update ssh config for git

hosts/nixos/lumiose/configuration.nix

@@ -42,9 +42,31 @@
 
   homelab = {
     enable = true;
-    base_domain = "lumiose.lan";
+    base_domain = "lumiose.blakedheld.xyz";
     host_ip = "10.10.0.11";
+    gitea.enable = true;
+    glance.enable = true;
+    immich.enable = true;
+    vaultwarden.enable = true;
+    #searx.enable = true;
+    # home assistant
+    home.enable = true;
+    # network
     tailscale.enable = true;
+    caddy.enable = true;
+    dnsmasq.enable = false;
+    # mediastack
+    mediastack.enable = true;
+    qbittorrent.vpn_inf = "enp34s0.69";
+    # system
+    backups.enable = true;
+    motd.enable = true;
+    postfix.enable = false;
+    uptime-kuma.enable = true;
+    # ai
+    ollama.enable = false;
+    open-webui.enable = false;
+    wyoming.enable = false;
   };
 
   holocron = {
@@ -78,16 +100,16 @@
       enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
       ensureProfiles.profiles = {
-        #        vpn = {
+        vpn = {
-        #          ethernet.mac-address = "7a:e4:07:8d:22:76";
+          #ethernet.mac-address = "7a:e4:07:8d:22:76";
-        #          connection.type = "vlan";
+          connection.type = "vlan";
-        #          connection.id = "vpn";
+          connection.id = "vpn";
-        #          connection.interface-name = "enp89s0.69";   # or just "vpn-vlan"
+          connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
-        #          vlan.interface-name = "enp89s0.69";   # or just "vpn-vlan"
+          vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
-        #          vlan.parent = "enp89s0";
+          vlan.parent = "enp34s0";
-        #          vlan.id = 69;
+          vlan.id = 69;
-        #          #ipv4.dns = "9.9.9.9";
+          #ipv4.dns = "9.9.9.9";
-        #        };
+        };
       };
     };
   };

hosts/nixos/lumiose/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "subvol=@root" ];
+    };
+
+  boot.initrd.luks.devices."crypted".device = "/dev/disk/by-uuid/4c5bef93-c0b8-4f03-8325-6ab1b9b9199a";
+
+  fileSystems."/.swapvol" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "subvol=@swap" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/3E0D-91EE";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/nixos/vaniville/configuration.nix

@@ -8,7 +8,9 @@
   ...
 }: let
   vpsip4 = "100.100.1.10";
-  homelabipv4 = "10.10.0.10";
+  snowbelle_ip = "10.10.0.10";
+  lumiose_ip = "10.10.0.11";
+
   homelab = config.homelab;
 in {
   imports = [
@@ -29,7 +31,7 @@ in {
   };
   homelab = {
     base_domain = "vaniville.lan";
-    host_ip = "10.10.0.11";
+    host_ip = "10.10.0.12";
     ddns.enable = true;
     uptime-kuma = {
       enable = true;
@@ -105,27 +107,27 @@ in {
       allowedUDPPorts = [config.services.tailscale.port 25777 21116];
       trustedInterfaces = ["tailscale0"];
       /*
-      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80        # http
+      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80        # http
-      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443      # https
+      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443      # https
 
-      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}     # http
+      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}     # http
-      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}    # https
+      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}    # https
       */
       extraCommands = ''
         # Clear any previous rules if you are iterating
         iptables -t nat -F
 
         # DNAT: internet -> homelab over tailscale
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567    # gitea ssh
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${snowbelle_ip}:25777  # recpro mc
-        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${snowbelle_ip}:25777  # recpro mc
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778  # cbblemon mc
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${snowbelle_ip}:25778  # cbblemon mc
 
         # SNAT: ensure replies go back through VPS tailscale IP
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
-        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # cbblemon mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # cbblemon mc
       '';
     };
   };
@@ -153,19 +155,19 @@ in {
       # this is instead of forwarding all 80 & 443 traffic to have more explicit
       # publishing things to the open web
       "media.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy 10.10.0.10:7100
+        reverse_proxy ${lumiose_ip}:7100
       '';
       "pass.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy 10.10.0.10:7701
+        reverse_proxy ${lumiose_ip}:7701
       '';
       "photos.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy 10.10.0.10:7702
+        reverse_proxy ${lumiose_ip}:7702
       '';
       "git.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy 10.10.0.10:7703
+        reverse_proxy ${lumiose_ip}:7703
       '';
       "hass.${homelab.public_domain}".extraConfig = ''
-          reverse_proxy 10.10.0.10:7704 {
+          reverse_proxy ${lumiose_ip}:7704 {
           header_up Host {host}
           header_up X-Real-IP {remote_host}
           header_up X-Forwarded-For {remote_host}

users/blake/hosts/lumiose.nix

@@ -32,7 +32,7 @@ in {
       identityFile = "${home_dir}/.ssh/id_snowbelle";
       port = 7567;
     };
-    "git.snowbelle.blakedheld.xyz" = {
+    "git.lumiose.blakedheld.xyz" = {
       user = "gitea";
       identityFile = "${home_dir}/.ssh/id_snowbelle";
       port = 7567;

users/blake/hosts/snowbelle.nix

@@ -32,7 +32,7 @@ in {
       identityFile = "${home_dir}/.ssh/id_snowbelle";
       port = 7567;
     };
-    "git.snowbelle.blakedheld.xyz" = {
+    "git.lumiose.blakedheld.xyz" = {
       user = "gitea";
       identityFile = "${home_dir}/.ssh/id_snowbelle";
       port = 7567;

users/blake/hosts/vaniville.nix

@@ -32,7 +32,7 @@ in {
       identityFile = "${home_dir}/.ssh/id_vaniville";
       port = 7567;
     };
-    "git.snowbelle.blakedheld.xyz" = {
+    "git.lumiose.blakedheld.xyz" = {
       user = "gitea";
       identityFile = "${home_dir}/.ssh/id_vaniville";
       port = 7567;