initial commit

hosts/arion/configuration.nix

@@ -0,0 +1,37 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../common/common.nix
+      #./wireguard.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
+
+  networking.hostName = "arion"; 
+
+  networking.useDHCP = false;
+  networking.interfaces.ens4.useDHCP = true;
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "91.228.52.159";
+    prefixLength = 24;
+  } ];
+  networking.defaultGateway = "91.228.52.1";
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2001:67c:12a0:264::2";
+    prefixLength = 64;
+  }];
+  networking.defaultGateway6 = {
+    address = "2001:67c:12a0:264::1";
+    interface = "ens3";
+  };
+}

hosts/arion/hardware-configuration.nix

@@ -0,0 +1,22 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/9afe949f-2c87-4b20-bbd2-893e0028ae2c";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/11072752-a36e-4a02-aa9f-8ca206d5a954"; }
+    ];
+
+}

hosts/arion/wireguard.nix

@@ -0,0 +1,49 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+    
+    networking = {
+        firewall.allowedUDPPorts = [ 51820 52820];
+        firewall.trustedInterfaces = [ "wg0" "server"];
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            wg0 = {
+                ips = [ "fd33:ab07:f877:23::1/64"];
+                listenPort = 52820;
+                privateKeyFile = "/run/keys/wg-arion_priv";
+                allowedIPsAsRoutes = false;
+                postSetup = ''
+                    ip route add 2001:67c:12a0:8003::0/64 via fd33:ab07:f877:23:300::1 dev wg0
+                '';
+                peers = [{
+                    publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
+                    allowedIPs = [ "2001:67c:12a0:8003::0/64" "fd33:ab07:f877:23:300::1/72" ];
+                    endpoint = "usg.net.entr0py.de:52820";
+                    persistentKeepalive = 25;
+                }];
+            };
+            server = {
+                ips = [ "fd33:ab07:f877:2342::1/64"];
+                listenPort = 51820;
+                privateKeyFile = "/run/keys/wg-arion_priv";
+                allowedIPsAsRoutes = true;
+                postSetup = ''
+                    ip route add 2001:67c:12a0:264:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
+                '';
+                peers = [{
+                    publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
+                    allowedIPs = [ "2001:67c:12a0:264:200::0/72"  "fd33:ab07:f877:2342:200::1/72" ];
+                    endpoint = "scotty-router:52820";
+                    persistentKeepalive = 25;
+                }]; 
+            };
+        };
+    };
+}

hosts/dyon/configuration.nix

@@ -0,0 +1,41 @@
+{ ... }: {
+  imports = [
+    ./hardware-configuration.nix
+    ../../common/common.nix
+    ../../common/nginx.nix
+    ../../common/netdata.nix
+    ./wireguard.nix
+  ];
+
+  
+  networking.hostName = "dyon";  
+  
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "168.119.153.98";
+    prefixLength = 32;
+  }];
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc::1";
+    prefixLength = 64;
+  }];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
+  };
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+
+  clerie.monitoring = {
+    enable = true;
+    id = "201";
+    privKeyFile = "/run/keys/wg-dyon_priv";
+    pubkey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
+  };
+
+  clerie.nginx-port-forward = {
+    enable = true;
+    tcpPorts."2222" = {
+      host = "geon.net.entr0py.de";
+      port = 2222;
+    };
+  };
+}

hosts/dyon/hardware-configuration.nix

@@ -0,0 +1,6 @@
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/sda";
+  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+}

hosts/dyon/wireguard.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+    
+    networking = {
+        firewall.allowedUDPPorts = [ 51820 ];
+        firewall.trustedInterfaces = [ "server"];
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            server = {
+                ips = [ "fd33:ab07:ff00:2342::1/64"];
+                listenPort = 51820;
+                privateKeyFile = "/run/keys/wg-dyon_priv";
+                allowedIPsAsRoutes = false;
+                postSetup = ''
+                    ip route add 2a01:4f8:c010:61dc:200::0/72 via fd33:ab07:ff00:2342:200::1 dev server
+                '';
+                peers = [{
+                    publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
+                    allowedIPs = [ "2a01:4f8:c010:61dc:200::0/72"  "fd33:ab07:ff00:2342:200::1/72" ];
+                    endpoint = "scotty-router:52820";
+                    persistentKeepalive = 25;
+                }]; 
+            };
+            
+        };
+    };
+}

