feat: migrate nfmnk to ifog, add hosthatch
This commit is contained in:
parent
4a42e3fe3c
commit
2f60cd571a
16 changed files with 656 additions and 119 deletions
340
nix/os/devices/router0-hosthatch/configuration.nix
Normal file
340
nix/os/devices/router0-hosthatch/configuration.nix
Normal file
|
|
@ -0,0 +1,340 @@
|
|||
{
|
||||
repoFlake,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
nodeFlake,
|
||||
nodeName,
|
||||
localDomainName,
|
||||
system,
|
||||
variables,
|
||||
...
|
||||
}: {
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
imports = [
|
||||
nodeFlake.inputs.disko.nixosModules.disko
|
||||
nodeFlake.inputs.srvos.nixosModules.mixins-terminfo
|
||||
|
||||
repoFlake.inputs.sops-nix.nixosModules.sops
|
||||
|
||||
../../snippets/nix-settings.nix
|
||||
../../profiles/common/user.nix
|
||||
|
||||
nodeFlake.inputs.nixos-nftables-firewall.nixosModules.default
|
||||
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
services.openssh.settings.PermitRootLogin = "yes";
|
||||
|
||||
users.commonUsers = {
|
||||
enable = true;
|
||||
enableNonRoot = false;
|
||||
rootPasswordFile = config.sops.secrets.passwords-root.path;
|
||||
};
|
||||
|
||||
# sops.age.keyFile = "/etc/age.key";
|
||||
# sops.age.sshKeyPaths = [];
|
||||
|
||||
sops.defaultSopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
sops.defaultSopsFormat = "yaml";
|
||||
|
||||
sops.secrets.passwords-root.neededForUsers = true;
|
||||
}
|
||||
|
||||
# TODO: extract this into single-disk VM BIOS module
|
||||
{
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.loader.grub.efiSupport = false;
|
||||
|
||||
# forcing seems required or else there's an error about duplicated devices
|
||||
boot.loader.grub.devices = lib.mkForce ["/dev/vda"];
|
||||
|
||||
disko.devices.disk.vda = {
|
||||
device = "/dev/vda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
size = "1M";
|
||||
type = "EF02"; # for grub MBR
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = ["-f"]; # Override existing partition
|
||||
subvolumes = {
|
||||
# Subvolume name is different from mountpoint
|
||||
"/rootfs" = {
|
||||
mountpoint = "/";
|
||||
};
|
||||
"/nix" = {
|
||||
mountOptions = ["noatime"];
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
"/boot" = {
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot.initrd.kernelModules = [
|
||||
"virtio_balloon"
|
||||
"virtio_scsi"
|
||||
"virtio_net"
|
||||
"virtio_pci"
|
||||
"virtio_ring"
|
||||
"virtio"
|
||||
"scsi_mod"
|
||||
|
||||
"virtio_blk"
|
||||
"virtio_ring"
|
||||
"ata_piix"
|
||||
"pata_acpi"
|
||||
"ata_generic"
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
# sops.secrets.ssh_host_ed25519_key = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_ed25519_key";
|
||||
# mode = "0600";
|
||||
# };
|
||||
# sops.secrets.ssh_host_ed25519_key_pub = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_ed25519_key.pub";
|
||||
# mode = "0600";
|
||||
# };
|
||||
# sops.secrets.ssh_host_rsa_key = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_rsa_key";
|
||||
# mode = "0600";
|
||||
# };
|
||||
# sops.secrets.ssh_host_rsa_key_pub = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_rsa_key.pub";
|
||||
# mode = "0644";
|
||||
# };
|
||||
|
||||
boot = {
|
||||
kernel = {
|
||||
sysctl = {
|
||||
"net.ipv4.conf.all.forwarding" = true;
|
||||
"net.ipv6.conf.all.forwarding" = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = nodeName;
|
||||
useNetworkd = true;
|
||||
useDHCP = true;
|
||||
usePredictableInterfaceNames = false;
|
||||
|
||||
interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
address = variables.ipv4;
|
||||
prefixLength = variables.ipv4length;
|
||||
}
|
||||
];
|
||||
defaultGateway = {
|
||||
interface = "eth0";
|
||||
address = variables.ipv4gateway;
|
||||
};
|
||||
nameservers = [
|
||||
variables.ipv4dns
|
||||
];
|
||||
|
||||
# these will be configured via nftables
|
||||
nat.enable = lib.mkForce false;
|
||||
firewall.enable = lib.mkForce false;
|
||||
|
||||
# Use the nftables firewall instead of the base nixos scripted rules.
|
||||
# This flake provides a similar utility to the base nixos scripting.
|
||||
# https://github.com/thelegy/nixos-nftables-firewall/tree/main
|
||||
|
||||
nftables = {
|
||||
enable = true;
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
snippets.nnf-common.enable = true;
|
||||
|
||||
zones.wan = {
|
||||
interfaces = ["eth0"];
|
||||
};
|
||||
|
||||
zones.vpn = {
|
||||
interfaces = ["wg0" "wg1"];
|
||||
};
|
||||
|
||||
rules = {
|
||||
to-fw = {
|
||||
from = "all";
|
||||
to = ["fw"];
|
||||
verdict = "drop";
|
||||
|
||||
allowedTCPPorts = [
|
||||
22
|
||||
5201
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
22
|
||||
5201
|
||||
config.systemd.network.netdevs.wg0.wireguardConfig.ListenPort
|
||||
config.systemd.network.netdevs.wg1.wireguardConfig.ListenPort
|
||||
];
|
||||
};
|
||||
|
||||
vpn-to-wan-nat = {
|
||||
from = ["vpn"];
|
||||
to = ["wan"];
|
||||
masquerade = true;
|
||||
verdict = "accept";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.wg0-privatekey = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg0-peer0-psk = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg1-privatekey = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg1-peer0-psk = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
|
||||
systemd.network.enable = true;
|
||||
systemd.network.netdevs.wg0 = {
|
||||
enable = true;
|
||||
netdevConfig = {
|
||||
Name = "wg0";
|
||||
Kind = "wireguard";
|
||||
};
|
||||
wireguardConfig = {
|
||||
ListenPort = 51820;
|
||||
# PublicKey /RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=
|
||||
PrivateKeyFile = builtins.toString config.sops.secrets.wg0-privatekey.path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
AllowedIPs = [
|
||||
"10.0.1.1/32"
|
||||
"192.168.0.0/16"
|
||||
];
|
||||
PersistentKeepalive = 15;
|
||||
PresharedKeyFile = builtins.toString config.sops.secrets.wg0-peer0-psk.path;
|
||||
PublicKey = "hsjIenUFV/FBqplIKxSL/Zn2zDAfojlIKHMxPA6RC04=";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.netdevs.wg1 = {
|
||||
enable = true;
|
||||
netdevConfig = {
|
||||
Name = "wg1";
|
||||
Kind = "wireguard";
|
||||
};
|
||||
wireguardConfig = {
|
||||
ListenPort = 51821;
|
||||
# PublicKey /RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=
|
||||
PrivateKeyFile = builtins.toString config.sops.secrets.wg1-privatekey.path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
AllowedIPs = [
|
||||
"10.0.1.3/31"
|
||||
"192.168.0.0/16"
|
||||
];
|
||||
PersistentKeepalive = 15;
|
||||
PresharedKeyFile = builtins.toString config.sops.secrets.wg1-peer0-psk.path;
|
||||
PublicKey = "Ha5hsarCRO8LX9SrkopUeP14ebLdFgxXUC0ezrobax4=";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.networks.wg0 = {
|
||||
enable = true;
|
||||
matchConfig.Name = "wg0";
|
||||
address = [
|
||||
"10.0.1.0/31"
|
||||
];
|
||||
|
||||
routes = [
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "192.168.0.0/16";
|
||||
MultiPathRoute = "10.0.1.1 1";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.networks.wg1 = {
|
||||
enable = true;
|
||||
matchConfig.Name = "wg1";
|
||||
address = [
|
||||
"10.0.1.2/31"
|
||||
];
|
||||
|
||||
routes = [
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "192.168.0.0/16";
|
||||
MultiPathRoute = "10.0.1.3 1";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.ethtool
|
||||
pkgs.neovim
|
||||
pkgs.tmux
|
||||
|
||||
pkgs.wireguard-tools
|
||||
pkgs.tshark
|
||||
|
||||
(pkgs.writeShellScriptBin "dbg-ip" ''
|
||||
echo links:
|
||||
ip -br -c l
|
||||
echo
|
||||
echo addresses:
|
||||
ip -br -c a
|
||||
echo
|
||||
echo vlans:
|
||||
bridge -c vlan
|
||||
'')
|
||||
|
||||
(pkgs.writeShellScriptBin "dbg-dnsmasq" ''
|
||||
# get the rendered in-use config
|
||||
pgrep -a dnsmasq | grep -Eo '[^ ]*conf' | xargs cat | grep -Eo '[^=]*conf' | xargs cat
|
||||
'')
|
||||
];
|
||||
}
|
||||
34
nix/os/devices/router0-hosthatch/default.nix
Normal file
34
nix/os/devices/router0-hosthatch/default.nix
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
system ? "x86_64-linux",
|
||||
nodeName,
|
||||
repoFlake,
|
||||
nodeFlake,
|
||||
...
|
||||
}: let
|
||||
variables = import ./variables.crypt.nix;
|
||||
in {
|
||||
meta.nodeSpecialArgs.${nodeName} = {
|
||||
inherit repoFlake nodeName nodeFlake system variables;
|
||||
packages' = repoFlake.packages.${system};
|
||||
nodePackages' = nodeFlake.packages.${system};
|
||||
};
|
||||
|
||||
meta.nodeNixpkgs.${nodeName} =
|
||||
import nodeFlake.inputs.nixpkgs.outPath
|
||||
{
|
||||
inherit system;
|
||||
};
|
||||
|
||||
${nodeName} = {
|
||||
deployment.targetHost = variables.ipv4;
|
||||
deployment.replaceUnknownProfiles = true;
|
||||
|
||||
imports = [
|
||||
nodeFlake.inputs.home-manager.nixosModules.home-manager
|
||||
|
||||
./configuration.nix
|
||||
];
|
||||
|
||||
networking.hostName = nodeName;
|
||||
};
|
||||
}
|
||||
151
nix/os/devices/router0-hosthatch/flake.lock
generated
Normal file
151
nix/os/devices/router0-hosthatch/flake.lock
generated
Normal file
|
|
@ -0,0 +1,151 @@
|
|||
{
|
||||
"nodes": {
|
||||
"dependencyDagOfSubmodule": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-nftables-firewall",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1656615370,
|
||||
"narHash": "sha256-IZDqz1aSySoqf1qtVQg+oJMHfC4IlT55Zoa7EkjvPug=",
|
||||
"owner": "thelegy",
|
||||
"repo": "nix-dependencyDagOfSubmodule",
|
||||
"rev": "98eb563d80b35acafbfc1abb9ccee569c1efb19c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "thelegy",
|
||||
"repo": "nix-dependencyDagOfSubmodule",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717915259,
|
||||
"narHash": "sha256-VsGPboaleIlPELHY5cNTrXK4jHVmgUra8uC6h7KVC5c=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "1bbdb06f14e2621290b250e631cf3d8948e4d19b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717527182,
|
||||
"narHash": "sha256-vWSkg6AMok1UUQiSYVdGMOXKD2cDFnajITiSi0Zjd1A=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "845a5c4c073f74105022533907703441e0464bc3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "release-24.05",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-nftables-firewall": {
|
||||
"inputs": {
|
||||
"dependencyDagOfSubmodule": "dependencyDagOfSubmodule",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1715521768,
|
||||
"narHash": "sha256-BQkkBqDemoPRd2a4G94I9w9fNE0IxWtVsQ9SalnNqCQ=",
|
||||
"owner": "thelegy",
|
||||
"repo": "nixos-nftables-firewall",
|
||||
"rev": "2c5a19966b4dfc5ca92df7eb250c68f90be653c8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "thelegy",
|
||||
"repo": "nixos-nftables-firewall",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1717696253,
|
||||
"narHash": "sha256-1+ua0ggXlYYPLTmMl3YeYYsBXDSCqT+Gw3u6l4gvMhA=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9b5328b7f761a7bbdc0e332ac4cf076a3eedb89b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-24.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1717786204,
|
||||
"narHash": "sha256-4q0s6m0GUcN7q+Y2DqD27iLvbcd1G50T2lv08kKxkSI=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "051f920625ab5aabe37c920346e3e69d7d34400e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"disko": "disko",
|
||||
"home-manager": "home-manager",
|
||||
"nixos-nftables-firewall": "nixos-nftables-firewall",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"srvos": "srvos"
|
||||
}
|
||||
},
|
||||
"srvos": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717807544,
|
||||
"narHash": "sha256-djHfn29HdlfWdmyeu3rqlVS8k5q/xRh2P0mX2RAafb0=",
|
||||
"owner": "numtide",
|
||||
"repo": "srvos",
|
||||
"rev": "64ae31cb29923128f27a503a550ee4fb1631c4c6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "srvos",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
19
nix/os/devices/router0-hosthatch/flake.nix
Normal file
19
nix/os/devices/router0-hosthatch/flake.nix
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
|
||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
|
||||
home-manager.url = "github:nix-community/home-manager/release-24.05";
|
||||
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
srvos.url = "github:numtide/srvos";
|
||||
srvos.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nixos-nftables-firewall.url = "github:thelegy/nixos-nftables-firewall";
|
||||
nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = _: {};
|
||||
}
|
||||
BIN
nix/os/devices/router0-hosthatch/variables.crypt.nix
Normal file
BIN
nix/os/devices/router0-hosthatch/variables.crypt.nix
Normal file
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue