421 lines
10 KiB
Nix
421 lines
10 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
username,
|
|
...
|
|
}:
|
|
let
|
|
inherit username;
|
|
|
|
ethInterface = "enp0s31f6";
|
|
sshPorts = [ 30072 ];
|
|
sshPortsString = builtins.concatStringsSep ", " (builtins.map (p: builtins.toString p) sshPorts);
|
|
|
|
personal = {
|
|
inherit (config.networking) domain;
|
|
ip = "10.0.0.1/24";
|
|
interface = "wg0";
|
|
port = 51820;
|
|
range = "10.0.0.0/24";
|
|
full = "10.0.0.1/25";
|
|
restrict = "10.0.0.128/25";
|
|
};
|
|
|
|
kube = {
|
|
ip = "10.10.0.1/24";
|
|
range = "10.10.0.0/24";
|
|
interface = "wg1";
|
|
port = 51821;
|
|
masterIP = "10.10.0.1";
|
|
masterHostname = "api-kube.${config.networking.domain}";
|
|
masterAPIServerPort = 6443;
|
|
};
|
|
|
|
allowedSSHIPs = builtins.concatStringsSep ", " [
|
|
"122.117.215.55"
|
|
"192.168.100.1/24"
|
|
personal.range
|
|
];
|
|
|
|
fullRoute = [
|
|
{
|
|
# Jonly
|
|
dns = "jonly";
|
|
publicKey = "GAayY6p8ST3I66kFSGY3seaHhfkrc6atcrFu2C9BDDs=";
|
|
allowedIPs = [ "10.0.0.5/32" ];
|
|
}
|
|
{
|
|
dns = "jonly-mac";
|
|
publicKey = "jPmeA0WH3vQw/PDNdJwYLfE7Ibl5oZGuta9UkZNEyTk=";
|
|
allowedIPs = [ "10.0.0.9/32" ];
|
|
}
|
|
{
|
|
# YC
|
|
dns = "yc";
|
|
publicKey = "5LfmjAg07ixmBCcsEn319UHqMRO3AdusXsoibGUqfQE=";
|
|
allowedIPs = [ "10.0.0.7/32" ];
|
|
}
|
|
{
|
|
# Tommy
|
|
dns = "tommy";
|
|
publicKey = "AxujfkiHLj09LoAXZl7yUf3fzyjorKOg8CfcJJvr2HQ=";
|
|
allowedIPs = [ "10.0.0.8/32" ];
|
|
}
|
|
];
|
|
meshRoute = [
|
|
{
|
|
# pre7780.dn
|
|
dns = "pre7780";
|
|
publicKey = "WvvBRGbWUMUhSgodZNlhglacsWhMOTdHhJxcf81kTmQ=";
|
|
allowedIPs = [ "10.0.0.130/32" ];
|
|
}
|
|
{
|
|
# Skydrive
|
|
dns = "skydrive";
|
|
publicKey = "GceSQwI7XqYQw2oPmquuKdPqmt6KsYnoGuFoiaKRb0E=";
|
|
allowedIPs = [ "10.0.0.132/32" ];
|
|
}
|
|
{
|
|
# ken
|
|
dns = "phone.ken";
|
|
publicKey = "knRpD7qb2JejioJBP5HZgWCrDEOWUq27+ueWPYwnWws=";
|
|
allowedIPs = [ "10.0.0.134/32" ];
|
|
}
|
|
{
|
|
# lap.dn
|
|
dns = "lap";
|
|
publicKey = "Cm2AZU+zlv+ThMqah6WiLVxgPNvMHm9DEGd4PfywNWU=";
|
|
allowedIPs = [ "10.0.0.135/32" ];
|
|
}
|
|
{
|
|
# justin03
|
|
dns = "justin";
|
|
publicKey = "WOze/PPilBPqQudk1D4Se34zWV3UghKXWTG6M/f7bEM=";
|
|
allowedIPs = [ "10.0.0.136/32" ];
|
|
}
|
|
{
|
|
# ahhaha
|
|
dns = "ahhaha";
|
|
publicKey = "PGBqCPLxaFd/+KqwrjF6B6lqxvpPKos0sst5gk8p8Bo=";
|
|
allowedIPs = [ "10.0.0.137/32" ];
|
|
}
|
|
{
|
|
# oreo
|
|
dns = "oreo";
|
|
publicKey = "GXHRZ9DmVg7VtuJdvcHOGFCuFqH2Kd/c+3unrq7e5SE=";
|
|
allowedIPs = [ "10.0.0.139/32" ];
|
|
}
|
|
{
|
|
# phone.dn
|
|
dns = "phone";
|
|
publicKey = "XiR4NZLdHyOvzt+fdYoFDW2s/Su8nlz8UgrVPLISdBY=";
|
|
allowedIPs = [ "10.0.0.140/32" ];
|
|
}
|
|
{
|
|
# kavic
|
|
dns = "kavic";
|
|
publicKey = "VVzGcHjSo6QkvN6raS9g/NYLIrZ1xzxdnEronQaTIHs=";
|
|
allowedIPs = [ "10.0.0.141/32" ];
|
|
}
|
|
{
|
|
dns = "yc-mesh";
|
|
publicKey = "dKcEjRq9eYA8rXVfispNoKEbrs9R3ZIVlQi5AXfFch8=";
|
|
allowedIPs = [ "10.0.0.142/32" ];
|
|
}
|
|
{
|
|
dns = "jonly-mesh";
|
|
publicKey = "EyRL+iyKZJaqz9DXVsH2Ne/wVInx5hg9oQARrXP3/k0=";
|
|
allowedIPs = [ "10.0.0.143/32" ];
|
|
}
|
|
{
|
|
dns = "tommy-mesh";
|
|
publicKey = "oCRNCyg0bw6W6W87XQ4pIUW+WFi/bx9MG4cIwE23GxI=";
|
|
allowedIPs = [ "10.0.0.144/32" ];
|
|
}
|
|
{
|
|
