127 lines
3.3 KiB
Text
127 lines
3.3 KiB
Text
// This file is managed in the nixos-config repo
|
|
{
|
|
// Declare static groups of users beyond those in the identity service.
|
|
"groups": {
|
|
"group:admins": ["DarkKirb@github"]
|
|
},
|
|
|
|
// Access control lists.
|
|
"acls": [
|
|
// Allow DNS access to the DNS servers
|
|
{
|
|
"action": "accept",
|
|
"src": ["*"],
|
|
"dst": ["tag:dnsserver:53"]
|
|
},
|
|
// Allow ssh access to build devices
|
|
{
|
|
"action": "accept",
|
|
"src": ["*"],
|
|
"dst": ["tag:buildserver:22"]
|
|
},
|
|
// Allow all development devices to connect via ssh
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:devDevice"],
|
|
"dst": ["*:22"]
|
|
},
|
|
|
|
// http servers running on the servers can be accessed
|
|
{
|
|
"action": "accept",
|
|
"src": ["*"],
|
|
"dst": ["tag:server:80", "tag:server:443"]
|
|
},
|
|
|
|
// members can access email server
|
|
{
|
|
"action": "accept",
|
|
"src": ["*"],
|
|
"dst": [
|
|
"tag:nixos-8gb-fsn1-1:25", // SMTP
|
|
"tag:nixos-8gb-fsn1-1:110", // POP3
|
|
"tag:nixos-8gb-fsn1-1:143", // IMAP
|
|
"tag:nixos-8gb-fsn1-1:465", // Submission
|
|
"tag:nixos-8gb-fsn1-1:587", // SMTPS
|
|
"tag:nixos-8gb-fsn1-1:993", // IMAPS
|
|
"tag:nixos-8gb-fsn1-1:995" // POP3S
|
|
]
|
|
},
|
|
|
|
// Prometheus scrapers
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:nixos-8gb-fsn1-1"],
|
|
"dst": [
|
|
"*:9100", // node exporter
|
|
"*:28183",
|
|
"*:41115", // promtail
|
|
"tag:dnsserver:9119", // bind
|
|
"tag:nixos-8gb-fsn1-1:9000", // matrix mediaa repo
|
|
"tag:nas:9102", // statsd-exporter
|
|
"tag:nixos-8gb-fsn1-1:3100", // loki
|
|
"tag:server:9187", // postgres
|
|
"tag:nutty-noon:9187"
|
|
]
|
|
},
|
|
|
|
// postgres and redis
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:instance-20221213-1915"],
|
|
"dst": ["tag:nixos-8gb-fsn1-1:5432", "tag:nixos-8gb-fsn1-1:53538"]
|
|
},
|
|
|
|
// syncthing
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:syncthing"],
|
|
"dst": ["tag:syncthing:22000"]
|
|
},
|
|
// syncthing admin panel, cups
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:devDevice"],
|
|
"dst": ["tag:nas:8384", "tag:nas:631", "tag:ipfs:5001"]
|
|
},
|
|
// Woodpecker agents
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:woodpeckerRunner"],
|
|
"dst": ["tag:nas:9000"]
|
|
},
|
|
// Mautrix bridges
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:nas"],
|
|
"dst": [
|
|
"tag:instance-20221213-1915:29320", // mautrix-discord
|
|
"tag:instance-20221213-1915:29328", // mautrix-signal
|
|
"tag:instance-20221213-1915:29317", // mautrix-telegram
|
|
"tag:instance-20221213-1915:29318" // mautrix-whatsapp
|
|
]
|
|
},
|
|
// IPFS
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:ipfs"],
|
|
"dst": ["tag:ipfs:4001"]
|
|
}
|
|
],
|
|
|
|
"tagOwners": {
|
|
"tag:instance-20221213-1915": ["DarkKirb@github"],
|
|
"tag:nixos-8gb-fsn1-1": ["DarkKirb@github"],
|
|
"tag:nas": ["DarkKirb@github"],
|
|
"tag:moto-g82-5g": ["DarkKirb@github"],
|
|
"tag:nutty-noon": ["DarkKirb@github"],
|
|
"tag:thinkrac": ["DarkKirb@github"],
|
|
"tag:dnsserver": ["DarkKirb@github"],
|
|
"tag:buildserver": ["DarkKirb@github"],
|
|
"tag:devDevice": ["DarkKirb@github"],
|
|
"tag:server": ["DarkKirb@github"],
|
|
"tag:syncthing": ["DarkKirb@github"],
|
|
"tag:woodpeckerRunner": ["DarkKirb@github"],
|
|
"tag:ipfs": ["DarkKirb@github"]
|
|
}
|
|
}
|