initial commit
This commit is contained in:
garionion
commit
0e480bb6b6
|
|
@ -0,0 +1,2 @@
|
|||
secrets.nix
|
||||
/hosts/nio
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../modules
|
||||
];
|
||||
|
||||
boot.cleanTmpDir = true;
|
||||
networking.firewall.allowPing = true;
|
||||
networking.useDHCP = false;
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "de-latin1-nodeadkeys";
|
||||
};
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
system.autoUpgrade.enable = false;
|
||||
system.autoUpgrade.allowReboot = false;
|
||||
|
||||
networking.domain = "net.entr0py.de";
|
||||
networking.nameservers = [ "2a02:2970:1002::18" "46.182.19.48" "2001:1608:10:25::9249:d69b" "84.200.70.40" ];
|
||||
networking.extraHosts =
|
||||
''
|
||||
2001:638:904:ffcb::5 scotty-router
|
||||
'';
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.garionion = {
|
||||
isNormalUser = true;
|
||||
hashedPassword = "$6$NMzXsfARs2HVA4iq$55uxWCANME/HsjIg9HmZyxqGwlr7RpJfCcMad2OhbmUiHhdnOh/v9TDwT3Vt0mu9HE37Fh3b1g2yyEa3Dxxg80";
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
openssh.authorizedKeys.keys = ["ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGw3Yuee8oSXSEqmoMzrqQrUizKV9sJbJMxAUC01wxvbxevAqFEpiGrznnu3K0HN3sfKItjqGkNDPDQ+mIlQwdwJAE0GyJIx9CMvo1RPugKSJ5rFh/vEgJTNMPaeYUb/L2rn3WEZHrZI5wwf+z4ljSHCVetAnaMKjk/+QQWgBHdvNImmA== matze@darwin"];
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
"ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGw3Yuee8oSXSEqmoMzrqQrUizKV9sJbJMxAUC01wxvbxevAqFEpiGrznnu3K0HN3sfKItjqGkNDPDQ+mIlQwdwJAE0GyJIx9CMvo1RPugKSJ5rFh/vEgJTNMPaeYUb/L2rn3WEZHrZI5wwf+z4ljSHCVetAnaMKjk/+QQWgBHdvNImmA== matze@darwin"
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
wget vim screen mtr iperf
|
||||
htop dstat dnsutils nettools tcpdump
|
||||
git zsh oh-my-zsh spaceship-prompt
|
||||
];
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [1022];
|
||||
passwordAuthentication = false;
|
||||
};
|
||||
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.email = "letsencrypt@entr0py.de";
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "21.03"; # Did you read the comment?
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
services.qemuGuest.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
netdata
|
||||
];
|
||||
networking.firewall.allowedTCPPorts = [ 19999 ];
|
||||
services.netdata.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{ config, pkgs, ...}:
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
package = pkgs.nginxMainline;
|
||||
enableReload = true;
|
||||
proxyResolveWhileRunning = true;
|
||||
resolver = {
|
||||
addresses = [ "[2a02:2970:1002::18]" "46.182.19.48" "[2001:1608:10:25::9249:d69b]" "84.200.70.40" ];
|
||||
};
|
||||
appendHttpConfig = ''
|
||||
server {
|
||||
listen 0.0.0.0:80 default;
|
||||
listen [::]:80 default;
|
||||
location /.well-known/acme-challenge {
|
||||
proxy_pass http://$host$request_uri;
|
||||
}
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
'';
|
||||
streamConfig = ''
|
||||
resolver [2a02:2970:1002::18] 46.182.19.48 [2001:1608:10:25::9249:d69b] 84.200.70.40 ;
|
||||
server {
|
||||
listen 0.0.0.0:443;
|
||||
listen [::]:443;
|
||||
proxy_pass $ssl_preread_server_name:443;
|
||||
ssl_preread on;
|
||||
}
|
||||
'';
|
||||
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
#!/usr/bin/env bash
|
||||
DEPLOY_HOST=$1
|
||||
DEPLOY_ADDRESS=$2
|
||||
DEPLOY_PORT=$3
|
||||
|
||||
if [ -z $DEPLOY_HOST ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cmd=" \
|
||||
nixos-rebuild switch \
|
||||
-I nixos-config=hosts/${DEPLOY_HOST}/configuration.nix \
|
||||
"
|
||||
|
||||
if [ -z $DEPLOY_ADDRESS ] || [ $DEPLOY_ADDRESS = "-" ]; then
|
||||
DEPLOY_ADDRESS="root@${DEPLOY_HOST}.net.entr0py.de"
|
||||
fi
|
||||
|
||||
if [ $DEPLOY_ADDRESS != "localhost" ]; then
|
||||
cmd="${cmd} \
|
||||
--target-host ${DEPLOY_ADDRESS} \
|
||||
"
|
||||
fi
|
||||
|
||||
if [ -n "$DEPLOY_PORT" ]; then
|
||||
cmd="NIX_SSHOPTS=\"-p $DEPLOY_PORT\" ${cmd}"
|
||||
fi
|
||||
|
||||
eval ${cmd}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
#./wireguard.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
||||
|
||||
networking.hostName = "arion";
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens4.useDHCP = true;
|
||||
networking.interfaces.ens3.ipv4.addresses = [ {
|
||||
address = "91.228.52.159";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
networking.defaultGateway = "91.228.52.1";
|
||||
networking.interfaces.ens3.ipv6.addresses = [{
|
||||
address = "2001:67c:12a0:264::2";
|
||||
prefixLength = 64;
|
||||
}];
|
||||
networking.defaultGateway6 = {
|
||||
address = "2001:67c:12a0:264::1";
|
||||
interface = "ens3";
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/9afe949f-2c87-4b20-bbd2-893e0028ae2c";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/11072752-a36e-4a02-aa9f-8ca206d5a954"; }
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
wireguard
|
||||
wireguard-tools
|
||||
];
|
||||
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
|
||||
|
||||
networking = {
|
||||
firewall.allowedUDPPorts = [ 51820 52820];
|
||||
firewall.trustedInterfaces = [ "wg0" "server"];
|
||||
|
||||
wireguard.enable = true;
|
||||
wireguard.interfaces = {
|
||||
wg0 = {
|
||||
ips = [ "fd33:ab07:f877:23::1/64"];
|
||||
listenPort = 52820;
|
||||
privateKeyFile = "/run/keys/wg-arion_priv";
|
||||
allowedIPsAsRoutes = false;
|
||||
postSetup = ''
|
||||
ip route add 2001:67c:12a0:8003::0/64 via fd33:ab07:f877:23:300::1 dev wg0
|
||||
'';
|
||||
peers = [{
|
||||
publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
|
||||
allowedIPs = [ "2001:67c:12a0:8003::0/64" "fd33:ab07:f877:23:300::1/72" ];
|
||||
endpoint = "usg.net.entr0py.de:52820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
server = {
|
||||
ips = [ "fd33:ab07:f877:2342::1/64"];
|
||||
listenPort = 51820;
|
||||
privateKeyFile = "/run/keys/wg-arion_priv";
|
||||
allowedIPsAsRoutes = true;
|
||||
postSetup = ''
|
||||
ip route add 2001:67c:12a0:264:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
|
||||
'';
|
||||
peers = [{
|
||||
publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
|
||||
allowedIPs = [ "2001:67c:12a0:264:200::0/72" "fd33:ab07:f877:2342:200::1/72" ];
|
||||
endpoint = "scotty-router:52820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
{ ... }: {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
../../common/nginx.nix
|
||||
../../common/netdata.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
|
||||
|
||||
networking.hostName = "dyon";
|
||||
|
||||
networking.interfaces.ens3.ipv4.addresses = [ {
|
||||
address = "168.119.153.98";
|
||||
prefixLength = 32;
|
||||
}];
|
||||
networking.interfaces.ens3.ipv6.addresses = [{
|
||||
address = "2a01:4f8:c010:61dc::1";
|
||||
prefixLength = 64;
|
||||
}];
|
||||
networking.defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
interface = "ens3";
|
||||
};
|
||||
networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
|
||||
|
||||
clerie.monitoring = {
|
||||
enable = true;
|
||||
id = "201";
|
||||
privKeyFile = "/run/keys/wg-dyon_priv";
|
||||
pubkey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
|
||||
};
|
||||
|
||||
clerie.nginx-port-forward = {
|
||||
enable = true;
|
||||
tcpPorts."2222" = {
|
||||
host = "geon.net.entr0py.de";
|
||||
port = 2222;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{ modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
wireguard
|
||||
wireguard-tools
|
||||
];
|
||||
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
|
||||
|
||||
networking = {
|
||||
firewall.allowedUDPPorts = [ 51820 ];
|
||||
firewall.trustedInterfaces = [ "server"];
|
||||
|
||||
