initial commit

.gitignore

@@ -0,0 +1,2 @@
+secrets.nix
+/hosts/nio

common/common.nix

@@ -0,0 +1,63 @@
+{ config, pkgs, ... }:
+
+{
+   imports = [
+      ../modules
+   ];
+   
+   boot.cleanTmpDir = true;
+   networking.firewall.allowPing = true;
+   networking.useDHCP = false;
+
+   i18n.defaultLocale = "en_US.UTF-8";
+   console = {
+     font = "Lat2-Terminus16";
+     keyMap = "de-latin1-nodeadkeys";
+  };
+   time.timeZone = "Europe/Berlin";
+
+   system.autoUpgrade.enable = false;
+   system.autoUpgrade.allowReboot = false;
+   
+   networking.domain = "net.entr0py.de";
+   networking.nameservers = [ "2a02:2970:1002::18" "46.182.19.48" "2001:1608:10:25::9249:d69b" "84.200.70.40"  ];
+   networking.extraHosts =
+      ''
+        2001:638:904:ffcb::5 scotty-router
+      '';
+
+   # Define a user account. Don't forget to set a password with ‘passwd’.
+   users.users.garionion = {
+      isNormalUser = true;
+      hashedPassword = "$6$NMzXsfARs2HVA4iq$55uxWCANME/HsjIg9HmZyxqGwlr7RpJfCcMad2OhbmUiHhdnOh/v9TDwT3Vt0mu9HE37Fh3b1g2yyEa3Dxxg80";
+      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+      openssh.authorizedKeys.keys = ["ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGw3Yuee8oSXSEqmoMzrqQrUizKV9sJbJMxAUC01wxvbxevAqFEpiGrznnu3K0HN3sfKItjqGkNDPDQ+mIlQwdwJAE0GyJIx9CMvo1RPugKSJ5rFh/vEgJTNMPaeYUb/L2rn3WEZHrZI5wwf+z4ljSHCVetAnaMKjk/+QQWgBHdvNImmA== matze@darwin"];
+   };
+   users.users.root.openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGw3Yuee8oSXSEqmoMzrqQrUizKV9sJbJMxAUC01wxvbxevAqFEpiGrznnu3K0HN3sfKItjqGkNDPDQ+mIlQwdwJAE0GyJIx9CMvo1RPugKSJ5rFh/vEgJTNMPaeYUb/L2rn3WEZHrZI5wwf+z4ljSHCVetAnaMKjk/+QQWgBHdvNImmA== matze@darwin"
+   ];
+
+   environment.systemPackages = with pkgs; [
+      wget vim screen mtr iperf
+      htop dstat dnsutils nettools tcpdump
+      git zsh oh-my-zsh spaceship-prompt
+   ];
+
+   # Enable the OpenSSH daemon.
+   services.openssh = {
+   	enable = true;
+   	ports = [1022];
+   	passwordAuthentication = false;
+   };
+   
+   security.acme.acceptTerms = true;
+   security.acme.email = "letsencrypt@entr0py.de";
+
+   # This value determines the NixOS release from which the default
+   # settings for stateful data, like file locations and database versions
+   # on your system were taken. It‘s perfectly fine and recommended to leave
+   # this value at the release version of the first install of this system.
+   # Before changing this value read the documentation for this option
+   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+   system.stateVersion = "21.03"; # Did you read the comment?
+}

common/kvm.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  services.qemuGuest.enable = true;
+}

common/netdata.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        netdata
+    ];
+    networking.firewall.allowedTCPPorts = [ 19999 ];
+    services.netdata.enable = true;
+} 

common/nginx.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ...}:
+{
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    services.nginx = {
+        enable = true;
+        package = pkgs.nginxMainline;
+        enableReload = true;
+        proxyResolveWhileRunning = true;
+        resolver = {
+            addresses = [ "[2a02:2970:1002::18]" "46.182.19.48" "[2001:1608:10:25::9249:d69b]" "84.200.70.40"  ];
+        };
+        appendHttpConfig = ''
+            server {
+                listen 0.0.0.0:80 default;
+                listen [::]:80 default;
+                location /.well-known/acme-challenge { 
+                    proxy_pass http://$host$request_uri; 
+                }
+                location / {
+                    return 301 https://$host$request_uri;
+                }
+            }
+        '';
+        streamConfig = ''
+            resolver [2a02:2970:1002::18] 46.182.19.48 [2001:1608:10:25::9249:d69b] 84.200.70.40  ;
+            server {
+                listen      0.0.0.0:443;
+                listen      [::]:443;
+                proxy_pass  $ssl_preread_server_name:443;
+                ssl_preread on;
+            }
+        '';
+        
+    };
+}

deploy.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+DEPLOY_HOST=$1
+DEPLOY_ADDRESS=$2
+DEPLOY_PORT=$3
+
+if [ -z $DEPLOY_HOST ]; then
+  exit 1
+fi
+
+cmd=" \
+nixos-rebuild switch \
+  -I nixos-config=hosts/${DEPLOY_HOST}/configuration.nix \
+"
+
+if [ -z $DEPLOY_ADDRESS ] || [ $DEPLOY_ADDRESS = "-" ]; then
+  DEPLOY_ADDRESS="root@${DEPLOY_HOST}.net.entr0py.de"
+fi
+
+if [ $DEPLOY_ADDRESS != "localhost" ]; then
+  cmd="${cmd} \
+  --target-host ${DEPLOY_ADDRESS} \
+  "
+fi
+
+if [ -n "$DEPLOY_PORT" ]; then
+  cmd="NIX_SSHOPTS=\"-p $DEPLOY_PORT\" ${cmd}"
+fi
+
+eval ${cmd}

hosts/arion/configuration.nix

@@ -0,0 +1,37 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../common/common.nix
+      #./wireguard.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
+
+  networking.hostName = "arion"; 
+
+  networking.useDHCP = false;
+  networking.interfaces.ens4.useDHCP = true;
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "91.228.52.159";
+    prefixLength = 24;
+  } ];
+  networking.defaultGateway = "91.228.52.1";
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2001:67c:12a0:264::2";
+    prefixLength = 64;
+  }];
+  networking.defaultGateway6 = {
+    address = "2001:67c:12a0:264::1";
+    interface = "ens3";
+  };
+}

hosts/arion/hardware-configuration.nix

@@ -0,0 +1,22 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/9afe949f-2c87-4b20-bbd2-893e0028ae2c";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/11072752-a36e-4a02-aa9f-8ca206d5a954"; }
+    ];
+
+}

hosts/arion/wireguard.nix

@@ -0,0 +1,49 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+    
+    networking = {
+        firewall.allowedUDPPorts = [ 51820 52820];
+        firewall.trustedInterfaces = [ "wg0" "server"];
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            wg0 = {
+                ips = [ "fd33:ab07:f877:23::1/64"];
+                listenPort = 52820;
+                privateKeyFile = "/run/keys/wg-arion_priv";
+                allowedIPsAsRoutes = false;
+                postSetup = ''
+                    ip route add 2001:67c:12a0:8003::0/64 via fd33:ab07:f877:23:300::1 dev wg0
+                '';
+                peers = [{
+                    publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
+                    allowedIPs = [ "2001:67c:12a0:8003::0/64" "fd33:ab07:f877:23:300::1/72" ];
+                    endpoint = "usg.net.entr0py.de:52820";
+                    persistentKeepalive = 25;
+                }];
+            };
+            server = {
+                ips = [ "fd33:ab07:f877:2342::1/64"];
+                listenPort = 51820;
+                privateKeyFile = "/run/keys/wg-arion_priv";
+                allowedIPsAsRoutes = true;
+                postSetup = ''
+                    ip route add 2001:67c:12a0:264:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
+                '';
+                peers = [{
+                    publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
+                    allowedIPs = [ "2001:67c:12a0:264:200::0/72"  "fd33:ab07:f877:2342:200::1/72" ];
+                    endpoint = "scotty-router:52820";
+                    persistentKeepalive = 25;
+                }]; 
+            };
+        };
+    };
+}

