| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
| |
Delete files related to:
- Terraform
- opt/*
- scripts/deploy
- secrets/*
- git-crypt
- Nix
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- remove NixOS stateVersion from .envrc;
- add guix-reconfigure.sh;
- add vps.scm with initial Guix system configuration;
- update vps.tf to use the new "base-guix" snapshot.
The "base-guix" image doesn't need a password. The "andreh" users has one, but
it is configured for not requiring it when running commands as "sudo".
The expected minimal steps one has to go through for privilege scalation is via
the SSH private key, and accessing the VPS via SSH. Since password login is
disabled and root can't login via SSH either, only the private SSH key allows
access to the server. After that, the attacker will be able to run commands as
root.
|
| | |
|
| | |
|
| |
|
|
| |
Also rename thingTLD to thingDomain.
|
| |
|
|
|
|
|
| |
I'm using the snapshot here because I don't have any backup system yet, ¯\_(ツ)_/¯
This should be reverted on vps.tf after applying, and I should get down to doing
automatic backups.
|
| | |
|
| |
|
|
|
|
| |
Terraform file changes were du to me initially trying to do this via creating a
SRV DNS record. However this is not required, because Prosody is already on the
$TLD sever, the only difference being that it is listening on a different port.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
After a terraform state rm '...' of the server and domain configuration, and
recreating the instance again while leaving the dettached one running.
I had to do this because I was experimenting too much with the domain and I hit
the Let's Encrypt rate limit[0].
Because of that I'll recreate certificates less often so that doesn't happen in
the new domain during development of the VPS.
I'm not shure if this solution works, but I'll commit just as a checkpoint. I
had to change the custom DNS nameservers from Digital Ocean to Vultr and that
may take a while, so it's worth having this as a checkpoint in time while I'm
off to other things.
[0]: https://letsencrypt.org/docs/rate-limits/
|
| |
|
|
|
| |
Useful reference:
- https://discourse.nixos.org/t/can-i-move-etc-nixos-to-my-dotfiles-and-symlink-it-back-to-etc-nixos/4833/10
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
