WIP: add router0-nfmnk and connect router0-dmz0 via wg
This commit is contained in:
parent
f0c4b67ecb
commit
cdf973208f
12 changed files with 686 additions and 60 deletions
|
|
@ -211,6 +211,7 @@ in {
|
|||
vlan.interfaces = builtins.map (vlanid: (mkInterfaceName {inherit vlanid;})) vlanRange;
|
||||
# lan.ipv4Addresses = ["192.168.0.0/16"];
|
||||
wan.interfaces = ["wan" "lan0"];
|
||||
wg.interfaces = ["wg0"];
|
||||
}
|
||||
//
|
||||
# generate a zone for each vlan
|
||||
|
|
@ -342,9 +343,40 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
sops.secrets.wg0-privatekey = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg1-privatekey = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg0-peer0-psk = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg1-peer0-psk = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
wait-online.anyInterface = true;
|
||||
netdevs =
|
||||
netdevs = let
|
||||
router0-nmfk_wgEndpoint = "${repoFlake.colmena.router0-nfmnk.deployment.targetHost}:${
|
||||
builtins.toString
|
||||
repoFlake
|
||||
.nixosConfigurations
|
||||
.router0-nfmnk
|
||||
.config
|
||||
.systemd
|
||||
.network
|
||||
.netdevs
|
||||
.wg0
|
||||
.wireguardConfig
|
||||
.ListenPort
|
||||
}";
|
||||
in
|
||||
{
|
||||
# Create the bridge interface
|
||||
"20-${bridgeInterfaceName}" = {
|
||||
|
|
@ -361,6 +393,54 @@ in {
|
|||
DefaultPVID=0
|
||||
'';
|
||||
};
|
||||
|
||||
wg0 = {
|
||||
enable = true;
|
||||
netdevConfig = {
|
||||
Name = "wg0";
|
||||
Kind = "wireguard";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = builtins.toString config.sops.secrets.wg0-privatekey.path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
AllowedIPs = [
|
||||
"10.0.0.254/32"
|
||||
];
|
||||
PersistentKeepalive = 15;
|
||||
PresharedKeyFile = builtins.toString config.sops.secrets.wg0-peer0-psk.path;
|
||||
PublicKey = "/RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=";
|
||||
Endpoint = router0-nmfk_wgEndpoint;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# wg1 = {
|
||||
# enable = true;
|
||||
# netdevConfig = {
|
||||
# Name = "wg1";
|
||||
# Kind = "wireguard";
|
||||
# };
|
||||
# wireguardConfig = {
|
||||
# PrivateKeyFile = builtins.toString config.sops.secrets.wg1-privatekey.path;
|
||||
# };
|
||||
# wireguardPeers = [
|
||||
# {
|
||||
# wireguardPeerConfig = {
|
||||
# AllowedIPs = [
|
||||
# "10.0.0.254/32"
|
||||
# ];
|
||||
# PersistentKeepalive = 15;
|
||||
# PresharedKeyFile = builtins.toString config.sops.secrets.wg1-peer0-psk.path;
|
||||
# PublicKey = "/RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=";
|
||||
# Endpoint = "${router0-nmfk_variables.ipv4}:51820";
|
||||
# };
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
}
|
||||
# generate the vlan devices. these will be tagged on the main bridge
|
||||
// builtins.foldl'
|
||||
|
|
@ -509,6 +589,21 @@ in {
|
|||
vlanRange
|
||||
);
|
||||
};
|
||||
|
||||
"50-wg0" = {
|
||||
enable = true;
|
||||
matchConfig.Name = "wg0";
|
||||
address = [
|
||||
"10.0.0.1/24"
|
||||
];
|
||||
};
|
||||
# "50-wg1" = {
|
||||
# enable = true;
|
||||
# matchConfig.Name = "wg1";
|
||||
# address = [
|
||||
# "10.0.0.2/24"
|
||||
# ];
|
||||
# };
|
||||
}
|
||||
# configuration for the hostapd dynamic interfaces
|
||||
# * netdev type vlan
|
||||
|
|
|
|||
256
nix/os/devices/router0-nfmnk/configuration.nix
Normal file
256
nix/os/devices/router0-nfmnk/configuration.nix
Normal file
|
|
@ -0,0 +1,256 @@
|
|||
{
|
||||
repoFlake,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
nodeFlake,
|
||||
nodeName,
|
||||
localDomainName,
|
||||
system,
|
||||
...
