From 1362d6d3c6fbe8881267a1e613592aa0e5c91d40 Mon Sep 17 00:00:00 2001 From: Chris Kruining Date: Tue, 4 Mar 2025 23:36:00 +0100 Subject: [PATCH] woo, got the server working only thing to figure out now is how to install tekxit and fix the dns --- hosts/chris-pc/default.nix | 12 ++-- hosts/chris-server/default.nix | 4 ++ modules/desktop/games/minecraft.nix | 8 ++- modules/services/auth.nix | 73 ++++++++++++++++++++- modules/services/games/minecraft.nix | 96 +++++++++++++++++++--------- modules/services/oidc_clients.yml | 5 ++ modules/system/graphics.nix | 28 ++++---- 7 files changed, 172 insertions(+), 54 deletions(-) create mode 100644 modules/services/oidc_clients.yml diff --git a/hosts/chris-pc/default.nix b/hosts/chris-pc/default.nix index b949ff1..236a2d7 100644 --- a/hosts/chris-pc/default.nix +++ b/hosts/chris-pc/default.nix @@ -31,16 +31,14 @@ dotnet.enable = true; }; - services.games.minecraft.enable = true; + # EXPERIMENTS + # services.games.minecraft.enable = true; + services.auth.enable = true; desktop = { plasma.enable = true; type = "wayland"; -# games = { -# minecraft.enable = false; -# }; - applications = { communication.enable = true; email.enable = true; @@ -68,6 +66,10 @@ firefox.enable = true; chrome.enable = true; }; + + games = { + minecraft.enable = true; + }; }; shell = { diff --git a/hosts/chris-server/default.nix b/hosts/chris-server/default.nix index 45f5bed..da290f9 100644 --- a/hosts/chris-server/default.nix +++ b/hosts/chris-server/default.nix @@ -22,6 +22,10 @@ services = { enable = true; media.enable = true; + + games = { + minecraft.enable = true; + }; }; desktop = { diff --git a/modules/desktop/games/minecraft.nix b/modules/desktop/games/minecraft.nix index c5b21ff..9ecaf29 100644 --- a/modules/desktop/games/minecraft.nix +++ b/modules/desktop/games/minecraft.nix @@ -12,10 +12,12 @@ in enable = mkEnableOption "minecraft (Modrinth)"; }; - config = mkIf cfg.enable - { + config = mkIf cfg.enable { + # environment.systemPackages = [ + # pkgs.minecract + # ]; user.packages = attrValues { - inherit (pkgs) modrinth-app minecraft; + inherit (pkgs) modrinth-app prismlauncher; }; }; } diff --git a/modules/services/auth.nix b/modules/services/auth.nix index 44d0f03..67a2531 100644 --- a/modules/services/auth.nix +++ b/modules/services/auth.nix @@ -6,12 +6,83 @@ in options.modules.services.auth = let inherit (lib.options) mkEnableOption; in { - enable = mkEnableOption "Media auth"; + enable = mkEnableOption "Auth"; }; config = mkIf config.modules.services.auth.enable { environment.systemPackages = with pkgs; [ authelia ]; + + services.authelia.instances.testing = { + enable = true; + secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile"; + secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile"; + settings = { + log.level = "info"; + authentication_backend.file.path = "/etc/authelia/users_database.yml"; + access_control.default_policy = "one_factor"; + session.domain = "kruining.eu"; + storage.local.path = "/tmp/db.sqlite3"; + notifier.filesystem.filename = "/tmp/notifications.txt"; + server.endpoints.authz.forward-auth.implementation = "ForwardAuth"; + identity_providers.oidc.clients = []; + }; + }; + + # systemd.services."authelia-testing" = { + # serviceConfig.Environment = "X_AUTHELIA_CONFIG_FILTERS=template"; + # }; + + # These should not be set from nix but through other means to not leak the secret! + # This is purely for testing purposes! + environment.etc."authelia/storageEncryptionKeyFile" = { + mode = "0400"; + user = "authelia-testing"; + text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this"; + }; + environment.etc."authelia/jwtSecretFile" = { + mode = "0400"; + user = "authelia-testing"; + text = "a_very_important_secret"; + }; + environment.etc."authelia/users_database.yml" = { + mode = "0400"; + user = "authelia-testing"; + text = '' + users: + bob: + disabled: false + displayname: bob + # password of password + password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs + email: bob@jim.com + groups: + - admin + - dev + ''; + }; + + services.caddy = { + enable = true; + virtualHosts = { + "auth.kruining.eu".extraConfig = '' + reverse_proxy :9091 + ''; + "kaas.kruining.eu".extraConfig = '' + respond "KAAS" + ''; + }; + extraConfig = '' + (auth) { + forward_auth :9091 { + uri /api/authz/forward-auth + copy_headers Remote-User Remote-Groups Remote-Email Remote-Name + } + } + ''; + }; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; }; } diff --git a/modules/services/games/minecraft.nix b/modules/services/games/minecraft.nix index 655f745..6093ed6 100644 --- a/modules/services/games/minecraft.nix +++ b/modules/services/games/minecraft.nix @@ -10,44 +10,78 @@ in }; config = mkIf config.modules.services.games.minecraft.enable { - services.minecraft-servers = { - enable = true; - eula = true; + services = { + minecraft-servers = { + enable = true; + eula = true; + openFirewall = true; - user = "chris"; - dataDir = "/var/lib/minecraft"; + user = "chris"; + dataDir = "/var/lib/minecraft"; - servers = { - vanilla = { - enable = true; - autoStart = true; + managementSystem.systemd-socket.enable = true; - package = pkgs.fabricServers.fabric-1_20_4.override { loaderVersion = "0.15.11"; }; + servers = { + vanilla = { + enable = true; + autoStart = true; - serverProperties = { - gamemode = "survival"; - difficulty = 3; - motd = "Chris' vanilla server"; - white-list = true; - simulation-distance = 10; - server-port = 25501; - }; + package = pkgs.fabricServers.fabric-1_21_4.override { loaderVersion = "0.16.10"; }; - whitelist = { - ChrisPBacon = "e6128495-075b-44a9-87f6-8d844d5ea0e4"; - }; + serverProperties = { + gamemode = "survival"; + difficulty = 3; + motd = "Chris' vanilla server"; + white-list = true; + simulation-distance = 10; + server-port = 25501; + level-name = "world"; - jvmOpts = "-Xms4092M -Xmx4092M -XX:+UseG1GC"; + allow-flight = true; + enable-command-block = true; + enforce-whitelist = true; + spawn-protection = 0; + }; - symlinks = let - inherit (lib.attrsets) attrValues; - inherit (pkgs) linkFarmFromDrvs fetchurl; - in{ - mods = linkFarmFromDrvs "mods" (attrValues { - FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/QVBohPm2/fabric-api-0.97.2%2B1.20.4.jar"; sha512 = "8f02bf562781a2f08294736eff784b7e7463be1595b1e3b4f53d4dcb57fc0643890078265141c3bce882dfec6e77553d2db252992fdfbd55cd7d32777adb9d78"; }; - Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/WeYhEb5d/Terralith_1.20.x_v2.5.4.jar"; sha512 = "885e171d8b34aae7e142f082d0364285ec5a8e8342f11c60d341f7a94083d5a42c4e30612fe4f9f64d57b484396a3dff3a224e2a2497d4ced8d22f2ad6cd561d"; }; - DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; }; - }); + whitelist = { + ChrisPBacon = "e6128495-075b-44a9-87f6-8d844d5ea0e4"; + satanjr616 = "1718f9d5-df1d-4aac-b10c-3229a0f1e8b2"; + Ono95 = "010e7652-6d5d-4f9e-af89-438c8fe694ca"; + JackLeLumber = "41910a94-8c8e-4528-a8ca-a2d7043f069d"; + DarkyLink = "6faddb7f-12a9-4aac-bc08-dd6db892a380"; + Archonite86 = "b5ab594d-de1c-4453-ba32-9107452be51b"; + NotACultist86 = "44ac3f7c-0e18-4234-bb04-11a0652cdaeb"; + }; + + jvmOpts = "-Xms4092M -Xmx4092M -XX:+UseG1GC -Djava.net.preferIPv4Stack=true"; + + symlinks = let + inherit (lib.attrsets) attrValues; + inherit (pkgs) linkFarmFromDrvs fetchurl; + in { + mods = linkFarmFromDrvs "mods" (attrValues { + FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; }; + Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; }; + # DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; }; + }); + }; + + files."ops.json" = { + value = [ + { + uuid = "e6128495-075b-44a9-87f6-8d844d5ea0e4"; + name = "ChrisPBacon"; + level = 4; + bypassesPlayerLimit = false; + } + { + uuid = "6faddb7f-12a9-4aac-bc08-dd6db892a380"; + name = "DarkyLink"; + level = 4; + bypassesPlayerLimit = false; + } + ]; + }; }; }; }; diff --git a/modules/services/oidc_clients.yml b/modules/services/oidc_clients.yml new file mode 100644 index 0000000..665daf5 --- /dev/null +++ b/modules/services/oidc_clients.yml @@ -0,0 +1,5 @@ +# Hashed client secrets go here, and unhashed ones go in the client configurations + +identity_providers: + oidc: + clients: diff --git a/modules/system/graphics.nix b/modules/system/graphics.nix index ef035a0..55f020e 100644 --- a/modules/system/graphics.nix +++ b/modules/system/graphics.nix @@ -20,21 +20,21 @@ # package = config.boot.kernelPackages.nvidiaPackages.vulkan_beta; - package = let - rcu_patch = pkgs.fetchpatch { - url = "https://github.com/gentoo/gentoo/raw/c64caf53/x11-drivers/nvidia-drivers/files/nvidia-drivers-470.223.02-gpl-pfn_valid.patch"; - hash = "sha256-eZiQQp2S/asE7MfGvfe6dA/kdCvek9SYa/FFGp24dVg="; - }; - in config.boot.kernelPackages.nvidiaPackages.mkDriver { - version = "550.40.07"; - sha256_64bit = "sha256-KYk2xye37v7ZW7h+uNJM/u8fNf7KyGTZjiaU03dJpK0="; - sha256_aarch64 = "sha256-AV7KgRXYaQGBFl7zuRcfnTGr8rS5n13nGUIe3mJTXb4="; - openSha256 = "sha256-mRUTEWVsbjq+psVe+kAT6MjyZuLkG2yRDxCMvDJRL1I="; - settingsSha256 = "sha256-c30AQa4g4a1EHmaEu1yc05oqY01y+IusbBuq+P6rMCs="; - persistencedSha256 = "sha256-11tLSY8uUIl4X/roNnxf5yS2PQvHvoNjnd2CB67e870="; + # package = let + # rcu_patch = pkgs.fetchpatch { + # url = "https://github.com/gentoo/gentoo/raw/c64caf53/x11-drivers/nvidia-drivers/files/nvidia-drivers-470.223.02-gpl-pfn_valid.patch"; + # hash = "sha256-eZiQQp2S/asE7MfGvfe6dA/kdCvek9SYa/FFGp24dVg="; + # }; + # in config.boot.kernelPackages.nvidiaPackages.mkDriver { + # version = "550.40.07"; + # sha256_64bit = "sha256-KYk2xye37v7ZW7h+uNJM/u8fNf7KyGTZjiaU03dJpK0="; + # sha256_aarch64 = "sha256-AV7KgRXYaQGBFl7zuRcfnTGr8rS5n13nGUIe3mJTXb4="; + # openSha256 = "sha256-mRUTEWVsbjq+psVe+kAT6MjyZuLkG2yRDxCMvDJRL1I="; + # settingsSha256 = "sha256-c30AQa4g4a1EHmaEu1yc05oqY01y+IusbBuq+P6rMCs="; + # persistencedSha256 = "sha256-11tLSY8uUIl4X/roNnxf5yS2PQvHvoNjnd2CB67e870="; - patches = [ rcu_patch ]; - }; + # patches = [ rcu_patch ]; + # }; }; }; }