nixos/services/Legion.nix

104 lines
2.3 KiB
Nix
Raw Normal View History

{lib, ...}: let
# generate via openvpn --genkey --secret openvpn-laptop.key
client-key = "/root/openvpn.key";
domain = "vpn.xenia.me.uk";
vpn-dev = "tun0";
port = 1194;
in {
imports = [
./adguardhome
./gitea
./nextcloud
./sshd
./syncthing
./terraria/windy_limbo_of_melancholy.nix
./traefik/adguardhome.nix
./traefik/gitea.nix
./traefik/nextcloud.nix
./traefik/qbittorrent.nix
];
services.syncthing = let
user = "xenia";
dataDir = "/var/lib/syncthing";
in {
user = user;
group = "users";
dataDir = dataDir;
2023-07-24 13:30:39 +01:00
settings.folders = {
"Archive".path = lib.mkForce (dataDir + "/Archive");
"Books".path = lib.mkForce (dataDir + "/Books");
"Comics".path = lib.mkForce (dataDir + "/Comics");
"Documents".path = lib.mkForce (dataDir + "/Documents");
"Exports".path = lib.mkForce (dataDir + "/Exports");
"Notes".path = lib.mkForce (dataDir + "/Notes");
"Pictures".path = lib.mkForce (dataDir + "/Pictures");
"Tasks".path = lib.mkForce (dataDir + "/Tasks");
"Zotero".path = lib.mkForce (dataDir + "/Zotero");
};
};
networking = {
nat = {
enable = true;
externalInterface = "enp42s0";
internalInterfaces = [vpn-dev];
};
firewall = {
trustedInterfaces = [vpn-dev];
allowedUDPPorts = [port];
};
};
services.openvpn = {
restartAfterSleep = true;
servers.xenia.config = ''
dev ${vpn-dev}
proto udp
ifconfig 10.8.0.1 10.8.0.2
secret ${client-key}
port ${toString port}
cipher AES-256-CBC
auth-nocache
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
'';
};
environment.etc."openvpn/client.ovpn" = {
text = ''
dev tun
remote "${domain}"
ifconfig 10.8.0.2 10.8.0.1
port ${toString port}
redirect-gateway def1
cipher AES-256-CBC
auth-nocache
comp-lzo
keepalive 10 60
resolv-retry infinite
nobind
persist-key
persist-tun
secret [inline]
'';
mode = "600";
};
system.activationScripts.openvpn-addkey = ''
f="/etc/openvpn/client.ovpn"
if ! grep -q '<secret>' $f; then
echo "appending secret key"
echo "<secret>" >> $f
cat ${client-key} >> $f
echo "</secret>" >> $f
fi
'';
}