update: system update & refactor
# Breaking Changes - sops location movod to "system/dev/<dev-name>/sops/sops-conf.nix" - flake devices declaration changes - whole flake update
This commit is contained in:
danny
parent
321f740af0
commit
6a71b601f5
116 changed files with 2576 additions and 3634 deletions
|
|
@ -1,428 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
username,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit username;
|
||||
|
||||
ethInterface = "enp0s31f6";
|
||||
sshPorts = [ 30072 ];
|
||||
sshPortsString = builtins.concatStringsSep ", " (builtins.map (p: builtins.toString p) sshPorts);
|
||||
|
||||
personal = {
|
||||
inherit (config.networking) domain;
|
||||
ip = "10.0.0.1/24";
|
||||
interface = "wg0";
|
||||
port = 51820;
|
||||
range = "10.0.0.0/24";
|
||||
full = "10.0.0.1/25";
|
||||
restrict = "10.0.0.128/25";
|
||||
};
|
||||
|
||||
kube = {
|
||||
ip = "10.10.0.1/24";
|
||||
range = "10.10.0.0/24";
|
||||
interface = "wg1";
|
||||
port = 51821;
|
||||
masterIP = "10.10.0.1";
|
||||
masterHostname = "api-kube.${config.networking.domain}";
|
||||
masterAPIServerPort = 6443;
|
||||
};
|
||||
|
||||
allowedSSHIPs = builtins.concatStringsSep ", " [
|
||||
"122.117.215.55"
|
||||
"192.168.100.1/24"
|
||||
personal.range
|
||||
];
|
||||
|
||||
fullRoute = [
|
||||
{
|
||||
# Jonly
|
||||
dns = "jonly";
|
||||
publicKey = "GAayY6p8ST3I66kFSGY3seaHhfkrc6atcrFu2C9BDDs=";
|
||||
allowedIPs = [ "10.0.0.5/32" ];
|
||||
}
|
||||
{
|
||||
dns = "jonly-mac";
|
||||
publicKey = "jPmeA0WH3vQw/PDNdJwYLfE7Ibl5oZGuta9UkZNEyTk=";
|
||||
allowedIPs = [ "10.0.0.9/32" ];
|
||||
}
|
||||
{
|
||||
# YC
|
||||
dns = "yc";
|
||||
publicKey = "5LfmjAg07ixmBCcsEn319UHqMRO3AdusXsoibGUqfQE=";
|
||||
allowedIPs = [ "10.0.0.7/32" ];
|
||||
}
|
||||
{
|
||||
# Tommy
|
||||
dns = "tommy";
|
||||
publicKey = "AxujfkiHLj09LoAXZl7yUf3fzyjorKOg8CfcJJvr2HQ=";
|
||||
allowedIPs = [ "10.0.0.8/32" ];
|
||||
}
|
||||
];
|
||||
|
||||
meshRoute = [
|
||||
{
|
||||
# pre7780.dn
|
||||
dns = "pre7780";
|
||||
publicKey = "WvvBRGbWUMUhSgodZNlhglacsWhMOTdHhJxcf81kTmQ=";
|
||||
allowedIPs = [ "10.0.0.130/32" ];
|
||||
}
|
||||
{
|
||||
# Skydrive
|
||||
dns = "skydrive";
|
||||
publicKey = "GceSQwI7XqYQw2oPmquuKdPqmt6KsYnoGuFoiaKRb0E=";
|
||||
allowedIPs = [ "10.0.0.132/32" ];
|
||||
}
|
||||
{
|
||||
# ken
|
||||
dns = "phone.ken";
|
||||
publicKey = "knRpD7qb2JejioJBP5HZgWCrDEOWUq27+ueWPYwnWws=";
|
||||
allowedIPs = [ "10.0.0.134/32" ];
|
||||
}
|
||||
{
|
||||
# lap.dn
|
||||
dns = "lap";
|
||||
publicKey = "Cm2AZU+zlv+ThMqah6WiLVxgPNvMHm9DEGd4PfywNWU=";
|
||||
allowedIPs = [ "10.0.0.135/32" ];
|
||||
}
|
||||
{
|
||||
# justin03
|
||||
dns = "justin";
|
||||
publicKey = "WOze/PPilBPqQudk1D4Se34zWV3UghKXWTG6M/f7bEM=";
|
||||
allowedIPs = [ "10.0.0.136/32" ];
|
||||
}
|
||||
{
|
||||
# ahhaha
|
