721a7e6828
ops/nixos: refactor ssh_config
2023-03-12 03:58:52 +00:00
9aa6298df4
ssh-ca: also sign for otter-acoustic.ts.net
2023-03-12 03:53:42 +00:00
6d24fe6e78
ops/nixos: whitby-distributed
2023-03-12 03:51:10 +00:00
c5d4542bbb
ops/nixos/lib/content: fixup
2023-03-12 03:35:48 +00:00
ca7b57a78a
cofractal-ams01: adopt more responsibility from clouvider-fra01
2023-03-12 03:15:34 +00:00
f0712a966a
nixbuild-distributed: tweak secret format
2023-03-12 02:04:08 +00:00
9d6aa88d2d
ops/nixos: add gitlab-runner-cacher, unassign clouvider-lon01, assign cofractal-ams01
2023-03-11 18:15:45 +00:00
4daa3a593a
nixbuild-distributed: create
2023-03-09 21:33:42 +00:00
a17cc6e422
totoro: enable NFS
2023-03-09 21:33:22 +00:00
40baed5b59
cofractal-ams01: enable aarch64-linux binfmt emulation
2023-03-05 12:34:40 +00:00
2f41c3a0f7
cofractal-ams01: switch back to default kernel
2023-03-05 12:31:07 +00:00
a861c3f460
3p/nixpkgs: drop prison-zxing, upstreamed
2023-03-05 12:21:05 +00:00
09610ee555
hm/client: copybara only on x86 Linux
2023-02-12 17:57:39 +00:00
916240fe30
home-assistant: drop api_key/user_key
2023-02-12 17:08:46 +00:00
3efed27d62
treewide: adapt to newer nixpkgs
2023-02-04 00:24:32 +00:00
7c6bdab11c
etheroute-lon01: quadv1-4
2023-02-03 23:30:35 +00:00
28cbcf08a4
kerrigan: provision IPv6
2023-01-21 22:46:00 +00:00
12d9be8909
kerrigan: working IPv6 passthru
2023-01-21 22:38:56 +00:00
6fd15f1080
kerrigan: configure radvd for IPv6 forwarding
2023-01-21 19:54:18 +00:00
d3fdb0b04d
ops/nixos/common: demand system as an arg
2023-01-21 18:59:48 +00:00
c8f1d10e4e
switch-prebuilt: update
2023-01-21 18:52:15 +00:00
f1118a9a04
cofractal-ams01: support v4-on-v6 + ENH
2023-01-19 09:29:37 +00:00
9213875d8b
cofractal-ams01: bgp-over-ipv4
2023-01-18 23:41:42 +00:00
756c1a3dd2
cofractal-ams01: more turnup bits
2023-01-18 21:43:48 +00:00
605dae808a
cofractal-ams01: init placeholder
2023-01-17 22:09:48 +00:00
0583eb2f07
clouvider-lon01: enable aarch64 emulation
2023-01-17 21:49:53 +00:00
f8aaa89d74
coredns: update oracle-lon01, add cofractal-ams01
2023-01-17 21:45:18 +00:00
3fdced1c68
kerrigan: init MochaBin
2023-01-17 19:36:53 +00:00
f053953bb6
ops/raritan: migrate to using vault for username/password
2023-01-15 16:37:30 +00:00
35a9ec6bf5
nhsenglandtests: delete
2023-01-15 16:26:50 +00:00
8407c1a743
hm/common: point at actual terminfo dir
2023-01-15 16:14:14 +00:00
e2b9b63743
terminfos: init
2023-01-15 16:10:12 +00:00
ff0eff593d
totoro: tweak alertmanager setup
2023-01-14 22:24:01 +00:00
ed03e709c5
euw1.api.riotgames.com is on AWS and isn't useful
2023-01-14 22:17:36 +00:00
77c4d9d7c2
totoro: ADSB
2023-01-09 02:09:04 +00:00
91b44d92e4
howl: add redis and postgresql, but don't start them by default
2023-01-08 05:44:13 +00:00
40ed8549b8
resolve some warnings
2022-12-29 14:15:58 +00:00
376e20fe04
ops/nixos: update to cope with the fact we now have warnings/errors at the top level in the exporters set
2022-12-19 08:27:41 +00:00
46c0e2713a
porcorosso/blast: update IPs, add hl2prom
2022-12-19 07:54:48 +00:00
7d752e9871
porcorosso: fix networkmanager bindmount
2022-12-14 05:35:46 +00:00
757900436a
hm/common: update blast IPs
2022-12-14 05:35:38 +00:00
c758bcb61a
hm/client: fix path to jj
2022-12-04 22:03:47 +00:00
754afefc78
jj: init at c52a14eac6532ba814c88f2c8c740415293bfb1a
2022-12-04 21:52:55 +00:00
494935849b
porcorosso: make sure the lukegb database exists
2022-12-04 02:31:03 +00:00
980a2be55c
ops/nixos/hm/client: add git-absorb
2022-12-02 03:04:25 +00:00
08332c8a7b
hm/graphical-client: drop yubioath-desktop, since it got deleted from nixpkgs
2022-11-30 11:06:19 +00:00
6f77028a62
ops: pending changes
2022-11-30 10:50:47 +00:00
3c7d0fa54e
clouvider-lon01: add live1 relay
2022-11-24 13:03:16 +00:00
154ea3a393
howl: disable lukegbgp/try to fix bindsTo/partOf
2022-11-13 19:37:02 +00:00
79ae0d7fef
nix/pkgs/baserow/web-frontend: fix
...
