Merge branch 'main' of https://tangled.sh/@ocbwoy3.dev/nix

hosts/server/configuration.nix

@@ -5,6 +5,7 @@
 		./modules/atproto-pds.nix
 		./modules/cloudflare.nix
 		./modules/knot.nix
+		./modules/misskey.nix
 		../../modules/force.nix
 	];
 

hosts/server/modules/atproto-pds.nix

@@ -6,7 +6,7 @@
 	# Upload PDS backup to /var/lib/pds
 	# and specify secrets in /private/atproto-pds.env
 
-	services.pds = {
+	services.bluesky-pds = {
 		enable = true;
 		pdsadmin.enable = true;
 		environmentFiles = [ "/private/atproto-pds.env" ];
@@ -14,7 +14,7 @@
 			PDS_CRAWLERS = "https://bsky.network";
 			LOG_ENABLED = "true";
 			PDS_HOSTNAME = "pds.ocbwoy3.dev";
-			PDS_VERSION = "\"ATProto PDS v69420\"";
+			# PDS_VERSION = "\"ATProto PDS v69420\"";
 			PDS_DID_PLC_URL = "https://plc.directory";
 			PDS_CONTACT_EMAIL_ADDRESS = "ocbwoy3@ocbwoy3.dev";
 			PDS_PRIVACY_POLICY_URL = "https://ocbwoy3.dev";

hosts/server/modules/misskey.nix

@@ -0,0 +1,31 @@
+{ config, pkgs, lib, ... }:
+
+{
+    services.misskey = {
+        enable = true;
+
+        settings = {
+            maxFileSize = 20 * 1024 * 1024;
+            port = 8089;
+            url = "https://ocbwoy3.dev";
+            publishTarballInsteadOfProvideRepositoryUrl = false;
+        };
+
+        database = {
+            # passwordFile = "/private/misskey-db.pw";
+            createLocally = true;
+        };
+
+        redis = {
+            # passwordFile = "/private/misskey-db.pw";
+            createLocally = true;
+        };
+
+        reverseProxy.enable = lib.mkDefault false; # shit, we already have cloudflared
+
+    };
+
+    systemd.tmpfiles.rules = [
+        "d /misskey 0755 root root -"
+    ];
+}

modules/nixos/programs.nix

@@ -26,9 +26,24 @@
 		c-ares ffmpeg gtk3 http-parser libevent libvpx libxslt minizip nss re2 snappy libnotify libappindicator-gtk3
 	];
 
+	services.fail2ban = {
+		enable = true;
+		# Ban IP after 5 failures
+		maxretry = 5;
+		ignoreIP = [
+			"10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
+		];
+	};
+
 	services.openssh = {
 		enable = true;
 		ports = [ 22 ];
+		settings = {
+			PasswordAuthentication = false;
+			KbdInteractiveAuthentication = false;
+			PermitRootLogin = "no";
+			AllowUsers = [ "ocbwoy3" "git" ];
+		};
 		# fucks up ssh connections from iphone if you enable this
 		# settings = {
 		# 	KexAlgorithms = [ "curve25519-sha256@libssh.org" ];