7b02477486
servo: define /etc/persist via sane impermanence module
2023-01-04 02:15:43 +00:00
a9ee26388c
guest account: make home-dir writable by other users
2023-01-04 01:09:23 +00:00
933063115b
moby: fix home-dirs for newer impermanence module
2023-01-04 00:47:48 +00:00
2d7b3750cd
impermanence: split the /home/colin perms fix into more appropriate places
2023-01-03 08:25:43 +00:00
5a2bbcce3b
move plaintext home-dirs out of home-manager module into users module
2023-01-03 07:35:42 +00:00
327e6b536f
impermanence: large refactor, and experimental bind mounting of things from ~/private
2023-01-03 07:22:37 +00:00
9e32211c12
impermanence: cange "encryptedClearOnBoot" to a broader "store" argument
...
in the future it can support ~/private as a backing store
2023-01-03 03:04:19 +00:00
be222c1d70
trust-dns: allow shorthand assignment of record lists
2023-01-02 13:23:52 +00:00
875e923197
declare ~/private in fileSystems and reuse for pamMount
2023-01-02 11:34:02 +00:00
3c726f148b
remove some stale references to mobile-nixos
2023-01-02 10:00:20 +00:00
5a273213f6
sops: remove sops.age.sshKeyPaths override: sops gets this from openssh config already
2022-12-30 03:49:31 +00:00
0a6d88dfc1
impermanence: simplify /etc/ssh/host_keys setup
2022-12-30 03:34:59 +00:00
50dfd482cf
document plans for better handling of /etc/ssh
2022-12-29 19:19:51 +00:00
9743aee79d
ssh keys: document the issues i'm seeing
2022-12-29 18:42:59 +00:00
aa1c1f40cb
WIP: impermanence rework (gut 3rd-party lib)
2022-12-29 16:38:58 +00:00
760f2ac66d
move ~/.cache into encrypted private dir
2022-12-29 01:17:40 +00:00
8e5ca11259
cleanup gocryptfs mounting
...
there's possibly some latent issues. i think my changes to the gocryptfs
package *might* not be necessary: if you work via the fuse front-door,
it's a lot harder to get it into these weird places.
2022-12-29 01:17:40 +00:00
121936620a
impermanence: add support for encrypted clear-on-boot storage
...
this is useful for when we need to store files to disk purely due to
their size, but don't actually want them to be persisted.
2022-12-29 01:17:40 +00:00
f5b49e014c
net: add parent's wifi
2022-12-29 00:57:36 +00:00
4bdb34775d
consolidate filesystems./ across devices
2022-12-28 01:36:22 +00:00
a0ac7fa98d
snippets: add secret snippets
2022-12-26 09:29:04 +00:00
b03043e513
add sane-bt-search script to search jackett/torrents
2022-12-26 09:05:26 +00:00
0713e3bad1
secrets: move bluetooth/vpn secret defn to toplevel nix file
2022-12-26 08:28:44 +00:00
d3a3f39756
move universal secrets out of net.nix -> secrets.nix
2022-12-26 08:09:58 +00:00
9b75d8705b
ejabberd: enable push notifications (verified working on iOS/Modal IM)
2022-12-22 14:12:15 +00:00
217ecec250
ejabberd: enable xmpps-{client,server} SRV records
2022-12-22 13:13:09 +00:00
1f99d44288
/home/colin: fix perms to 0700
2022-12-22 11:33:13 +00:00
0c35e2b3c1
servo: enable nsncd
2022-12-22 10:34:47 +00:00
c745612cfd
Merge branch 'master' of git.uninsane.org:colin/nix-files
2022-12-21 08:51:12 +00:00
278cc98c6d
minor ejabberd config changes, simplify DNS %NATIVE% updating
2022-12-21 08:50:41 +00:00
09c524a5b1
Merge remote-tracking branch 'origin/staging/nixpkgs-2022-12-18'
2022-12-21 07:47:55 +00:00
0db7f0857a
moby: reduce the number of configurations we keep in /boot
2022-12-21 06:33:50 +00:00
55e09c2dbf
ejabberd: port to dns-dns; add experimental STUN/TURN support
...
during startup it says:
```
Ignoring TLS-enabled STUN/TURN listener
```
and later
```
Invalid certificate in /var/lib/acme/uninsane.org/fullchain.pem: at line 61: certificate is signed by unknown CA
```
the invalid cert thing has always been here. it's for the root cert. idk
if i need to tell ejabberd that one's self-signed, or what.
2022-12-20 03:26:08 +00:00
d60e5264f3
don't bind-mount /etc/ssh/host_keys: symlink them instead
2022-12-20 00:04:09 +00:00
97044bf70e
trust-dns: port to dyn-dns for determining WAN IP
...
although the systemd wantedBy directive is working,
`before` seems to be ignored when the unit fails. so on first run,
dyn-dns runs, fails (poor net connectivity), then trust-dns starts
(fails), then they both restart 10s later.
it's not great, but good enough. also, wan IP is persisted, so this
likely won't happen much in practice.
2022-12-19 13:12:23 +00:00
0b2faef989
/etc/ssh/host_keys: fix endlessly stacked mounts
...
i believe this was mounting a new /etc/ssh/host_keys on every
activation, resulting in literally thousands of mounts and slowing down
later activations
2022-12-19 11:18:08 +00:00
8acd6ca4f1
create sane.services.dyn-dns
to manage dynamic DNS stuff
...
not yet integrated into servo
2022-12-19 11:16:30 +00:00
8169f7c6b2
ddns-trust-dns: use ddns from router rather than ipinfo.io
2022-12-19 08:24:11 +00:00
567c08460a
add sane-ip-check-router-wan to query WAN with a more trustworthy source
2022-12-19 05:59:44 +00:00
9b66aecf1b
trust-dns: port the remaining records to a structured format
...
SRV and MX _could_ have more structure (priority, etc).
not sure the best path there (option submodule, i guess).
2022-12-19 04:38:43 +00:00
16cb3b83a2
trust-dns: more idiomatic way to define SOA records
2022-12-19 04:00:27 +00:00
970438be8a
trust-dns: rename records
option -> extraConfig
...
i'll be adding special options for records
2022-12-19 03:12:32 +00:00
8a745a9b8a
ejabberd: enable STUN (with partial discovery support)
...
discovery is probably not working:
```
Won't auto-announce STUN/TURN service on port 3478 (udp) without public IP address, please specify 'turn_ipv4_address' and optionally 'turn_ipv6_address'
Won't auto-announce STUN/TURN service on port 3478 (tcp) without public IP address, please specify 'turn_ipv4_address' and optionally 'turn_ipv6_address'
```
no messages for the TLS implementation, so maybe that's working?
2022-12-19 01:22:20 +00:00
3505f3b9f3
ejabberd: provision cert for conference.xmpp.uninsane.org
...
i guess the cert already had that because of legacy prosody setup (?),
but we weren't setup so that new requests would work, i expect.
either that or all of these nginx entries aren't necessary?
2022-12-19 01:22:20 +00:00
444595e847
disable HE and afraid DDNS
2022-12-19 01:22:20 +00:00
22e46d52c2
trust-dns: distribute records across service files
2022-12-17 01:29:12 +00:00
1e0c213adf
split webconfig into each service file
2022-12-17 00:52:48 +00:00
3e1340ed61
enable i2p in firefox
2022-12-16 22:15:19 +00:00
a8a4b8e739
kiwix: serve the full english Wikipedia
2022-12-16 05:58:51 +00:00
2550601179
serve w.uninsane.org through kiwix-serve
2022-12-16 02:25:57 +00:00