initial commit

modules/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  imports = [
+    ./gre-tunnel
+    ./nginx-port-forward
+    ./monitoring
+  ];
+}

modules/gre-tunnel/default.nix

@@ -0,0 +1,89 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.clerie.gre-tunnel;
+
+  generateInterfaceUnit = isIPv6: (name: tunnel:
+    nameValuePair "gre-tunnel-${name}" {
+        description = "GRE Tunnel - ${name}";
+        requires = [ "network-online.target" ];
+        after = [ "network.target" "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        environment.DEVICE = name;
+        path = with pkgs; [ iproute ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+
+        script = ''
+          ${tunnel.preSetup}
+          ip${optionalString isIPv6 " -6"} tunnel add ${name} mode ${optionalString isIPv6 "ip6"}gre remote ${tunnel.remote} local ${tunnel.local}
+          ip link set ${name} up
+          ip${optionalString isIPv6 " -6"} a add ${tunnel.address} dev ${name}
+          ${tunnel.postSetup}
+        '';
+
+        postStop = ''
+          ip link set ${name} down
+          ip tunnel del ${name}
+          ${tunnel.postShutdown}
+        '';
+      });
+
+  checkOpts = { config, ... }@moduleAttrs: {
+    options = {
+      remote = mkOption {
+        type = types.str;
+        description = "Address of reciever.";
+      };
+      local = mkOption {
+        type = types.str;
+        description = "Address our packets originate from.";
+      };
+      address = mkOption {
+        type = types.str;
+        description = "Our address in this tunnel.";
+      };
+      preSetup = mkOption {
+        type = types.str;
+        default = "";
+        description = "Commands called at the start of the interface setup.";
+      };
+      postSetup = mkOption {
+        type = types.str;
+        default = "";
+        description = "Commands called at the end of the interface setup.";
+      };
+      postShutdown = mkOption {
+        type = types.str;
+        default = "";
+        description = "Commands called after shutting down the interface.";
+      };
+    };
+  };
+
+in {
+  options = {
+    clerie.gre-tunnel = {
+      enable = mkEnableOption "Declarative Policy-Routing";
+      ipv6 = mkOption {
+        type = with types; attrsOf (submodule checkOpts);
+        default = {};
+      };
+      ipv4 = mkOption {
+        type = with types; attrsOf (submodule checkOpts);
+        default = {};
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services =
+    (mapAttrs' (generateInterfaceUnit false) cfg.ipv4)
+    // (mapAttrs' (generateInterfaceUnit true) cfg.ipv6);
+  };
+}

modules/monitoring/default.nix

@@ -0,0 +1,77 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.clerie.monitoring;
+
+  monitoringServer = "kaon.net.entr0py.de";
+  networkBase = "fd00:23:23:23::";
+  serverPubKey = "iHrvJyvIWnsAc2FuXBy1ATuj2hy1jek0C9MqFcisH0k=";
+
+in
+
+{
+  options = {
+    clerie.monitoring = {
+      enable = mkEnableOption "clerie's Monitoring (with tweaks)";
+      networkBase = mkOption {
+          type = types.str;
+          default = networkBase;
+      };
+      server = mkOption {
+          type = types.str;
+          default = monitoringServer;
+      };
+      serverPort = mkOption {
+          type = types.int;
+          default = 51820;
+      };
+      id = mkOption {
+        type = types.str;
+        description = "ID of the Monitoring Interface (it is actually a part of an ip address)";
+      };
+      serverPublicKey = mkOption {
+          type = types.str;
+          default = serverPubKey;
+      };
+      pubkey = mkOption {
+        type = types.str;
+        description = "Public Key of the monitoring wireguard interface of this host";
+      };
+      privKeyFile = mkOption {
+          type = types.str;
+          example = "/run/keys/keyfile";
+      };
+    };
+  };
+  
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+        wireguard
+        wireguard-tools
+    ];
+    networking.wireguard.enable = true;
+    networking.wireguard.interfaces = {
+      wg-monitoring = {
+        ips = [ "${cfg.networkBase}${cfg.id}/64" ];
+        peers = [
+          {
+            endpoint = "${cfg.server}:${toString cfg.serverPort}";
+            persistentKeepalive = 25;
+            allowedIPs = [ "${cfg.networkBase}/64" ];
+            publicKey = "${cfg.serverPublicKey}";
+          }
+        ];
+        privateKeyFile = "${cfg.privKeyFile}";
+      };
+    };
+
+    services.prometheus.exporters.node = {
+      enable = true;
+      #listenAddress = "${monitoring-network-base}${cfg.id}";
+      openFirewall = true;
+      firewallFilter = "-i wg-monitoring -p tcp -m tcp --dport 9100";
+    };
+  };
+}

modules/nginx-port-forward/default.nix

@@ -0,0 +1,66 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.clerie.nginx-port-forward;
+  certs = config.security.acme.certs;
+  sslDhparam = config.services.nginx.sslDhparam;
+
+  mkServerBlock = isUDP: port: forward: ''
+    server {
+      listen ${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
+      listen [::]:${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
+      ${ optionalString (forward.certName != null) ''
+        ssl_certificate ${certs.${forward.certName}.directory}/fullchain.pem;
+        ssl_certificate_key ${certs.${forward.certName}.directory}/key.pem;
+        ${ optionalString (sslDhparam != null) "ssl_dhparam ${sslDhparam};" }
+      '' }
+      proxy_pass ${forward.host}:${toString forward.port};
+    }
+  '';
+
+  portForwardConf = ''
+      ${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock false) cfg.tcpPorts) }
+      ${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock true) cfg.udpPorts) }
+  '';
+
+  portOpts = { config, ... }@moduleAttrs: {
+    options = {
+      host = mkOption {
+        type = types.str;
+      };
+      port = mkOption {
+        type = types.int;
+      };
+      certName = mkOption {
+        type = with types; nullOr str;
+        default = null;
+      };
+    };
+  };
+
+in
+
+{
+  options = {
+    clerie.nginx-port-forward = {
+      enable = mkEnableOption "Nginx Port Forward";
+      tcpPorts = mkOption {
+        type = with types; attrsOf (submodule portOpts);
+        default = {};
+      };
+      udpPorts = mkOption {
+        type = with types; attrsOf (submodule portOpts);
+        default = {};
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx.enable = true;
+    services.nginx.streamConfig = portForwardConf;
+    networking.firewall.allowedTCPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.tcpPorts;
+    networking.firewall.allowedUDPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.udpPorts;
+  };
+}