# ken
|
|
dns = "pc.ken";
|
|
publicKey = "ERLMpSbSIYRN5HoKmvsk2852/aAvzjvMV7tOs0oupxI=";
|
|
allowedIPs = [ "10.0.0.145/32" ];
|
|
}
|
|
{
|
|
# Skydrive Lap
|
|
dns = "skydrive-mesh";
|
|
publicKey = "MK6UX8WadSbDXI3919F5EarYlZHjFNbHwYJH8Ub/YXk=";
|
|
allowedIPs = [ "10.0.0.146/32" ];
|
|
}
|
|
{
|
|
# Skydrive Phone
|
|
dns = "skydrive-mesh-phone";
|
|
publicKey = "K6Pd69/Hfu4ceCAp/JbeEL2QQ+/4ohugW1lAOxHFKDA=";
|
|
allowedIPs = [ "10.0.0.147/32" ];
|
|
}
|
|
];
|
|
in
|
|
{
|
|
networking = {
|
|
nat = {
|
|
enable = true;
|
|
enableIPv6 = true;
|
|
externalInterface = ethInterface;
|
|
internalInterfaces = [
|
|
personal.interface
|
|
kube.interface
|
|
];
|
|
};
|
|
|
|
firewall = {
|
|
allowedUDPPorts = [
|
|
53
|
|
personal.port
|
|
kube.port
|
|
25565
|
|
kube.masterAPIServerPort
|
|
5359
|
|
];
|
|
allowedTCPPorts = sshPorts ++ [
|
|
53
|
|
25565
|
|
kube.masterAPIServerPort
|
|
5359
|
|
];
|
|
};
|
|
|
|
nftables = {
|
|
enable = true;
|
|
ruleset = ''
|
|
table inet wg-filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
iif lo accept
|
|
|
|
meta nftrace set 1
|
|
meta l4proto { icmp, ipv6-icmp } accept
|
|
|
|
ct state vmap { invalid : drop, established : accept, related : accept }
|
|
|
|
udp dport 53 accept
|
|
tcp dport 53 accept
|
|
|
|
tcp dport { ${sshPortsString} } jump ssh-filter
|
|
|
|
iifname { ${ethInterface}, ${personal.interface}, ${kube.interface} } udp dport { ${builtins.toString personal.port}, ${builtins.toString kube.port} } accept
|
|
iifname ${personal.interface} ip saddr ${personal.ip} jump wg-subnet
|
|
iifname ${kube.interface} ip saddr ${kube.ip} jump kube-filter
|
|
|
|
counter reject
|
|
}
|
|
|
|
chain ssh-filter {
|
|
ip saddr { ${allowedSSHIPs} } accept
|
|
counter reject
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
|
|
meta l4proto { icmp, ipv6-icmp } accept
|
|
|
|
iifname ${personal.interface} ip saddr ${personal.ip} jump wg-subnet
|
|
iifname ${kube.interface} ip saddr ${kube.ip} jump kube-filter
|
|
|
|
counter
|
|
}
|
|
|
|
chain kube-filter {
|
|
ip saddr ${kube.ip} ip daddr ${kube.ip} accept
|
|
counter drop
|
|
}
|
|
|
|
chain wg-subnet {
|
|
ip saddr ${personal.full} accept
|
|
ip saddr ${personal.restrict} ip daddr ${personal.range} accept
|
|
counter drop
|
|
}
|
|
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100; policy accept;
|
|
oifname ${ethInterface} masquerade
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
|
|
wireguard = {
|
|
enable = true;
|
|
interfaces = {
|
|
${personal.interface} = {
|
|
ips = [ personal.ip ];
|
|
listenPort = personal.port;
|
|
privateKeyFile = config.sops.secrets."wireguard/privateKey".path;
|
|
peers = builtins.map (r: {
|
|
inherit (r) publicKey allowedIPs;
|
|
}) (fullRoute ++ meshRoute);
|
|
};
|
|
|
|
${kube.interface} = {
|
|
ips = [ kube.ip ];
|
|
listenPort = kube.port;
|
|
privateKeyFile = config.sops.secrets."wireguard/privateKey".path;
|
|
peers = [ ];
|
|
};
|
|
};
|
|
};
|
|
|
|
extraHosts = "${kube.masterIP} ${kube.masterHostname}";
|
|
};
|
|
|
|
services = {
|
|
dbus.enable = true;
|
|
blueman.enable = true;
|
|
|
|
postgresql = {
|
|
enable = lib.mkDefault true;
|
|
authentication = ''
|
|
host powerdnsadmin powerdnsadmin 127.0.0.1/32 trust
|
|
'';
|
|
ensureUsers = [
|
|
{
|
|
name = "powerdnsadmin";
|
|
ensureDBOwnership = true;
|
|
}
|
|
{
|
|
name = "pdns";
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
ensureDatabases = [
|
|
"powerdnsadmin"
|
|
"pdns"
|
|
];
|
|
};
|
|
|
|
openssh = {
|
|
enable = true;
|
|
ports = sshPorts;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
UseDns = false;
|
|
PermitRootLogin = "yes";
|
|
};
|
|
};
|
|
|
|
powerdns = {
|
|
enable = true;
|
|
extraConfig = ''
|
|
launch=gpgsql
|
|
loglevel=6
|
|
webserver-password=$WEB_PASSWORD
|
|
api=yes
|
|
api-key=$WEB_PASSWORD
|
|
gpgsql-host=/var/run/postgresql
|
|
gpgsql-dbname=pdns
|
|
gpgsql-user=pdns
|
|
webserver=yes
|
|
webserver-port=8081
|
|
local-port=5359
|
|
dnsupdate=yes
|
|
allow-dnsupdate-from=10.0.0.0/24
|
|
'';
|
|
secretFile = config.sops.secrets.powerdns.path;
|
|
};
|
|
|
|
pdns-recursor = {
|
|
enable = true;
|
|
forwardZones = {
|
|
"${config.networking.domain}." = "127.0.0.1:5359";
|
|
"pre7780.dn." = "127.0.0.1:5359";
|
|
};
|
|
forwardZonesRecurse = {
|
|
"." = "8.8.8.8";
|
|
};
|
|
dnssecValidation = "off";
|
|
dns.allowFrom = [
|
|
"127.0.0.0/8"
|
|
"10.0.0.0/24"
|
|
"192.168.100.0/24"
|
|
"::1/128"
|
|
"fc00::/7"
|
|
"fe80::/10"
|
|
];
|
|
yaml-settings = {
|
|
webservice.webserver = true;
|
|
};
|
|
};
|
|
|
|
powerdns-admin = {
|
|
enable = true;
|
|
secretKeyFile = config.sops.secrets."powerdns-admin/secret".path;
|
|
saltFile = config.sops.secrets."powerdns-admin/salt".path;
|
|
config =
|
|
# python
|
|
''
|
|
import cachelib
|
|
|
|
SESSION_TYPE = 'cachelib'
|
|
SESSION_CACHELIB = cachelib.simple.SimpleCache()
|
|
SQLALCHEMY_DATABASE_URI = 'postgresql://powerdnsadmin@/powerdnsadmin?host=localhost'
|
|
'';
|
|
};
|
|
|
|
xserver = {
|
|
enable = false;
|
|
xkb.layout = "us";
|
|
};
|
|
};
|
|
|
|
users.users = {
|
|
root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJSAOufpee7f8D8ONIIGU3qsN+8+DGO7BfZnEOTYqtQ5 danny@pre7780.dn"
|
|
];
|
|
|
|
"${username}".openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJSAOufpee7f8D8ONIIGU3qsN+8+DGO7BfZnEOTYqtQ5 danny@pre7780.dn"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJFQA42R3fZmjb9QnUgzzOTIXQBC+D2ravE/ZLvdjoOQ danny@lap.dn"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSHkPa6vmr5WBPXAazY16+Ph1Mqv9E24uLIf32oC2oH danny@phone.dn"
|
|
];
|
|
};
|
|
|
|
virtualisation = {
|
|
oci-containers = {
|
|
backend = "docker";
|
|
containers = {
|
|
uptime-kuma = {
|
|
extraOptions = [ "--network=host" ];
|
|
image = "louislam/uptime-kuma:1";
|
|
volumes = [
|
|
"/var/lib/uptime-kuma:/app/data"
|
|
"${config.security.pki.caBundle}:/etc/ca.crt:ro"
|
|
];
|
|
environment = {
|
|
NODE_EXTRA_CA_CERTS = "/etc/ca.crt";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.raspamd-trainer = {
|
|
after = [ "pdns-recursor.service" ];
|
|
};
|
|
|
|
services.nginx.virtualHosts = {
|
|
"powerdns.${config.networking.domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/api".proxyPass = "http://127.0.0.1:8081";
|
|
locations."/".proxyPass = "http://127.0.0.1:8000";
|
|
};
|
|
|
|
"uptime.${config.networking.domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".proxyPass = "http://localhost:3001";
|
|
};
|
|
};
|
|
|
|
nix.settings.trusted-users = [
|
|
username
|
|
];
|
|
}
|