lyes/nixfiles
1
0
Fork 0
Code Issues Pull requests Activity Actions

Updates to the server and first rate limiting attempts

Browse source
This commit is contained in:
Lyes Saadi 2026-01-06 17:44:17 +01:00
parent c8a103ea43
commit e91c83f572
Signed by: lyes
GPG key ID: 55A1D803917CF39A
4 changed files with 34 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

18
hosts/zora/networking.nix
View file

@ -50,4 +50,22 @@
};
};
};
# Imposing a bandwidth limit to avoid Aurore/Crans disruptions
networking.nftables = {
tables.rate_limit = {
name = "rate_limit";
family = "inet";
enable = true;
content = ''
limit lim { rate over 20 mbytes/second burst 1 gbytes ; comment "use to limit taffic" ; }
chain IN {
type filter hook input priority filter; policy drop;
tcp dport 80 limit name "lim" accept
tcp dport 443 limit name "lim" accept
}
'';
};
};
}

2
modules/server/default.nix
View file

@ -22,6 +22,8 @@
'';
};
networking.nftables.enable = true;
environment.systemPackages = with pkgs; [
mdadm
];

3
modules/server/maistro/default.nix
View file

@ -3,7 +3,8 @@
{
virtualisation.incus.enable = true;
virtualisation.incus.ui.enable = true;
networking.nftables.enable = true;
# Enabled on server as a whole
# networking.nftables.enable = true;
networking.firewall.trustedInterfaces = [ "incusbr0" ];
virtualisation.incus.preseed = {
networks = [

22
modules/server/taf/default.nix
View file

@ -79,18 +79,12 @@
# Crans Nounou
elsif anyof (
header :contains "List-Id" "<nounou.lists.crans.org>",
header :contains "List-Id" "<apprenti-es.lists.crans.org>"
header :contains "List-Id" "<apprenti-es.lists.crans.org>",
address :is :all "To" "contact@crans.org",
address :is :all "From" "contact@crans.org"
) {
fileinto :create "Crans.crans.nounou";
}
# Crans Root
elsif anyof (
address :is :all "To" "root@crans.org",
address :is :all "From" "root@crans.org",
address :is :all "From" "www-data@crans.org"
) {
fileinto :create "Crans.crans.root";
}
# Crans Root Postmaster
elsif address :is :all "To" "postmaster@crans.org" {
addflag "\\Seen";
@ -100,6 +94,14 @@
elsif address :is :all "From" "MAILER-DAEMON@crans.org" {
fileinto :create "Crans.crans.root.mailer";
}
# Crans Root
elsif anyof (
address :is :all "To" "root@crans.org",
address :is :all "From" "root@crans.org",
address :is :all "From" "www-data@crans.org"
) {
fileinto :create "Crans.crans.root";
}
# Crans Gitlab
elsif address :is :all "From" "gitlab@crans.org" {
fileinto :create "Crans.crans.gitlab";
@ -179,7 +181,7 @@
# "@lyes.eu" = "lyes@mail.lyes.eu";
# };
# certificateScheme = "acme-nginx";
x509.useACMEHost = config.mailserver.fqdn;
};
# services.dovecot2.extraConfig = ''