hosts/geon/configuration.nix

@@ -0,0 +1,40 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+        ./hardware-configuration.nix
+        ../../common/common.nix
+        ../../common/netdata.nix
+        ../../common/kvm.nix
+        ./gitea.nix
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "geon";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens18.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc:200::500:1";
+    prefixLength = 72;
+  }];
+
+  networking.defaultGateway6 = {
+    address = "2a01:4f8:c010:61dc:200::1";
+    interface = "ens18";
+  };
+
+  clerie.monitoring = {
+    enable = true;
+    id = "201";
+    privKeyFile = "/run/keys/wg-geon_priv";
+    pubkey = "WlVtrmfqZs6acvi185ovDn6NS2sZQkQNUf2oG0/QIx0=";
+  };
+}

hosts/geon/gitea.nix

@@ -0,0 +1,89 @@
+ { config, pkgs, lib, ... }:
+
+{
+  services.openssh.ports = [ 2222 ];
+  services.gitea = {
+    enable = true;
+    appName = "Git: entr0py.de";
+    database = {
+      createDatabase = false;
+      type = "postgres";
+      name = "gitea";
+      user = "gitea";
+      socket = "/run/postgresql";
+    };
+    cookieSecure = true;
+    disableRegistration = true;
+    rootUrl = "https://git.entr0py.de/";
+    domain = "git.entr0py.de";
+    httpAddress =  "127.0.0.1";
+    httpPort = 3000;
+    lfs.enable = true;
+    log.level = "Info";
+    ssh = {
+      enable = true;
+      clonePort = 2222;
+    };
+    settings = {
+      database = {
+        CHARSET = "utf8";
+      };
+      repository = {
+        ENABLE_PUSH_CREATE_USER = true;
+        ENABLE_PUSH_CREATE_ORG = true;
+        DEFAULT_PRIVATE = true;
+      };
+      server = {
+        OFFLINE_MODE = true;
+        LANDING_PAGE = "explore";
+      };
+      mailer = {
+        enabled = false;
+      };
+      service = {
+        REGISTER_EMAIL_CONFIRM = false;
+        ENABLE_NOTIFY_MAIL = false;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = false;
+        ENABLE_CAPTCHA = false;
+        REQUIRE_SIGNIN_VIEW = false;
+        DEFAULT_KEEP_EMAIL_PRIVATE = true;
+        DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
+        DEFAULT_ENABLE_TIMETRACKING = false;
+      };
+      picture = {
+        DISABLE_GRAVATAR = true;
+        ENABLE_FEDERATED_AVATAR = false;
+      };
+      openid = {
+        ENABLE_OPENID_SIGNIN = false;
+        ENABLE_OPENID_SIGNUP = false;
+      };
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_12;
+    ensureDatabases = [ "gitea" ];
+    ensureUsers = [
+      {
+        name = "gitea";
+        ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  services.nginx = {
+    enable = true;                                          # Enable Nginx
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."git.entr0py.de" = {                  # Gitea hostname
+      enableACME = true;                                    # Use ACME certs
+      forceSSL = true;                                      # Force SSL
+      locations."/".proxyPass = "http://localhost:3000/";   # Proxy Gitea
+    };
+  };
+}

hosts/geon/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/e46b795c-491c-4559-93e9-09477b6b4c81";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B6EC-6AEE";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/3a94c2d1-c565-4bf5-ab1f-8db82fa069d7"; }
+    ];
+
+}

hosts/kaon/configuration.nix

@@ -0,0 +1,33 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+        ./hardware-configuration.nix
+        ../../common/common.nix
+        ../../common/netdata.nix
+        ../../common/kvm.nix
+        ./monitoring.nix
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "kaon";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens18.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc:200::42:1";
+    prefixLength = 72;
+  }];
+
+  networking.defaultGateway6 = {
+    address = "2a01:4f8:c010:61dc:200::1";
+    interface = "ens18";
+  };
+}

hosts/kaon/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f48111ec-6b98-47f6-a8c6-4a447a78a2e0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B6B1-63E8";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/d6bcd29a-401b-4e84-9328-f03fc589e652"; }
+    ];
+
+}

hosts/kaon/monitoring.nix

@@ -0,0 +1,147 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  hosts = (import ../../lib/hosts.nix { inherit pkgs; }).hosts;
+
+  monitoringHosts = filterAttrs (name: host:
+    attrByPath ["clerie" "monitoring" "enable"] false host.config)
+    hosts;
+
+  monitoringHostsNames = mapAttrs' (name: host:
+    nameValuePair "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}"  ["${host.config.networking.hostName}.mon.entr0py.de"])
+    monitoringHosts;
+
+  monitoringPeers = mapAttrsToList (name: host: {
+      allowedIPs = [ "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}/128" ];
+      publicKey = host.config.clerie.monitoring.pubkey;
+    })
+    monitoringHosts;
+
+  monitoringTargets = mapAttrsToList (name: host:
+    "${host.config.networking.hostName}.mon.entr0py.de:9100")
+    monitoringHosts;
+
+in {
+
+  networking.hosts = {
+    "fd00:23:23:23::1" = [ "monitoring-1.mon.entr0py.de" ];
+  }
+  // monitoringHostsNames;
+
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces = {
+    wg-monitoring = {
+      ips = [ "fd00:23:23:23::1/64" ];
+      listenPort = 51820;
+      peers = monitoringPeers;
+      privateKeyFile = "/run/keys/wg-mon_priv";
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg-monitoring.listenPort ];
+
+  services.prometheus.exporters.node.enable = true;
+
+  services.prometheus = {
+    enable = true;
+    listenAddress = "[::1]";
+    scrapeConfigs = [
+      {
+        job_name = "prometheus";
+        scrape_interval = "20s";
+        scheme = "http";
+        static_configs = [
+          {
+            targets = [
+              "monitoring-1.mon.entr0py.de:9090"
+            ];
+          }
+        ];
+      }
+      {
+        job_name = "node-exporter";
+        scrape_interval = "60s";
+        static_configs = [
+          {
+            targets = [
+              "monitoring-1.mon.entr0py.de:9100"
+            ]
+            ++ monitoringTargets;
+          }
+        ];
+      }
+    ];
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_12;
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [
+      {
+        name = "grafana";
+        ensurePermissions."DATABASE grafana" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+  services.grafana = {
+    enable  = true;
+    domain  = "grafana.monitoring.entr0py.de";
+    rootUrl = "https://grafana.monitoring.entr0py.de";
+    port    = 3001;
+    addr = "::1";
+
+    database = {
+      type = "postgres";
+      name = "grafana";
+      user = "grafana";
+      host = "/run/postgresql";
+    };
+
+    auth.anonymous.enable = true;
+    security = {
+      adminUser = "garionion";
+      adminPasswordFile = "/run/keys/grafana-admin";
+    };
+
+    provision = {
+      enable = true;
+      datasources = [
+        {
+          type = "prometheus";
+          name = "Prometheus";
+          url = "http://[::1]:9090";
+          isDefault = true;
+        }
+      ];
+      dashboards = [
+        {
+          options.path = ./dashboards;
+        }
+      ];
+    };
+  };
+  systemd.services.grafana.after = ["postgresql.service"];
+
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+      "prometheus.monitoring.entr0py.de" = {
+        enableACME = true;
+        forceSSL   = true;
+        locations."/".proxyPass = "http://[::1]:9090/";
+      };
+      "grafana.monitoring.entr0py.de" = {
+        enableACME = true;
+        forceSSL   = true;
+        locations."/".proxyPass = "http://[::1]:${toString config.services.grafana.port}/";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

hosts/pion/configuration.nix

@@ -0,0 +1,48 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../common/common.nix
+      ../../common/nginx.nix
+      ../../common/netdata.nix
+      ../../common/kvm.nix
+      ./wireguard.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  networking.hostName = "pion";   
+ 
+  networking.useDHCP = false;
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "45.9.62.100";
+    prefixLength = 22;
+  } ];
+  networking.defaultGateway = "45.9.60.1";
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2a03:4000:45:5f3::1";
+    prefixLength = 64;
+  }{
+    address = "2a03:4000:45:5f3:a817:42ff:fe13:3d86";
+    prefixLength = 64;
+  }
+  ];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
+  };
+
+
+  services.ndppd = {
+    enable = true;
+    proxies = {
+      ens3.rules."2a03:4000:45:5f3:200::0/72".method = "static";
+      ens3.rules."2a03:4000:45:5f3:500::3/128".method = "static";
+    };
+  };
+}

hosts/pion/hardware-configuration.nix

@@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/fc6e5fc5-1c29-40fb-a769-58ff65cae9fa";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/473f0ace-f538-4011-9319-99791d032862"; }
+    ];
+
+}

hosts/pion/wireguard.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+    
+    networking = {
+        firewall.allowedUDPPorts = [ 51820 52820 53820];
+        firewall.trustedInterfaces = [ "wg0" "server"];
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            wg0 = {
+                ips = [ "fd33:ab07:f877:23::1/64"];
+                listenPort = 52820;
+                privateKeyFile = "/run/keys/wg-pion_priv";
+                allowedIPsAsRoutes = false;
+                postSetup = ''
+                    ip route add 2a03:4000:20:18e::/64 via fd33:ab07:f877:23:300::1 dev wg0
+                '';
+                peers = [{
+                    publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
+                    allowedIPs = [ "2a03:4000:20:18e::/64" "fd33:ab07:f877:23:300::1/72" ];
+                    endpoint = "usg.net.entr0py.de:52820";
+                    persistentKeepalive = 25;
+                }];
+            };
+            /*server = {
+                ips = [ "fd33:ab07:f877:2342::1/64"];
+                listenPort = 51820;
+                privateKeyFile = "/run/keys/wg-pion_priv";
+                allowedIPsAsRoutes = true;
+                postSetup = ''
+                    ip route add 2a03:4000:45:5f3:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
+                '';
+                peers = [{
+                    publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
+                    allowedIPs = [ "2a03:4000:45:5f3:200::0/72"  "fd33:ab07:f877:2342:200::1/72" ];
+                    endpoint = "scotty-router:52820";
+                    persistentKeepalive = 25;
+                }]; 
+            };*/
+            vpn = {
+                ips = [ "fd33:ab07:f877:2342::3/64"];
+                listenPort = 53820;
+                privateKeyFile = "/run/keys/wg-pion_priv";
+                allowedIPsAsRoutes = true;
+                peers = [{
+                    publicKey = "7mmKxFeI/TYDqy4pLDkZyq32viNfon1zODFdOdbnhyM=";
+                    allowedIPs = [ "2a03:4000:45:5f3:500::3/128" ];
+                    persistentKeepalive = 25;
+                }]; 
+            };
+        };
+    };
+}

hosts/scotty-router/configuration.nix

@@ -0,0 +1,64 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../common/common.nix
+      ./nat.nix
+      ./dnsmasq.nix
+      ./wireguard.nix
+      ../../common/netdata.nix
+      ../../common/kvm.nix
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  
+  networking.hostName = "router";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens18.ipv6.addresses = [{
+    address = "2001:638:904:ffcb::5";
+    prefixLength = 64;
+  }];
+  networking.interfaces.ens19.ipv4.addresses = [ {
+    address = "10.23.42.1";
+    prefixLength = 24;
+  }];
+  networking.interfaces.ens19.ipv6.addresses = [{
+    address = "2a01:4f8:c010:61dc:200::1";
+    prefixLength = 72;
+  }];
+
+  networking.defaultGateway6 = {
+    address = "fe80::d067:2680:4649:fba6";
+    interface = "ens18";
+  };
+
+  services.radvd = {
+    enable = true;
+    config = ''
+      interface ens19
+      {
+        AdvSendAdvert on;
+        AdvDefaultLifetime 1800;
+        prefix 2a01:4f8:c010:61dc:200::/72 {};
+        AdvSourceLLAddress on;
+        route ::/0 {};
+      };
+    '';
+  };
+
+  /*services.ndppd = {
+    enable = true;
+    proxies."pub0" = {
+      interface = "pub0";
+      rules."2a03:4000:45:5f3:200::/72" = {
+        method = "iface";
+        interface = "ens19";
+      };
+    };
+  };*/
+
+}