wireguard.enable = true;
|
||||
wireguard.interfaces = {
|
||||
server = {
|
||||
ips = [ "fd33:ab07:ff00:2342::1/64"];
|
||||
listenPort = 51820;
|
||||
privateKeyFile = "/run/keys/wg-dyon_priv";
|
||||
allowedIPsAsRoutes = false;
|
||||
postSetup = ''
|
||||
ip route add 2a01:4f8:c010:61dc:200::0/72 via fd33:ab07:ff00:2342:200::1 dev server
|
||||
'';
|
||||
peers = [{
|
||||
publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
|
||||
allowedIPs = [ "2a01:4f8:c010:61dc:200::0/72" "fd33:ab07:ff00:2342:200::1/72" ];
|
||||
endpoint = "scotty-router:52820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
../../common/netdata.nix
|
||||
../../common/kvm.nix
|
||||
./gitea.nix
|
||||
];
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "geon";
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.useDHCP = true;
|
||||
networking.interfaces.ens18.ipv6.addresses = [{
|
||||
address = "2a01:4f8:c010:61dc:200::500:1";
|
||||
prefixLength = 72;
|
||||
}];
|
||||
|
||||
networking.defaultGateway6 = {
|
||||
address = "2a01:4f8:c010:61dc:200::1";
|
||||
interface = "ens18";
|
||||
};
|
||||
|
||||
clerie.monitoring = {
|
||||
enable = true;
|
||||
id = "201";
|
||||
privKeyFile = "/run/keys/wg-geon_priv";
|
||||
pubkey = "WlVtrmfqZs6acvi185ovDn6NS2sZQkQNUf2oG0/QIx0=";
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
services.openssh.ports = [ 2222 ];
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
appName = "Git: entr0py.de";
|
||||
database = {
|
||||
createDatabase = false;
|
||||
type = "postgres";
|
||||
name = "gitea";
|
||||
user = "gitea";
|
||||
socket = "/run/postgresql";
|
||||
};
|
||||
cookieSecure = true;
|
||||
disableRegistration = true;
|
||||
rootUrl = "https://git.entr0py.de/";
|
||||
domain = "git.entr0py.de";
|
||||
httpAddress = "127.0.0.1";
|
||||
httpPort = 3000;
|
||||
lfs.enable = true;
|
||||
log.level = "Info";
|
||||
ssh = {
|
||||
enable = true;
|
||||
clonePort = 2222;
|
||||
};
|
||||
settings = {
|
||||
database = {
|
||||
CHARSET = "utf8";
|
||||
};
|
||||
repository = {
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
ENABLE_PUSH_CREATE_ORG = true;
|
||||
DEFAULT_PRIVATE = true;
|
||||
};
|
||||
server = {
|
||||
OFFLINE_MODE = true;
|
||||
LANDING_PAGE = "explore";
|
||||
};
|
||||
mailer = {
|
||||
enabled = false;
|
||||
};
|
||||
service = {
|
||||
REGISTER_EMAIL_CONFIRM = false;
|
||||
ENABLE_NOTIFY_MAIL = false;
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION = false;
|
||||
ENABLE_CAPTCHA = false;
|
||||
REQUIRE_SIGNIN_VIEW = false;
|
||||
DEFAULT_KEEP_EMAIL_PRIVATE = true;
|
||||
DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
|
||||
DEFAULT_ENABLE_TIMETRACKING = false;
|
||||
};
|
||||
picture = {
|
||||
DISABLE_GRAVATAR = true;
|
||||
ENABLE_FEDERATED_AVATAR = false;
|
||||
};
|
||||
openid = {
|
||||
ENABLE_OPENID_SIGNIN = false;
|
||||
ENABLE_OPENID_SIGNUP = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_12;
|
||||
ensureDatabases = [ "gitea" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "gitea";
|
||||
ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
services.nginx = {
|
||||
enable = true; # Enable Nginx
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts."git.entr0py.de" = { # Gitea hostname
|
||||
enableACME = true; # Use ACME certs
|
||||
forceSSL = true; # Force SSL
|
||||
locations."/".proxyPass = "http://localhost:3000/"; # Proxy Gitea
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/e46b795c-491c-4559-93e9-09477b6b4c81";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/B6EC-6AEE";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/3a94c2d1-c565-4bf5-ab1f-8db82fa069d7"; }
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
../../common/netdata.nix
|
||||
../../common/kvm.nix
|
||||
./monitoring.nix
|
||||
];
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "kaon";
