steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

[BROKEN DYNDNS] feat(containers): switch to hetzner for primary domain

Browse source
This commit is contained in:
steveej 2023-08-08 17:53:01 +02:00
parent 09374a71fd
commit 9988e3e969
7 changed files with 132 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/os/devices/sj-vps-htz0/system.nix
View file

@ -6,6 +6,8 @@
...
}: {
networking.firewall.enable = true;
networking.nftables.enable = true;
networking.firewall.allowedTCPPorts = [
# iperf3
5201
@ -38,19 +40,32 @@
interface = "eth0";
};
networking.nameservers = ["1.1.1.1"];
networking.nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
services.resolved = {
enable = true;
dnssec = "true";
domains = ["~."];
fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
extraConfig = ''
DNSOverTLS=yes
'';
};
networking.nat = {
enable = true;
internalInterfaces = ["ve-+"];
internalInterfaces = ["ve-*"];
externalInterface = "eth0";
};
# Kubernetes
# services.kubernetes.roles = ["master" "node"];
networking.firewall.filterForward = true;
networking.firewall.extraForwardRules = ''
meta nfproto ipv4 tcp flags syn tcp option maxseg size set 1360;
meta nfproto ipv6 tcp flags syn tcp option maxseg size set 1340;
'';
# virtualization
virtualisation = {docker.enable = true;};
virtualisation = {docker.enable = false;};
services.spice-vdagentd.enable = true;
services.qemuGuest.enable = true;