hosts/scotty-router/dnsmasq.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, ...}:
+
+{
+    networking.firewall.allowedTCPPorts = [ 53 ];
+    networking.firewall.allowedUDPPorts = [ 67 ];
+    services.dnsmasq = {
+        enable = true;
+        resolveLocalQueries = true;
+        servers = [ "141.24.40.3" "141.24.40.4" ];
+        extraConfig = ''
+            domain-needed
+            bogus-priv
+            interface=ens19
+            expand-hosts
+            domain=gari
+            dhcp-range=10.23.42.50,10.23.42.200,12h
+            dhcp-option=3,10.23.42.1
+            dhcp-lease-max=150
+            dhcp-rapid-commit
+            listen-address=127.0.0.1
+            listen-address=10.23.42.1
+        '';
+    };
+} 

hosts/scotty-router/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/afd88905-a070-4032-a1a2-9c2b9c289220";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/2CFD-B740";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/f500aa6c-0971-429a-a651-1d7fed0d8101"; }
+    ];
+
+}

hosts/scotty-router/nat.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ...}:
+
+{
+  networking.nat = {
+    enable = true;
+    extraCommands = "iptables -A INPUT -p icmp -j ACCEPT";
+    externalInterface = "ens18";
+    internalInterfaces = [ "ens19" ];
+  };
+}

hosts/scotty-router/wireguard.nix

@@ -0,0 +1,40 @@
+{ config, pkgs, ...}:
+
+{
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+
+    networking = {
+        firewall.allowedUDPPorts = [ 51820  52820];
+        firewall.trustedInterfaces = [ "wg0" "pub0" "ens19"];
+        
+        iproute2.enable = true;
+        iproute2.rttablesExtraConfig = ''
+        100 PUBLIC6
+        '';
+
+        wireguard.enable = true;
+        wireguard.interfaces = {
+            pub0 = {
+                ips = [ "fd33:ab07:ff00:2342:200::1/64" ];
+                privateKeyFile = "/run/keys/wg-scotty-router_priv";
+                listenPort = 52820;
+                allowedIPsAsRoutes = true;
+                postSetup = ''
+                    ip -6 rule add from 2a01:4f8:c010:61dc:200::0/72 lookup PUBLIC6
+                    ip -6 route add default via fd33:ab07:ff00:2342::1 dev pub0 table PUBLIC6
+                '';
+                #ip -6 route add fd33:ab07:f877:2342::1/64 dev pub0 table PUBLIC6
+                peers = [{
+                    publicKey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
+                    allowedIPs = [ "::/0"  ];
+                    endpoint = "dyon.net.entr0py.de:51820";
+                    persistentKeepalive = 25;
+                }];
+            };
+        };
+    };
+}

hosts/tailpipe/configuration.nix

@@ -0,0 +1,25 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../common/common.nix
+  ];
+
+  boot.cleanTmpDir = true;
+  networking.hostName = "tailpipe";
+  
+  networking.interfaces.ens3.ipv4.addresses = [ {
+    address = "188.34.155.206";
+    prefixLength = 32;
+  }];
+  networking.interfaces.ens3.ipv6.addresses = [{
+    address = "2a01:4f8:c010:460a::1";
+    prefixLength = 64;
+  }];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
+  };
+  networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
+
+}

hosts/tailpipe/hardware-configuration.nix

@@ -0,0 +1,6 @@
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/sda";
+  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+}