qo.is/infrastructure
3
0
Fork 0
Code Issues 12 Pull requests 2 Projects 1 Activity Actions

Compare commits

base: qo.is:6661ab441db4bb41f473a00ff9cf28625ab1e886
Branches Tags
qo.is:main
qo.is:54-deploy-vms-automatically
qo.is:renovate/lock-file-maintenance
qo.is:18-caral
..
compare: qo.is:bcf390e8a753c65542d2688a1de1976de7eea5a0
Branches Tags
qo.is:54-deploy-vms-automatically
qo.is:renovate/lock-file-maintenance
qo.is:main
qo.is:18-caral

5 commits
6661ab441d ... bcf390e8a7

Author SHA1 Message Date
Fabian Hauser
bcf390e8a7 Remove CVE-2024-6387 ssh workaround
Some checks failed
CI / build (push) Has been cancelled
Details
2024-12-10 14:49:54 +02:00
Fabian Hauser
75ffd54e7d Update inputs 2024-12-10 14:49:54 +02:00
Fabian Hauser
5507106e41 Refactore backplane-net to module with hosts 2024-12-10 14:49:54 +02:00
Fabian Hauser
752bed060b Refactor attic configuration as module 2024-12-10 14:49:54 +02:00
Fabian Hauser
cf86743d68 Remove self-hosted subsitution services from lindberg-build 2024-12-10 14:49:54 +02:00
1 changed files with 20 additions and 19 deletions
Show stats Expand all files Collapse all files

39
defaults/base-minimal/default.nix
View file

@ -52,21 +52,26 @@
# Package management # Package management
nix = { nix = {
settings = { settings =
trusted-users = [ let
"root" substituters = [
"@wheel" "https://${inputs.self.nixosConfigurations.lindberg-build.config.qois.nixpkgs-cache.hostname}?priority=39"
]; "https://cache.nixos.org?priority=40"
substituters = [ "https://attic.qo.is/qois-infrastructure"
"https://${inputs.self.nixosConfigurations.lindberg-build.config.qois.nixpkgs-cache.hostname}?priority=39" ];
"https://cache.nixos.org?priority=40" in
"https://attic.qo.is/qois-infrastructure" {
]; trusted-users = [
trusted-public-keys = [ "root"
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "@wheel"
"qois-infrastructure:lh35ymN7Aoxm5Hz0S6JusxE+cYzMU+x9OMKjDVIpfuE=" ];
]; trusted-public-keys = [
}; "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"qois-infrastructure:lh35ymN7Aoxm5Hz0S6JusxE+cYzMU+x9OMKjDVIpfuE="
];
trusted-substituters = substituters; # For hosts that limit the subst list
inherit substituters;
};
gc = { gc = {
automatic = true; automatic = true;
dates = "weekly"; dates = "weekly";
@ -87,10 +92,6 @@
services.openssh = { services.openssh = {
enable = true; enable = true;
settings.PasswordAuthentication = false; settings.PasswordAuthentication = false;
# temporary mitigation agains CVE-2024-6387 «regreSSHion» RCE
# See https://github.com/NixOS/nixpkgs/pull/323753#issuecomment-2199762128
settings.LoginGraceTime = 0;
}; };
security.acme = { security.acme = {