ajout machine xray

* la définition d'un server de cache supprimait cache.nixos.org de la liste

  Pour le voir nixos-option nix.binaryCaches

activation-manuelle/fail2ban.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+
+{
+  # Gestion de fail2ban
+  
+  services = pkgs.lib.mkIf config.r6d.config-generator.fail2ban {
+    fail2ban = {
+      enable = true;
+      jails = {
+        DEFAULT = ''
+          # "ignoreip" can be an IP address, a CIDR mask or a DNS host
+          ignoreip = 127.0.0.1/8 pedro.dubronetwork.fr cube.dubronetwork.fr voyage.prunetwork.fr xray.prunetwork.fr 192.168.0.0/16 172.16.0.0/16
+
+          # 1 jour
+          # bantime  = 86400
+          # 5 jours 
+          bantime  = 432000
+          maxretry = 3
+
+          #
+          # Destination email address used solely for the interpolations in
+          # jail.{conf,local} configuration files.
+          destemail = admins@dubronetwork.fr
+        '';
+        ssh-route = ''
+          filter   = sshd
+          action   = route[blocktype=blackhole]
+          maxretry = 3
+        '';
+      };
+    };
+  };
+}

activation-manuelle/nix-serve-client.nix

@@ -2,12 +2,16 @@
 let
   inherit (lib) mkIf mkMerge;
   profiles = config.r6d.profiles;
+  computers = config.r6d.computers;
 in {
   nix = mkIf config.r6d.config-generator.nix-serve-client {
     # Cache http pour le store
     requireSignedBinaryCaches = false;
     binaryCaches =  [
-      (mkIf profiles.isDubronetwork "http://192.168.10.169:5000")
+      ("https://cache.nixos.org/")
+      (mkIf (profiles.isDubronetwork && (! computers.isMonstre)) "http://192.168.10.169:5000")
+      (mkIf profiles.isDubronetwork "http://192.168.10.252:5000")
+
       (mkIf profiles.isPrunetwork   "http://192.168.1.20:5000")
     ];
   };

config-generator.nix

@@ -5,6 +5,7 @@ let
   inherit (lib) mkEnableOption mkIf mkMerge mkOption singleton types;
   cfg = config.r6d.config-generator;
   pfl = config.r6d.profiles;
+  comp = config.r6d.computers;
   host = config.networking.hostName;
 in
 
@@ -12,6 +13,7 @@ in
   imports = [
     ./activation-manuelle/auto-upgrade.nix
     ./activation-manuelle/locate.nix
+    ./activation-manuelle/fail2ban.nix
     ./activation-manuelle/nix-serve-client.nix
     ./activation-manuelle/nix-serve-server.nix
     ./activation-manuelle/swap.nix
@@ -38,6 +40,7 @@ in
       enable          = mkEnableOption "Génération de la configuration d'une machine.";
       auto-upgrade    = mkEnableOption "Profil pour activer les mises à jour automatiques.";
       docker          = mkEnableOption "Profil pour l'utilisation de Docker.";
+      fail2ban        = mkEnableOption "Profil pour activer Fail2ban.";
       jeux            = mkEnableOption "Profil pour les jeux vidéos.";
       laptop          = mkEnableOption "Profil pour les outils spécifiques aux ordinateurs portables..";
       locate          = mkEnableOption "Profil pour activer la fonction locate.";
@@ -46,6 +49,15 @@ in
       swap            = mkEnableOption "Profil pour que le swap soit activé.";
       virtualbox      = mkEnableOption "Profil pour l'utilisation de VirtualBox.";
     };
+    #* Utilisé pour avoir des raccourcis de machine
+    r6d.computers = {
+      isLatitude      = mkEnableOption "Identification du nom de machine.";
+      isMonstre       = mkEnableOption "Identification du nom de machine.";
+      isNeoNomade     = mkEnableOption "Identification du nom de machine.";
+      isPhenom        = mkEnableOption "Identification du nom de machine.";
+      isRadx          = mkEnableOption "Identification du nom de machine.";
+      isXray          = mkEnableOption "Identification du nom de machine.";
+    };
   };
 
   ###### implementation
@@ -54,8 +66,15 @@ in
   config = mkMerge
   [ # Unconditional stuff.
     {
-      #environment.systemPackages = [ ... ];
       r6d.config-generator.enable = true;
+      r6d.computers = {
+        isLatitude  = host == "latitude.dubronetwork.fr";
+        isMonstre   = host == "monstre.dubronetwork.fr";
+        isNeoNomade = host == "neo-nomade.dubronetwork.fr";
+        isPhenom    = host == "phenom.dubronetwork.fr";
+        isRadx      = host == "radx.prunetwork.fr";
+        isXray      = host == "xray.prunetwork.fr";
+      };
     }
 
     # Conditional stuff
@@ -90,13 +109,14 @@ in
     })
     (mkIf pfl.isPrunetwork {
       r6d.config-generator.auto-upgrade = true;
+      r6d.config-generator.fail2ban = true;
       r6d.config-generator.nix-serve-client = true;
       r6d.config-generator.swap = true;
     })
  
  
     ## Affectation des profils aux machines
-    (mkIf (host == "radx.prunetwork.fr") {
+    (mkIf comp.isRadx {
       r6d.profiles.isHome = true;
       r6d.profiles.isPrunetwork = true;
       r6d.profiles.isServer = true;
@@ -106,8 +126,12 @@ in
         virtualbox = true;
       };
     })
+    (mkIf comp.isXray {
+      r6d.profiles.isPrunetwork = true;
+      r6d.profiles.isServer = true;
+    })
 
-    (mkIf (host == "latitude.dubronetwork.fr") {
+    (mkIf comp.isLatitude {
       r6d.profiles.isDubronetwork = true;
       r6d.profiles.isHome = true;
       r6d.profiles.isWorkstation = true;
@@ -116,11 +140,13 @@ in
         laptop = true;
       };
     })
-   (mkIf (host == "monstre.dubronetwork.fr") {
+   (mkIf comp.isMonstre {
       r6d.profiles.isDubronetwork = true;
       r6d.profiles.isServer = true;
+
+      r6d.config-generator.fail2ban = true;
     })
-    (mkIf (host == "neo-nomade.dubronetwork.fr") {
+    (mkIf comp.isNeoNomade{
       r6d.profiles.isDubronetwork = true;
       r6d.profiles.isHome = true;
 
@@ -128,7 +154,7 @@ in
         laptop = true;
       };
     })
-     (mkIf (host == "phenom.dubronetwork.fr") {
+     (mkIf comp.isPhenom {
       r6d.profiles.isDubronetwork = true;
       r6d.profiles.isHome = true;
       r6d.profiles.isWorkstation = true;

gitconfig

@@ -1,3 +1,4 @@
+# http://www.git-attitude.fr/2014/09/15/30-options-git-qui-gagnent-a-etre-connues/
 [color]
     diff = auto
     branch = auto
@@ -10,6 +11,7 @@
     ci = commit
     co = checkout
     ff = pull --ff-only
+    oops = commit --amend --no-edit
     # Show files ignored by git
     ignored = ls-files -o -i --exclude-standard
     ls = ls-files