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.useDHCP = true;
|
||||
networking.interfaces.ens18.ipv6.addresses = [{
|
||||
address = "2a01:4f8:c010:61dc:200::42:1";
|
||||
prefixLength = 72;
|
||||
}];
|
||||
|
||||
networking.defaultGateway6 = {
|
||||
address = "2a01:4f8:c010:61dc:200::1";
|
||||
interface = "ens18";
|
||||
};
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,30 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/f48111ec-6b98-47f6-a8c6-4a447a78a2e0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/B6B1-63E8";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/d6bcd29a-401b-4e84-9328-f03fc589e652"; }
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,147 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
hosts = (import ../../lib/hosts.nix { inherit pkgs; }).hosts;
|
||||
|
||||
monitoringHosts = filterAttrs (name: host:
|
||||
attrByPath ["clerie" "monitoring" "enable"] false host.config)
|
||||
hosts;
|
||||
|
||||
monitoringHostsNames = mapAttrs' (name: host:
|
||||
nameValuePair "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}" ["${host.config.networking.hostName}.mon.entr0py.de"])
|
||||
monitoringHosts;
|
||||
|
||||
monitoringPeers = mapAttrsToList (name: host: {
|
||||
allowedIPs = [ "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}/128" ];
|
||||
publicKey = host.config.clerie.monitoring.pubkey;
|
||||
})
|
||||
monitoringHosts;
|
||||
|
||||
monitoringTargets = mapAttrsToList (name: host:
|
||||
"${host.config.networking.hostName}.mon.entr0py.de:9100")
|
||||
monitoringHosts;
|
||||
|
||||
in {
|
||||
|
||||
networking.hosts = {
|
||||
"fd00:23:23:23::1" = [ "monitoring-1.mon.entr0py.de" ];
|
||||
}
|
||||
// monitoringHostsNames;
|
||||
|
||||
networking.wireguard.enable = true;
|
||||
networking.wireguard.interfaces = {
|
||||
wg-monitoring = {
|
||||
ips = [ "fd00:23:23:23::1/64" ];
|
||||
listenPort = 51820;
|
||||
peers = monitoringPeers;
|
||||
privateKeyFile = "/run/keys/wg-mon_priv";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg-monitoring.listenPort ];
|
||||
|
||||
services.prometheus.exporters.node.enable = true;
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
listenAddress = "[::1]";
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "prometheus";
|
||||
scrape_interval = "20s";
|
||||
scheme = "http";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"monitoring-1.mon.entr0py.de:9090"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "node-exporter";
|
||||
scrape_interval = "60s";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"monitoring-1.mon.entr0py.de:9100"
|
||||
]
|
||||
++ monitoringTargets;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_12;
|
||||
ensureDatabases = [ "grafana" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "grafana";
|
||||
ensurePermissions."DATABASE grafana" = "ALL PRIVILEGES";
|
||||
}
|
||||
];
|
||||
};
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
domain = "grafana.monitoring.entr0py.de";
|
||||
rootUrl = "https://grafana.monitoring.entr0py.de";
|
||||
port = 3001;
|
||||
addr = "::1";
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
name = "grafana";
|
||||
user = "grafana";
|
||||
host = "/run/postgresql";
|
||||
};
|
||||
|
||||
auth.anonymous.enable = true;
|
||||
security = {
|
||||
adminUser = "garionion";
|
||||
adminPasswordFile = "/run/keys/grafana-admin";
|
||||
};
|
||||
|
||||
provision = {
|
||||
enable = true;
|
||||
datasources = [
|
||||
{
|
||||
type = "prometheus";
|
||||
name = "Prometheus";
|
||||
url = "http://[::1]:9090";
|
||||
isDefault = true;
|
||||
}
|
||||
];
|
||||
dashboards = [
|
||||
{
|
||||
options.path = ./dashboards;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
systemd.services.grafana.after = ["postgresql.service"];
|
||||
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
virtualHosts = {
|