||||
dns = "ahhaha";
|
||||
publicKey = "PGBqCPLxaFd/+KqwrjF6B6lqxvpPKos0sst5gk8p8Bo=";
|
||||
allowedIPs = [ "10.0.0.137/32" ];
|
||||
}
|
||||
{
|
||||
# oreo
|
||||
dns = "oreo";
|
||||
publicKey = "GXHRZ9DmVg7VtuJdvcHOGFCuFqH2Kd/c+3unrq7e5SE=";
|
||||
allowedIPs = [ "10.0.0.139/32" ];
|
||||
}
|
||||
{
|
||||
# phone.dn
|
||||
dns = "phone";
|
||||
publicKey = "XiR4NZLdHyOvzt+fdYoFDW2s/Su8nlz8UgrVPLISdBY=";
|
||||
allowedIPs = [ "10.0.0.140/32" ];
|
||||
}
|
||||
{
|
||||
# kavic
|
||||
dns = "kavic";
|
||||
publicKey = "VVzGcHjSo6QkvN6raS9g/NYLIrZ1xzxdnEronQaTIHs=";
|
||||
allowedIPs = [ "10.0.0.141/32" ];
|
||||
}
|
||||
{
|
||||
dns = "yc-mesh";
|
||||
publicKey = "dKcEjRq9eYA8rXVfispNoKEbrs9R3ZIVlQi5AXfFch8=";
|
||||
allowedIPs = [ "10.0.0.142/32" ];
|
||||
}
|
||||
{
|
||||
dns = "jonly-mesh";
|
||||
publicKey = "EyRL+iyKZJaqz9DXVsH2Ne/wVInx5hg9oQARrXP3/k0=";
|
||||
allowedIPs = [ "10.0.0.143/32" ];
|
||||
}
|
||||
{
|
||||
dns = "tommy-mesh";
|
||||
publicKey = "oCRNCyg0bw6W6W87XQ4pIUW+WFi/bx9MG4cIwE23GxI=";
|
||||
allowedIPs = [ "10.0.0.144/32" ];
|
||||
}
|
||||
{
|
||||
# ken
|
||||
dns = "pc.ken";
|
||||
publicKey = "ERLMpSbSIYRN5HoKmvsk2852/aAvzjvMV7tOs0oupxI=";
|
||||
allowedIPs = [ "10.0.0.145/32" ];
|
||||
}
|
||||
{
|
||||
# Skydrive Lap
|
||||
dns = "skydrive-mesh";
|
||||
publicKey = "MK6UX8WadSbDXI3919F5EarYlZHjFNbHwYJH8Ub/YXk=";
|
||||
allowedIPs = [ "10.0.0.146/32" ];
|
||||
}
|
||||
{
|
||||
# Skydrive Phone
|
||||
dns = "skydrive-mesh-phone";
|
||||
publicKey = "K6Pd69/Hfu4ceCAp/JbeEL2QQ+/4ohugW1lAOxHFKDA=";
|
||||
allowedIPs = [ "10.0.0.147/32" ];
|
||||
}
|
||||
{
|
||||
# GCP
|
||||
dns = "gcp";
|
||||
publicKey = "5th0G9c7vHrhcByvPJAbrn2LXjLPqDEMsHzda0FGUTQ=";
|
||||
allowedIPs = [ "10.0.0.148/32" ];
|
||||
}
|
||||
];
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
nat = {
|
||||
enable = true;
|
||||
enableIPv6 = true;
|
||||
externalInterface = ethInterface;
|
||||
internalInterfaces = [
|
||||
personal.interface
|
||||
kube.interface
|
||||
];
|
||||
};
|
||||
|
||||
firewall = {
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
personal.port
|
||||
kube.port
|
||||
25565
|
||||
kube.masterAPIServerPort
|
||||
5359
|
||||
];
|
||||
allowedTCPPorts = sshPorts ++ [
|
||||
53
|
||||
25565
|
||||
kube.masterAPIServerPort
|
||||
5359
|
||||
];
|
||||
};
|
||||
|
||||
nftables = {
|
||||
enable = true;
|
||||
ruleset = ''
|
||||
table inet wg-filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
iif lo accept
|
||||
|
||||
meta nftrace set 1
|
||||
meta l4proto { icmp, ipv6-icmp } accept
|
||||
|
||||
ct state vmap { invalid : drop, established : accept, related : accept }
|
||||
|
||||
udp dport 53 accept
|
||||
tcp dport 53 accept
|
||||
|
||||
tcp dport { ${sshPortsString} } jump ssh-filter
|
||||
|
||||
iifname { ${ethInterface}, ${personal.interface}, ${kube.interface} } udp dport { ${builtins.toString personal.port}, ${builtins.toString kube.port} } accept
|
||||
iifname ${personal.interface} ip saddr ${personal.ip} jump wg-subnet
|
||||
iifname ${kube.interface} ip saddr ${kube.ip} jump kube-filter
|
||||
|
||||
counter reject
|
||||
}
|
||||
|
||||
chain ssh-filter {
|
||||
ip saddr { ${allowedSSHIPs} } accept
|
||||
counter reject
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
|
||||
meta l4proto { icmp, ipv6-icmp } accept
|
||||
|
||||
iifname ${personal.interface} ip saddr ${personal.ip} jump wg-subnet
|
||||
iifname ${kube.interface} ip saddr ${kube.ip} jump kube-filter
|
||||
|
||||
counter
|
||||
}
|
||||
|
||||
chain kube-filter {
|
||||
ip saddr ${kube.ip} ip daddr ${kube.ip} accept
|
||||
counter drop
|
||||
}
|
||||
|
||||
chain wg-subnet {
|
||||
ip saddr ${personal.full} accept
|
||||
ip saddr ${personal.restrict} ip daddr ${personal.range} accept
|
||||
counter drop
|
||||
}
|
||||
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100; policy accept;
|
||||
oifname ${ethInterface} masquerade
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
wireguard = {
|
||||
enable = true;
|
||||
interfaces = {
|
||||
${personal.interface} = {
|
||||
ips = [ personal.ip ];
|
||||
listenPort = personal.port;
|
||||
privateKeyFile = config.sops.secrets."wireguard/privateKey".path;
|
||||
peers = builtins.map (r: {
|
||||
inherit (r) publicKey allowedIPs;
|
||||
}) (fullRoute ++ meshRoute);
|
||||
};
|
||||
|
||||
${kube.interface} = {
|
||||
ips = [ kube.ip ];
|
||||
listenPort = kube.port;
|
||||
privateKeyFile = config.sops.secrets."wireguard/privateKey".path;
|
||||
peers = [ ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
extraHosts = "${kube.masterIP} ${kube.masterHostname}";
|
||||
};
|
||||
|
||||
services = {
|
||||
dbus.enable = true;
|
||||
blueman.enable = true;
|
||||
|
||||
postgresql = {
|
||||
enable = lib.mkDefault true;
|
||||
authentication = ''
|
||||
host powerdnsadmin powerdnsadmin 127.0.0.1/32 trust
|
||||
'';
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "powerdnsadmin";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
{
|
||||
name = "pdns";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
ensureDatabases = [
|
||||
"powerdnsadmin"
|
||||
"pdns"
|
||||
];
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = sshPorts;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
UseDns = false;
|
||||
PermitRootLogin = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
powerdns = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
launch=gpgsql
|
||||
loglevel=6
|
||||
webserver-password=$WEB_PASSWORD
|
||||
api=yes
|
||||
api-key=$WEB_PASSWORD
|
||||
gpgsql-host=/var/run/postgresql
|
||||
gpgsql-dbname=pdns
|
||||
gpgsql-user=pdns
|
||||
webserver=yes
|
||||
webserver-port=8081
|
||||
local-port=5359
|
||||
dnsupdate=yes
|
||||
allow-dnsupdate-from=10.0.0.0/24
|
||||
'';
|
||||
secretFile = config.sops.secrets.powerdns.path;
|
||||
};
|
||||
|
||||
pdns-recursor = {
|
||||
enable = true;
|
||||
forwardZones = {
|
||||
"${config.networking.domain}." = "127.0.0.1:5359";
|
||||
"pre7780.dn." = "127.0.0.1:5359";
|
||||
};
|
||||
forwardZonesRecurse = {
|
||||
"." = "8.8.8.8";
|
||||
};
|
||||
dnssecValidation = "off";
|
||||
dns.allowFrom = [
|
||||
"127.0.0.0/8"
|
||||
"10.0.0.0/24"
|
||||
"192.168.100.0/24"
|
||||
"::1/128"
|
||||
"fc00::/7"
|
||||
"fe80::/10"
|
||||
];
|
||||
yaml-settings = {
|
||||
webservice.webserver = true;
|
||||
};
|
||||
};
|
||||
|
||||
powerdns-admin = {
|
||||
enable = true;
|
||||
secretKeyFile = config.sops.secrets."powerdns-admin/secret".path;
|
||||
saltFile = config.sops.secrets."powerdns-admin/salt".path;
|
||||
config =
|
||||
# python
|
||||
''
|
||||
import cachelib
|
||||
|
||||
SESSION_TYPE = 'cachelib'
|
||||
SESSION_CACHELIB = cachelib.simple.SimpleCache()
|
||||
SQLALCHEMY_DATABASE_URI = 'postgresql://powerdnsadmin@/powerdnsadmin?host=localhost'
|
||||
'';
|
||||
};
|
||||
|
||||
xserver = {
|
||||
enable = false;
|
||||
xkb.layout = "us";
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
root.openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJSAOufpee7f8D8ONIIGU3qsN+8+DGO7BfZnEOTYqtQ5 danny@pre7780.dn"
|
||||
];
|
||||
|
||||
"${username}".openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJSAOufpee7f8D8ONIIGU3qsN+8+DGO7BfZnEOTYqtQ5 danny@pre7780.dn"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJFQA42R3fZmjb9QnUgzzOTIXQBC+D2ravE/ZLvdjoOQ danny@lap.dn"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSHkPa6vmr5WBPXAazY16+Ph1Mqv9E24uLIf32oC2oH danny@phone.dn"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
oci-containers = {
|
||||
backend = "podman";
|
||||
containers = {
|
||||
uptime-kuma = {
|
||||
extraOptions = [ "--network=host" ];
|
||||
image = "louislam/uptime-kuma:1";
|
||||
volumes = [
|
||||
"/var/lib/uptime-kuma:/app/data"
|
||||
"${config.security.pki.caBundle}:/etc/ca.crt:ro"
|
||||
];
|
||||
environment = {
|
||||
NODE_EXTRA_CA_CERTS = "/etc/ca.crt";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.raspamd-trainer = {
|
||||
after = [ "pdns-recursor.service" ];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"powerdns.${config.networking.domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/api".proxyPass = "http://127.0.0.1:8081";
|
||||
locations."/".proxyPass = "http://127.0.0.1:8000";
|
||||
};
|
||||
|
||||
"uptime.${config.networking.domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://localhost:3001";
|
||||
};
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = [
|
||||
username
|
||||
];
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue