router0-dmz0: lots of formattign and exposed host fixes
This commit is contained in:
parent
a825e8eea9
commit
a7e2bc2c3b
2 changed files with 491 additions and 461 deletions
|
|
@ -1,14 +1,14 @@
|
|||
{
|
||||
repoFlake,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
nodeFlake,
|
||||
nodeName,
|
||||
localDomainName,
|
||||
system,
|
||||
...
|
||||
}: let
|
||||
{ repoFlake
|
||||
, pkgs
|
||||
, lib
|
||||
, config
|
||||
, nodeFlake
|
||||
, nodeName
|
||||
, localDomainName
|
||||
, system
|
||||
, ...
|
||||
}:
|
||||
let
|
||||
inherit
|
||||
(nodeFlake.inputs)
|
||||
bpir3
|
||||
|
|
@ -16,11 +16,12 @@
|
|||
;
|
||||
|
||||
vlanRangeStart = builtins.head vlanRange;
|
||||
vlanRangeEnd = builtins.elemAt vlanRange ((builtins.length vlanRange)-1);
|
||||
vlanRangeEnd = builtins.elemAt vlanRange ((builtins.length vlanRange) - 1);
|
||||
vlanRange = builtins.map (vlanid: (lib.strings.toInt vlanid)) (builtins.attrNames vlans);
|
||||
vlanRangeWith0 = [ 0 ] ++ vlanRange;
|
||||
|
||||
mkVlanIpv4HostAddr = { vlanid, host, thirdIpv4SegmentMin ? 20, cidr ? true }: let
|
||||
mkVlanIpv4HostAddr = { vlanid, host, thirdIpv4SegmentMin ? 20, cidr ? true }:
|
||||
let
|
||||
# reserve the first subnet for vlanid == 0
|
||||
# number the other subnets continously from there
|
||||
offset =
|
||||
|
|
@ -57,11 +58,13 @@
|
|||
"15".packet_priority = -10;
|
||||
};
|
||||
|
||||
vlansByName = lib.attrsets.mapAttrs' (vlanid': attrs:
|
||||
vlansByName = lib.attrsets.mapAttrs'
|
||||
(vlanid': attrs:
|
||||
lib.attrsets.nameValuePair
|
||||
attrs.name
|
||||
(attrs // { id = lib.strings.toInt vlanid'; id' = vlanid';})
|
||||
) vlans;
|
||||
(attrs // { id = lib.strings.toInt vlanid'; id' = vlanid'; })
|
||||
)
|
||||
vlans;
|
||||
|
||||
getVlanDomain = { vlanid }:
|
||||
if vlanid == 0
|
||||
|
|
@ -77,7 +80,10 @@
|
|||
then bridgeInterfaceName
|
||||
else "${bridgeInterfaceName}.${toString vlanid}"
|
||||
;
|
||||
in {
|
||||
|
||||
exposedHost = "sj-srv1.dmz.internal";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
repoFlake.inputs.sops-nix.nixosModules.sops
|
||||
|
||||
|
|
@ -180,15 +186,16 @@ in {
|
|||
|
||||
chains = {
|
||||
prerouting = {
|
||||
"redirectweb" = {
|
||||
after = ["hook"];
|
||||
rules = let
|
||||
"exposeHost" = {
|
||||
after = [ "hook" ];
|
||||
rules =
|
||||
let
|
||||
wanInterfaces = builtins.concatStringsSep ", " config.networking.nftables.firewall.zones.wan.interfaces;
|
||||
exposedHost = "srv0-dmz0.dmz.internal";
|
||||
in [
|
||||
"iifname { ${wanInterfaces} } tcp dport 220 redirect to 22"
|
||||
in
|
||||
# TODO: if this hostname doesn't resolve it'll break the whole ruleset
|
||||
# "iifname { ${wanInterfaces} } dnat ip to ${exposedHost}"
|
||||
[
|
||||
"iifname { ${wanInterfaces} } tcp dport 220 redirect to 22"
|
||||
"iifname { ${wanInterfaces} } dnat ip to ${exposedHost}"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
@ -197,60 +204,73 @@ in {
|
|||
firewall = {
|
||||
enable = true;
|
||||
zones = {
|
||||
lan.interfaces = [ (mkInterfaceName {vlanid = 0;}) ];
|
||||
vlan.interfaces = builtins.map (vlanid: (mkInterfaceName {inherit vlanid;})) vlanRange;
|
||||
lan.interfaces = [ (mkInterfaceName { vlanid = 0; }) ];
|
||||
vlan.interfaces = builtins.map (vlanid: (mkInterfaceName { inherit vlanid; })) vlanRange;
|
||||
# lan.ipv4Addresses = ["192.168.0.0/16"];
|
||||
wan.interfaces = ["wan" "lan0"];
|
||||
wan.interfaces = [ "wan" "lan0" ];
|
||||
} //
|
||||
# generate a zone for each vlan
|
||||
lib.attrsets.mapAttrs (key: value: {
|
||||
lib.attrsets.mapAttrs
|
||||
(key: value: {
|
||||
interfaces = [ (mkInterfaceName { vlanid = value.id; }) ];
|
||||
})
|
||||
vlansByName
|
||||
;
|
||||
rules = let
|
||||
rules =
|
||||
let
|
||||
ipv6IcmpTypes = [
|
||||
"destination-unreachable" "echo-reply" "echo-request"
|
||||
"packet-too-big" "parameter-problem" "time-exceeded"
|
||||
"destination-unreachable"
|
||||
"echo-reply"
|
||||
"echo-request"
|
||||
"packet-too-big"
|
||||
"parameter-problem"
|
||||
"time-exceeded"
|
||||
|
||||
# Without the nd-* ones ipv6 will not work.
|
||||
"nd-neighbor-solicit" "nd-router-advert" "nd-neighbor-advert"
|
||||
"nd-neighbor-solicit"
|
||||
"nd-router-advert"
|
||||
"nd-neighbor-advert"
|
||||
];
|
||||
ipv4IcmpTypes = [
|
||||
"destination-unreachable" "echo-reply" "echo-request" "source-quench" "time-exceeded"
|
||||
"destination-unreachable"
|
||||
"echo-reply"
|
||||
"echo-request"
|
||||
"source-quench"
|
||||
"time-exceeded"
|
||||
"router-advertisement"
|
||||
];
|
||||
allowIcmpLines = [
|
||||
"ip protocol icmp icmp type { ${builtins.concatStringsSep ", " ipv4IcmpTypes} } accept"
|
||||
"ip6 nexthdr icmpv6 icmpv6 type { ${builtins.concatStringsSep ", " ipv6IcmpTypes} } accept"
|
||||
];
|
||||
in {
|
||||
in
|
||||
{
|
||||
fw = {
|
||||
from = ["fw"];
|
||||
from = [ "fw" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
office-to-dmz = {
|
||||
from = ["office"];
|
||||
to = ["dmz"];
|
||||
from = [ "office" ];
|
||||
to = [ "dmz" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
lan-to-fw = {
|
||||
from = ["lan"];
|
||||
to = ["fw" "lan"];
|
||||
from = [ "lan" ];
|
||||
to = [ "fw" "lan" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
lan-to-wan = {
|
||||
from = ["lan"];
|
||||
to = ["wan"];
|
||||
from = [ "lan" ];
|
||||
to = [ "wan" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
vlan-to-wan = {
|
||||
from = ["vlan"];
|
||||
to = ["wan"];
|
||||
from = [ "vlan" ];
|
||||
to = [ "wan" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
|
|
@ -264,29 +284,29 @@ in {
|
|||
{ from = 53; to = 53; }
|
||||
{ from = 5201; to = 5201; }
|
||||
];
|
||||
from = ["vlan"];
|
||||
to = ["fw"];
|
||||
from = [ "vlan" ];
|
||||
to = [ "fw" ];
|
||||
extraLines = allowIcmpLines ++ [
|
||||
"drop"
|
||||
];
|
||||
};
|
||||
|
||||
to-wan-nat = {
|
||||
from = ["lan" "vlan"];
|
||||
to = ["wan"];
|
||||
from = [ "lan" "vlan" ];
|
||||
to = [ "wan" ];
|
||||
masquerade = true;
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
wan-to-dmz = {
|
||||
from = ["wan"];
|
||||
to = ["dmz"];
|
||||
from = [ "wan" ];
|
||||
to = [ "dmz" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
wan-to-fw = {
|
||||
from = ["wan"];
|
||||
to = ["fw"];
|
||||
from = [ "wan" ];
|
||||
to = [ "fw" ];
|
||||
allowedTCPPortRanges = [
|
||||
{
|
||||
from = 22;
|
||||
|
|
@ -325,7 +345,7 @@ in {
|
|||
# generate the vlan devices. these will be tagged on the main bridge
|
||||
// builtins.foldl'
|
||||
(acc: cur: acc // cur)
|
||||
{}
|
||||
{ }
|
||||
(builtins.map
|
||||
({ vlanid, vlanid' }: {
|
||||
"20-${mkInterfaceName { inherit vlanid; }}" = {
|
||||
|
|
@ -433,9 +453,9 @@ in {
|
|||
# Configure the bridge for its desired function
|
||||
"40-${bridgeInterfaceName}" = {
|
||||
matchConfig.Name = bridgeInterfaceName;
|
||||
bridgeConfig = {};
|
||||
bridgeConfig = { };
|
||||
address = [
|
||||
(mkVlanIpv4HostAddr { vlanid = 0; host = 1;})
|
||||
(mkVlanIpv4HostAddr { vlanid = 0; host = 1; })
|
||||
];
|
||||
networkConfig = {
|
||||
ConfigureWithoutCarrier = true;
|
||||
|
|
@ -467,8 +487,9 @@ in {
|
|||
//
|
||||
builtins.foldl'
|
||||
(acc: cur: acc // cur)
|
||||
{}
|
||||
(builtins.map ({ vlanid, vlanid' }: {
|
||||
{ }
|
||||
(builtins.map
|
||||
({ vlanid, vlanid' }: {
|
||||
# configure the tagged vlan device with an address and vlan filtering.
|
||||
# dnsmasq is configured to serve the respective /24 range on each tagged device.
|
||||
# this device only receives traffic for the given vlanid and sends tagged traffic to the bridge.
|
||||
|
|
@ -539,10 +560,12 @@ in {
|
|||
services.hostapd = {
|
||||
enable = true;
|
||||
package = nodeFlake.packages.${system}.hostapd_patched;
|
||||
radios = let
|
||||
radios =
|
||||
let
|
||||
# generated with https://miniwebtool.com/mac-address-generator/
|
||||
mkBssid = i: "34:56:ce:0f:ed:4${toString i}";
|
||||
in {
|
||||
in
|
||||
{
|
||||
wlan0 = {
|
||||
band = "2g";
|
||||
countryCode = "CH";
|
||||
|
|
@ -551,12 +574,14 @@ in {
|
|||
# use 'iw phy#1 info' to determine your VHT capabilities
|
||||
wifi4 = {
|
||||
enable = true;
|
||||
capabilities = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935"];
|
||||
capabilities = [ "HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" ];
|
||||
};
|
||||
networks = {
|
||||
wlan0 = let
|
||||
wlan0 =
|
||||
let
|
||||
iface = "wlan0";
|
||||
in {
|
||||
in
|
||||
{
|
||||
ssid = "mlsia";
|
||||
bssid = mkBssid 0;
|
||||
|
||||
|
|
@ -575,7 +600,7 @@ in {
|
|||
# sae_password_file = config.sops.secrets.wlan0_saePasswordsFile.path;
|
||||
|
||||
# enables debug logging
|
||||
logger_stdout_level= lib.mkForce 0;
|
||||
logger_stdout_level = lib.mkForce 0;
|
||||
logger_stdout = -1;
|
||||
# logger_syslog_level= lib.mkForce 0;
|
||||
|
||||
|
|
@ -594,10 +619,13 @@ in {
|
|||
vlan_bridge = "br-${iface}.";
|
||||
*/
|
||||
|
||||
vlan_file = let
|
||||
generated = builtins.map (vlanid:
|
||||
vlan_file =
|
||||
let
|
||||
generated = builtins.map
|
||||
(vlanid:
|
||||
"${builtins.toString vlanid} ${iface}.${builtins.toString vlanid}"
|
||||
) vlanRange
|
||||
)
|
||||
vlanRange
|
||||
;
|
||||
|
||||
wildcard = [
|
||||
|
|
@ -611,7 +639,8 @@ in {
|
|||
file = pkgs.writeText "hostapd.vlan"
|
||||
(builtins.concatStringsSep "\n" (generated ++ wildcard));
|
||||
filePath = toString file;
|
||||
in filePath;
|
||||
in
|
||||
filePath;
|
||||
|
||||
wpa_key_mgmt = lib.mkForce (builtins.concatStringsSep " " [
|
||||
"WPA-PSK"
|
||||
|
|
@ -634,10 +663,10 @@ in {
|
|||
sae_groups = "19 20 21";
|
||||
|
||||
# [ENABLE-TLSv1.3] = enable TLSv1.3 (experimental - disabled by default)
|
||||
tls_flags= "[ENABLE-TLSv1.3]";
|
||||
tls_flags = "[ENABLE-TLSv1.3]";
|
||||
|
||||
ieee8021x=0;
|
||||
eap_server=0;
|
||||
ieee8021x = 0;
|
||||
eap_server = 0;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -797,7 +826,8 @@ in {
|
|||
local-ttl = 0;
|
||||
dhcp-ttl = 0;
|
||||
|
||||
dhcp-range = let
|
||||
dhcp-range =
|
||||
let
|
||||
mkDhcpRange = { tag, vlanid }: builtins.concatStringsSep "," [
|
||||
tag
|
||||
(mkVlanIpv4HostAddr { inherit vlanid; host = 100; cidr = false; })
|
||||
|
|
@ -807,7 +837,7 @@ in {
|
|||
in
|
||||
builtins.map
|
||||
(vlanid:
|
||||
mkDhcpRange { tag = mkInterfaceName {inherit vlanid;}; inherit vlanid; }
|
||||
mkDhcpRange { tag = mkInterfaceName { inherit vlanid; }; inherit vlanid; }
|
||||
)
|
||||
vlanRangeWith0
|
||||
;
|
||||
|
|
@ -854,7 +884,9 @@ in {
|
|||
(vlanid:
|
||||
builtins.concatStringsSep "," [
|
||||
# "${getVlanDomain{inherit vlanid;}}" "0.0.0.1" (mkInterfaceName {inherit vlanid;})
|
||||
"${nodeName}.${getVlanDomain{inherit vlanid;}}" "0.0.0.1" (mkInterfaceName {inherit vlanid;})
|
||||
"${nodeName}.${getVlanDomain{inherit vlanid;}}"
|
||||
"0.0.0.1"
|
||||
(mkInterfaceName { inherit vlanid; })
|
||||
]
|
||||
)
|
||||
vlanRangeWith0
|
||||
|
|
@ -864,6 +896,11 @@ in {
|
|||
(vlanid: "${mkInterfaceName {inherit vlanid;}},option:domain-search,${getVlanDomain{inherit vlanid;}}")
|
||||
vlanRangeWith0
|
||||
;
|
||||
|
||||
cname = [
|
||||
"mailserver.svc.stefanjunker.de,${exposedHost}"
|
||||
"www.stefanjunker.de,${exposedHost}"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -881,10 +918,10 @@ in {
|
|||
# They fail to load properly, leaving the system without working ethernet, they'll oops on
|
||||
# remove. MTK-DSA parts and PCIe were observed to do this.
|
||||
boot.initrd.includeDefaultModules = false;
|
||||
boot.initrd.kernelModules = ["rfkill" "cfg80211" "mt7915e"];
|
||||
boot.initrd.availableKernelModules = ["nvme"];
|
||||
boot.initrd.kernelModules = [ "rfkill" "cfg80211" "mt7915e" ];
|
||||
boot.initrd.availableKernelModules = [ "nvme" ];
|
||||
|
||||
boot.kernelParams = ["console=ttyS0,115200"];
|
||||
boot.kernelParams = [ "console=ttyS0,115200" ];
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
# Wireless hardware exists, regulatory database is essential.
|
||||
hardware.wirelessRegulatoryDatabase = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{lib, ...}: let
|
||||
{ lib, ... }:
|
||||
let
|
||||
stage1Modules = [
|
||||
"aesni_intel"
|
||||
"kvm_amd"
|
||||
|
|
@ -10,21 +11,13 @@
|
|||
|
||||
"usbcore"
|
||||
"xhci_hcd"
|
||||
"usbnet"
|
||||
"snd_usb_audio"
|
||||
"usbhid"
|
||||
"snd_usbmidi_lib"
|
||||
"cdc_mbim"
|
||||
"cdc_ncm"
|
||||
"usb_storage"
|
||||
"cdc_wdm"
|
||||
"uvcvideo"
|
||||
"btusb"
|
||||
"xhci_pci"
|
||||
"cdc_ether"
|
||||
"uas"
|
||||
];
|
||||
in {
|
||||
in
|
||||
{
|
||||
# TASK: new device
|
||||
hardware.opinionatedDisk = {
|
||||
enable = true;
|
||||
|
|
@ -37,7 +30,7 @@ in {
|
|||
|
||||
# see https://linrunner.de/tlp/
|
||||
services.tlp = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
settings = {
|
||||
CPU_DRIVER_OPMODE_ON_AC = "active";
|
||||
CPU_DRIVER_OPMODE_ON_BAT = "passive";
|
||||
|
|
@ -81,7 +74,7 @@ in {
|
|||
# #DEVICES_TO_DISABLE_ON_WIFI_CONNECT="wwan";
|
||||
# #DEVICES_TO_DISABLE_ON_WWAN_CONNECT="wifi";
|
||||
|
||||
SATA_LINKPWR_ON_AC = "maax_performance";
|
||||
SATA_LINKPWR_ON_AC = "max_performance";
|
||||
SATA_LINKPWR_ON_BAT = "min_power";
|
||||
};
|
||||
};
|
||||
|
|
@ -91,16 +84,16 @@ in {
|
|||
enable = true;
|
||||
levels = [
|
||||
# ["level auto" 0 60]
|
||||
[0 0 60]
|
||||
[1 60 65]
|
||||
[1 65 75]
|
||||
[2 75 78]
|
||||
[3 78 80]
|
||||
[4 80 82]
|
||||
[5 82 84]
|
||||
[6 84 86]
|
||||
[7 86 88]
|
||||
["level full-speed" 88 999]
|
||||
[ 0 0 60 ]
|
||||
[ 1 60 65 ]
|
||||
[ 1 65 75 ]
|
||||
[ 2 75 78 ]
|
||||
[ 3 78 80 ]
|
||||
[ 4 80 82 ]
|
||||
[ 5 82 84 ]
|
||||
[ 6 84 86 ]
|
||||
[ 7 86 88 ]
|
||||
[ "level full-speed" 88 999 ]
|
||||
];
|
||||
|
||||
extraArgs = [
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue