diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 8c25527..9a125fa 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -13,10 +13,13 @@ # PATH before invoking `nix`. This uses the host's actual Lix rather than installing a # second Nix client that would mismatch the running Lix daemon. # * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency. -# * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only). -# Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs -# QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms, -# which require a nixos-rebuild switch that hasn't been applied yet. +# * matrix over x86_64-linux + aarch64-linux. +# All jobs use --no-build (eval-only) because the runner has 2 cores / 4GB RAM: +# building nix derivations would exhaust memory and crash the server. +# Pre-commit hooks run locally via git-hooks-nix on the developer's machine. +# * aarch64 builds need QEMU binfmt (boot.binfmt.emulatedSystems) + nix extra-platforms, +# which require a nixos-rebuild switch not yet applied. Flake-check for aarch64 +# runs eval-only (no build) and passes. name: CI @@ -61,24 +64,3 @@ jobs: run: | export PATH=/run/current-system/sw/bin:$PATH nix flake check --no-build --system ${{ matrix.system }} - - pre-commit: - name: Pre-commit checks (${{ matrix.system }}) - runs-on: native - strategy: - fail-fast: false - matrix: - # aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt + - # extra-platforms; system hasn't been rebuilt to apply them yet. - system: - - x86_64-linux - timeout-minutes: 20 - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Pre-commit checks (${{ matrix.system }}) - run: | - export PATH=/run/current-system/sw/bin:$PATH - nix build .#checks.${{ matrix.system }}.pre-commit diff --git a/result b/result new file mode 120000 index 0000000..382bdf6 --- /dev/null +++ b/result @@ -0,0 +1 @@ +/nix/store/d8ysys9mxibkvpiskrvsdiybhwkdnj3d-nixos-system-debian-4gb-fsn1-1-24.05.20241230.b134951 \ No newline at end of file diff --git a/servers/hetzner/modules/services/backup.nix b/servers/hetzner/modules/services/backup.nix index 43ac1f6..192da97 100644 --- a/servers/hetzner/modules/services/backup.nix +++ b/servers/hetzner/modules/services/backup.nix @@ -89,4 +89,4 @@ in { requires = ["restic-password.service"]; after = ["restic-password.service"]; }; -} \ No newline at end of file +} diff --git a/servers/hetzner/modules/services/caddy.nix b/servers/hetzner/modules/services/caddy.nix index a13e004..13d6877 100644 --- a/servers/hetzner/modules/services/caddy.nix +++ b/servers/hetzner/modules/services/caddy.nix @@ -1,7 +1,4 @@ -{ - unstablePkgs, - ... -}: let +{unstablePkgs, ...}: let antiScrape = '' @bad_bot { header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*" @@ -30,6 +27,13 @@ in { @notvpn not remote_ip 10.8.0.0/24 respond @notvpn "Forbidden" 403 } + # Restrict access to the server itself (loopback + public IPs) or the + # WireGuard VPN. Gitea reaches this from the server when publishing a + # release, and VPN clients can download from it; the public cannot. + (release_gate) { + @deny not remote_ip 127.0.0.1 ::1 10.8.0.0/24 49.13.92.205 2a01:4f8:c014:2585::1 + respond @deny "Forbidden" 403 + } # Security headers applied to every response of every site that # imports this snippet (covers all current and future hosts). # For proxied hosts whose upstream sets its own copies, strip them @@ -245,6 +249,16 @@ in { ''; }; + "releases.severijnse.eu" = { + extraConfig = '' + import security_headers + import release_gate + root * /srv/releases + file_server browse + encode zstd gzip + ''; + }; + "http://ip.severijnse.eu" = { extraConfig = '' import security_headers @@ -259,5 +273,6 @@ in { systemd.tmpfiles.rules = [ "d /srv 0755 caddy caddy -" "d /srv/jory 0755 caddy caddy -" + "d /srv/releases 0755 admin caddy -" ]; } diff --git a/servers/hetzner/modules/services/stalwart.nix b/servers/hetzner/modules/services/stalwart.nix index 5e6b041..d4353ca 100644 --- a/servers/hetzner/modules/services/stalwart.nix +++ b/servers/hetzner/modules/services/stalwart.nix @@ -85,7 +85,10 @@ in { session.auth.mechanisms = "[plain]"; session.auth.directory = "'internal'"; session.auth.require = [ - {"if" = "listener != 'smtp'"; "then" = true;} + { + "if" = "listener != 'smtp'"; + "then" = true; + } {"else" = false;} ]; @@ -182,4 +185,4 @@ in { systemd.tmpfiles.rules = [ "d /var/lib/bulwark 0755 1001 1001 - -" ]; -} \ No newline at end of file +} diff --git a/servers/hetzner/modules/services/wireguard.nix b/servers/hetzner/modules/services/wireguard.nix index b09dc12..d7128a7 100644 --- a/servers/hetzner/modules/services/wireguard.nix +++ b/servers/hetzner/modules/services/wireguard.nix @@ -7,7 +7,7 @@ ]; environment = { WG_HOST = "severijnse.eu"; - PASSWORD_HASH = "$2a$12$b3n4drXgS3B6ubMZxxjPUOQ1XktZ1EuDwm4AIdVulhtoD7b1.WQGC"; + PASSWORD_HASH = "$2a$14$f6l9jto2Uwn9hNudNo7cHeq08M8UDYzrUiOofWSH522QDRhgTlddC"; WG_DEFAULT_ADDRESS = "10.8.0.x"; WG_DEFAULT_DNS = "1.1.1.1"; WG_PORT = "51820"; diff --git a/servers/hetzner/modules/system/opencode.nix b/servers/hetzner/modules/system/opencode.nix index f4f62d2..89b60e9 100644 --- a/servers/hetzner/modules/system/opencode.nix +++ b/servers/hetzner/modules/system/opencode.nix @@ -1,7 +1,4 @@ -{ - pkgs, - ... -}: { +{pkgs, ...}: { environment.systemPackages = [ (pkgs.writeShellScriptBin "opencode" '' exec /home/admin/.local/bin/opencode "$@"