jory
cba6b18914
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, ...); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys, inherit, bool-compare guards); add missing trailing newlines
61 lines
1.2 KiB
Nix
61 lines
1.2 KiB
Nix
{...}: {
|
|
networking = {
|
|
hostName = "debian-4gb-fsn1-1";
|
|
domain = "severijnse.eu";
|
|
useDHCP = true;
|
|
dhcpcd.enable = true;
|
|
nameservers = [
|
|
"2a01:4ff:ff00::add:2"
|
|
"2a01:4ff:ff00::add:1"
|
|
"185.12.64.2"
|
|
];
|
|
search = ["severijnse.eu"];
|
|
interfaces."enp1s0" = {
|
|
ipv6.addresses = [
|
|
{
|
|
address = "2a01:4f8:c014:2585::1";
|
|
prefixLength = 64;
|
|
}
|
|
];
|
|
ipv6.routes = [
|
|
{
|
|
address = "::";
|
|
prefixLength = 0;
|
|
via = "fe80::1";
|
|
}
|
|
];
|
|
};
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
22 # SSH
|
|
53 # DNS (CoreDNS)
|
|
80 # HTTP (Caddy)
|
|
443 # HTTPS (Caddy)
|
|
465 # SMTP over TLS
|
|
587 # SMTP (STARTTLS)
|
|
993 # IMAP over TLS
|
|
143 # IMAP
|
|
25 # SMTP
|
|
222 # Gitea SSH
|
|
51821 # WG-Easy web UI
|
|
];
|
|
allowedUDPPorts = [
|
|
53 # DNS
|
|
51820 # WireGuard
|
|
];
|
|
};
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = "enp1s0";
|
|
internalInterfaces = ["wg0"];
|
|
};
|
|
};
|
|
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv4.conf.all.src_valid_mark" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
}
|