add nova

modules/server/caddy.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  options.services.caddy.authedHosts = lib.mkOption {
+    type = lib.types.attrsOf lib.types.lines;
+    default = [ ];
+  };
+
+  config = {
+    systemd.services.caddy.serviceConfig.Restart = lib.mkForce "always";
+    networking.firewall.allowedTCPPorts = [ 443 ];
+    services.caddy = {
+      enable = true;
+      email = "henry@henryhiles.com";
+      environmentFile = config.age.secrets."base64JwtSecret.age".path;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/ggicci/caddy-jwt@v1.1.0"
+          "pkg.jsn.cam/caddy-defender@v0.9.0"
+        ];
+        hash = "sha256-DO4jgD7UWva6z2/pQT+4RfBfKoBAAZVCgjXC/unYCQk=";
+      };
+
+      virtualHosts = lib.mapAttrs (domain: host: {
+        extraConfig =
+          let
+            auth = "https://auth.federated.nexus";
+          in
+          ''
+            handle_errors 401 {
+              redir https://federated.nexus/login?redirect_uri=${auth}/bridge?redirect_uri=https://${domain}{uri} 302
+            }
+
+            route {
+              jwtauth {
+                from_cookies id_token
+                sign_key {$JWK_SECRET}
+                issuer_whitelist ${auth}
+                audience_whitelist proxy
+              }
+
+              ${host}
+            }
+          '';
+      }) config.services.caddy.authedHosts;
+    };
+  };
+}

modules/server/continuwuity.nix

@@ -0,0 +1,47 @@
+{ config, lib, ... }:
+{
+  options.quad.matrix = {
+    enable = lib.mkEnableOption "matrix";
+
+    domain = lib.mkOption { type = lib.types.string; };
+    settings = lib.mkOption {
+      type = lib.types.submodule { };
+      default = { };
+    };
+  };
+
+  config = {
+    systemd.services.continuwuity.serviceConfig.Restart = lib.mkForce "always";
+    services =
+      let
+        subdomain = "matrix.${config.quad.matrix.domain}";
+        socket = "/var/run/continuwuity/continuwuity.sock";
+      in
+      {
+        matrix-continuwuity = {
+          enable = config.quad.matrix.enable;
+          group = "caddy";
+          settings.global = config.quad.matrix.settings // {
+            server_name = config.quad.matrix.domain;
+            unix_socket_path = socket;
+            new_user_displayname_suffix = "";
+            allow_public_room_directory_over_federation = true;
+            trusted_servers = [
+              "matrix.org"
+              "tchncs.de"
+              "maunium.net"
+            ];
+            ignore_messages_from_server_names = [ ];
+            url_preview_domain_explicit_allowlist = [ "*" ];
+
+            well_known = {
+              client = "https://${subdomain}";
+              server = "${subdomain}:443";
+            };
+          };
+        };
+
+        caddy.virtualHosts."${subdomain}".extraConfig = "reverse_proxy unix/${socket}";
+      };
+  };
+}

modules/server/disko.nix

@@ -1,35 +0,0 @@
-{ inputs, ... }:
-{
-  imports = [ inputs.disko.nixosModules.disko ];
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/sda";
-    content = {
-      type = "gpt";
-      partitions = {
-        boot = {
-          size = "1M";
-          type = "EF02"; # for grub MBR
-        };
-        ESP = {
-          size = "1G";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [ "umask=0077" ];
-          };
-        };
-        root = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
-          };
-        };
-      };
-    };
-  };
-}

modules/server/ssh.nix

@@ -1,16 +1,28 @@
-let
-  port = 2222;
-in
 {
-  networking.firewall.allowedTCPPorts = [ port ];
   users.users.quadradical.openssh.authorizedKeys.keys = import ../../secrets/keys.nix;
-  services.openssh = {
-    enable = true;
-    ports = [ port ];
-    settings = {
-      PasswordAuthentication = false;
-      AllowUsers = [ "quadradical" ];
-      PermitRootLogin = "no";
+  services = {
+    openssh = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        PasswordAuthentication = false;
+        AllowUsers = [ "quadradical" ];
+        PermitRootLogin = "no";
+      };
+    };
+
+    fail2ban = {
+      enable = true;
+      maxretry = 5;
+      ignoreIP = [ "192.168.0.0/16" ];
+      bantime = "6h";
+      bantime-increment = {
+        enable = true;
+        formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+        maxtime = "240h";
+        overalljails = true;
+      };
     };
   };
+
 }