hosts/dyon/configuration.nix

@@ -0,0 +1,41 @@
+{ ... }: {
+  imports = [
+    ./hardware-configuration.nix
+    ../../common/common.nix
+    ../../common/nginx.nix
+    ../../common/netdata.nix
+    ./wireguard.nix
+  ];
+
+  
+  networking.hostName = "dyon";  
+  
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "168.119.153.98";
+    prefixLength = 32;
+  }];
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc::1";
+    prefixLength = 64;
+  }];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
+  };
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+
+  clerie.monitoring = {
+    enable = true;
+    id = "201";
+    privKeyFile = "/run/keys/wg-dyon_priv";
+    pubkey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
+  };
+
+  clerie.nginx-port-forward = {
+    enable = true;
+    tcpPorts."2222" = {
+      host = "geon.net.entr0py.de";
+      port = 2222;
+    };
+  };
+}

hosts/dyon/hardware-configuration.nix

@@ -0,0 +1,6 @@
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/sda";
+  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+}

hosts/dyon/wireguard.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+    
+    networking = {
+        firewall.allowedUDPPorts = [ 51820 ];
+        firewall.trustedInterfaces = [ "server"];
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            server = {
+                ips = [ "fd33:ab07:ff00:2342::1/64"];
+                listenPort = 51820;
+                privateKeyFile = "/run/keys/wg-dyon_priv";
+                allowedIPsAsRoutes = false;
+                postSetup = ''
+                    ip route add 2a01:4f8:c010:61dc:200::0/72 via fd33:ab07:ff00:2342:200::1 dev server
+                '';
+                peers = [{
+                    publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
+                    allowedIPs = [ "2a01:4f8:c010:61dc:200::0/72"  "fd33:ab07:ff00:2342:200::1/72" ];
+                    endpoint = "scotty-router:52820";
+                    persistentKeepalive = 25;
+                }]; 
+            };
+            
+        };
+    };
+}

hosts/geon/configuration.nix

@@ -0,0 +1,40 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+        ./hardware-configuration.nix
+        ../../common/common.nix
+        ../../common/netdata.nix
+        ../../common/kvm.nix
+        ./gitea.nix
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "geon";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens18.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc:200::500:1";
+    prefixLength = 72;
+  }];
+
+  networking.defaultGateway6 = {
+    address = "2a01:4f8:c010:61dc:200::1";
+    interface = "ens18";
+  };
+
+  clerie.monitoring = {
+    enable = true;
+    id = "201";
+    privKeyFile = "/run/keys/wg-geon_priv";
+    pubkey = "WlVtrmfqZs6acvi185ovDn6NS2sZQkQNUf2oG0/QIx0=";
+  };
+}

hosts/geon/gitea.nix

@@ -0,0 +1,89 @@
+ { config, pkgs, lib, ... }:
+
+{
+  services.openssh.ports = [ 2222 ];
+  services.gitea = {
+    enable = true;
+    appName = "Git: entr0py.de";
+    database = {
+      createDatabase = false;
+      type = "postgres";
+      name = "gitea";
+      user = "gitea";
+      socket = "/run/postgresql";
+    };
+    cookieSecure = true;
+    disableRegistration = true;
+    rootUrl = "https://git.entr0py.de/";
+    domain = "git.entr0py.de";
+    httpAddress =  "127.0.0.1";
+    httpPort = 3000;
+    lfs.enable = true;
+    log.level = "Info";
+    ssh = {
+      enable = true;
+      clonePort = 2222;
+    };
+    settings = {
+      database = {
+        CHARSET = "utf8";
+      };
+      repository = {
+        ENABLE_PUSH_CREATE_USER = true;
+        ENABLE_PUSH_CREATE_ORG = true;
+        DEFAULT_PRIVATE = true;
+      };
+      server = {
+        OFFLINE_MODE = true;
+        LANDING_PAGE = "explore";
+      };
+      mailer = {
+        enabled = false;
+      };
+      service = {
+        REGISTER_EMAIL_CONFIRM = false;
+        ENABLE_NOTIFY_MAIL = false;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = false;
+        ENABLE_CAPTCHA = false;
+        REQUIRE_SIGNIN_VIEW = false;
+        DEFAULT_KEEP_EMAIL_PRIVATE = true;
+        DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
+        DEFAULT_ENABLE_TIMETRACKING = false;
+      };
+      picture = {
+        DISABLE_GRAVATAR = true;
+        ENABLE_FEDERATED_AVATAR = false;
+      };
+      openid = {
+        ENABLE_OPENID_SIGNIN = false;
+        ENABLE_OPENID_SIGNUP = false;
+      };
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_12;
+    ensureDatabases = [ "gitea" ];
+    ensureUsers = [
+      {
+        name = "gitea";
+        ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  services.nginx = {
+    enable = true;                                          # Enable Nginx
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."git.entr0py.de" = {                  # Gitea hostname
+      enableACME = true;                                    # Use ACME certs
+      forceSSL = true;                                      # Force SSL
+      locations."/".proxyPass = "http://localhost:3000/";   # Proxy Gitea
+    };
+  };
+}

hosts/geon/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/e46b795c-491c-4559-93e9-09477b6b4c81";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B6EC-6AEE";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/3a94c2d1-c565-4bf5-ab1f-8db82fa069d7"; }
+    ];
+
+}

hosts/kaon/configuration.nix

@@ -0,0 +1,33 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+        ./hardware-configuration.nix
+        ../../common/common.nix
+        ../../common/netdata.nix
+        ../../common/kvm.nix
+        ./monitoring.nix
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "kaon";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens18.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc:200::42:1";
+    prefixLength = 72;
+  }];
+
+  networking.defaultGateway6 = {
+    address = "2a01:4f8:c010:61dc:200::1";
+    interface = "ens18";
+  };
+}

hosts/kaon/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f48111ec-6b98-47f6-a8c6-4a447a78a2e0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B6B1-63E8";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/d6bcd29a-401b-4e84-9328-f03fc589e652"; }
+    ];
+
+}

hosts/kaon/monitoring.nix

@@ -0,0 +1,147 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  hosts = (import ../../lib/hosts.nix { inherit pkgs; }).hosts;
+
+  monitoringHosts = filterAttrs (name: host:
+    attrByPath ["clerie" "monitoring" "enable"] false host.config)
+    hosts;
+
+  monitoringHostsNames = mapAttrs' (name: host:
+    nameValuePair "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}"  ["${host.config.networking.hostName}.mon.entr0py.de"])
+    monitoringHosts;
+
+  monitoringPeers = mapAttrsToList (name: host: {
+      allowedIPs = [ "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}/128" ];
+      publicKey = host.config.clerie.monitoring.pubkey;
+    })
+    monitoringHosts;
+
+  monitoringTargets = mapAttrsToList (name: host:
+    "${host.config.networking.hostName}.mon.entr0py.de:9100")
+    monitoringHosts;
+
+in {
+
+  networking.hosts = {
+    "fd00:23:23:23::1" = [ "monitoring-1.mon.entr0py.de" ];
+  }
+  // monitoringHostsNames;
+
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces = {
+    wg-monitoring = {
+      ips = [ "fd00:23:23:23::1/64" ];
+      listenPort = 51820;
+      peers = monitoringPeers;
+      privateKeyFile = "/run/keys/wg-mon_priv";
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg-monitoring.listenPort ];
+
+  services.prometheus.exporters.node.enable = true;
+
+  services.prometheus = {
+    enable = true;
+    listenAddress = "[::1]";
+    scrapeConfigs = [
+      {
+        job_name = "prometheus";
+        scrape_interval = "20s";
+        scheme = "http";
+        static_configs = [
+          {
+            targets = [
+              "monitoring-1.mon.entr0py.de:9090"
+            ];
+          }
+        ];
+      }
+      {
+        job_name = "node-exporter";
+        scrape_interval = "60s";
+        static_configs = [
+          {
+            targets = [
+              "monitoring-1.mon.entr0py.de:9100"
+            ]
+            ++ monitoringTargets;
+          }
+        ];
+      }
+    ];
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_12;
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [
+      {
+        name = "grafana";
+        ensurePermissions."DATABASE grafana" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+  services.grafana = {
+    enable  = true;
+    domain  = "grafana.monitoring.entr0py.de";
+    rootUrl = "https://grafana.monitoring.entr0py.de";
+    port    = 3001;
+    addr = "::1";
+
+    database = {
+      type = "postgres";
+      name = "grafana";
+      user = "grafana";
+      host = "/run/postgresql";
+    };
+
+    auth.anonymous.enable = true;
+    security = {
+      adminUser = "garionion";
+      adminPasswordFile = "/run/keys/grafana-admin";
+    };
+
+    provision = {
+      enable = true;
+      datasources = [
+        {
+          type = "prometheus";
+          name = "Prometheus";
+          url = "http://[::1]:9090";
+          isDefault = true;
+        }
+      ];
+      dashboards = [
+        {
+          options.path = ./dashboards;
+        }
+      ];
+    };
+  };
+  systemd.services.grafana.after = ["postgresql.service"];
+
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+      "prometheus.monitoring.entr0py.de" = {
+        enableACME = true;
+        forceSSL   = true;
+        locations."/".proxyPass = "http://[::1]:9090/";
+      };
+      "grafana.monitoring.entr0py.de" = {
+        enableACME = true;
+        forceSSL   = true;
+        locations."/".proxyPass = "http://[::1]:${toString config.services.grafana.port}/";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

hosts/pion/configuration.nix

@@ -0,0 +1,48 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../common/common.nix
+      ../../common/nginx.nix
+      ../../common/netdata.nix
+      ../../common/kvm.nix
+      ./wireguard.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  networking.hostName = "pion";   
+ 
+  networking.useDHCP = false;
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "45.9.62.100";
+    prefixLength = 22;
+  } ];
+  networking.defaultGateway = "45.9.60.1";
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2a03:4000:45:5f3::1";
+    prefixLength = 64;
+  }{
+    address = "2a03:4000:45:5f3:a817:42ff:fe13:3d86";
+    prefixLength = 64;
+  }
+  ];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
+  };
+
+
+  services.ndppd = {
+    enable = true;
+    proxies = {
+      ens3.rules."2a03:4000:45:5f3:200::0/72".method = "static";
+      ens3.rules."2a03:4000:45:5f3:500::3/128".method = "static";
+    };
+  };
+}

hosts/pion/hardware-configuration.nix

@@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/fc6e5fc5-1c29-40fb-a769-58ff65cae9fa";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/473f0ace-f538-4011-9319-99791d032862"; }
+    ];
+
+}

hosts/pion/wireguard.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+    
+    networking = {
+        firewall.allowedUDPPorts = [ 51820 52820 53820];
+        firewall.trustedInterfaces = [ "wg0" "server"];
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            wg0 = {
+                ips = [ "fd33:ab07:f877:23::1/64"];
+                listenPort = 52820;
+                privateKeyFile = "/run/keys/wg-pion_priv";
+                allowedIPsAsRoutes = false;
+                postSetup = ''
+                    ip route add 2a03:4000:20:18e::/64 via fd33:ab07:f877:23:300::1 dev wg0
+                '';
+                peers = [{
+                    publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
+                    allowedIPs = [ "2a03:4000:20:18e::/64" "fd33:ab07:f877:23:300::1/72" ];
+                    endpoint = "usg.net.entr0py.de:52820";
+                    persistentKeepalive = 25;
+                }];
+            };
+            /*server = {
+                ips = [ "fd33:ab07:f877:2342::1/64"];
+                listenPort = 51820;
+                privateKeyFile = "/run/keys/wg-pion_priv";
+                allowedIPsAsRoutes = true;
+                postSetup = ''
+                    ip route add 2a03:4000:45:5f3:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
+                '';
+                peers = [{
+                    publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
+                    allowedIPs = [ "2a03:4000:45:5f3:200::0/72"  "fd33:ab07:f877:2342:200::1/72" ];
+                    endpoint = "scotty-router:52820";
+                    persistentKeepalive = 25;
+                }]; 
+            };*/
+            vpn = {
+                ips = [ "fd33:ab07:f877:2342::3/64"];
+                listenPort = 53820;
+                privateKeyFile = "/run/keys/wg-pion_priv";
+                allowedIPsAsRoutes = true;
+                peers = [{
+                    publicKey = "7mmKxFeI/TYDqy4pLDkZyq32viNfon1zODFdOdbnhyM=";
+                    allowedIPs = [ "2a03:4000:45:5f3:500::3/128" ];
+                    persistentKeepalive = 25;
+                }]; 
+            };
+        };
+    };
+}

hosts/scotty-router/configuration.nix

@@ -0,0 +1,64 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../common/common.nix
+      ./nat.nix
+      ./dnsmasq.nix
+      ./wireguard.nix
+      ../../common/netdata.nix
+      ../../common/kvm.nix
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  
+  networking.hostName = "router";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens18.ipv6.addresses = [{
+    address = "2001:638:904:ffcb::5";
+    prefixLength = 64;
+  }];
+  networking.interfaces.ens19.ipv4.addresses = [ {
+    address = "10.23.42.1";
+    prefixLength = 24;
+  }];
+  networking.interfaces.ens19.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc:200::1";
+    prefixLength = 72;
+  }];
+
+  networking.defaultGateway6 = {
+    address = "fe80::d067:2680:4649:fba6";
+    interface = "ens18";
+  };
+
+  services.radvd = {
+    enable = true;
+    config = ''
+      interface ens19
+      {
+        AdvSendAdvert on;
+        AdvDefaultLifetime 1800;
+        prefix 2a01:4f8:c010:61dc:200::/72 {};
+        AdvSourceLLAddress on;
+        route ::/0 {};
+      };
+    '';
+  };
+
+  /*services.ndppd = {
+    enable = true;
+    proxies."pub0" = {
+      interface = "pub0";
+      rules."2a03:4000:45:5f3:200::/72" = {
+        method = "iface";
+        interface = "ens19";
+      };
+    };
+  };*/
+
+}

hosts/scotty-router/dnsmasq.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, ...}:
+
+{
+    networking.firewall.allowedTCPPorts = [ 53 ];
+    networking.firewall.allowedUDPPorts = [ 67 ];
+    services.dnsmasq = {
+        enable = true;
+        resolveLocalQueries = true;
+        servers = [ "141.24.40.3" "141.24.40.4" ];
+        extraConfig = ''
+            domain-needed
+            bogus-priv
+            interface=ens19
+            expand-hosts
+            domain=gari
+            dhcp-range=10.23.42.50,10.23.42.200,12h
+            dhcp-option=3,10.23.42.1
+            dhcp-lease-max=150
+            dhcp-rapid-commit
+            listen-address=127.0.0.1
+            listen-address=10.23.42.1
+        '';
+    };
+} 

hosts/scotty-router/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/afd88905-a070-4032-a1a2-9c2b9c289220";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/2CFD-B740";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/f500aa6c-0971-429a-a651-1d7fed0d8101"; }
+    ];
+
+}

hosts/scotty-router/nat.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ...}:
+
+{
+  networking.nat = {
+    enable = true;
+    extraCommands = "iptables -A INPUT -p icmp -j ACCEPT";
+    externalInterface = "ens18";
+    internalInterfaces = [ "ens19" ];
+  };
+}

hosts/scotty-router/wireguard.nix

@@ -0,0 +1,40 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+
+    networking = {
+        firewall.allowedUDPPorts = [ 51820  52820];
+        firewall.trustedInterfaces = [ "wg0" "pub0" "ens19"];
+        
+        iproute2.enable = true;
+        iproute2.rttablesExtraConfig = ''
+        100 PUBLIC6
+        '';
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            pub0 = {
+                ips = [ "fd33:ab07:ff00:2342:200::1/64" ];
+                privateKeyFile = "/run/keys/wg-scotty-router_priv";
+                listenPort = 52820;
+                allowedIPsAsRoutes = true;
+                postSetup = ''
+                    ip -6 rule add from 2a01:4f8:c010:61dc:200::0/72 lookup PUBLIC6
+                    ip -6 route add default via fd33:ab07:ff00:2342::1 dev pub0 table PUBLIC6
+                '';
+                #ip -6 route add fd33:ab07:f877:2342::1/64 dev pub0 table PUBLIC6
+                peers = [{
+                    publicKey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
+                    allowedIPs = [ "::/0"  ];
+                    endpoint = "dyon.net.entr0py.de:51820";
+                    persistentKeepalive = 25;
+                }];
+            };
+        };
+    };
+}

hosts/tailpipe/configuration.nix

@@ -0,0 +1,25 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../common/common.nix
+  ];
+
+  boot.cleanTmpDir = true;
+  networking.hostName = "tailpipe";
+  
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "188.34.155.206";
+    prefixLength = 32;
+  }];
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2a01:4f8:c010:460a::1";
+    prefixLength = 64;
+  }];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
+  };
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+
+}

hosts/tailpipe/hardware-configuration.nix

@@ -0,0 +1,6 @@
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/sda";
+  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+}

lib/hosts.nix

@@ -0,0 +1,26 @@
+{ pkgs ? import ../pkgs {} }:
+
+with pkgs.lib;
+
+rec {
+  hostsDir = ../hosts;
+
+  hostNames = attrNames (
+    filterAttrs (
+      name: type: type == "directory"
+    ) (
+      builtins.readDir hostsDir
+    )
+  );
+
+  hosts = listToAttrs (
+    map (
+      hostName: nameValuePair hostName (
+        import (pkgs.path + "/nixos") {
+          configuration = import (hostsDir + "/${hostName}/configuration.nix");
+          system = "x86_64-linux";
+        }
+      )
+    ) hostNames
+  );
+}

modules/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  imports = [
+    ./gre-tunnel
+    ./nginx-port-forward
+    ./monitoring
+  ];
+}

modules/gre-tunnel/default.nix

@@ -0,0 +1,89 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.clerie.gre-tunnel;
+
+  generateInterfaceUnit = isIPv6: (name: tunnel:
+    nameValuePair "gre-tunnel-${name}" {
+        description = "GRE Tunnel - ${name}";
+        requires = [ "network-online.target" ];
+        after = [ "network.target" "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        environment.DEVICE = name;
+        path = with pkgs; [ iproute ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+
+        script = ''
+          ${tunnel.preSetup}
+          ip${optionalString isIPv6 " -6"} tunnel add ${name} mode ${optionalString isIPv6 "ip6"}gre remote ${tunnel.remote} local ${tunnel.local}
+          ip link set ${name} up
+          ip${optionalString isIPv6 " -6"} a add ${tunnel.address} dev ${name}
+          ${tunnel.postSetup}
+        '';
+
+        postStop = ''
+          ip link set ${name} down
+          ip tunnel del ${name}
+          ${tunnel.postShutdown}
+        '';
+      });
+
+  checkOpts = { config, ... }@moduleAttrs: {
+    options = {
+      remote = mkOption {
+        type = types.str;
+        description = "Address of reciever.";
+      };
+      local = mkOption {
+        type = types.str;
+        description = "Address our packets originate from.";
+      };
+      address = mkOption {
+        type = types.str;
+        description = "Our address in this tunnel.";
+      };
+      preSetup = mkOption {
+        type = types.str;
+        default = "";
+        description = "Commands called at the start of the interface setup.";
+      };
+      postSetup = mkOption {
+        type = types.str;
+        default = "";
+        description = "Commands called at the end of the interface setup.";
+      };
+      postShutdown = mkOption {
+        type = types.str;
+        default = "";
+        description = "Commands called after shutting down the interface.";
+      };
+    };
+  };
+
+in {
+  options = {
+    clerie.gre-tunnel = {
+      enable = mkEnableOption "Declarative Policy-Routing";
+      ipv6 = mkOption {
+        type = with types; attrsOf (submodule checkOpts);
+        default = {};
+      };
+      ipv4 = mkOption {
+        type = with types; attrsOf (submodule checkOpts);
+        default = {};
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services =
+    (mapAttrs' (generateInterfaceUnit false) cfg.ipv4)
+    // (mapAttrs' (generateInterfaceUnit true) cfg.ipv6);
+  };
+}

modules/monitoring/default.nix

@@ -0,0 +1,77 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.clerie.monitoring;
+
+  monitoringServer = "kaon.net.entr0py.de";
+  networkBase = "fd00:23:23:23::";
+  serverPubKey = "iHrvJyvIWnsAc2FuXBy1ATuj2hy1jek0C9MqFcisH0k=";
+
+in
+
+{
+  options = {
+    clerie.monitoring = {
+      enable = mkEnableOption "clerie's Monitoring (with tweaks)";
+      networkBase = mkOption {
+          type = types.str;
+          default = networkBase;
+      };
+      server = mkOption {
+          type = types.str;
+          default = monitoringServer;
+      };
+      serverPort = mkOption {
+          type = types.int;
+          default = 51820;
+      };
+      id = mkOption {
+        type = types.str;
+        description = "ID of the Monitoring Interface (it is actually a part of an ip address)";
+      };
+      serverPublicKey = mkOption {
+          type = types.str;
+          default = serverPubKey;
+      };
+      pubkey = mkOption {
+        type = types.str;
+        description = "Public Key of the monitoring wireguard interface of this host";
+      };
+      privKeyFile = mkOption {
+          type = types.str;
+          example = "/run/keys/keyfile";
+      };
+    };
+  };
+  
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+    networking.wireguard.enable = true;
+    networking.wireguard.interfaces = {
+      wg-monitoring = {
+        ips = [ "${cfg.networkBase}${cfg.id}/64" ];
+        peers = [
+          {
+            endpoint = "${cfg.server}:${toString cfg.serverPort}";
+            persistentKeepalive = 25;
+            allowedIPs = [ "${cfg.networkBase}/64" ];
+            publicKey = "${cfg.serverPublicKey}";
+          }
+        ];
+        privateKeyFile = "${cfg.privKeyFile}";
+      };
+    };
+
+    services.prometheus.exporters.node = {
+      enable = true;
+      #listenAddress = "${monitoring-network-base}${cfg.id}";
+      openFirewall = true;
+      firewallFilter = "-i wg-monitoring -p tcp -m tcp --dport 9100";
+    };
+  };
+}

modules/nginx-port-forward/default.nix

@@ -0,0 +1,66 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.clerie.nginx-port-forward;
+  certs = config.security.acme.certs;
+  sslDhparam = config.services.nginx.sslDhparam;
+
+  mkServerBlock = isUDP: port: forward: ''
+    server {
+      listen ${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
+      listen [::]:${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
+      ${ optionalString (forward.certName != null) ''
+        ssl_certificate ${certs.${forward.certName}.directory}/fullchain.pem;
+        ssl_certificate_key ${certs.${forward.certName}.directory}/key.pem;
+        ${ optionalString (sslDhparam != null) "ssl_dhparam ${sslDhparam};" }
+      '' }
+      proxy_pass ${forward.host}:${toString forward.port};
+    }
+  '';
+
+  portForwardConf = ''
+      ${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock false) cfg.tcpPorts) }
+      ${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock true) cfg.udpPorts) }
+  '';
+
+  portOpts = { config, ... }@moduleAttrs: {
+    options = {
+      host = mkOption {
+        type = types.str;
+      };
+      port = mkOption {
+        type = types.int;
+      };
+      certName = mkOption {
+        type = with types; nullOr str;
+        default = null;
+      };
+    };
+  };
+
+in
+
+{
+  options = {
+    clerie.nginx-port-forward = {
+      enable = mkEnableOption "Nginx Port Forward";
+      tcpPorts = mkOption {
+        type = with types; attrsOf (submodule portOpts);
+        default = {};
+      };
+      udpPorts = mkOption {
+        type = with types; attrsOf (submodule portOpts);
+        default = {};
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx.enable = true;
+    services.nginx.streamConfig = portForwardConf;
+    networking.firewall.allowedTCPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.tcpPorts;
+    networking.firewall.allowedUDPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.udpPorts;
+  };
+}

nixops/bulldog/deployment.nix

@@ -0,0 +1,9 @@
+{
+    arion = import ../../hosts/arion/configuration.nix;
+    geon = import ../../hosts/geon/configuration.nix;
+    pion = import ../../hosts/pion/configuration.nix;
+    scotty-router = import ../../hosts/scotty-router/configuration.nix;
+    tailpipe = import ../../hosts/tailpipe/configuration.nix;
+    dyon = import ../../hosts/dyon/configuration.nix;
+    kaon = import ../../hosts/kaon/configuration.nix;
+}

nixops/bulldog/deployment_ip.nix

@@ -0,0 +1,23 @@
+{
+    arion = { config, pkgs, ... }:{ 
+        deployment.targetHost = "arion.net.entr0py.de";
+    };
+    geon = { config, pkgs, ... }:{
+        deployment.targetHost = "geon.net.entr0py.de";
+    };
+    pion = { config, pkgs, ... }:{
+        deployment.targetHost = "pion.net.entr0py.de";
+    };
+    scotty-router = { config, pkgs, ... }:{
+        deployment.targetHost = "scotty-router";
+    };
+    tailpipe = { config, pkgs, ... }:{ 
+        deployment.targetHost = "tailpipe.net.entr0py.de";
+    };
+    dyon = { config, pkgs, ... }:{
+        deployment.targetHost = "dyon.net.entr0py.de";
+    };
+    kaon = { config, pkgs, ... }:{ 
+        deployment.targetHost = "kaon.net.entr0py.de";
+    };
+}