initial commit

This commit is contained in:
garionion 2021-03-13 15:32:44 +01:00
commit 0e480bb6b6
36 changed files with 13615 additions and 0 deletions

2
.gitignore vendored Normal file
View file

@ -0,0 +1,2 @@
secrets.nix
/hosts/nio

63
common/common.nix Normal file
View file

@ -0,0 +1,63 @@
{ config, pkgs, ... }:
{
imports = [
../modules
];
boot.cleanTmpDir = true;
networking.firewall.allowPing = true;
networking.useDHCP = false;
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "de-latin1-nodeadkeys";
};
time.timeZone = "Europe/Berlin";
system.autoUpgrade.enable = false;
system.autoUpgrade.allowReboot = false;
networking.domain = "net.entr0py.de";
networking.nameservers = [ "2a02:2970:1002::18" "46.182.19.48" "2001:1608:10:25::9249:d69b" "84.200.70.40" ];
networking.extraHosts =
''
2001:638:904:ffcb::5 scotty-router
'';
# Define a user account. Don't forget to set a password with passwd.
users.users.garionion = {
isNormalUser = true;
hashedPassword = "$6$NMzXsfARs2HVA4iq$55uxWCANME/HsjIg9HmZyxqGwlr7RpJfCcMad2OhbmUiHhdnOh/v9TDwT3Vt0mu9HE37Fh3b1g2yyEa3Dxxg80";
extraGroups = [ "wheel" ]; # Enable sudo for the user.
openssh.authorizedKeys.keys = ["ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGw3Yuee8oSXSEqmoMzrqQrUizKV9sJbJMxAUC01wxvbxevAqFEpiGrznnu3K0HN3sfKItjqGkNDPDQ+mIlQwdwJAE0GyJIx9CMvo1RPugKSJ5rFh/vEgJTNMPaeYUb/L2rn3WEZHrZI5wwf+z4ljSHCVetAnaMKjk/+QQWgBHdvNImmA== matze@darwin"];
};
users.users.root.openssh.authorizedKeys.keys = [
"ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGw3Yuee8oSXSEqmoMzrqQrUizKV9sJbJMxAUC01wxvbxevAqFEpiGrznnu3K0HN3sfKItjqGkNDPDQ+mIlQwdwJAE0GyJIx9CMvo1RPugKSJ5rFh/vEgJTNMPaeYUb/L2rn3WEZHrZI5wwf+z4ljSHCVetAnaMKjk/+QQWgBHdvNImmA== matze@darwin"
];
environment.systemPackages = with pkgs; [
wget vim screen mtr iperf
htop dstat dnsutils nettools tcpdump
git zsh oh-my-zsh spaceship-prompt
];
# Enable the OpenSSH daemon.
services.openssh = {
enable = true;
ports = [1022];
passwordAuthentication = false;
};
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt@entr0py.de";
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.03"; # Did you read the comment?
}

5
common/kvm.nix Normal file
View file

@ -0,0 +1,5 @@
{ ... }:
{
services.qemuGuest.enable = true;
}

9
common/netdata.nix Normal file
View file

@ -0,0 +1,9 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
netdata
];
networking.firewall.allowedTCPPorts = [ 19999 ];
services.netdata.enable = true;
}

35
common/nginx.nix Normal file
View file

@ -0,0 +1,35 @@
{ config, pkgs, ...}:
{
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx = {
enable = true;
package = pkgs.nginxMainline;
enableReload = true;
proxyResolveWhileRunning = true;
resolver = {
addresses = [ "[2a02:2970:1002::18]" "46.182.19.48" "[2001:1608:10:25::9249:d69b]" "84.200.70.40" ];
};
appendHttpConfig = ''
server {
listen 0.0.0.0:80 default;
listen [::]:80 default;
location /.well-known/acme-challenge {
proxy_pass http://$host$request_uri;
}
location / {
return 301 https://$host$request_uri;
}
}
'';
streamConfig = ''
resolver [2a02:2970:1002::18] 46.182.19.48 [2001:1608:10:25::9249:d69b] 84.200.70.40 ;
server {
listen 0.0.0.0:443;
listen [::]:443;
proxy_pass $ssl_preread_server_name:443;
ssl_preread on;
}
'';
};
}

29
deploy.sh Executable file
View file

@ -0,0 +1,29 @@
#!/usr/bin/env bash
DEPLOY_HOST=$1
DEPLOY_ADDRESS=$2
DEPLOY_PORT=$3
if [ -z $DEPLOY_HOST ]; then
exit 1
fi
cmd=" \
nixos-rebuild switch \
-I nixos-config=hosts/${DEPLOY_HOST}/configuration.nix \
"
if [ -z $DEPLOY_ADDRESS ] || [ $DEPLOY_ADDRESS = "-" ]; then
DEPLOY_ADDRESS="root@${DEPLOY_HOST}.net.entr0py.de"
fi
if [ $DEPLOY_ADDRESS != "localhost" ]; then
cmd="${cmd} \
--target-host ${DEPLOY_ADDRESS} \
"
fi
if [ -n "$DEPLOY_PORT" ]; then
cmd="NIX_SSHOPTS=\"-p $DEPLOY_PORT\" ${cmd}"
fi
eval ${cmd}

View file

@ -0,0 +1,37 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
{
imports =
[
./hardware-configuration.nix
../../common/common.nix
#./wireguard.nix
];
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
networking.hostName = "arion";
networking.useDHCP = false;
networking.interfaces.ens4.useDHCP = true;
networking.interfaces.ens3.ipv4.addresses = [ {
address = "91.228.52.159";
prefixLength = 24;
} ];
networking.defaultGateway = "91.228.52.1";
networking.interfaces.ens3.ipv6.addresses = [{
address = "2001:67c:12a0:264::2";
prefixLength = 64;
}];
networking.defaultGateway6 = {
address = "2001:67c:12a0:264::1";
interface = "ens3";
};
}

View file

@ -0,0 +1,22 @@
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/9afe949f-2c87-4b20-bbd2-893e0028ae2c";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/11072752-a36e-4a02-aa9f-8ca206d5a954"; }
];
}

49
hosts/arion/wireguard.nix Normal file
View file

@ -0,0 +1,49 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
wireguard
wireguard-tools
];
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking = {
firewall.allowedUDPPorts = [ 51820 52820];
firewall.trustedInterfaces = [ "wg0" "server"];
wireguard.enable = true;
wireguard.interfaces = {
wg0 = {
ips = [ "fd33:ab07:f877:23::1/64"];
listenPort = 52820;
privateKeyFile = "/run/keys/wg-arion_priv";
allowedIPsAsRoutes = false;
postSetup = ''
ip route add 2001:67c:12a0:8003::0/64 via fd33:ab07:f877:23:300::1 dev wg0
'';
peers = [{
publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
allowedIPs = [ "2001:67c:12a0:8003::0/64" "fd33:ab07:f877:23:300::1/72" ];
endpoint = "usg.net.entr0py.de:52820";
persistentKeepalive = 25;
}];
};
server = {
ips = [ "fd33:ab07:f877:2342::1/64"];
listenPort = 51820;
privateKeyFile = "/run/keys/wg-arion_priv";
allowedIPsAsRoutes = true;
postSetup = ''
ip route add 2001:67c:12a0:264:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
'';
peers = [{
publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
allowedIPs = [ "2001:67c:12a0:264:200::0/72" "fd33:ab07:f877:2342:200::1/72" ];
endpoint = "scotty-router:52820";
persistentKeepalive = 25;
}];
};
};
};
}

View file

@ -0,0 +1,41 @@
{ ... }: {
imports = [
./hardware-configuration.nix
../../common/common.nix
../../common/nginx.nix
../../common/netdata.nix
./wireguard.nix
];
networking.hostName = "dyon";
networking.interfaces.ens3.ipv4.addresses = [ {
address = "168.119.153.98";
prefixLength = 32;
}];
networking.interfaces.ens3.ipv6.addresses = [{
address = "2a01:4f8:c010:61dc::1";
prefixLength = 64;
}];
networking.defaultGateway6 = {
address = "fe80::1";
interface = "ens3";
};
networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
clerie.monitoring = {
enable = true;
id = "201";
privKeyFile = "/run/keys/wg-dyon_priv";
pubkey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
};
clerie.nginx-port-forward = {
enable = true;
tcpPorts."2222" = {
host = "geon.net.entr0py.de";
port = 2222;
};
};
}

View file

@ -0,0 +1,6 @@
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.loader.grub.device = "/dev/sda";
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
}

35
hosts/dyon/wireguard.nix Normal file
View file

@ -0,0 +1,35 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
wireguard
wireguard-tools
];
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking = {
firewall.allowedUDPPorts = [ 51820 ];
firewall.trustedInterfaces = [ "server"];
wireguard.enable = true;
wireguard.interfaces = {
server = {
ips = [ "fd33:ab07:ff00:2342::1/64"];
listenPort = 51820;
privateKeyFile = "/run/keys/wg-dyon_priv";
allowedIPsAsRoutes = false;
postSetup = ''
ip route add 2a01:4f8:c010:61dc:200::0/72 via fd33:ab07:ff00:2342:200::1 dev server
'';
peers = [{
publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
allowedIPs = [ "2a01:4f8:c010:61dc:200::0/72" "fd33:ab07:ff00:2342:200::1/72" ];
endpoint = "scotty-router:52820";
persistentKeepalive = 25;
}];
};
};
};
}

View file

@ -0,0 +1,40 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
../../common/common.nix
../../common/netdata.nix
../../common/kvm.nix
./gitea.nix
];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "geon";
networking.useDHCP = false;
networking.interfaces.ens18.useDHCP = true;
networking.interfaces.ens18.ipv6.addresses = [{
address = "2a01:4f8:c010:61dc:200::500:1";
prefixLength = 72;
}];
networking.defaultGateway6 = {
address = "2a01:4f8:c010:61dc:200::1";
interface = "ens18";
};
clerie.monitoring = {
enable = true;
id = "201";
privKeyFile = "/run/keys/wg-geon_priv";
pubkey = "WlVtrmfqZs6acvi185ovDn6NS2sZQkQNUf2oG0/QIx0=";
};
}

89
hosts/geon/gitea.nix Normal file
View file

@ -0,0 +1,89 @@
{ config, pkgs, lib, ... }:
{
services.openssh.ports = [ 2222 ];
services.gitea = {
enable = true;
appName = "Git: entr0py.de";
database = {
createDatabase = false;
type = "postgres";
name = "gitea";
user = "gitea";
socket = "/run/postgresql";
};
cookieSecure = true;
disableRegistration = true;
rootUrl = "https://git.entr0py.de/";
domain = "git.entr0py.de";
httpAddress = "127.0.0.1";
httpPort = 3000;
lfs.enable = true;
log.level = "Info";
ssh = {
enable = true;
clonePort = 2222;
};
settings = {
database = {
CHARSET = "utf8";
};
repository = {
ENABLE_PUSH_CREATE_USER = true;
ENABLE_PUSH_CREATE_ORG = true;
DEFAULT_PRIVATE = true;
};
server = {
OFFLINE_MODE = true;
LANDING_PAGE = "explore";
};
mailer = {
enabled = false;
};
service = {
REGISTER_EMAIL_CONFIRM = false;
ENABLE_NOTIFY_MAIL = false;
ALLOW_ONLY_EXTERNAL_REGISTRATION = false;
ENABLE_CAPTCHA = false;
REQUIRE_SIGNIN_VIEW = false;
DEFAULT_KEEP_EMAIL_PRIVATE = true;
DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
DEFAULT_ENABLE_TIMETRACKING = false;
};
picture = {
DISABLE_GRAVATAR = true;
ENABLE_FEDERATED_AVATAR = false;
};
openid = {
ENABLE_OPENID_SIGNIN = false;
ENABLE_OPENID_SIGNUP = false;
};
};
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_12;
ensureDatabases = [ "gitea" ];
ensureUsers = [
{
name = "gitea";
ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES";
}
];
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx = {
enable = true; # Enable Nginx
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."git.entr0py.de" = { # Gitea hostname
enableACME = true; # Use ACME certs
forceSSL = true; # Force SSL
locations."/".proxyPass = "http://localhost:3000/"; # Proxy Gitea
};
};
}

