flake.lock

@@ -229,6 +229,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-schule": {
+      "locked": {
+        "lastModified": 1699099776,
+        "narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1699099776,
@@ -255,6 +271,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-krypton": "nixpkgs-krypton",
+        "nixpkgs-schule": "nixpkgs-schule",
         "solid-xmpp-alarm": "solid-xmpp-alarm"
       }
     },

flake.nix

@@ -2,6 +2,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixpkgs-krypton.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-schule.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     agenix = {
       url = "github:ryantm/agenix";
@@ -68,6 +69,7 @@
       osmium = { name = "osmium"; };
       palladium = { name = "palladium"; };
       porter = { name = "porter"; };
+      schule = { name = "schule"; };
       storage-2 = { name = "storage-2"; };
       web-2 = { name = "web-2"; };
       zinc = { name = "zinc"; };

hosts/porter/configuration.nix

@@ -21,6 +21,32 @@
   networking.defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
   networking.nameservers = [ "46.38.255.230" "46.38.252.230" ];
 
+  services.nginx.enable = true;
+  services.nginx.virtualHosts.default = lib.mkForce {};
+  services.nginx.virtualHosts."*.schule.clerie.de" = {
+    locations."/" = {
+      proxyPass = "http://schule.net.clerie.de";
+    };
+  };
+
+  services.sniproxy = {
+    enable = true;
+    config = ''
+      error_log {
+        filename /var/log/sniproxy/error.log
+      }
+      access_log {
+        filename /var/log/sniproxy/access.log
+      }
+      listen 443 {
+        proto tls
+      }
+      table {
+        ^.*\.schule\.clerie\.de$ [2001:638:904:ffcb::d]
+      }
+    '';
+  };
+
   clerie.nginx-port-forward = {
     enable = true;
     tcpPorts."2022" = {
@@ -29,6 +55,13 @@
     };
   };
 
+  services.chisel-server = {
+    enable = false;
+    host = "[::1]";
+    port = 3765;
+    authfile = "/var/src/secrets/chisel/users.json";
+  };
+
   services.snowflake-proxy.enable = true;
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];

hosts/schule/configuration.nix

@@ -0,0 +1,125 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+    ];
+
+  boot.kernelParams = [ "console=ttyS0,115200n8" ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/vda";
+
+  boot.loader.grub.extraConfig = ''
+    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial
+    terminal_output serial
+  '';
+
+  networking.hostName = "schule";
+
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = false;
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.37"; prefixLength = 24; } ];
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "2001:638:904:ffcb::d"; prefixLength = 64; } ];
+  networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens19"; };
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.nameservers = [ "141.24.40.3" "141.24.40.4" ];
+
+  users.users.lord.isNormalUser = true;
+
+  users.users.js.isNormalUser = true;
+
+  services.openssh.settings = {
+    PasswordAuthentication = lib.mkForce true;
+    ChallengeResponseAuthentication = lib.mkForce true;
+  };
+
+  services.ttyd = {
+    enable = true;
+    port = 8436;
+    enableIPv6 = true;
+    interface = "::1";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 8436 ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+      "term.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://[::1]:8436";
+          proxyWebsockets = true;
+        };
+      };
+
+      "term.v6.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://[::1]:8436";
+          proxyWebsockets = true;
+        };
+      };
+
+      "ports.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          return = ''200 "Some piece of infrastructure\n"'';
+          extraConfig = ''
+            types { } default_type "text/plain; charset=utf-8";
+          '';
+        };
+      };
+
+      "\"~^(?<requestedport>[0-9]{4,5})\.ports\.schule\.clerie\.de$\"" = {
+        forceSSL = true;
+        sslCertificate = "${config.security.acme.certs."ports.schule.clerie.de".directory}/fullchain.pem";
+        sslCertificateKey = "${config.security.acme.certs."ports.schule.clerie.de".directory}/key.pem";
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://127.0.0.1:$requestedport";
+          proxyWebsockets = true;
+        };
+      };
+
+      "ports.v6.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          return = ''200 "Some piece of infrastructure\n"'';
+          extraConfig = ''
+            types { } default_type "text/plain; charset=utf-8";
+          '';
+        };
+      };
+
+      "\"~^(?<requestedport>[0-9]{4,5})\.ports\.v6\.schule\.clerie\.de$\"" = {
+        forceSSL = true;
+        sslCertificate = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/fullchain.pem";
+        sslCertificateKey = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/key.pem";
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://127.0.0.1:$requestedport";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+  };
+
+  system.stateVersion = "22.11";
+}

hosts/schule/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f24fdef6-1ace-46a4-80cf-652edb285be6";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/schule/ssh.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAIuAyY1FtMWoBdLzOkDsCro6vQjGYQduGzU9HLcSvfj

lib/flake-helper.nix

@@ -64,7 +64,7 @@ rec {
     };
     nixpkgs.system = hostSystem.config.nixpkgs.system;
     imports = hostSystem._module.args.modules;
-    deployment.allowLocalDeployment = builtins.any (n: n == name) [ "osmium" ];
+    deployment.allowLocalDeployment = builtins.any (n: n == name) [ "schule" "osmium" ];
   };
 
   mapToColmenaHosts = hosts: builtins.mapAttrs (generateColmenaHost) hosts;