||||
"prometheus.monitoring.entr0py.de" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://[::1]:9090/";
|
||||
};
|
||||
"grafana.monitoring.entr0py.de" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://[::1]:${toString config.services.grafana.port}/";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
}
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
../../common/nginx.nix
|
||||
../../common/netdata.nix
|
||||
../../common/kvm.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
networking.hostName = "pion";
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens3.ipv4.addresses = [ {
|
||||
address = "45.9.62.100";
|
||||
prefixLength = 22;
|
||||
} ];
|
||||
networking.defaultGateway = "45.9.60.1";
|
||||
networking.interfaces.ens3.ipv6.addresses = [{
|
||||
address = "2a03:4000:45:5f3::1";
|
||||
prefixLength = 64;
|
||||
}{
|
||||
address = "2a03:4000:45:5f3:a817:42ff:fe13:3d86";
|
||||
prefixLength = 64;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
interface = "ens3";
|
||||
};
|
||||
|
||||
|
||||
services.ndppd = {
|
||||
enable = true;
|
||||
proxies = {
|
||||
ens3.rules."2a03:4000:45:5f3:200::0/72".method = "static";
|
||||
ens3.rules."2a03:4000:45:5f3:500::3/128".method = "static";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/fc6e5fc5-1c29-40fb-a769-58ff65cae9fa";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/473f0ace-f538-4011-9319-99791d032862"; }
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
wireguard
|
||||
wireguard-tools
|
||||
];
|
||||
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
|
||||
|
||||
networking = {
|
||||
firewall.allowedUDPPorts = [ 51820 52820 53820];
|
||||
firewall.trustedInterfaces = [ "wg0" "server"];
|
||||
|
||||
wireguard.enable = true;
|
||||
wireguard.interfaces = {
|
||||
wg0 = {
|
||||
ips = [ "fd33:ab07:f877:23::1/64"];
|
||||
listenPort = 52820;
|
||||
privateKeyFile = "/run/keys/wg-pion_priv";
|
||||
allowedIPsAsRoutes = false;
|
||||
postSetup = ''
|
||||
ip route add 2a03:4000:20:18e::/64 via fd33:ab07:f877:23:300::1 dev wg0
|
||||
'';
|
||||
peers = [{
|
||||
publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
|
||||
allowedIPs = [ "2a03:4000:20:18e::/64" "fd33:ab07:f877:23:300::1/72" ];
|
||||
endpoint = "usg.net.entr0py.de:52820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
/*server = {
|
||||
ips = [ "fd33:ab07:f877:2342::1/64"];
|
||||
listenPort = 51820;
|
||||
privateKeyFile = "/run/keys/wg-pion_priv";
|
||||
allowedIPsAsRoutes = true;
|
||||
postSetup = ''
|
||||
ip route add 2a03:4000:45:5f3:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
|
||||
'';
|
||||
peers = [{
|
||||
publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
|
||||
allowedIPs = [ "2a03:4000:45:5f3:200::0/72" "fd33:ab07:f877:2342:200::1/72" ];
|
||||
endpoint = "scotty-router:52820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};*/
|
||||
vpn = {
|
||||
ips = [ "fd33:ab07:f877:2342::3/64"];
|
||||
listenPort = 53820;
|
||||
privateKeyFile = "/run/keys/wg-pion_priv";
|
||||
allowedIPsAsRoutes = true;
|
||||
peers = [{
|
||||
publicKey = "7mmKxFeI/TYDqy4pLDkZyq32viNfon1zODFdOdbnhyM=";
|
||||
allowedIPs = [ "2a03:4000:45:5f3:500::3/128" ];
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
./nat.nix
|
||||
./dnsmasq.nix
|
||||
./wireguard.nix
|
||||
../../common/netdata.nix
|
||||
../../common/kvm.nix
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "router";
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.useDHCP = true;
|
||||
networking.interfaces.ens18.ipv6.addresses = [{
|
||||
address = "2001:638:904:ffcb::5";
|
||||
prefixLength = 64;
|
||||
}];
|
||||
networking.interfaces.ens19.ipv4.addresses = [ {
|
||||
address = "10.23.42.1";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
networking.interfaces.ens19.ipv6.addresses = [{
|
||||
address = "2a01:4f8:c010:61dc:200::1";
|
||||
prefixLength = 72;
|
||||
}];
|
||||
|
||||
networking.defaultGateway6 = {
|
||||
address = "fe80::d067:2680:4649:fba6";
|
||||
interface = "ens18";
|
||||
};
|
||||
|
||||
services.radvd = {
|
||||
enable = true;
|
||||
config = ''
|
||||
interface ens19
|
||||
{
|
||||
AdvSendAdvert on;
|
||||
AdvDefaultLifetime 1800;
|
||||
prefix 2a01:4f8:c010:61dc:200::/72 {};
|
||||
AdvSourceLLAddress on;
|
||||
route ::/0 {};
|
||||
};
|
||||
'';
|
||||
};
|
||||
|
||||
/*services.ndppd = {
|
||||
enable = true;
|
||||
proxies."pub0" = {
|
||||
interface = "pub0";
|
||||
rules."2a03:4000:45:5f3:200::/72" = {
|
||||
method = "iface";
|
||||
interface = "ens19";
|
||||
};
|
||||
};
|
||||
};*/
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 53 ];
|
||||
networking.firewall.allowedUDPPorts = [ 67 ];
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
resolveLocalQueries = true;
|
||||
servers = [ "141.24.40.3" "141.24.40.4" ];
|
||||
extraConfig = ''
|
||||
domain-needed
|
||||
bogus-priv
|
||||
interface=ens19
|
||||
expand-hosts
|
||||
domain=gari
|
||||
dhcp-range=10.23.42.50,10.23.42.200,12h
|
||||
dhcp-option=3,10.23.42.1
|
||||
dhcp-lease-max=150
|
||||
dhcp-rapid-commit
|
||||
listen-address=127.0.0.1
|
||||
listen-address=10.23.42.1
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/afd88905-a070-4032-a1a2-9c2b9c289220";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/2CFD-B740";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/f500aa6c-0971-429a-a651-1d7fed0d8101"; }
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
extraCommands = "iptables -A INPUT -p icmp -j ACCEPT";
|
||||
externalInterface = "ens18";
|
||||
internalInterfaces = [ "ens19" ];
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
{ config, pkgs, ...}:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
wireguard
|
||||
wireguard-tools
|
||||
];
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
|
||||
|
||||
networking = {
|
||||
firewall.allowedUDPPorts = [ 51820 52820];
|
||||
firewall.trustedInterfaces = [ "wg0" "pub0" "ens19"];
|
||||
|
||||
iproute2.enable = true;
|
||||
iproute2.rttablesExtraConfig = ''
|
||||
100 PUBLIC6
|
||||
'';
|
||||
|
||||
wireguard.enable = true;
|
||||
wireguard.interfaces = {
|
||||
pub0 = {
|
||||
ips = [ "fd33:ab07:ff00:2342:200::1/64" ];
|
||||
privateKeyFile = "/run/keys/wg-scotty-router_priv";
|
||||
listenPort = 52820;
|
||||
allowedIPsAsRoutes = true;
|
||||
postSetup = ''
|
||||
ip -6 rule add from 2a01:4f8:c010:61dc:200::0/72 lookup PUBLIC6
|
||||
ip -6 route add default via fd33:ab07:ff00:2342::1 dev pub0 table PUBLIC6
|
||||
'';
|
||||
#ip -6 route add fd33:ab07:f877:2342::1/64 dev pub0 table PUBLIC6
|
||||
peers = [{
|
||||
publicKey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
|
||||
allowedIPs = [ "::/0" ];
|
||||
endpoint = "dyon.net.entr0py.de:51820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../common/common.nix
|
||||
];
|
||||
|
||||
boot.cleanTmpDir = true;
|
||||
networking.hostName = "tailpipe";
|
||||
|
||||
networking.interfaces.ens3.ipv4.addresses = [ {
|
||||
address = "188.34.155.206";
|
||||
prefixLength = 32;
|
||||
}];
|
||||
networking.interfaces.ens3.ipv6.addresses = [{
|
||||
address = "2a01:4f8:c010:460a::1";
|
||||
prefixLength = 64;
|
||||
}];
|
||||
networking.defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
interface = "ens3";
|
||||
};
|
||||
networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{ modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
|
||||
}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
{ pkgs ? import ../pkgs {} }:
|
||||
|
||||
with pkgs.lib;
|
||||
|
||||
rec {
|
||||
hostsDir = ../hosts;
|
||||
|
||||
hostNames = attrNames (
|
||||
filterAttrs (
|
||||
name: type: type == "directory"
|
||||
) (
|
||||
builtins.readDir hostsDir
|
||||
)
|
||||
);
|
||||
|
||||
hosts = listToAttrs (
|
||||
map (
|
||||
hostName: nameValuePair hostName (
|
||||
import (pkgs.path + "/nixos") {
|
||||
configuration = import (hostsDir + "/${hostName}/configuration.nix");
|
||||
system = "x86_64-linux";
|
||||
}
|
||||
)
|
||||
) hostNames
|
||||
);
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./gre-tunnel
|
||||
./nginx-port-forward
|
||||
./monitoring
|
||||
];
|
||||
}
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.clerie.gre-tunnel;
|
||||
|
||||
generateInterfaceUnit = isIPv6: (name: tunnel:
|
||||
nameValuePair "gre-tunnel-${name}" {
|
||||
description = "GRE Tunnel - ${name}";
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment.DEVICE = name;
|
||||
path = with pkgs; [ iproute ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
${tunnel.preSetup}
|
||||
ip${optionalString isIPv6 " -6"} tunnel add ${name} mode ${optionalString isIPv6 "ip6"}gre remote ${tunnel.remote} local ${tunnel.local}
|
||||
ip link set ${name} up
|
||||
ip${optionalString isIPv6 " -6"} a add ${tunnel.address} dev ${name}
|
||||
${tunnel.postSetup}
|
||||
'';
|
||||
|
||||
postStop = ''
|
||||
ip link set ${name} down
|
||||
ip tunnel del ${name}
|
||||
${tunnel.postShutdown}
|
||||
'';
|
||||
});
|
||||
|
||||
checkOpts = { config, ... }@moduleAttrs: {
|
||||
options = {
|
||||
remote = mkOption {
|
||||
type = types.str;
|
||||
description = "Address of reciever.";
|
||||
};
|
||||
local = mkOption {
|
||||
type = types.str;
|
||||
description = "Address our packets originate from.";
|
||||
};
|
||||
address = mkOption {
|
||||
type = types.str;
|
||||
description = "Our address in this tunnel.";
|
||||
};
|
||||
preSetup = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands called at the start of the interface setup.";
|
||||
};
|
||||
postSetup = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands called at the end of the interface setup.";
|
||||
};
|
||||
postShutdown = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands called after shutting down the interface.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
in {
|
||||
options = {
|
||||
clerie.gre-tunnel = {
|
||||
enable = mkEnableOption "Declarative Policy-Routing";
|
||||
ipv6 = mkOption {
|
||||
type = with types; attrsOf (submodule checkOpts);
|
||||
default = {};
|
||||
};
|
||||
ipv4 = mkOption {
|
||||
type = with types; attrsOf (submodule checkOpts);
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services =
|
||||
(mapAttrs' (generateInterfaceUnit false) cfg.ipv4)
|
||||
// (mapAttrs' (generateInterfaceUnit true) cfg.ipv6);
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.clerie.monitoring;
|
||||
|
||||
monitoringServer = "kaon.net.entr0py.de";
|
||||
networkBase = "fd00:23:23:23::";
|
||||
serverPubKey = "iHrvJyvIWnsAc2FuXBy1ATuj2hy1jek0C9MqFcisH0k=";
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
options = {
|
||||
clerie.monitoring = {
|
||||
enable = mkEnableOption "clerie's Monitoring (with tweaks)";
|
||||
networkBase = mkOption {
|
||||
type = types.str;
|
||||
default = networkBase;
|
||||
};
|
||||
server = mkOption {
|
||||
type = types.str;
|
||||
default = monitoringServer;
|
||||
};
|
||||
serverPort = mkOption {
|
||||
type = types.int;
|
||||
default = 51820;
|
||||
};
|
||||
id = mkOption {
|
||||
type = types.str;
|
||||
description = "ID of the Monitoring Interface (it is actually a part of an ip address)";
|
||||
};
|
||||
serverPublicKey = mkOption {
|
||||
type = types.str;
|
||||
default = serverPubKey;
|
||||
};
|
||||
pubkey = mkOption {
|
||||
type = types.str;
|
||||
description = "Public Key of the monitoring wireguard interface of this host";
|
||||
};
|
||||
privKeyFile = mkOption {
|
||||
type = types.str;
|
||||
example = "/run/keys/keyfile";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [
|
||||
wireguard
|
||||
wireguard-tools
|
||||
];
|
||||
networking.wireguard.enable = true;
|
||||
networking.wireguard.interfaces = {
|
||||
wg-monitoring = {
|
||||
ips = [ "${cfg.networkBase}${cfg.id}/64" ];
|
||||
peers = [
|
||||
{
|
||||
endpoint = "${cfg.server}:${toString cfg.serverPort}";
|
||||
persistentKeepalive = 25;
|
||||
allowedIPs = [ "${cfg.networkBase}/64" ];
|
||||
publicKey = "${cfg.serverPublicKey}";
|
||||
}
|
||||
];
|
||||
privateKeyFile = "${cfg.privKeyFile}";
|
||||
};
|
||||
};
|
||||
|
||||
services.prometheus.exporters.node = {
|
||||
enable = true;
|
||||
#listenAddress = "${monitoring-network-base}${cfg.id}";
|
||||
openFirewall = true;
|
||||
firewallFilter = "-i wg-monitoring -p tcp -m tcp --dport 9100";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.clerie.nginx-port-forward;
|
||||
certs = config.security.acme.certs;
|
||||
sslDhparam = config.services.nginx.sslDhparam;
|
||||
|
||||
mkServerBlock = isUDP: port: forward: ''
|
||||
server {
|
||||
listen ${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
|
||||
listen [::]:${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
|
||||
${ optionalString (forward.certName != null) ''
|
||||
ssl_certificate ${certs.${forward.certName}.directory}/fullchain.pem;
|
||||
ssl_certificate_key ${certs.${forward.certName}.directory}/key.pem;
|
||||
${ optionalString (sslDhparam != null) "ssl_dhparam ${sslDhparam};" }
|
||||
'' }
|
||||
proxy_pass ${forward.host}:${toString forward.port};
|
||||
}
|
||||
'';
|
||||
|
||||
portForwardConf = ''
|
||||
${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock false) cfg.tcpPorts) }
|
||||
${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock true) cfg.udpPorts) }
|
||||
'';
|
||||
|
||||
portOpts = { config, ... }@moduleAttrs: {
|
||||
options = {
|
||||
host = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
};
|
||||
certName = mkOption {
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
options = {
|
||||
clerie.nginx-port-forward = {
|
||||
enable = mkEnableOption "Nginx Port Forward";
|
||||
tcpPorts = mkOption {
|
||||
type = with types; attrsOf (submodule portOpts);
|
||||
default = {};
|
||||
};
|
||||
udpPorts = mkOption {
|
||||
type = with types; attrsOf (submodule portOpts);
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.nginx.enable = true;
|
||||
services.nginx.streamConfig = portForwardConf;
|
||||
networking.firewall.allowedTCPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.tcpPorts;
|
||||
networking.firewall.allowedUDPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.udpPorts;
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
arion = import ../../hosts/arion/configuration.nix;
|
||||
geon = import ../../hosts/geon/configuration.nix;
|
||||
pion = import ../../hosts/pion/configuration.nix;
|
||||
scotty-router = import ../../hosts/scotty-router/configuration.nix;
|
||||
tailpipe = import ../../hosts/tailpipe/configuration.nix;
|
||||
dyon = import ../../hosts/dyon/configuration.nix;
|
||||
kaon = import ../../hosts/kaon/configuration.nix;
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
arion = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "arion.net.entr0py.de";
|
||||
};
|
||||
geon = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "geon.net.entr0py.de";
|
||||
};
|
||||
pion = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "pion.net.entr0py.de";
|
||||
};
|
||||
scotty-router = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "scotty-router";
|
||||
};
|
||||
tailpipe = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "tailpipe.net.entr0py.de";
|
||||
};
|
||||
dyon = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "dyon.net.entr0py.de";
|
||||
};
|
||||
kaon = { config, pkgs, ... }:{
|
||||
deployment.targetHost = "kaon.net.entr0py.de";
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue