dataset = "shield/unit";
+        plan = "1w=>1d,1m=>1w,1y=>1m";
+      };
+    };
+  };
+
+  # Nextcloud configuration
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud21;
+    home = "/vault/nextcloud";
+    hostName = "coace.duckdns.org";
+    https = true;
+    autoUpdateApps = {
+      enable = true;
+      startAt = "Sun 05:00:00";
+    };
+    config = {
+      overwriteProtocol = "https";
+      dbtype = "pgsql";
+      dbuser = "nextcloud";
+      dbname = "nextcloud";
+      dbpassFile = "/var/keys/nextcloud";
+      adminpassFile = "/var/keys/nextcloud-admin";
+      adminuser = "admin";
+      defaultPhoneRegion = "ES";
+    };
+  };
+
 }

modules/hardware-configuration.nix

@@ -0,0 +1,110 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "system/stateful/root";
+      fsType = "zfs";
+    };
+
+  fileSystems."/nix" =
+    { device = "system/ephemeral/nix";
+      fsType = "zfs";
+    };
+
+  fileSystems."/tmp" =
+    { device = "system/ephemeral/tmp";
+      fsType = "zfs";
+    };
+
+  fileSystems."/home" =
+    { device = "system/stateful/home";
+      fsType = "zfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B314-22E9";
+      fsType = "vfat";
+    };
+
+  fileSystems."/vault" =
+    { device = "vault";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/VMs" =
+    { device = "vault/VMs";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/backups" =
+    { device = "vault/backups";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/nextcloud" =
+    { device = "vault/nextcloud";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/code" =
+    { device = "vault/code";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/backups/databases" =
+    { device = "vault/backups/databases";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/samba" =
+    { device = "vault/samba";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/backups/wordpress" =
+    { device = "vault/backups/wordpress";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/backups/frontend" =
+    { device = "vault/backups/frontend";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/backups/documents" =
+    { device = "vault/backups/documents";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/config" =
+    { device = "vault/config";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/VMs/legacy" =
+    { device = "vault/VMs/legacy";
+      fsType = "zfs";
+    };
+
+  fileSystems."/vault/frontend" =
+    { device = "vault/frontend";
+      fsType = "zfs";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/8262a243-b6aa-49e8-bf72-d2b85864d1c0"; }
+    ];
+
+}

modules/monitoring.nix

@@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Notify when a disk starts going haywire
+  services.smartd = {
+    enable = true;
+    autodetect = false;
+    devices = [ { device = "/dev/sda"; } { device = "/dev/sdb"; } ];
+    notifications.mail = {
+      enable = true;
+      recipient = "akasroua@gmail.com";
+    };
+  };
+
+  # Enable trivial MTA for smartd notifications
+  services.ssmtp = {
+    enable = true;
+    useTLS = true;
+    useSTARTTLS = true;
+    domain = "gmail.com";
+    hostName = "smtp.gmail.com:587";
+    authUser = "akasroua@gmail.com";
+    authPassFile = "/var/keys/ssmtp";
+  };
+}

modules/networking.nix

@@ -1,14 +1,18 @@
 { config, lib, pkgs, ... }:
 
-{
+let password = builtins.readFile /var/keys/ddclient;
+
+in {
   # Assign a static IP
   networking = {
+    hostName = "unit";
+    hostId = "737d82f4";
     interfaces.eth0 = {
       useDHCP = false;
-      addresses = {
+      ipv4.addresses = [{
         address = "10.0.1.3";
         prefixLength = 24;
-      };
+      }];
     };
     defaultGateway = {
       address = "10.0.1.1";
@@ -24,11 +28,18 @@
     nssmdns = true;
     publish = {
       enable = true;
-      userServices = true;
+      addresses = true;
       domain = true;
-      workstation = true;
     };
-    reflector = true;
+  };
+
+  # Dynamic DNS configuration
+  services.ddclient = {
+    enable = true;
+    quiet = true;
+    protocol = "duckdns";
+    domains = [ "coace.duckdns.org" ];
+    inherit password;
   };
 
   # Firewall configuration
@@ -36,39 +47,115 @@
     allowedTCPPorts = [
       445 # Samba
       139 # Samba
+      2222 # VM SSH
+      5000 # Sybase
+      80 # HTTP
+      443 # HTTPS
+      53 # DNS
     ];
     allowedUDPPorts = [
       137 # Samba
       138 # Samba
       1194 # Wireguard
+      53 # DNS
     ];
-    extraCommands = ''
+    allowPing = true;
-      iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-    '';
   };
 
-  # Enable NAT for wireguard
+  # Enable NAT for wireguard and forward ports to sica VM
   networking.nat = {
     enable = true;
     externalInterface = "eth0";
-    internalInterfaces = [ "wg0" ];
+    internalInterfaces = [ "wg0" "br0" ];
+    forwardPorts = [
+      {
+        destination = "192.168.122.100:22";
+        sourcePort = 2222;
+        loopbackIPs = [ "10.0.1.3" ];
+      }
+      {
+        destination = "192.168.122.100:5000";
+        sourcePort = 5000;
+        loopbackIPs = [ "10.0.1.3" ];
+      }
+    ];
   };
 
   # Wireguard setup
   networking.wireguard.interfaces = {
     wg0 = {
-      ips = [ "10.8.0.1/24" ];
+      ips = [ "10.9.0.1/24" ];
       listenPort = 1194;
-      privateKeyFile = "/home/coace/.wg/keys/privatekey";
+      privateKeyFile = "/home/coace/.wg/server/privatekey";
       peers = [
-        # Fernando
+        # panacea
         {
-          # Placeholder public key
           publicKey = "XMkTztU2Y8hw6Fu/2o4Gszij+EmNacvFMXuZyHS1n38=";
-          allowedIPs = [ "10.8.0.2/32" ];
+          allowedIPs = [ "10.9.0.2/32" ];
+        }
+        # caravanserai
+        {
+          publicKey = "4jiEKaPjNPU3JghfwLyArRhCKZmT8VYN07iw0SL/eHc=";
+          allowedIPs = [ "10.9.0.3/32" ];
+        }
+        # fernando
+        {
+          publicKey = "5DU9ipxJcut2wKrUr3yQux9crzXMSW4ZeKWFLRpUc1I=";
+          allowedIPs = [ "10.9.0.4/32" ];
+        }
+        # manuela
+        {
+          publicKey = "V+DaOya2hLuV6C9BeCkDyFqXpPAFq9jMAeg1dvQw/FI=";
+          allowedIPs = [ "10.9.0.5/32" ];
         }
       ];
     };
   };
 
+  # QEMU virtual bridge
+  networking.interfaces.br0 = {
+    ipv4.addresses = [{
+      address = "192.168.122.1";
+      prefixLength = 24;
+    }];
+  };
+  networking.bridges.br0.interfaces = [ ];
+
+  services.dhcpd4 = {
+    enable = true;
+    interfaces = [ "br0" ];
+    extraConfig = ''
+      option routers 192.168.122.1;
+      option broadcast-address 192.168.122.255;
+      option subnet-mask 255.255.255.0;
+      option domain-name-servers 1.1.1.1, 8.8.8.8;
+      default-lease-time -1;
+      max-lease-time -1;
+      subnet 192.168.122.0 netmask 255.255.255.0 {
+        range 192.168.122.100 192.168.122.200;
+      }
+    '';
+  };
+
+  # DNS server with adblock
+  services.dnsmasq = {
+    enable = true;
+    servers = [ "1.1.1.1" "8.8.8.8" ];
+    extraConfig = ''
+      domain-needed
+      bogus-priv
+      no-resolv
+
+      listen-address=127.0.0.1,10.0.1.3
+      bind-interfaces
+
+      cache-size=10000
+      local-ttl=300
+
+      conf-file=/var/lib/dnsmasq/dnsmasq.blacklist.txt
+
+      address=/coace.duckdns.org/10.0.1.3
+    '';
+  };
+
 }

