wip: add specus VPN

configs/stardict.nix

@@ -161,11 +161,11 @@
     turkish = {
       BabylonTurkishEnglish = pkgs.fetchzip {
         url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_Turkish_English-2.4.2.tar.bz2";
-        sha256 = "1zpzgk3w0536gww31bj58cmn3imnkndyjwbcr7bay8ibq2kzv44z";
+        sha256 = "17rv46r95nkikg7aszqmfrbgdhz9ny52w423m8n01g3p93shdb4i";
       };
       BabylonEnglishTurkish = pkgs.fetchzip {
         url = "http://download.huzheng.org/babylon/bidirectional/stardict-babylon-Babylon_English_Turkish-2.4.2.tar.bz2";
-        sha256 = "0myx31xzb7nrn5m657h0bwdgm5xp93ccwp6lcpbxgjxdjm3q0hc5";
+        sha256 = "063dl02s8ii8snsxgma8wi49xwr6afk6ysq0v986fygx5511353f";
       };
     };
   };

flake.lock

@@ -363,11 +363,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1681482634,
-        "narHash": "sha256-cT/nr3L8khEYZSGp8qqwxFH+/q4/547MfyOdSj6MhBk=",
+        "lastModified": 1681269223,
+        "narHash": "sha256-i6OeI2f7qGvmLfD07l1Az5iBL+bFeP0RHixisWtpUGo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fda0d99c2cbbb5c89d8855d258cb0821bd9113ad",
+        "rev": "87edbd74246ccdfa64503f334ed86fa04010bab9",
         "type": "github"
       },
       "original": {
@@ -458,11 +458,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1681601319,
-        "narHash": "sha256-R/UmDcWLxks3WjA95MA2oPLgqnVN2TZHF+C5s4VaEpo=",
+        "lastModified": 1681454031,
+        "narHash": "sha256-JOamj7vKkFRp5mJ7FKt5dPfCmWj33sZLnBGDt15c/sc=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c9e3bd49580c525989f6ce9803e1c5875ab8548a",
+        "rev": "8a35714f0be00235e2a1c8b759e6dc3888763d8b",
         "type": "github"
       },
       "original": {

flake.nix

@@ -49,6 +49,7 @@
         passport = import modules/passport.nix;
         panoptikon = import modules/panoptikon.nix;
         power-action = import modules/power-action.nix;
+        specus = import modules/specus.nix;
         system-dependent = import modules/system-dependent.nix;
         telegram-bot = import modules/telegram-bot.nix;
         traadfri = import modules/traadfri.nix;
@@ -79,6 +80,7 @@
             systems/ful/configuration.nix
             agenix.nixosModules.default
             inputs.self.nixosModules.passport
+            inputs.self.nixosModules.specus
             inputs.self.nixosModules.panoptikon
             retiolum.nixosModules.retiolum
             nur.nixosModules.nur
@@ -127,6 +129,7 @@
             inputs.self.nixosModules.telegram-bot
             inputs.self.nixosModules.htgen
             inputs.self.nixosModules.passport
+            inputs.self.nixosModules.specus
             agenix.nixosModules.default
             retiolum.nixosModules.retiolum
             nur.nixosModules.nur
@@ -190,6 +193,7 @@
             systems/kabsa/configuration.nix
             agenix.nixosModules.default
             retiolum.nixosModules.retiolum
+            inputs.self.nixosModules.specus
             home-manager.nixosModules.home-manager
             nur.nixosModules.nur
           ];

lib/colours/owickstrom-dark.nix

@@ -1,37 +1,37 @@
-rec { # all dark colours are 20% darker than the bright ones
+rec {
   black = {
-    bright = "#4c5363"; # "#282c34";
-    dark = "#20232a";
+    bright = "#282c34";
+    dark = "#282c34";
   };
   red = {
-    bright = "#e68990"; #"#e06c75";
-    dark = "#d43541";
+    bright = "#e06c75";
+    dark = "#e06c75";
   };
   green = {
-    bright = "#acce93"; #"#98c379";
-    dark = "#77af4e";
+    bright = "#98c379";
+    dark = "#98c379";
   };
   yellow = {
-    bright = "#eacc95"; #"#e5c07b";
-    dark = "#d9a440";
+    bright = "#e5c07b";
+    dark = "#e5c07b";
   };
   blue = {
-    bright = "#80bff2"; #"#61afef";
-    dark = "#2490e9";
+    bright = "#61afef";
+    dark = "#61afef";
   };
   magenta = {
-    bright = "#d193e3"; #"#c678dd";
-    dark = "#af42cf";
+    bright = "#c678dd";
+    dark = "#c678dd";
   };
   cyan = {
-    bright = "#77c4ce"; #"#56b6c2";
-    dark = "#3b99a5";
+    bright = "#56b6c2";
+    dark = "#56b6c2";
   };
   white = {
-    bright = "#e3e5e9"; #"#dcdfe4";
-    dark = "#a9b1bd";
+    bright = "#dcdfe4";
+    dark = "#dcdfe4";
   };
-  background = "#282c34"; #black.dark;
-  foreground = "#dcdfe4"; #white.bright;
+  background = black.dark;
+  foreground = white.bright;
   cursor = "#a3b3cc";
 }

lib/colours/owickstrom-light.nix

@@ -29,9 +29,9 @@ rec {
   };
   white = {
     bright = "#8c00ec";
-    dark = "#bfbfbf";
+    dark = "#efefef";
   };
-  background = "#efefef";
+  background = white.dark;
   foreground = "#181818";
-  cursor = "#a3b3cc";
+  cursor = "#bbbbbb";
 }

modules/specus.nix

@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  specusMachines = {
+    servers = {
+      makanek = {
+        ipv4 = "10.100.0.1";
+        publicKey = "KhcScd4fBpdhQzK8Vc+1mEHQMQBpbKBUPB4oZ7skeSk=";
+      };
+      ful = {
+        ipv4 = "10.100.0.2";
+        publicKey = "0Y7+zoXkWJGVOWWnMjvYjtwP+WpggAlmkRbgMw0z8Dk=";
+      };
+    };
+    clients = {
+      kabsa = {
+        ipv4 = "10.100.0.101";
+        publicKey = "nRkzoRi9crKHF7263U37lt4GGL7/8637NBSKjifI9hY=";
+      };
+    };
+  };
+in {
+  options.services.specus = {
+    server = {
+      enable = lib.mkEnableOption "Specus private VPN (server)";
+    };
+    client = {
+      enable = lib.mkEnableOption "Specus private VPN (client)";
+    };
+    privateKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Private key file of the server/client machine";
+    };
+  };
+
+  config = let
+    cfg = config.services.specus;
+    specusPort = 22;
+  in
+    {
+      assertions = [
+        {
+          assertion =
+            !(cfg.server.enable && cfg.client.enable);
+          message = "specus: systems cannot be client and server at the same time";
+        }
+      ];
+    }
+    // lib.mkIf cfg.server.enable {
+      networking.nat = {
+        enable = true;
+        externalInterface = "eth0"; # TODO
+        internalInterfaces = ["specus"];
+      };
+      networking.firewall.allowedUDPPorts = [specusPort];
+      networking.wireguard.interfaces.specus = {
+        ips = ["${specusMachines.servers.${config.networking.hostName}.ipv4}/24"];
+        # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+        listenPort = specusPort;
+        privateKeyFile = cfg.privateKeyFile;
+        peers =
+          lib.mapAttrsToList (clientName: clientConfig: {
+            publicKey = clientConfig.publicKey;
+            allowedIPs = ["${clientConfig.ipv4}/32"];
+          })
+          specusMachines.clients;
+      };
+    }
+    // lib.mkIf cfg.client.enable {
+      networking.firewall.allowedUDPPorts = [specusPort];
+      networking.wireguard.interfaces = lib.attrsets.mapAttrs' (serverName: serverConfig:
+        lib.nameValuePair "specus-${serverName}" {
+          ips = ["${specusMachines.clients.${config.networking.hostName}.ipv4}/24"];
+          listenPort = specusPort;
+          privateKeyFile = cfg.privateKeyFile;
+          peers = [
+            {
+              allowedIPs = ["0.0.0.0/0"];
+              endpoint = "${(import ../lib/external-network.nix).${serverName}}:${toString specusPort}";
+              persistentKeepalive = 25;
+              publicKey = serverConfig.publicKey;
+            }
+          ];
+        })
+      specusMachines.servers;
+    };
+}

packages/itl.nix

@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, cmake, lib }:
+stdenv.mkDerivation rec {
+  pname = "itl";
+  version = "0.8.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "ITL";
+    rev = "v${version}";
+    sha256 = "sha256-GTicTbZmFbPhzInFob3cfvtTxOpUZuqsQz1w9CoWu9w=";
+  };
+  nativeBuildInputs = [cmake];
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "Islamic Tools and Libraries";
+    license = lib.licenses.lgpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}

packages/itools.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, itl, lib, autoreconfHook }:
+stdenv.mkDerivation rec {
+  pname = "itools";
+  version = "1.0";
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "itools";
+    rev = version;
+    sha256 = "sha256-g9bsjupC4Sb5ywAgUNbjYLbHZ/i994lbNSnX2JyaP3g=";
+  };
+  preAutoreconf = "autoupdate";
+  nativeBuildInputs = [autoreconfHook];
+  buildInputs = [itl];
+  meta = {
+    homepage = "https://www.arabeyes.org/ITL";
+    description = "The itools package is a set of user friendly applications utilizing Arabeyes' ITL library. ";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainer = [lib.maintainers.kmein];
+  };
+}

systems/ful/configuration.nix

@@ -49,6 +49,12 @@ in {
     };
     root.file = ../../secrets/ful-root.age;
     restic.file = ../../secrets/restic.age;
+    specus.file = ../../secrets/ful-specus-privateKey.age;
+  };
+
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    server.enable = true;
   };
 
   services.restic.backups.niveum = {

systems/kabsa/configuration.nix

@@ -40,10 +40,16 @@ in {
     restic.file = ../../secrets/restic.age;
     syncthing-cert.file = ../../secrets/kabsa-syncthing-cert.age;
     syncthing-key.file = ../../secrets/kabsa-syncthing-key.age;
+    specus.file = ../../secrets/kabsa-specus-privateKey.age;
   };
 
   environment.systemPackages = [pkgs.minecraft pkgs.zeroad];
 
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    client.enable = false;
+  };
+
   networking = {
     hostName = "kabsa";
     wireless.interfaces = ["wlp3s0"];

systems/makanek/configuration.nix

@@ -95,6 +95,12 @@ in {
       group = "tinc.retiolum";
     };
     restic.file = ../../secrets/restic.age;
+    specus.file = ../../secrets/makanek-specus-privateKey.age;
+  };
+
+  services.specus = {
+    privateKeyFile = config.age.secrets.specus.path;
+    server.enable = true;
   };
 
   system.stateVersion = "20.03";

systems/zaatar/moodle-dl-meinhark.nix

@@ -95,11 +95,6 @@ in {
         # WS 2022
         115414 # Nonnos
         116108 # Dialektologie
-
-        # SS 2023
-        117967 # Archaische Lyrik
-        119658 # Dyskolos
-        118963 # Antike Biographie
       ];
       download_submissions = true;
       download_descriptions = true;