|
||||
}: {
|
||||
system.stateVersion = "23.11";
|
||||
|
||||
imports = [
|
||||
nodeFlake.inputs.disko.nixosModules.disko
|
||||
nodeFlake.inputs.srvos.nixosModules.mixins-terminfo
|
||||
|
||||
repoFlake.inputs.sops-nix.nixosModules.sops
|
||||
|
||||
../../snippets/nix-settings.nix
|
||||
../../profiles/common/user.nix
|
||||
|
||||
nodeFlake.inputs.nixos-nftables-firewall.nixosModules.default
|
||||
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
services.openssh.settings.PermitRootLogin = "yes";
|
||||
|
||||
users.commonUsers = {
|
||||
enable = true;
|
||||
enableNonRoot = false;
|
||||
rootPasswordFile = config.sops.secrets.passwords-root.path;
|
||||
};
|
||||
|
||||
sops.age.keyFile = "/etc/age.key";
|
||||
sops.age.sshKeyPaths = [];
|
||||
|
||||
sops.defaultSopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
sops.defaultSopsFormat = "yaml";
|
||||
|
||||
sops.secrets.passwords-root.neededForUsers = true;
|
||||
}
|
||||
|
||||
# TODO: extract this into single-disk VM BIOS module
|
||||
{
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.loader.grub.efiSupport = false;
|
||||
|
||||
# forcing seems required or else there's an error about duplicated devices
|
||||
boot.loader.grub.devices = lib.mkForce ["/dev/sda"];
|
||||
|
||||
disko.devices.disk.sda = {
|
||||
device = "/dev/sda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
size = "1M";
|
||||
type = "EF02"; # for grub MBR
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = ["-f"]; # Override existing partition
|
||||
subvolumes = {
|
||||
# Subvolume name is different from mountpoint
|
||||
"/rootfs" = {
|
||||
mountpoint = "/";
|
||||
};
|
||||
"/nix" = {
|
||||
mountOptions = ["noatime"];
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
"/boot" = {
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot.initrd.kernelModules = [
|
||||
"virtio_balloon"
|
||||
"virtio_scsi"
|
||||
"virtio_net"
|
||||
"virtio_pci"
|
||||
"virtio_ring"
|
||||
"virtio"
|
||||
"scsi_mod"
|
||||
|
||||
"virtio_blk"
|
||||
"virtio_ring"
|
||||
"ata_piix"
|
||||
"pata_acpi"
|
||||
"ata_generic"
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
# sops.secrets.ssh_host_ed25519_key = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_ed25519_key";
|
||||
# mode = "0600";
|
||||
# };
|
||||
# sops.secrets.ssh_host_ed25519_key_pub = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_ed25519_key.pub";
|
||||
# mode = "0600";
|
||||
# };
|
||||
# sops.secrets.ssh_host_rsa_key = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_rsa_key";
|
||||
# mode = "0600";
|
||||
# };
|
||||
# sops.secrets.ssh_host_rsa_key_pub = {
|
||||
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||
# format = "yaml";
|
||||
|
||||
# path = "/etc/ssh/ssh_host_rsa_key.pub";
|
||||
# mode = "0644";
|
||||
# };
|
||||
|
||||
boot = {
|
||||
kernel = {
|
||||
sysctl = {
|
||||
"net.ipv4.conf.all.forwarding" = true;
|
||||
"net.ipv6.conf.all.forwarding" = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = nodeName;
|
||||
useNetworkd = true;
|
||||
useDHCP = true;
|
||||
usePredictableInterfaceNames = false;
|
||||
|
||||
# these will be configured via nftables
|
||||
firewall.enable = lib.mkForce true;
|
||||
firewall.allowedUDPPorts = [
|
||||
config.systemd.network.netdevs.wg0.wireguardConfig.ListenPort
|
||||
];
|
||||
|
||||
nat = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# Use the nftables firewall instead of the base nixos scripted rules.
|
||||
# This flake provides a similar utility to the base nixos scripting.
|
||||
# https://github.com/thelegy/nixos-nftables-firewall/tree/main
|
||||
|
||||
nftables = {
|
||||
enable = true;
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
snippets.nnf-common.enable = true;
|
||||
|
||||
zones.wan = {
|
||||
interfaces = ["eth0"];
|
||||
};
|
||||
zones.vpns = {
|
||||
interfaces = ["wg0"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.wg0-privatekey = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg0-peer0-psk = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
sops.secrets.wg0-peer1-psk = {
|
||||
mode = "440";
|
||||
group = "systemd-network";
|
||||
};
|
||||
|
||||
systemd.network.enable = true;
|
||||
systemd.network.netdevs.wg0 = {
|
||||
enable = true;
|
||||
netdevConfig = {
|
||||
Name = "wg0";
|
||||
Kind = "wireguard";
|
||||
};
|
||||
wireguardConfig = {
|
||||
ListenPort = 51820;
|
||||
# PublicKey /RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=
|
||||
PrivateKeyFile = builtins.toString config.sops.secrets.wg0-privatekey.path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
AllowedIPs = [
|
||||
"10.0.0.1/32"
|
||||
];
|
||||
PersistentKeepalive = 15;
|
||||
PresharedKeyFile = builtins.toString config.sops.secrets.wg0-peer0-psk.path;
|
||||
PublicKey = "hsjIenUFV/FBqplIKxSL/Zn2zDAfojlIKHMxPA6RC04=";
|
||||
};
|
||||
}
|
||||
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
AllowedIPs = [
|
||||
"10.0.0.2/32"
|
||||
];
|
||||
PersistentKeepalive = 15;
|
||||
PresharedKeyFile = builtins.toString config.sops.secrets.wg0-peer1-psk.path;
|
||||
PublicKey = "Ha5hsarCRO8LX9SrkopUeP14ebLdFgxXUC0ezrobax4=";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.networks.wg0 = {
|
||||
enable = true;
|
||||
matchConfig.Name = "wg0";
|
||||
address = [
|
||||
"10.0.0.254/24"
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.ethtool
|
||||
pkgs.neovim
|
||||
|
||||
(pkgs.writeShellScriptBin "dbg-ip" ''
|
||||
echo links:
|
||||
ip -br -c l
|
||||
echo
|
||||
echo addresses:
|
||||
ip -br -c a
|
||||
echo
|
||||
echo vlans:
|
||||
bridge -c vlan
|
||||
'')
|
||||
|
||||
(pkgs.writeShellScriptBin "dbg-dnsmasq" ''
|
||||
# get the rendered in-use config
|
||||
pgrep -a dnsmasq | grep -Eo '[^ ]*conf' | xargs cat | grep -Eo '[^=]*conf' | xargs cat
|
||||
'')
|
||||
];
|
||||
}
|
||||
34
nix/os/devices/router0-nfmnk/default.nix
Normal file
34
nix/os/devices/router0-nfmnk/default.nix
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
system ? "x86_64-linux",
|
||||
nodeName,
|
||||
repoFlake,
|
||||
nodeFlake,
|
||||
...
|
||||
}: let
|
||||
variables = import ./variables.crypt.nix;
|
||||
in {
|
||||
meta.nodeSpecialArgs.${nodeName} = {
|
||||
inherit repoFlake nodeName nodeFlake system;
|
||||
packages' = repoFlake.packages.${system};
|
||||
nodePackages' = nodeFlake.packages.${system};
|
||||
};
|
||||
|
||||
meta.nodeNixpkgs.${nodeName} =
|
||||
import nodeFlake.inputs.nixpkgs.outPath
|
||||
{
|
||||
inherit system;
|
||||
};
|
||||
|
||||
${nodeName} = {
|
||||
deployment.targetHost = variables.ipv4;
|
||||
deployment.replaceUnknownProfiles = true;
|
||||
|
||||
imports = [
|
||||
nodeFlake.inputs.home-manager.nixosModules.home-manager
|
||||
|
||||
./configuration.nix
|
||||
];
|
||||
|
||||
networking.hostName = nodeName;
|
||||
};
|
||||
}
|
||||
151
nix/os/devices/router0-nfmnk/flake.lock
generated
Normal file
151
nix/os/devices/router0-nfmnk/flake.lock
generated
Normal file
|
|
@ -0,0 +1,151 @@
|
|||
{
|
||||
"nodes": {
|
||||
"dependencyDagOfSubmodule": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-nftables-firewall",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1656615370,
|
||||
"narHash": "sha256-IZDqz1aSySoqf1qtVQg+oJMHfC4IlT55Zoa7EkjvPug=",
|
||||
"owner": "thelegy",
|
||||
"repo": "nix-dependencyDagOfSubmodule",
|
||||
"rev": "98eb563d80b35acafbfc1abb9ccee569c1efb19c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "thelegy",
|
||||
"repo": "nix-dependencyDagOfSubmodule",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1716431128,
|
||||
"narHash": "sha256-t3T8HlX3udO6f4ilLcN+j5eC3m2gqsouzSGiriKK6vk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "7ffc4354dfeb37c8c725ae1465f04a9b45ec8606",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1715381426,
|
||||
"narHash": "sha256-wPuqrAQGdv3ISs74nJfGb+Yprm23U/rFpcHFFNWgM94=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "ab5542e9dbd13d0100f8baae2bc2d68af901f4b4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "release-23.11",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-nftables-firewall": {
|
||||
"inputs": {
|
||||
"dependencyDagOfSubmodule": "dependencyDagOfSubmodule",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1715521768,
|
||||
"narHash": "sha256-BQkkBqDemoPRd2a4G94I9w9fNE0IxWtVsQ9SalnNqCQ=",
|
||||
"owner": "thelegy",
|
||||
"repo": "nixos-nftables-firewall",
|
||||
"rev": "2c5a19966b4dfc5ca92df7eb250c68f90be653c8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "thelegy",
|
||||
"repo": "nixos-nftables-firewall",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1716361217,
|
||||
"narHash": "sha256-mzZDr00WUiUXVm1ujBVv6A0qRd8okaITyUp4ezYRgc4=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "46397778ef1f73414b03ed553a3368f0e7e33c2f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-23.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1716509168,
|
||||
"narHash": "sha256-4zSIhSRRIoEBwjbPm3YiGtbd8HDWzFxJjw5DYSDy1n8=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "bfb7a882678e518398ce9a31a881538679f6f092",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"disko": "disko",
|
||||
"home-manager": "home-manager",
|
||||
"nixos-nftables-firewall": "nixos-nftables-firewall",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"srvos": "srvos"
|
||||
}
|
||||
},
|
||||
"srvos": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1716425501,
|
||||
"narHash": "sha256-BSLhmGYY1khyyBAjraR+N0Pa9Nha/et5yQQlEZxcfkU=",
|
||||
"owner": "numtide",
|
||||
"repo": "srvos",
|
||||
"rev": "1122cd50a23647e09c3e7a679d37ec02113bc412",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "srvos",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
19
nix/os/devices/router0-nfmnk/flake.nix
Normal file
19
nix/os/devices/router0-nfmnk/flake.nix
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
|
||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
|
||||
home-manager.url = "github:nix-community/home-manager/release-23.11";
|
||||
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
srvos.url = "github:numtide/srvos";
|
||||
srvos.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nixos-nftables-firewall.url = "github:thelegy/nixos-nftables-firewall";
|
||||
nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = _: {};
|
||||
}
|
||||
BIN
nix/os/devices/router0-nfmnk/variables.crypt.nix
Normal file
BIN
nix/os/devices/router0-nfmnk/variables.crypt.nix
Normal file
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue