commit 5f5006198491e42fc3a81c7647d1a648a5f1932e
parent c83b940c15f2d2a2ed6b44d23b4332182ec41ff1
Author: vin <vin@vineetk.net>
Date: Mon, 3 Mar 2025 19:54:56 -0500
demiurge: switch back to using self-signed cert instead of step-ca
step-ca was being a massive pain when I switched the domain from
demiurge.vpn to demiurge.epistemia. After a long time of trying to see
why it couldn't connect, it later switched to rejectedIdentifier and I
had no idea how to fix it. (one of the github issues on it had
maintainer saying they're closing due to being unable to reproduce)
Diffstat:
5 files changed, 51 insertions(+), 89 deletions(-)
diff --git a/home.nix b/home.nix
@@ -432,7 +432,7 @@ in {
};
searchEngines = {
- DEFAULT = "https://searx.demiurge.vpn/search?q={}";
+ DEFAULT = "https://searx.demiurge.epistemia/search?q={}";
ddg = "https://lite.duckduckgo.com/?q={}";
nw = "https://wiki.nixos.org/index.php?search={}";
aw = "https://wiki.archlinux.org/?search={}";
@@ -481,7 +481,7 @@ config.set('content.javascript.enabled', True, 'cloud.binary.ninja')
config.set('content.javascript.enabled', True, 'console.hetzner.cloud')
config.set('content.javascript.enabled', True, '*.hetzner.com')
config.set('content.javascript.enabled', True, '*.digikey.com')
-config.set('content.javascript.enabled', True, '*.demiurge.vpn')
+config.set('content.javascript.enabled', True, '*.demiurge.epistemia')
# Allow locally loaded documents to access remote URLs.
config.set('content.local_content_can_access_remote_urls', True, 'file:///home/vin/.local/share/qutebrowser/userscripts/*')
@@ -884,15 +884,15 @@ def _pastebin_redir(url: QUrl) -> bool:
# Any return value other than a literal 'False' means we redirected
REDIRECT_MAP = {
- "new.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
- "np.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
- "old.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
- "reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
- "www.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
-
- "www.youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.vpn'),
- "youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.vpn'),
- "youtu.be": operator.methodcaller('setHost', 'invidious.demiurge.vpn'),
+ "new.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+ "np.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+ "old.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+ "reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+ "www.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+
+ "www.youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.epistemia'),
+ "youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.epistemia'),
+ "youtu.be": operator.methodcaller('setHost', 'invidious.demiurge.epistemia'),
"imgur.com": operator.methodcaller('setHost', 'rimgo.bloat.cat'),
"i.imgur.com": operator.methodcaller('setHost', 'rimgo.bloat.cat'),
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -14,12 +14,6 @@
owner = "root";
group = "root";
};
-
- smallstep = {
- file = ../../secrets/smallstep.age;
- owner = "step-ca";
- group = "step-ca";
- };
};
# boot options
@@ -187,12 +181,6 @@
# };
security = {
- acme = {
- acceptTerms = true;
- defaults.email = "me@vineetk.net";
- defaults.server = "https://127.0.0.1:4433/acme/acme/directory";
- };
-
# I prefer doas over sudo for simplicity
doas = {
enable = true;
@@ -206,15 +194,24 @@
pki.certificates = [
''
-----BEGIN CERTIFICATE-----
-MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
-MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
-ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
-E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
-BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
-LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
+MIIDMDCCAhigAwIBAgIUcSUafnojcFKod3f436VELfEKoFkwDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlhMB4XDTI1MDMwMzEwMjQw
+OVoXDTI2MDMwMzEwMjQwOVowHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlh
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiRlreCXc7f+yWclxR2M
+639g0+Lr/c9HrX7EM2/olavPAtZgCzqqvJsDmXq4AURlwd82wZUZxXjWFwlRji/+
+WViXQBTWwnXVjc9MJlxTq2X2zfU2GIxYsrA1ZQuj0wVHlA+R/66oL0Padc/qQZfv
+sshQnrqnutvGobBWEGJXcCIDiwUGgHlIoelwY9G0GLE/rkVujNjAonyMhVGJHVUv
+lXyc3RNslQHymr4Wl6+lL6V6XfuB1taECJYSLXPx66TvJqod2Io+b7T7cWp+9g9U
+B2jQu1YnPRpwjdPvbOCPjPbOP6UcbyHdbHAidSM0FSL5riVUmugwDwbQKXFFX2gH
+hwIDAQABo2gwZjAfBgNVHREEGDAWghQqLmRlbWl1cmdlLmVwaXN0ZW1pYTATBgNV
+HSUEDDAKBggrBgEFBQcDATAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBTjMVhw
+zmkE6P5jFHkLVQE2gNB2ejANBgkqhkiG9w0BAQsFAAOCAQEAWvnwB83vXzQFpObF
+vn/nfZ9wYpNaBsE15ab3Fwd2nDc55KDkDWgBi5Xl8fwN3OhFOU2XXBCYqbCU6asx
+OnSx9glbhJioORO7B5ENbEYrpB97SaWASNXrBQ2KiQT5aC+9xb52K53kkk0tTn2l
+nBb+jyLItzWX99H6EavOq69a4T2BObZaSPQAfpM8FIrKl+UZC3152+bi8wKfG4K4
+FQsOJMjIvhTm2IiOS8xIaZz7EJORxFjtOkLEIGGZBNK6QcnD714/nYbHSrQx4eNM
+/ek8Rmf6DTLaFBx+raWyDTgMY23lvWTKDTT1+dZnRNcg72bFpIdqHsDrIg/IBjZ0
+3eGfkQ==
-----END CERTIFICATE-----
''
];
@@ -271,7 +268,7 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
nginx = {
enable = true;
- defaultListenAddresses = [ "10.0.13.2" ];
+ defaultListenAddresses = [ "100.64.0.5" ];
recommendedGzipSettings = true;
recommendedOptimisation = true;
@@ -280,26 +277,30 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
virtualHosts = {
"searx.demiurge.epistemia" = {
- enableACME = true;
- forceSSL = false;
+ addSSL = true;
+ sslCertificate = "/var/demiurge.epistemia.crt";
+ sslCertificateKey = "/var/demiurge.epistemia.key";
locations."/".proxyPass = "http://127.0.0.1:8081";
};
"redlib.demiurge.epistemia" = {
- enableACME = true;
- forceSSL = false;
+ addSSL = true;
+ sslCertificate = "/var/demiurge.epistemia.crt";
+ sslCertificateKey = "/var/demiurge.epistemia.key";
locations."/".proxyPass = "http://127.0.0.1:8082";
};
"navidrome.demiurge.epistemia" = {
- enableACME = true;
- forceSSL = false;
+ addSSL = true;
+ sslCertificate = "/var/demiurge.epistemia.crt";
+ sslCertificateKey = "/var/demiurge.epistemia.key";
locations."/".proxyPass = "http://127.0.0.1:4533";
};
"sdui.demiurge.epistemia" = {
- enableACME = true;
- forceSSL = false;
+ addSSL = true;
+ sslCertificate = "/var/demiurge.epistemia.crt";
+ sslCertificateKey = "/var/demiurge.epistemia.key";
locations."/" = {
proxyPass = "http://127.0.0.1:7860";
proxyWebsockets = true;
@@ -770,52 +771,6 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
};
};
- # certificate authority
- step-ca = {
- enable = true;
- address = "127.0.0.1";
- port = 4433;
- intermediatePasswordFile = config.age.secrets.smallstep.path;
-
- settings = {
- root = "/var/lib/step-ca/certs/root_ca.crt";
- federatedRoots = null;
- crt = "/var/lib/step-ca/certs/intermediate_ca.crt";
- key = "/var/lib/step-ca/secrets/intermediate_ca_key";
- address = "127.0.0.1:4433";
- insecureAddress = "";
- dnsNames = [ "127.0.0.1" ];
- logger.format = "text";
-
- db = {
- type = "badgerv2";
- dataSource = "/var/lib/step-ca/db";
- badgerFileLoadingmode = "";
- };
-
- authority.provisioners = [{
- type = "ACME";
- name = "acme";
- claims = {
- enableSSHCA = true;
- disableRenewal = false;
- allowRenewalAfterExpiry = false;
- disableSmallstepExtensions = false;
- };
- }];
-
- tls = {
- cipherSuites = [
- "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
- "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
- ];
- minVersion = 1.2;
- maxVersion = 1.3;
- renegotiation = false;
- };
- };
- };
-
# vpn
tailscale = {
enable = true;
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
@@ -155,7 +155,15 @@
port = 8080;
settings = {
server_url = "https://headscale.13f0.net";
- dns.base_domain = "epistemia";
+ dns = {
+ base_domain = "epistemia";
+ extra_records = [
+ { name = "navidrome.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+ { name = "redlib.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+ { name = "sdui.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+ { name = "searx.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+ ];
+ };
logtail.enabled = false;
};
};
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -13,7 +13,6 @@ in
"hetzner_dns.age".publicKeys = users ++ [ saklas ];
"radicale_users.age".publicKeys = users ++ [ saklas ];
- "smallstep.age".publicKeys = users ++ [ demiurge ];
"tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
"tailscale_saklas.age".publicKeys = users ++ [ saklas ];
}
diff --git a/secrets/smallstep.age b/secrets/smallstep.age
Binary files differ.