View file

@ -0,0 +1,30 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/e46b795c-491c-4559-93e9-09477b6b4c81";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/B6EC-6AEE";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/3a94c2d1-c565-4bf5-ab1f-8db82fa069d7"; }
];
}

View file

@ -0,0 +1,33 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
../../common/common.nix
../../common/netdata.nix
../../common/kvm.nix
./monitoring.nix
];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "kaon";
networking.useDHCP = false;
networking.interfaces.ens18.useDHCP = true;
networking.interfaces.ens18.ipv6.addresses = [{
address = "2a01:4f8:c010:61dc:200::42:1";
prefixLength = 72;
}];
networking.defaultGateway6 = {
address = "2a01:4f8:c010:61dc:200::1";
interface = "ens18";
};
}

File diff suppressed because it is too large Load diff

View file

@ -0,0 +1,30 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/f48111ec-6b98-47f6-a8c6-4a447a78a2e0";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/B6B1-63E8";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/d6bcd29a-401b-4e84-9328-f03fc589e652"; }
];
}

147
hosts/kaon/monitoring.nix Normal file
View file

@ -0,0 +1,147 @@
{ config, pkgs, lib, ... }:
with lib;
let
hosts = (import ../../lib/hosts.nix { inherit pkgs; }).hosts;
monitoringHosts = filterAttrs (name: host:
attrByPath ["clerie" "monitoring" "enable"] false host.config)
hosts;
monitoringHostsNames = mapAttrs' (name: host:
nameValuePair "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}" ["${host.config.networking.hostName}.mon.entr0py.de"])
monitoringHosts;
monitoringPeers = mapAttrsToList (name: host: {
allowedIPs = [ "${host.config.clerie.monitoring.networkBase}${host.config.clerie.monitoring.id}/128" ];
publicKey = host.config.clerie.monitoring.pubkey;
})
monitoringHosts;
monitoringTargets = mapAttrsToList (name: host:
"${host.config.networking.hostName}.mon.entr0py.de:9100")
monitoringHosts;
in {
networking.hosts = {
"fd00:23:23:23::1" = [ "monitoring-1.mon.entr0py.de" ];
}
// monitoringHostsNames;
networking.wireguard.enable = true;
networking.wireguard.interfaces = {
wg-monitoring = {
ips = [ "fd00:23:23:23::1/64" ];
listenPort = 51820;
peers = monitoringPeers;
privateKeyFile = "/run/keys/wg-mon_priv";
};
};
networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg-monitoring.listenPort ];
services.prometheus.exporters.node.enable = true;
services.prometheus = {
enable = true;
listenAddress = "[::1]";
scrapeConfigs = [
{
job_name = "prometheus";
scrape_interval = "20s";
scheme = "http";
static_configs = [
{
targets = [
"monitoring-1.mon.entr0py.de:9090"
];
}
];
}
{
job_name = "node-exporter";
scrape_interval = "60s";
static_configs = [
{
targets = [
"monitoring-1.mon.entr0py.de:9100"
]
++ monitoringTargets;
}
];
}
];
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_12;
ensureDatabases = [ "grafana" ];
ensureUsers = [
{
name = "grafana";
ensurePermissions."DATABASE grafana" = "ALL PRIVILEGES";
}
];
};
services.grafana = {
enable = true;
domain = "grafana.monitoring.entr0py.de";
rootUrl = "https://grafana.monitoring.entr0py.de";
port = 3001;
addr = "::1";
database = {
type = "postgres";
name = "grafana";
user = "grafana";
host = "/run/postgresql";
};
auth.anonymous.enable = true;
security = {
adminUser = "garionion";
adminPasswordFile = "/run/keys/grafana-admin";
};
provision = {
enable = true;
datasources = [
{
type = "prometheus";
name = "Prometheus";
url = "http://[::1]:9090";
isDefault = true;
}
];
dashboards = [
{
options.path = ./dashboards;
}
];
};
};
systemd.services.grafana.after = ["postgresql.service"];
services.nginx = {
enable = true;
virtualHosts = {
"prometheus.monitoring.entr0py.de" = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://[::1]:9090/";
};
"grafana.monitoring.entr0py.de" = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://[::1]:${toString config.services.grafana.port}/";
};
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
}