modules/periodic.nix

@@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+let
+  stateDir = "/var/lib/dnsmasq";
+  blocklist = "${stateDir}/dnsmasq.blacklist.txt";
+
+in {
+  # Pull changes from git repos
+  systemd.user.services.git-pull = {
+    description = "Pull git repositories";
+    wantedBy = [ "default.target" ];
+    path = with pkgs; [ git ];
+    script = ''
+      base_folder=/vault/code
+      cd "$base_folder" || exit
+      ls | xargs -P10 -I{} git -C {} pull --rebase
+    '';
+    serviceConfig.Type = "oneshot";
+    startAt = "22:00:00";
+  };
+
+  # PostgreSQL daily backups
+  services.postgresqlBackup = {
+    enable = true;
+    backupAll = true;
+    location = "/vault/backups/databases/nextcloud";
+    startAt = "*-*-* 05:15:00";
+  };
+
+  # Fetch hosts-blocklists daily
+  systemd.services.download-dns-blocklist = {
+    description = "Download hosts-blocklists";
+    wantedBy = [ "default.target" ];
+    path = with pkgs; [ curl ];
+    script =
+      "curl -L https://github.com/notracking/hosts-blocklists/raw/master/dnsmasq/dnsmasq.blacklist.txt -o ${blocklist}";
+    serviceConfig.Type = "oneshot";
+    postStop = ''
+      chown -R dnsmasq ${stateDir}
+      systemctl restart dnsmasq
+    '';
+    startAt = "02:00:00";
+  };
+
+}

modules/virtualization.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Enable virtualisation
+  virtualisation.libvirtd = {
+    enable = true;
+    qemuRunAsRoot = false;
+    onBoot = "ignore";
+    onShutdown = "shutdown";
+    allowedBridges = [ "br0" ];
+  };
+
+  # Declarative configuration of the VMs
+  systemd.services.sica = {
+    description = "SICA database";
+    wantedBy = [ "default.target" ];
+    script = ''
+      disk=/vault/VMs/sica.qcow2
+      sock=/run/qemu-sica.mon.sock
+      ${pkgs.qemu}/bin/qemu-kvm -m 1G -nic bridge,br=br0,model=virtio --hda $disk -monitor unix:$sock,server,nowait -nographic
+    '';
+    preStop = ''
+      echo 'system_powerdown' | ${pkgs.socat}/bin/socat - UNIX-CONNECT:/run/qemu-sica.mon.sock
+      sleep 10
+    '';
+  };
+}

modules/webstack.nix

@@ -0,0 +1,71 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Reverse proxy configuration
+  services.nginx = {
+    enable = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    sslCiphers =
+      "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!AES128";
+    sslProtocols = "TLSv1.2 TLSv1.3";
+    sslDhparam = "/var/lib/dhparams/nginx.pem";
+    commonHttpConfig = ''
+      # Add HSTS header with preloading to HTTPS requests.
+      # Adding this header to HTTP requests is discouraged
+      map $scheme $hsts_header {
+          https   "max-age=31536000; includeSubdomains; preload";
+      }
+      add_header Strict-Transport-Security $hsts_header;
+
+      # Minimize information leaked to other domains
+      add_header 'Referrer-Policy' 'origin-when-cross-origin';
+
+      # Disable embedding as a frame
+      add_header X-Frame-Options DENY;
+
+      # Prevent injection of code in other mime types (XSS Attacks)
+      add_header X-Content-Type-Options nosniff;
+
+      # Enable XSS protection of the browser.
+      # May be unnecessary when CSP is configured properly (see above)
+      add_header X-XSS-Protection "1; mode=block";
+
+      # This might create errors
+      proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
+    '';
+    virtualHosts = {
+      "coace.duckdns.org" = {
+        enableACME = true;
+        forceSSL = true;
+      };
+    };
+  };
+
+  # ACME certs configuration
+  security.acme = {
+    acceptTerms = true;
+    email = "secretario@arquitectosdeceuta.com";
+    certs."coace.duckdns.org".webroot = "/var/lib/acme/acme-challenge";
+  };
+
+  # Generate dhparams
+  security.dhparams = {
+    enable = true;
+    params.nginx.bits = 2048;
+  };
+
+  # PostgreSQL databases configuration
+  services.postgresql = {
+    enable = true;
+    authentication = lib.mkForce ''
+      # Generated file; do not edit!
+      # TYPE  DATABASE        USER            ADDRESS                 METHOD
+      local   all             all                                     trust
+      host    all             all             127.0.0.1/32            trust
+      host    all             all             ::1/128                 trust
+    '';
+  };
+}

scripts/sybase-backup.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+sybase_service() {
+	/etc/init.d/sybase "$1"
+}
+
+perform_backup() {
+	zip -r BBDD_"$(date +"%d%m%Y")".zip /opt/sybase
+	scp -i /root/.ssh/unit BBDD_"$(date +"%d%m%Y")".zip coace@192.168.122.1:/vault/backups/databases/sica
+}
+
+cleanup() {
+	rm BBDD_"$(date +"%d%m%Y")".zip
+}
+
+sybase_service stop
+perform_backup
+sybase_service start
+cleanup