We need to use openssl-legacy-provider to fix an issue with OpenSSL 3.x,
because Webpack (or Nuxt?) need to use deprecated hashes.
2022-11-09 00:35:09 +00:00
b03bf3ea87
baserow: drop mjml-tcpserver
2022-11-02 02:08:52 +00:00
f34d5e20db
hm/common: no manuals
2022-11-02 00:49:53 +00:00
f143d0be51
3p/nixpkgs: post-bump fixups
2022-10-31 21:41:42 +00:00
1d7a00e684
hm/graphical-client: add 'discord'
2022-10-31 20:09:53 +00:00
9dee33f3dc
swann: reenable unifi controller
2022-10-09 18:15:47 +01:00
e772336dc5
porcorosso: bump system.stateVersion (will change postgresql version)
2022-10-08 22:11:21 +01:00
86539ec1f2
totoro: bump system.stateVersion
2022-10-08 22:05:50 +01:00
068f1e2d9c
treewide: various warning fixups
2022-10-08 21:49:16 +01:00
88334fa721
hm/porcorosso-wsl: drop genie
2022-10-08 21:27:01 +01:00
f216bbad29
ops/nixos: services.ipfs --> services.kubo
2022-10-08 21:20:04 +01:00
746c427690
hm/ext: init SSH config tweaks for 3p systems
2022-10-08 21:14:36 +01:00
e03ae8b853
treewide: fix things up for new nixpkgs
2022-10-02 22:23:44 +01:00
2796d03b22
nixos/client: add udisks2
2022-09-24 16:40:45 +01:00
18d7f36feb
howl/porcorosso: switch NetworkManager/system-connections from symlink to bind mount
2022-09-18 17:53:02 +01:00
bfe31111ba
bvm-paperless: oops, need to put square brackets there
2022-09-11 22:50:08 +01:00
27eb5b251e
blade-router: tweak export filter to drop local communities
2022-08-17 02:30:09 +01:00
a8bb05ba1e
blade-router: add ovh
2022-08-17 00:50:45 +01:00
9752742d76
bgp: force next-hop for OVH since I just can't talk to their router 2
2022-09-04 21:10:33 +01:00
2e56cddee5
hm/common: add a 'github' server alias
2022-09-04 21:10:20 +01:00
c16856f8ab
treewide: add my.ip.tailscale6
2022-09-02 00:22:16 +01:00
04df4d0a98
depotwide: make closures smaller, especially on frantech machines
2022-08-27 19:38:03 +01:00
4d0091c35e
as205479.net: add IPv6 tailnet, swap etheroute-lon01
2022-08-26 21:10:05 +01:00
203cba674d
blade: oops, we need SPICE
2022-08-26 21:00:52 +01:00
bc6832b6ca
etheroute-lon01: reinstall, reconfig bgp.tools session
2022-08-26 21:00:43 +01:00
bd37aaa161
porcorosso: enable swtpm and secure boot OVMF
2022-08-19 19:55:03 +01:00
e917fa122d
bvm-netbox: oops, ninovpn
2022-08-19 19:26:44 +01:00
e43e0a4e25
ops/nixos: switch from iosevka to iosevka-bin
2022-08-14 23:01:39 +01:00
e25a1ba6c4
depotwide: fix stuff
2022-08-14 21:01:26 +01:00
65d5cf0f92
porcorosso: some various changes
2022-08-14 18:11:14 +01:00
159da44acf
totoro: enable nodered
2022-08-14 18:10:49 +01:00
5c1742e13f
depotwide: add google-cloudflare role
2022-08-10 01:51:46 +01:00
54ba8ff398
bvm-matrix: add a pointless hostname to the cert set
2022-07-21 09:46:56 +01:00
d1b8449d76
ops/nixos/blade-router: don't export routes to LINX collector
...
It confuses some other people on LINX, so for the avoidance of arguments let's Just Not.
2022-07-15 12:03:37 +01:00
49cab76737
nixos/hm/common: tweak ssh settings
2022-07-15 08:59:43 +01:00
64940e45d6
ops/nixos/graphical-client: install qFlipper
2022-07-07 22:06:35 +01:00
f9f7542da5
bvm-paperless: add more paperless env variables
2022-06-29 21:39:56 +01:00
5f19f9d783
totoro: add gateway
2022-06-25 17:43:30 +00:00
a5fb805dfa
totoro: set default gateway. oops.
2022-06-25 17:35:49 +00:00
dd10a6ba6b
totoro: switch to networkd
2022-06-19 20:34:43 +00:00
2884ced8a3
bvm-paperless: fix DBHOST to use unix sockets again
2022-06-19 21:21:15 +01:00
679c040677
Backed out changeset a532ddc33432
2022-06-19 21:02:02 +01:00
855faad5a0
bvm-prosody: eventphone stuff
2022-06-19 21:01:55 +01:00
d04959acf9
bvm-paperless: clear password for paperless to force unix auth
2022-06-19 20:59:51 +01:00
bfe2fb1707
totoro: add deluge, expose content share over Samba
2022-06-19 00:55:31 +00:00
bd2be7196a
nixos/common: add pam-ussh
2022-06-04 12:21:32 +01:00
2c6be52ce9
howl: add BGP for EMFIX
2022-06-04 12:15:43 +01:00
e68f8b615f
hm/graphical-client-wayland: use wallpaper
2022-04-18 16:45:14 +01:00
60e6ae8af5
nixos/blade-router: bump LINX LON1 netmask to /21
2022-05-29 22:03:56 +01:00
977ee51c54
ops/nixos: change default for RP check to loose to silence Tailscale warnings
2022-05-21 16:31:58 +01:00
f7686f6a5a
hm/common: add whitby alias for ssh
2022-05-17 01:41:48 +01:00
7f587564de
porcorosso-wsl: don't try to load ed25519, use genie
2022-05-17 01:37:01 +01:00
4f3c21a8ea
blade: tweak rbd_cache settings
2022-05-02 17:40:32 +01:00
13d51a7978
ops/nixos: move gitlab-runner registration token to vault
2022-05-13 21:45:36 +00:00
bf601faa89
nix/pkgs/authentik: init
2022-05-12 22:55:10 +00:00
cb383c46ad
ops/nixos/lib/coredns: add IPv6 address for oracle-lon01
2022-05-12 18:38:16 +00:00
8d1ae0fce1
bvm-prosody: use SQLite3
2022-05-02 17:20:03 +01:00
58793004a2
ops/nixos/hm/common: Tweak the IP for SAR1.
2022-04-30 16:48:35 +01:00
6e746fb2cf
etheroute-lon01: use gre rather than ipip
...
Cloudflare Magic Transit appears to become Very Unhappy when you blast it with IPIP.
Use GRE instead, which it is happier with.
2022-04-30 16:48:28 +01:00
d21b733794
ops/nixos: add bgp.tools route collector
2022-04-30 16:48:01 +01:00
04e013b237
ops/nixos/bgp: add support for route collectors
2022-04-30 16:47:35 +01:00
8acf275884
porcorosso: add lukegb to dialout
...
I would like to be able to use /dev/ttyUSB0 without sudo thanks.
2022-04-30 16:46:31 +01:00
35c014bdbe
etheroute-lon01: configure endpoint my end
2022-04-26 09:16:25 +01:00
e51d58fac6
ops/vault: bump ACME TTL
2022-04-20 23:47:09 +01:00
6f70c36b8f
ops/nixos/blade: further nuke forwardX11
2022-04-16 01:52:50 +01:00
514d703560
ops/nixos/blade: nuke forwardX11
2022-04-16 01:48:32 +01:00
7b4febe0ab
ops/nixos/blade: honey I shrunk the closure
2022-04-10 02:20:41 +00:00
784324fd20
ops/nixos: decommission virgin media
2022-04-15 23:42:05 +01:00
75d3386cd2
treewide: fix up for nixpkgs bump
2022-04-15 23:33:53 +01:00
29ac5c60c3
oracle-lon01: do more complicated routing, because google
2022-04-15 11:58:16 +00:00
b5fbf1f472
oracle-lon01: add my first aarch64-linux boxen
2022-04-13 12:03:56 +00:00
dca96efffe
fup: move config to secret
2022-04-10 01:37:37 +01:00
8647af22d7
ops/nixos: put more things in Vault
2022-04-09 21:51:24 +01:00
2536214734
deluge: migrate auth file to vault
2022-04-09 20:59:11 +01:00
b238831963
frantech-nyc01: no more bgp
2022-04-07 04:13:33 +01:00
55b6bd2a19
ops/nixos: add nixos-size to measure total closure pinned by booted-system/current-system mismatch
2022-04-07 03:42:17 +00:00
157629a402
paperless: allow websockets, set up postgres
2022-04-06 11:49:52 +01:00
fa8f317d6f
totoro: add firewall rule for Lifx
2022-04-06 01:00:55 +01:00
da71f20036
ops/nixos: enable paperless
2022-04-06 00:57:22 +01:00
57c5a7d1ce
coredns: add bvm-paperless.int
2022-04-05 11:28:10 +01:00
2585d70127
porcorosso: tidy up gl packages
2022-04-05 03:14:07 +00:00
8f6ae5cfd4
bvm-paperless: init
2022-04-04 19:11:22 +00:00
f8f5d48eec
porcorosso: blocklist r8152/r8153_ecm
2022-04-03 19:47:19 +01:00
b40f3435f4
swann: switch to SFP
2022-03-30 16:42:37 +00:00
addba44d44
coredns: fix ipv6 zones
2022-03-30 17:25:25 +01:00
4b6b4842d1
update dns
2022-03-29 21:30:09 +01:00
3a32590571
go/access: init
2022-03-25 01:24:21 +00:00
eb163962a4
nixos/common: add wireguard-tools
2022-03-24 22:22:18 +00:00
b8acd6e31b
swann: re-enable vault-agent
2022-03-20 19:10:24 +00:00
7592e76a31
tokend: init
...
tokend is responsible for issuing service-scoped tokens based on the token held
and generated by the Vault Agent.
It can also generate "server-user" scoped tokens, which exist for convenience's
sake: they are not a strong attestation of the user on the machine, and have
limited privileges compared to a Vault token issued using e.g. `vault login
-method=oidc`.
2022-03-20 17:47:52 +00:00
58a907b700
nixos/vault-agent: listen on UDS only
...
This UDS is going to be private to vault-agent and tokend (which doesn't exist
yet).
As a stopgap, for the moment, secretsmgrd will be granted direct access to
speak to the Vault Agent over the UDS.
tokend will be responsible for provisioning applications with tokens, by
issuing subtokens which have roles corresponding to the user account requesting
access.
2022-03-20 11:14:51 +00:00
d97a1b7437
bvm-radius: reenable roaming2.ja.net
2022-03-20 11:08:34 +00:00
132cb805b3
ops/vault: use wrapping token to protect secret IDs in transit
2022-03-20 10:14:02 +00:00
829d179d37
nixos/common: make the EnvironmentFile optional to avoid... problems
...
In general, it's better for us to fail to pass credentials to the Nix daemon
than it is for the Nix daemon to fail to start up entirely.
We will restart the daemon once the secrets have been delivered anyway.
2022-03-20 10:00:17 +00:00
c9ffb4ed3e
secretsmgr: actually _enable_ the timer unit
2022-03-18 01:08:35 +00:00
ce698ab382
nixos/secretsmgr: add the timer unit
2022-03-18 01:03:55 +00:00
b719181dfe
nixos: migrate to secretsmgr for sshd and ACME
2022-03-17 23:31:55 +00:00
702cd972ab
nixos/vault-agent: should care about /var/lib/vault-agent instead
2022-03-17 12:27:10 +00:00
b0d2782369
nixos/vault-agent: set a longer timeout on HTTP requests to upstream
2022-03-17 01:25:44 +00:00
b469b24c5a
totoro: add live2 alias
2022-03-14 21:28:58 +00:00
f55dc46170
ssh-ca-vault: disable SSH host key signing for now
2022-03-14 21:28:37 +00:00
262620f177
swann: also put v6 RA routes into the correct route table
...