View file

@ -0,0 +1,48 @@
{ config, pkgs, ... }:
{
imports =
[
./hardware-configuration.nix
../../common/common.nix
../../common/nginx.nix
../../common/netdata.nix
../../common/kvm.nix
./wireguard.nix
];
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
networking.hostName = "pion";
networking.useDHCP = false;
networking.interfaces.ens3.ipv4.addresses = [ {
address = "45.9.62.100";
prefixLength = 22;
} ];
networking.defaultGateway = "45.9.60.1";
networking.interfaces.ens3.ipv6.addresses = [{
address = "2a03:4000:45:5f3::1";
prefixLength = 64;
}{
address = "2a03:4000:45:5f3:a817:42ff:fe13:3d86";
prefixLength = 64;
}
];
networking.defaultGateway6 = {
address = "fe80::1";
interface = "ens3";
};
services.ndppd = {
enable = true;
proxies = {
ens3.rules."2a03:4000:45:5f3:200::0/72".method = "static";
ens3.rules."2a03:4000:45:5f3:500::3/128".method = "static";
};
};
}

View file

@ -0,0 +1,25 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/fc6e5fc5-1c29-40fb-a769-58ff65cae9fa";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/473f0ace-f538-4011-9319-99791d032862"; }
];
}

60
hosts/pion/wireguard.nix Normal file
View file

@ -0,0 +1,60 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
wireguard
wireguard-tools
];
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking = {
firewall.allowedUDPPorts = [ 51820 52820 53820];
firewall.trustedInterfaces = [ "wg0" "server"];
wireguard.enable = true;
wireguard.interfaces = {
wg0 = {
ips = [ "fd33:ab07:f877:23::1/64"];
listenPort = 52820;
privateKeyFile = "/run/keys/wg-pion_priv";
allowedIPsAsRoutes = false;
postSetup = ''
ip route add 2a03:4000:20:18e::/64 via fd33:ab07:f877:23:300::1 dev wg0
'';
peers = [{
publicKey = "bgWFMIasw+IHfr/1drJWEHBcsCZ3fqoB4djiZ9BDUCM=";
allowedIPs = [ "2a03:4000:20:18e::/64" "fd33:ab07:f877:23:300::1/72" ];
endpoint = "usg.net.entr0py.de:52820";
persistentKeepalive = 25;
}];
};
/*server = {
ips = [ "fd33:ab07:f877:2342::1/64"];
listenPort = 51820;
privateKeyFile = "/run/keys/wg-pion_priv";
allowedIPsAsRoutes = true;
postSetup = ''
ip route add 2a03:4000:45:5f3:200::0/72 via fd33:ab07:f877:2342:200::1 dev server
'';
peers = [{
publicKey = "PQW2/P7wozf8pmpWxCDofT7AwqkPjc5kq8qQigZoUjo=";
allowedIPs = [ "2a03:4000:45:5f3:200::0/72" "fd33:ab07:f877:2342:200::1/72" ];
endpoint = "scotty-router:52820";
persistentKeepalive = 25;
}];
};*/
vpn = {
ips = [ "fd33:ab07:f877:2342::3/64"];
listenPort = 53820;
privateKeyFile = "/run/keys/wg-pion_priv";
allowedIPsAsRoutes = true;
peers = [{
publicKey = "7mmKxFeI/TYDqy4pLDkZyq32viNfon1zODFdOdbnhyM=";
allowedIPs = [ "2a03:4000:45:5f3:500::3/128" ];
persistentKeepalive = 25;
}];
};
};
};
}

View file

@ -0,0 +1,64 @@
{ config, pkgs, ... }:
{
imports =
[
./hardware-configuration.nix
../../common/common.nix
./nat.nix
./dnsmasq.nix
./wireguard.nix
../../common/netdata.nix
../../common/kvm.nix
];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "router";
networking.useDHCP = false;
networking.interfaces.ens18.useDHCP = true;
networking.interfaces.ens18.ipv6.addresses = [{
address = "2001:638:904:ffcb::5";
prefixLength = 64;
}];
networking.interfaces.ens19.ipv4.addresses = [ {
address = "10.23.42.1";
prefixLength = 24;
}];
networking.interfaces.ens19.ipv6.addresses = [{
address = "2a01:4f8:c010:61dc:200::1";
prefixLength = 72;
}];
networking.defaultGateway6 = {
address = "fe80::d067:2680:4649:fba6";
interface = "ens18";
};
services.radvd = {
enable = true;
config = ''
interface ens19
{
AdvSendAdvert on;
AdvDefaultLifetime 1800;
prefix 2a01:4f8:c010:61dc:200::/72 {};
AdvSourceLLAddress on;
route ::/0 {};
};
'';
};
/*services.ndppd = {
enable = true;
proxies."pub0" = {
interface = "pub0";
rules."2a03:4000:45:5f3:200::/72" = {
method = "iface";
interface = "ens19";
};
};
};*/
}

View file

@ -0,0 +1,24 @@
{ config, pkgs, ...}:
{
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 67 ];
services.dnsmasq = {
enable = true;
resolveLocalQueries = true;
servers = [ "141.24.40.3" "141.24.40.4" ];
extraConfig = ''
domain-needed
bogus-priv
interface=ens19
expand-hosts
domain=gari
dhcp-range=10.23.42.50,10.23.42.200,12h
dhcp-option=3,10.23.42.1
dhcp-lease-max=150
dhcp-rapid-commit
listen-address=127.0.0.1
listen-address=10.23.42.1
'';
};
}

View file

@ -0,0 +1,30 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/afd88905-a070-4032-a1a2-9c2b9c289220";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/2CFD-B740";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/f500aa6c-0971-429a-a651-1d7fed0d8101"; }
];
}

View file

@ -0,0 +1,10 @@
{ config, pkgs, ...}:
{
networking.nat = {
enable = true;
extraCommands = "iptables -A INPUT -p icmp -j ACCEPT";
externalInterface = "ens18";
internalInterfaces = [ "ens19" ];
};
}

View file

@ -0,0 +1,40 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
wireguard
wireguard-tools
];
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking = {
firewall.allowedUDPPorts = [ 51820 52820];
firewall.trustedInterfaces = [ "wg0" "pub0" "ens19"];
iproute2.enable = true;
iproute2.rttablesExtraConfig = ''
100 PUBLIC6
'';
wireguard.enable = true;
wireguard.interfaces = {
pub0 = {
ips = [ "fd33:ab07:ff00:2342:200::1/64" ];
privateKeyFile = "/run/keys/wg-scotty-router_priv";
listenPort = 52820;
allowedIPsAsRoutes = true;
postSetup = ''
ip -6 rule add from 2a01:4f8:c010:61dc:200::0/72 lookup PUBLIC6
ip -6 route add default via fd33:ab07:ff00:2342::1 dev pub0 table PUBLIC6
'';
#ip -6 route add fd33:ab07:f877:2342::1/64 dev pub0 table PUBLIC6
peers = [{
publicKey = "4faakn5yfzukxRwo79iTawag4jzAFkErXHLeEvtoLCc=";
allowedIPs = [ "::/0" ];
endpoint = "dyon.net.entr0py.de:51820";
persistentKeepalive = 25;
}];
};
};
};
}

View file

@ -0,0 +1,25 @@
{ ... }:
{
imports = [
./hardware-configuration.nix
../../common/common.nix
];
boot.cleanTmpDir = true;
networking.hostName = "tailpipe";
networking.interfaces.ens3.ipv4.addresses = [ {
address = "188.34.155.206";
prefixLength = 32;
}];
networking.interfaces.ens3.ipv6.addresses = [{
address = "2a01:4f8:c010:460a::1";
prefixLength = 64;
}];
networking.defaultGateway6 = {
address = "fe80::1";
interface = "ens3";
};
networking.defaultGateway = { address = "172.31.1.1"; interface = "ens3"; };
}