(fixes ee)
2022-03-13 20:35:11 +00:00
615c30ed54
swann: reduce write activity on disk
2022-03-13 17:34:23 +00:00
f1fcda810a
vault-agent-acme: disable
2022-03-12 23:39:45 +00:00
5283ee4fee
swann: migrate fully to using networkd
...
networkd appears to have gotten very aggressive about clearing routing rules it didn't insert itself
2022-03-12 19:38:54 +00:00
9099ee2a45
swann: only rename physical interfaces
2022-03-12 07:25:48 +00:00
fb2dc81bc0
bvm-radius: ensure acme user
2022-03-11 23:10:01 +00:00
6353ce6603
swann: make systemd-networkd-wait-online wait for _any_ NIC
2022-03-11 22:57:08 +00:00
f15e112da7
ssh-ca-vault: by default enable user matches
2022-03-11 22:31:57 +00:00
ae97fddae2
vault-agent-acme: migrate to using a single token file that writes the other files as a side-effect
...
This avoids annoying problems like "too many" retries for certificate issuance,
since we only ask for the secret once.
2022-03-11 22:07:31 +00:00
ac0c6eccef
ssh-ca-vault: init
2022-03-11 21:48:06 +00:00
86a6191a56
vault-agent-secrets: add wantedBy for all restartable units too
2022-03-11 18:48:54 +00:00
ada466bae0
vault-agent-secrets: put Before in the correct place
2022-03-11 18:48:08 +00:00
a66bd4822a
totoro: disable RP filter
2022-03-11 18:45:41 +00:00
fde964db82
hm/client: add VAULT_ADDR env variable
2022-03-11 18:44:52 +00:00
0187120a24
ops/nixos: move nix cache tokens into vault
2022-03-11 16:46:50 +00:00
4100b021aa
etheroute-lon01: add google service account token
2022-03-11 16:20:34 +00:00
dd746bec32
etheroute-lon01: use FQDN for Pomerium DNS
2022-03-11 16:20:24 +00:00
34fa21a171
treewide: fix eval fallout from nixpkgs bump
2022-03-11 14:56:55 +00:00
c98f3312a7
etheroute-lon01: migrate to vault-agent-secrets
2022-03-11 14:40:55 +00:00
6e6e714cf1
ops/nixos: init vault-agent-secrets module
2022-03-11 14:40:08 +00:00
f9546ed62a
ts3spotifybot: remove for now
2022-03-11 10:02:22 +00:00
e50f682237
totoro: remove cloudflare credentials from raritan-sslrenew
2022-03-11 03:46:31 +00:00
4be2eaeb6d
nixos/lib/common: remove security.acme
2022-03-11 03:28:32 +00:00
0c458988de
ops/nixos: misc cleanups
2022-03-11 03:27:58 +00:00
daccfa5717
ops/nixos: migrate everything to vault-agent-acme
2022-03-07 00:52:03 +00:00
0c7f785107
vault-agent-acme: tidy up
2022-03-06 23:01:51 +00:00
8be4fe603e
vault-agent-acme: init
2022-03-06 22:26:49 +00:00
a3eb1e4519
totoro: enable samba
2022-03-05 11:56:22 +00:00
f0e645fccb
swann: add lukegb01.ring.nlnog.net to smokeping prober
2022-03-03 18:44:56 +00:00
dfb663e659
blade-router: mark cloudflare as pending
2022-03-03 17:38:19 +00:00
c357d5ed8f
blade-router: add cloudflare2
2022-03-03 17:37:41 +00:00
610d5ccf40
hm/porcorosso-wsl: add nixpkgs to NIX_PATH
2022-03-03 16:25:34 +00:00
080577e0f3
swann: fix tailscale outbound
...
Tailscale adds a policy-based routing rule at priority 5200-ish, which is
before all the rules that we add. This avoids any Tailscale traffic going
out... over Tailscale, which would be bad.
Anyway, this breaks us because our main table is empty, so there's nowhere
for the Tailscale traffic to actually go. Oops.
Instead, use policy-based routing to send things over our WG tunnel, or over
any of our upstream connections depending on what's available.
2022-03-02 00:32:31 +00:00
d79faeb3e0
porcorosso-wsl: add keychain
2022-02-27 19:44:48 +00:00
df2c10ed4e
porcorosso-wsl: init
2022-02-27 19:32:48 +00:00
bdd9890f2f
totoro: adjust to new Home Assistant settings style
2022-02-22 03:56:49 +00:00
75a87253dd
porcorosso: remove defunct nvidiaWayland option
2022-02-13 21:29:00 +00:00
43f62d224f
ops/factorio/multiworld: prohibit /ws while hand-crafting
2022-02-05 21:04:03 +00:00
7b4b5dd1a4
clouvider-lon01: switch to -ws world
2022-02-05 17:52:06 +00:00
616a441451
clouvider-lon01: swap back to the other save
2022-02-02 02:20:19 +00:00
28b70d8e5a
clouvider-lon01: swap game save
2022-02-01 22:56:21 +00:00
11739cc4c6
clouvider-lon01: change factorio savegame
2022-01-31 23:35:18 +00:00
cbabb6f211
ops/nixos: migrate nix.maxJobs/binaryCaches/trustedBinaryCaches to the nix.settings equivalents
2022-01-30 20:30:20 +00:00
14a8bd4945
lib/blade-router: fix
2022-01-30 20:22:10 +00:00
1cd0963bf5
blade-tuvok: add the forced-MAC's LL address
2022-01-30 17:54:59 +00:00
947d959cfe
hm/graphical-client-wayland: swap to env variable + normal element-desktop
2022-01-30 16:46:01 +00:00
652cb68e09
bgp: avoid sending routes to clouvider over routeservers
2022-01-30 15:57:35 +00:00
e6b3dab777
clouvider-fra01: readd deluge
2022-01-24 22:08:38 +00:00
4065f9ac28
ops/nixos/hm: add vault
2022-01-23 23:58:55 +00:00
e30a6d203b
porcorosso: reconfigure monitors again
2022-01-23 23:38:52 +00:00
7c418666fe
ops/nixos: add some vault-agent setup
2022-01-23 23:38:40 +00:00
3ad4c2399a
nix/pkgs/lutris: add more deps
2022-01-23 23:37:19 +00:00
4729529b4d
totoro: move plex stuff onto a macVLAN interface
2022-01-23 17:58:04 +00:00
7673e8be9d
bvm-radius: take roaming2 out of the rotation
2022-01-23 17:57:52 +00:00
4b14ea5b4d
ops/nixos: remove rebuilder
...
It's in the common profile, we don't need it everywhere.
2022-01-23 16:57:20 +00:00
3eb564f12b
ops/nixos: factor out various things from clouvider-fra01
2022-01-23 16:58:29 +00:00
bf8e6b62ed
ops/nixos/hm: switch to networkmanagerapplet
2022-01-20 22:50:47 +00:00
bd3c7c090e
totoro: add HA config
2022-01-17 04:04:07 +00:00
6276e4b620
ops/nixos: add common-updater-scripts to hm/client
2022-01-16 18:04:24 +00:00
d8186b8f14
ops/nixos/graphical-client: enable gnome-keyring
2022-01-16 18:04:14 +00:00
afae9bec9a
totoro: add some home-assistant gubbins
2022-01-17 02:38:33 +00:00
eb3b306439
Backed out changeset 073cf55ed346
...
Mischief managed
2022-01-15 13:32:47 +00:00
687d72cfdc
ops/nixos: experiment with ECMP
2022-01-15 13:32:41 +00:00
9be6bcaf2d
ops/nixos: set up gnetwork link
2022-01-14 19:42:06 +00:00
7cfef2cd98
coredns/zones: add lukegb01.ring.nlnog.net
2022-01-10 23:35:54 +00:00
9ccf3b333d
blade-tuvok: provide a proper path to the sysctl utility
2022-01-10 22:40:57 +00:00
4f0a7b60bc
ops/nixos: use higher-priority 'mkDefault'
2022-01-09 21:38:17 +00:00
ea10f06a4c
ops/nixos: more cleanups
2022-01-09 00:22:52 +00:00
2770e7c086
porcorosso: tweak setup-display so that it overrides panning
2022-01-08 22:17:13 +00:00
9472db4577
ops/nixos: consolidate Frantech VM configs into lib/frantech.nix
2022-01-08 21:49:09 +00:00
ad95bffd3d
ops/nixos: tidy up networking.useDHCP
2022-01-08 21:45:18 +00:00
f463055acf
ops/nixos: pipewire for everyone
2022-01-08 21:41:30 +00:00
4b2c0f7fa8
porcorosso: set up PRIME so we can draw to my laptop's internal display!
2022-01-08 21:28:03 +00:00
1348172aba
porcorosso: remove unused hyperv config
2022-01-08 19:54:03 +00:00
1b4b7f0a80
porcorosso: remove default.pa
2022-01-08 19:45:55 +00:00
2ddd50aef4
etheroute-lon01: disable TLS verification for totoro
...
For some reason this is failing with a TLS alert that the certificate
is expired???
2022-01-07 15:23:43 +00:00
fe09e44c5c
porcorosso: block i2c-nvidia-gpu, causes X11 to fail to init
2022-01-07 12:51:18 +00:00
bac7e1fb69
porcorosso: remove blast config
2022-01-07 12:42:55 +00:00
05be94e4d7
ops/nixos/common: disable DNSSEC in systemd-resolved
...
It's super broken.
At the moment, resolving foss.heptapod.net breaks, because clever-cloud.com has
DNSKEY records but there's no matching DS record at .com for it.
There are also other reports: https://github.com/systemd/systemd/issues/12388
tl;dr: it just doesn't work, let's not use that.
2022-01-08 12:09:26 +00:00
506a584dea
totoro: set up podman socket support
2022-01-08 12:08:04 +00:00
9e79ad0cfa
bvm-radius: add new roaming2.ja.net IPs
2022-01-07 11:49:24 +00:00
5001971b87
totoro: add bvm-.* alerts
2022-01-06 17:51:39 +00:00
6ab12dcad5
ops/nixos: rm marukuru
2022-01-06 15:55:21 +00:00
d79265ddad
ops/nixos: tidy up security.acme
2022-01-04 14:00:45 +00:00
de71fd5c9a
ops/nixos/lib/common: add global DNS servers
2022-01-04 13:32:56 +00:00
8cc6e2001a
ops/nixos: create permanent quotesdb user
...
Stop relying on DynamicUser because it messes a bit with postgres' auth.
2022-01-01 21:49:23 +00:00
3318874168
marukuru: remove heptapod{,-runner}
2022-01-01 21:31:01 +00:00
67b038c2bc
ops/nixos/common: turn off logRefusedConnections - it's super noisy
2022-01-01 20:56:41 +00:00
37e36418a1
bvm-logger: add custom clickhouse config
...
Just make it less spammy into the journal, sheesh.
2022-01-01 16:31:05 +00:00
730d057e18
bvm-logger: enable journal2clickhouse for real
2022-01-01 15:24:32 +00:00
7b4e6c0e1b
ops/nixos: oops, try to fix my.scrapeJournal.addr
2022-01-01 15:14:02 +00:00
c91a42948d
journal2clickhouse: init
2022-01-01 15:08:52 +00:00
c5119b4882
ops/nixos: enable HTTP gateway if Tailscale is configured
2022-01-01 12:40:13 +00:00
1f13fd811d
coredns: bind to specific interfaces/IPs
2022-01-01 09:03:25 +00:00
8e28b5bbfe
ops/nixos: drop Google/AS15169 routes from Veloxserv to prefer RouteServer
2022-01-01 03:02:55 +00:00
bfd08b08cf
ops/nixos: add fastly passive peer
2022-01-01 02:39:01 +00:00
6cfcd10e06
swann: use the router's public IP when making connections
...
For v6, the link is on an unrouted subnet so there's no way to address it from
outside. We don't want Linux to use the v6 subnet for connections it makes, so
we ask politely that the source on the route is actually an IP address that we
Like.
2022-01-01 02:11:59 +00:00
3458c7766e
swann: switch from prod.euw1.riotgames.com to euw1.api.riotgames.com
...
The former appears to resolve, but no longer respond to ICMP ping (even from a
different network). Switch to the documented API endpoint, which still
responds to ICMP ping.
2022-01-01 01:31:56 +00:00
3e98fae657
bvm-heptapod: autoStart deployer container
2022-01-01 00:43:15 +00:00
e182171916
ops/nixos: disable LLMNR
2022-01-01 00:41:37 +00:00