View file

@ -0,0 +1,6 @@
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.loader.grub.device = "/dev/sda";
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
}

26
lib/hosts.nix Normal file
View file

@ -0,0 +1,26 @@
{ pkgs ? import ../pkgs {} }:
with pkgs.lib;
rec {
hostsDir = ../hosts;
hostNames = attrNames (
filterAttrs (
name: type: type == "directory"
) (
builtins.readDir hostsDir
)
);
hosts = listToAttrs (
map (
hostName: nameValuePair hostName (
import (pkgs.path + "/nixos") {
configuration = import (hostsDir + "/${hostName}/configuration.nix");
system = "x86_64-linux";
}
)
) hostNames
);
}

9
modules/default.nix Normal file
View file

@ -0,0 +1,9 @@
{ ... }:
{
imports = [
./gre-tunnel
./nginx-port-forward
./monitoring
];
}

View file

@ -0,0 +1,89 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.clerie.gre-tunnel;
generateInterfaceUnit = isIPv6: (name: tunnel:
nameValuePair "gre-tunnel-${name}" {
description = "GRE Tunnel - ${name}";
requires = [ "network-online.target" ];
after = [ "network.target" "network-online.target" ];
wantedBy = [ "multi-user.target" ];
environment.DEVICE = name;
path = with pkgs; [ iproute ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
${tunnel.preSetup}
ip${optionalString isIPv6 " -6"} tunnel add ${name} mode ${optionalString isIPv6 "ip6"}gre remote ${tunnel.remote} local ${tunnel.local}
ip link set ${name} up
ip${optionalString isIPv6 " -6"} a add ${tunnel.address} dev ${name}
${tunnel.postSetup}
'';
postStop = ''
ip link set ${name} down
ip tunnel del ${name}
${tunnel.postShutdown}
'';
});
checkOpts = { config, ... }@moduleAttrs: {
options = {
remote = mkOption {
type = types.str;
description = "Address of reciever.";
};
local = mkOption {
type = types.str;
description = "Address our packets originate from.";
};
address = mkOption {
type = types.str;
description = "Our address in this tunnel.";
};
preSetup = mkOption {
type = types.str;
default = "";
description = "Commands called at the start of the interface setup.";
};
postSetup = mkOption {
type = types.str;
default = "";
description = "Commands called at the end of the interface setup.";
};
postShutdown = mkOption {
type = types.str;
default = "";
description = "Commands called after shutting down the interface.";
};
};
};
in {
options = {
clerie.gre-tunnel = {
enable = mkEnableOption "Declarative Policy-Routing";
ipv6 = mkOption {
type = with types; attrsOf (submodule checkOpts);
default = {};
};
ipv4 = mkOption {
type = with types; attrsOf (submodule checkOpts);
default = {};
};
};
};
config = mkIf cfg.enable {
systemd.services =
(mapAttrs' (generateInterfaceUnit false) cfg.ipv4)
// (mapAttrs' (generateInterfaceUnit true) cfg.ipv6);
};
}

View file

@ -0,0 +1,77 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.clerie.monitoring;
monitoringServer = "kaon.net.entr0py.de";
networkBase = "fd00:23:23:23::";
serverPubKey = "iHrvJyvIWnsAc2FuXBy1ATuj2hy1jek0C9MqFcisH0k=";
in
{
options = {
clerie.monitoring = {
enable = mkEnableOption "clerie's Monitoring (with tweaks)";
networkBase = mkOption {
type = types.str;
default = networkBase;
};
server = mkOption {
type = types.str;
default = monitoringServer;
};
serverPort = mkOption {
type = types.int;
default = 51820;
};
id = mkOption {
type = types.str;
description = "ID of the Monitoring Interface (it is actually a part of an ip address)";
};
serverPublicKey = mkOption {
type = types.str;
default = serverPubKey;
};
pubkey = mkOption {
type = types.str;
description = "Public Key of the monitoring wireguard interface of this host";
};
privKeyFile = mkOption {
type = types.str;
example = "/run/keys/keyfile";
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
wireguard
wireguard-tools
];
networking.wireguard.enable = true;
networking.wireguard.interfaces = {
wg-monitoring = {
ips = [ "${cfg.networkBase}${cfg.id}/64" ];
peers = [
{
endpoint = "${cfg.server}:${toString cfg.serverPort}";
persistentKeepalive = 25;
allowedIPs = [ "${cfg.networkBase}/64" ];
publicKey = "${cfg.serverPublicKey}";
}
];
privateKeyFile = "${cfg.privKeyFile}";
};
};
services.prometheus.exporters.node = {
enable = true;
#listenAddress = "${monitoring-network-base}${cfg.id}";
openFirewall = true;
firewallFilter = "-i wg-monitoring -p tcp -m tcp --dport 9100";
};
};
}

View file

@ -0,0 +1,66 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.clerie.nginx-port-forward;
certs = config.security.acme.certs;
sslDhparam = config.services.nginx.sslDhparam;
mkServerBlock = isUDP: port: forward: ''
server {
listen ${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
listen [::]:${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
${ optionalString (forward.certName != null) ''
ssl_certificate ${certs.${forward.certName}.directory}/fullchain.pem;
ssl_certificate_key ${certs.${forward.certName}.directory}/key.pem;
${ optionalString (sslDhparam != null) "ssl_dhparam ${sslDhparam};" }
'' }
proxy_pass ${forward.host}:${toString forward.port};
}
'';
portForwardConf = ''
${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock false) cfg.tcpPorts) }
${ concatStringsSep "\n" (mapAttrsToList (mkServerBlock true) cfg.udpPorts) }
'';
portOpts = { config, ... }@moduleAttrs: {
options = {
host = mkOption {
type = types.str;
};
port = mkOption {
type = types.int;
};
certName = mkOption {
type = with types; nullOr str;
default = null;
};
};
};
in
{
options = {
clerie.nginx-port-forward = {
enable = mkEnableOption "Nginx Port Forward";
tcpPorts = mkOption {
type = with types; attrsOf (submodule portOpts);
default = {};
};
udpPorts = mkOption {
type = with types; attrsOf (submodule portOpts);
default = {};
};
};
};
config = mkIf cfg.enable {
services.nginx.enable = true;
services.nginx.streamConfig = portForwardConf;
networking.firewall.allowedTCPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.tcpPorts;
networking.firewall.allowedUDPPorts = mapAttrsToList ( port: dontcare: toInt port ) cfg.udpPorts;
};
}

View file

@ -0,0 +1,9 @@
{
arion = import ../../hosts/arion/configuration.nix;
geon = import ../../hosts/geon/configuration.nix;
pion = import ../../hosts/pion/configuration.nix;
scotty-router = import ../../hosts/scotty-router/configuration.nix;
tailpipe = import ../../hosts/tailpipe/configuration.nix;
dyon = import ../../hosts/dyon/configuration.nix;
kaon = import ../../hosts/kaon/configuration.nix;
}

View file

@ -0,0 +1,23 @@
{
arion = { config, pkgs, ... }:{
deployment.targetHost = "arion.net.entr0py.de";
};
geon = { config, pkgs, ... }:{
deployment.targetHost = "geon.net.entr0py.de";
};
pion = { config, pkgs, ... }:{
deployment.targetHost = "pion.net.entr0py.de";
};
scotty-router = { config, pkgs, ... }:{
deployment.targetHost = "scotty-router";
};
tailpipe = { config, pkgs, ... }:{
deployment.targetHost = "tailpipe.net.entr0py.de";
};
dyon = { config, pkgs, ... }:{
deployment.targetHost = "dyon.net.entr0py.de";
};
kaon = { config, pkgs, ... }:{
deployment.targetHost = "kaon.net.entr0py.de";
};
}