agares: use as router
This commit is contained in:
parent
572d813eed
commit
21add79ffa
13 changed files with 640 additions and 76 deletions
|
|
@ -1,18 +1,45 @@
|
||||||
{ config
|
{ config
|
||||||
, pkgs
|
|
||||||
, lib
|
, lib
|
||||||
|
, modulesPath
|
||||||
|
, pkgs
|
||||||
, ...
|
, ...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
./ddns.nix
|
||||||
|
./dns.nix
|
||||||
|
./firewall.nix
|
||||||
../modules/profiles/server.nix
|
../modules/profiles/server.nix
|
||||||
./hardware-configuration.nix
|
./network.nix
|
||||||
|
./ntp.nix
|
||||||
|
./ppp.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
# to be able to use qemu from substituter
|
fileSystems."/" = {
|
||||||
environment.noXlibs = false;
|
device = "/dev/sda1";
|
||||||
|
fsType = "btrfs";
|
||||||
|
options = [ "subvol=root" ];
|
||||||
|
};
|
||||||
|
|
||||||
# libvirtd
|
#fileSystems."/nix/store" = {
|
||||||
security.polkit.enable = true;
|
# device = "/dev/sda1";
|
||||||
|
# fsType = "btrfs";
|
||||||
|
# options = [ "subvol=/root/nix" "noatime" ];
|
||||||
|
#};
|
||||||
|
|
||||||
|
fileSystems."/swap" = {
|
||||||
|
device = "/dev/sda1";
|
||||||
|
fsType = "btrfs";
|
||||||
|
options = [ "subvol=/root/swap" "noatime" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
#swapDevices = [{
|
||||||
|
# device = "/swap/swapfile";
|
||||||
|
# size = 32 * 1024; # 32 GByte
|
||||||
|
#}];
|
||||||
|
|
||||||
|
hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
|
||||||
|
|
||||||
dadada = {
|
dadada = {
|
||||||
admin.enable = true;
|
admin.enable = true;
|
||||||
|
|
@ -23,9 +50,17 @@
|
||||||
networking.hostName = "agares";
|
networking.hostName = "agares";
|
||||||
networking.domain = "bs.dadada.li";
|
networking.domain = "bs.dadada.li";
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
|
||||||
|
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||||
|
|
||||||
# Use the GRUB 2 boot loader.
|
# Use the GRUB 2 boot loader.
|
||||||
boot.loader.grub.enable = true;
|
boot.loader.grub.enable = true;
|
||||||
boot.loader.grub.device = "/dev/sda";
|
boot.loader.grub.device = "/dev/sda";
|
||||||
|
boot.loader.grub.extraConfig = "
|
||||||
|
serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
|
||||||
|
terminal_input serial
|
||||||
|
terminal_output serial
|
||||||
|
";
|
||||||
|
|
||||||
boot.kernelParams = [
|
boot.kernelParams = [
|
||||||
"console=ttyS0,115200"
|
"console=ttyS0,115200"
|
||||||
|
|
@ -41,46 +76,15 @@
|
||||||
"vfio_virqfd"
|
"vfio_virqfd"
|
||||||
];
|
];
|
||||||
|
|
||||||
networking.vlans = {
|
|
||||||
lan = {
|
|
||||||
id = 11;
|
|
||||||
interface = "enp1s0";
|
|
||||||
};
|
|
||||||
backup = {
|
|
||||||
id = 13;
|
|
||||||
interface = "enp1s0";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.bridges = {
|
|
||||||
"br-lan" = {
|
|
||||||
interfaces = [ "lan" ];
|
|
||||||
};
|
|
||||||
"br-backup" = {
|
|
||||||
interfaces = [ "backup" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.interfaces.enp1s0.useDHCP = true;
|
|
||||||
|
|
||||||
networking.firewall = {
|
|
||||||
enable = true;
|
|
||||||
allowPing = true;
|
|
||||||
allowedTCPPorts = [
|
|
||||||
22 # SSH
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
virtualisation.libvirtd.enable = true;
|
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
curl
|
curl
|
||||||
flashrom
|
flashrom
|
||||||
dmidecode
|
dmidecode
|
||||||
|
tcpdump
|
||||||
];
|
];
|
||||||
|
|
||||||
# Running router VM. They have to be restarted in the right order, so network comes up cleanly. Not ideal.
|
# Running router VM. They have to be restarted in the right order, so network comes up cleanly. Not ideal.
|
||||||
system.autoUpgrade.allowReboot = false;
|
system.autoUpgrade.allowReboot = false;
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "23.05";
|
||||||
}
|
}
|
||||||
|
|
|
||||||
13
nixos/agares/ddns.nix
Normal file
13
nixos/agares/ddns.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
dadada.ddns = {
|
||||||
|
domains = [ "vpn.dadada.li" ];
|
||||||
|
credentialsPath = config.age.secrets."ddns-credentials".path;
|
||||||
|
interface = "wan";
|
||||||
|
};
|
||||||
|
|
||||||
|
age.secrets."ddns-credentials" = {
|
||||||
|
file = "${config.dadada.secrets.path}/ddns-credentials.age";
|
||||||
|
mode = "400";
|
||||||
|
};
|
||||||
|
}
|
||||||
69
nixos/agares/dns.nix
Normal file
69
nixos/agares/dns.nix
Normal file
|
|
@ -0,0 +1,69 @@
|
||||||
|
{ ... }:
|
||||||
|
{
|
||||||
|
services.unbound = {
|
||||||
|
enable = true;
|
||||||
|
localControlSocketPath = "/run/unbound/unbound.ctl";
|
||||||
|
settings = {
|
||||||
|
server = {
|
||||||
|
access-control = [
|
||||||
|
"127.0.0.0/8 allow"
|
||||||
|
"127.0.0.1/32 allow_snoop"
|
||||||
|
"192.168.100.0/24 allow"
|
||||||
|
"192.168.101.0/24 allow"
|
||||||
|
"192.168.102.0/24 allow"
|
||||||
|
"192.168.103.0/24 allow"
|
||||||
|
"192.168.1.0/24 allow"
|
||||||
|
"172.16.128.0/24 allow"
|
||||||
|
"::1/128 allow_snoop"
|
||||||
|
"fd42:9c3b:f96d::/48 allow"
|
||||||
|
];
|
||||||
|
interface = [
|
||||||
|
"127.0.0.1"
|
||||||
|
"192.168.1.1"
|
||||||
|
"192.168.100.1"
|
||||||
|
"192.168.101.1"
|
||||||
|
"192.168.102.1"
|
||||||
|
"::1"
|
||||||
|
"fd42:9c3b:f96d:100::1"
|
||||||
|
"fd42:9c3b:f96d:101::1"
|
||||||
|
"fd42:9c3b:f96d:102::1"
|
||||||
|
"fd42:9c3b:f96d:103::1"
|
||||||
|
];
|
||||||
|
prefer-ip6 = true;
|
||||||
|
prefetch = true;
|
||||||
|
prefetch-key = true;
|
||||||
|
serve-expired = false;
|
||||||
|
aggressive-nsec = true;
|
||||||
|
hide-identity = true;
|
||||||
|
hide-version = true;
|
||||||
|
use-caps-for-id = true;
|
||||||
|
val-permissive-mode = true;
|
||||||
|
local-zone = [
|
||||||
|
"\"168.192.in-addr.arpa.\" nodefault"
|
||||||
|
"\"d.f.ip6.arpa.\" nodefault"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
forward-zone = [
|
||||||
|
{
|
||||||
|
name = ".";
|
||||||
|
forward-tls-upstream = "yes";
|
||||||
|
forward-addr = [
|
||||||
|
"2620:fe::fe@853#dns.quad9.net"
|
||||||
|
"2620:fe::9@853#dns.quad9.net"
|
||||||
|
"9.9.9.9@853#dns.quad9.net"
|
||||||
|
"149.112.112.112@853#dns.quad9.net"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
stub-zone =
|
||||||
|
let
|
||||||
|
stubZone = name: addrs: { name = "${name}"; stub-addr = addrs; };
|
||||||
|
in
|
||||||
|
[
|
||||||
|
#(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
|
||||||
|
#(stubZone "d.6.9.f.b.3.c.9.2.4.d.f.ip6.arpa" ["192.168.101.220" "2a01:4f8:c010:a710::1"])
|
||||||
|
#(stubZone "168.192.in-addr.arpa" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
13
nixos/agares/firewall.nix
Normal file
13
nixos/agares/firewall.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
{ ... }:
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
useDHCP = false;
|
||||||
|
nat.enable = false;
|
||||||
|
firewall.enable = false;
|
||||||
|
nftables = {
|
||||||
|
enable = true;
|
||||||
|
checkRuleset = true;
|
||||||
|
ruleset = builtins.readFile ./rules.nft;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config
|
|
||||||
, lib
|
|
||||||
, pkgs
|
|
||||||
, modulesPath
|
|
||||||
, ...
|
|
||||||
}: {
|
|
||||||
imports = [
|
|
||||||
(modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" = {
|
|
||||||
device = "/dev/sda1";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=root" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
|
||||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
|
||||||
# replicates the default behaviour.
|
|
||||||
networking.useDHCP = lib.mkDefault false;
|
|
||||||
networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
|
||||||
networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
|
||||||
networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
252
nixos/agares/network.nix
Normal file
252
nixos/agares/network.nix
Normal file
|
|
@ -0,0 +1,252 @@
|
||||||
|
{ config, lib, ... }:
|
||||||
|
let
|
||||||
|
mergeAttrsList = lib.attrsets.mergeAttrsList;
|
||||||
|
map = builtins.map;
|
||||||
|
ulaPrefix = "fd42:9c3b:f96d"; # fd42:9c3b:f96d::/48
|
||||||
|
ipv4Prefix = "192.168"; # 192.168.96.0/19
|
||||||
|
domain = "bs.dadada.li";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
systemd.network = {
|
||||||
|
enable = true;
|
||||||
|
links = {
|
||||||
|
"10-persistent" = {
|
||||||
|
matchConfig.OriginalName = [ "enp1s0" "enp2s0" ];
|
||||||
|
linkConfig.MACAddressPolicy = "persistent";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
netdevs = {
|
||||||
|
# QoS concentrator
|
||||||
|
"ifb4ppp0" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "ifb";
|
||||||
|
Name = "ifb4ppp0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"20-lan" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "vlan";
|
||||||
|
Name = "lan.10";
|
||||||
|
};
|
||||||
|
vlanConfig = {
|
||||||
|
Id = 10;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"20-freifunk" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "vlan";
|
||||||
|
Name = "ff.11";
|
||||||
|
};
|
||||||
|
vlanConfig = {
|
||||||
|
Id = 11;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"20-srv" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "vlan";
|
||||||
|
Name = "srv.13";
|
||||||
|
};
|
||||||
|
vlanConfig = {
|
||||||
|
Id = 13;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"20-roadw" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "wireguard";
|
||||||
|
Name = "roadw";
|
||||||
|
};
|
||||||
|
wireguardConfig = {
|
||||||
|
PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path;
|
||||||
|
ListenPort = 51234;
|
||||||
|
};
|
||||||
|
wireguardPeers = [{
|
||||||
|
wireguardPeerConfig =
|
||||||
|
let
|
||||||
|
peerAddresses = i: [
|
||||||
|
"${ipv4Prefix}.120.${i}/32"
|
||||||
|
"${ulaPrefix}:120::${i}/128"
|
||||||
|
];
|
||||||
|
in
|
||||||
|
{
|
||||||
|
PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
|
||||||
|
AllowedIPs = peerAddresses "3";
|
||||||
|
};
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
networks = let
|
||||||
|
subnet = name: subnetId: {
|
||||||
|
matchConfig.Name = name;
|
||||||
|
addresses = [
|
||||||
|
{ addressConfig.Address = "${ipv4Prefix}.${subnetId}.1/24"; }
|
||||||
|
{ addressConfig.Address = "${ulaPrefix}:${subnetId}::1/64"; }
|
||||||
|
];
|
||||||
|
dhcpPrefixDelegationConfig = {
|
||||||
|
SubnetId = "0x${subnetId}";
|
||||||
|
};
|
||||||
|
ipv6Prefixes = [
|
||||||
|
{
|
||||||
|
ipv6PrefixConfig.Prefix = "${ulaPrefix}:${subnetId}::/64";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
dhcpServerConfig = {
|
||||||
|
DNS = "${ipv4Prefix}.${subnetId}.1";
|
||||||
|
NTP = "${ipv4Prefix}.${subnetId}.1";
|
||||||
|
EmitDNS = true;
|
||||||
|
EmitNTP = true;
|
||||||
|
EmitRouter = true;
|
||||||
|
PoolOffset = 100;
|
||||||
|
PoolSize = 100;
|
||||||
|
SendOption = "12:string:${domain}";
|
||||||
|
};
|
||||||
|
linkConfig = {
|
||||||
|
RequiredForOnline = "no";
|
||||||
|
};
|
||||||
|
networkConfig = {
|
||||||
|
Domains = domain;
|
||||||
|
EmitLLDP = "yes";
|
||||||
|
IPv6SendRA = true;
|
||||||
|
IPv6AcceptRA = false;
|
||||||
|
DHCPPrefixDelegation = true;
|
||||||
|
DHCPServer = true;
|
||||||
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
[CAKE]
|
||||||
|
OverheadBytes = 38
|
||||||
|
Bandwidth = 1G
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
in {
|
||||||
|
"10-mgmt" = subnet "enp1s0" "100" // {
|
||||||
|
networkConfig.VLAN = [ "lan.10" "ff.11" "srv.13" ];
|
||||||
|
dhcpServerStaticLeases = [
|
||||||
|
{
|
||||||
|
# legion
|
||||||
|
dhcpServerStaticLeaseConfig = {
|
||||||
|
Address = "192.168.100.107";
|
||||||
|
MACAddress = "80:CC:9C:95:4A:60";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
"30-lan" = subnet "lan.10" "101" // {
|
||||||
|
dhcpServerStaticLeases = [
|
||||||
|
{
|
||||||
|
# ninurta
|
||||||
|
dhcpServerStaticLeaseConfig = {
|
||||||
|
Address = "192.168.101.184";
|
||||||
|
MACAddress = "48:21:0B:3E:9C:FE";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# crocell
|
||||||
|
dhcpServerStaticLeaseConfig = {
|
||||||
|
Address = "192.168.101.122";
|
||||||
|
MACAddress = "9C:C9:EB:4F:3F:0E";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# gorgon
|
||||||
|
dhcpServerStaticLeaseConfig = {
|
||||||
|
Address = "192.168.101.205";
|
||||||
|
MACAddress = "8C:C6:81:6A:39:2F";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
"30-ff" = subnet "ff.11" "102";
|
||||||
|
|
||||||
|
"30-srv" = subnet "srv.13" "103";
|
||||||
|
|
||||||
|
"30-ifb4ppp0" = {
|
||||||
|
name = "ifb4ppp0";
|
||||||
|
extraConfig = ''
|
||||||
|
[CAKE]
|
||||||
|
OverheadBytes = 65
|
||||||
|
Bandwidth = 95M
|
||||||
|
FlowIsolationMode = triple
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# TODO does not work
|
||||||
|
"30-ppp0" = {
|
||||||
|
name = "ppp*";
|
||||||
|
linkConfig = {
|
||||||
|
RequiredForOnline = "routable";
|
||||||
|
};
|
||||||
|
networkConfig = {
|
||||||
|
KeepConfiguration = "static";
|
||||||
|
DefaultRouteOnDevice = true;
|
||||||
|
LinkLocalAddressing = "ipv6";
|
||||||
|
DHCP = "ipv6";
|
||||||
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
[CAKE]
|
||||||
|
OverheadBytes = 65
|
||||||
|
Bandwidth = 36M
|
||||||
|
FlowIsolationMode = triple
|
||||||
|
[DHCPv6]
|
||||||
|
PrefixDelegationHint= ::/56
|
||||||
|
UseAddress = false
|
||||||
|
UseDelegatedPrefix = true
|
||||||
|
WithoutRA = solicit
|
||||||
|
[DHCPPrefixDelegation]
|
||||||
|
UplinkInterface=:self
|
||||||
|
'';
|
||||||
|
ipv6SendRAConfig = {
|
||||||
|
# Let networkd know that we would very much like to use DHCPv6
|
||||||
|
# to obtain the "managed" information. Not sure why they can't
|
||||||
|
# just take that from the upstream RAs.
|
||||||
|
Managed = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# Talk to modem for management
|
||||||
|
"enp2s0" = {
|
||||||
|
name = "enp2s0";
|
||||||
|
linkConfig = {
|
||||||
|
RequiredForOnline = "no";
|
||||||
|
};
|
||||||
|
networkConfig = {
|
||||||
|
Address = "192.168.1.254/24";
|
||||||
|
EmitLLDP = "yes";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"10-roadw" = {
|
||||||
|
matchConfig.Name = "roadw";
|
||||||
|
address = [
|
||||||
|
"${ipv4Prefix}.120.1/32"
|
||||||
|
"${ulaPrefix}:120::1/128"
|
||||||
|
];
|
||||||
|
DHCP = "no";
|
||||||
|
networkConfig.IPv6AcceptRA = false;
|
||||||
|
linkConfig.RequiredForOnline = "no";
|
||||||
|
routes = [
|
||||||
|
{
|
||||||
|
routeConfig = { Destination = "${ipv4Prefix}.120.1/24"; };
|
||||||
|
}
|
||||||
|
{
|
||||||
|
routeConfig = { Destination = "${ulaPrefix}::120:1/64"; };
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
age.secrets."wg-privkey-vpn-dadada-li" = {
|
||||||
|
file = "${config.dadada.secrets.path}/wg-privkey-vpn-dadada-li.age";
|
||||||
|
owner = "systemd-network";
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.kernel.sysctl = {
|
||||||
|
# Enable forwarding for interface
|
||||||
|
"net.ipv4.conf.all.forwarding" = "1";
|
||||||
|
"net.ipv6.conf.all.forwarding" = "1";
|
||||||
|
"net.ipv6.conf.all.accept_ra" = "0";
|
||||||
|
"net.ipv6.conf.all.autoconf" = "0";
|
||||||
|
# Set via systemd-networkd
|
||||||
|
#"net.ipv6.conf.${intf}.use_tempaddr" = "0";
|
||||||
|
};
|
||||||
|
|
||||||
|
powerManagement.cpuFreqGovernor = lib.mkDefault "schedutil";
|
||||||
|
}
|
||||||
12
nixos/agares/ntp.nix
Normal file
12
nixos/agares/ntp.nix
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
{ ... }:
|
||||||
|
{
|
||||||
|
services.chrony = {
|
||||||
|
enable = true;
|
||||||
|
extraConfig = ''
|
||||||
|
allow 192.168.1
|
||||||
|
allow 192.168.100
|
||||||
|
allow 192.168.101
|
||||||
|
allow 192.168.102
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
63
nixos/agares/ppp.nix
Normal file
63
nixos/agares/ppp.nix
Normal file
|
|
@ -0,0 +1,63 @@
|
||||||
|
{ pkgs, lib, config, ... }:
|
||||||
|
let
|
||||||
|
secretsPath = config.dadada.secrets.path;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
# PPPoE
|
||||||
|
services.pppd = {
|
||||||
|
enable = true;
|
||||||
|
peers = {
|
||||||
|
telekom = {
|
||||||
|
enable = true;
|
||||||
|
autostart = true;
|
||||||
|
config = ''
|
||||||
|
debug
|
||||||
|
|
||||||
|
plugin pppoe.so enp2s0
|
||||||
|
|
||||||
|
noauth
|
||||||
|
hide-password
|
||||||
|
call telekom-secret
|
||||||
|
|
||||||
|
linkname ppp0
|
||||||
|
|
||||||
|
persist
|
||||||
|
maxfail 0
|
||||||
|
holdoff 5
|
||||||
|
|
||||||
|
noipdefault
|
||||||
|
defaultroute
|
||||||
|
|
||||||
|
lcp-echo-interval 15
|
||||||
|
lcp-echo-failure 3
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
age.secrets."etc-ppp-telekom-secret" = {
|
||||||
|
file = "${secretsPath}/etc-ppp-telekom-secret.age";
|
||||||
|
owner = "root";
|
||||||
|
mode = "700";
|
||||||
|
path = "/etc/ppp/peers/telekom-secret";
|
||||||
|
};
|
||||||
|
|
||||||
|
age.secrets."etc-ppp-pap-secrets" = {
|
||||||
|
# format: client server passphrase
|
||||||
|
file = "${secretsPath}/etc-ppp-chap-secrets.age";
|
||||||
|
owner = "root";
|
||||||
|
mode = "700";
|
||||||
|
path = "/etc/ppp/pap-secrets";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Hook for QoS via Intermediate Functional Block
|
||||||
|
environment.etc."ppp/ip-up" = {
|
||||||
|
mode = "755";
|
||||||
|
text = with lib; ''
|
||||||
|
#!/usr/bin/env sh
|
||||||
|
${getBin pkgs.iproute2}/bin/tc qdisc del dev $1 ingress
|
||||||
|
${getBin pkgs.iproute2}/bin/tc qdisc add dev $1 handle ffff: ingress
|
||||||
|
${getBin pkgs.iproute2}/bin/tc filter add dev $1 parent ffff: matchall action mirred egress redirect dev ifb4ppp0
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
140
nixos/agares/rules.nft
Normal file
140
nixos/agares/rules.nft
Normal file
|
|
@ -0,0 +1,140 @@
|
||||||
|
flush ruleset
|
||||||
|
|
||||||
|
define IF_MGMT = "enp1s0"
|
||||||
|
define IF_FF = "ff.11"
|
||||||
|
define IF_LAN = "lan.10"
|
||||||
|
define IF_WAN = "ppp0"
|
||||||
|
define IF_SRV = "srv.13"
|
||||||
|
|
||||||
|
# Modem uses this for internet uplink via our WAN
|
||||||
|
define IF_MODEM = "enp2s0"
|
||||||
|
|
||||||
|
define IF_ROADW = "roadwarrior"
|
||||||
|
|
||||||
|
table inet filter {
|
||||||
|
# Will give "no such file or directory if hardware does not support flow offloading"
|
||||||
|
# flowtable f {
|
||||||
|
# hook ingress priority 0; devices = { enp1s0, enp2s0 }; flags offload;
|
||||||
|
# }
|
||||||
|
|
||||||
|
chain input_local {
|
||||||
|
ip6 saddr != ::1/128 log prefix "Dropped IPv6 nonlocalhost packet on loopback:" drop
|
||||||
|
accept comment "Accept traffic to loopback interface"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_icmp_untrusted {
|
||||||
|
# Allow ICMP echo
|
||||||
|
ip protocol icmp icmp type { echo-request } limit rate 1000/second burst 5 packets accept comment "Accept echo request"
|
||||||
|
|
||||||
|
# Allow some ICMPv6
|
||||||
|
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-done, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } limit rate 1000/second burst 5 packets accept comment "Allow some ICMPv6"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_modem {
|
||||||
|
jump input_icmp_untrusted
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_wan {
|
||||||
|
# DHCPv6 client
|
||||||
|
meta nfproto ipv6 udp sport 547 accept comment "Allow DHCPv6 client"
|
||||||
|
|
||||||
|
jump input_icmp_untrusted
|
||||||
|
|
||||||
|
udp dport 51234 accept comment "Wireguard roadwarriors"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_lan {
|
||||||
|
counter accept comment "Accept all traffic from LAN"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_mgmt {
|
||||||
|
counter accept comment "Accept all traffic from MGMT"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_srv {
|
||||||
|
counter accept comment "Accept all traffic from services"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_roadw {
|
||||||
|
counter accept comment "Accept all traffic from roadwarriors"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input_ff {
|
||||||
|
jump input_icmp_untrusted
|
||||||
|
|
||||||
|
# DHCP
|
||||||
|
meta nfproto ipv6 udp dport 547 accept comment "Allow DHCPv6 client"
|
||||||
|
|
||||||
|
# Allow DNS and DHCP from Freifunk
|
||||||
|
udp dport { 53, 67 } accept comment "Allow DNS and DHCP from Freifunk"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority filter; policy drop;
|
||||||
|
|
||||||
|
ct state {established, related} counter accept comment "Accept packets from established and related connections"
|
||||||
|
ct state invalid counter drop comment "Early drop of invalid packets"
|
||||||
|
|
||||||
|
iifname vmap { lo : accept, $IF_WAN : jump input_wan, $IF_LAN : jump input_lan, $IF_FF : jump input_ff, $IF_ROADW : jump input_roadw, $IF_MODEM : jump input_modem, $IF_MGMT : jump input_mgmt }
|
||||||
|
}
|
||||||
|
|
||||||
|
# Only works if hardware flow offloading is available
|
||||||
|
# chain offload {
|
||||||
|
# type filter hook forward priority -100; policy accept;
|
||||||
|
# ip protocol tcp flow add @f
|
||||||
|
# counter packets 0 bytes 0
|
||||||
|
# }
|
||||||
|
|
||||||
|
chain forward {
|
||||||
|
type filter hook forward priority filter; policy drop;
|
||||||
|
|
||||||
|
# Accept connections tracked by destination NAT
|
||||||
|
ct status dnat counter accept comment "Accept connections tracked by DNAT"
|
||||||
|
|
||||||
|
# TCP options
|
||||||
|
tcp flags syn tcp option maxseg size set rt mtu comment "Remove TCP maximum segment size and set a size based on route information"
|
||||||
|
|
||||||
|
# ICMPv6
|
||||||
|
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem } limit rate 5/second counter accept comment "Forward up to five ICMP messages of allowed types per second"
|
||||||
|
meta l4proto ipv6-icmp accept comment "Forward ICMP in IPv6"
|
||||||
|
|
||||||
|
# mgmt <-> *
|
||||||
|
iifname { $IF_LAN, $IF_ROADW } oifname $IF_MGMT counter reject comment "Reject traffic from LAN and roadwarrior to MGMT"
|
||||||
|
iifname $IF_MGMT oifname { $IF_LAN, $IF_ROADW } counter reject comment "Reject traffic from MGMT to LAN and roadwarrior"
|
||||||
|
# drop (instead of reject) everything else to MGMT
|
||||||
|
|
||||||
|
# LAN, ROADW -> * (except mgmt)
|
||||||
|
iifname { $IF_LAN, $IF_ROADW } counter accept comment "Allow all traffic forwarding from LAN and roadwarrior to all interfaces, except to mgmt"
|
||||||
|
|
||||||
|
# FF -> WAN
|
||||||
|
iifname $IF_FF oifname $IF_WAN counter accept comment "Allow all traffic forwarding from Freifunk to WAN"
|
||||||
|
|
||||||
|
# { WAN, SRV } -> { FF, LAN, RW, SRV }
|
||||||
|
iifname { $IF_WAN, $IF_SRV } oifname { $IF_FF, $IF_LAN, $IF_ROADW, $IF_SRV } ct state established,related counter accept comment "Allow established back from WAN and SRV"
|
||||||
|
|
||||||
|
# WAN -> SRV
|
||||||
|
iifname $IF_WAN oifname $IF_SRV tcp dport ssh accept comment "Allow all SSH traffic forwarding from WAN to services"
|
||||||
|
}
|
||||||
|
|
||||||
|
chain output {
|
||||||
|
type filter hook output priority 100; policy accept;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
table ip nat {
|
||||||
|
chain prerouting {
|
||||||
|
type nat hook prerouting priority dstnat; policy accept;
|
||||||
|
}
|
||||||
|
|
||||||
|
chain postrouting {
|
||||||
|
type nat hook postrouting priority srcnat; policy accept;
|
||||||
|
ip saddr { 192.168.96.0/19 } oifname { $IF_WAN } masquerade comment "Masquerade traffic from LANs"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
table arp filter {
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority filter; policy drop;
|
||||||
|
iifname { $IF_MGMT, $IF_LAN, $IF_FF, $IF_MODEM } limit rate 1/second burst 2 packets accept comment "Limit number of ARP messages from LAN, FF, MGMT, modem"
|
||||||
|
}
|
||||||
|
}
|
||||||
11
secrets/etc-ppp-chap-secrets.age
Normal file
11
secrets/etc-ppp-chap-secrets.age
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 L7f05w xkw7tPnkvX1TGG2/Urocw8mQe6r2/Fpxkvs1Nr3cVXs
|
||||||
|
eJyvIUrFp0mGWXcmHjP1+5YW9cgs9m8bqUnwgm8iMi0
|
||||||
|
-> ssh-ed25519 Otklkw 1IfE9jxV6gz7yfPmSmXsTWsB36RFHmdpjw5eUlElTCo
|
||||||
|
GyTNhYhDbD2olE6DiKkr47Mu9NMBMHsO5/pTkcx8WXk
|
||||||
|
-> ~6#g&f-grease
|
||||||
|
lIbAZllBnOK9YRMIQfPX/veMc111/u5w83pQGuMMWUSyaHT0xwxp8IYn+R9m9iV0
|
||||||
|
haQXgTSuQxPhGUJg+1wwncJwnYgzDcCPruprrFTmf0s5HZDr
|
||||||
|
--- n9uSP8ZmTTZ89mlRiNKtRfAEz7NV7Yn0ZQhzP4uh4fo
|
||||||
|
‚#Ôü¿¯K²¥Ý~l¨Y‚_!Ï1!fz€î@
|
||||||
|
O¦FИ(öÃZ«!<21>Ȣʟ8aBÒ^¢ç!C FP•»[h$òOaf‡ÕÂýe<C3BD>(l:X®â*póÚÅÂ
|
||||||
9
secrets/etc-ppp-telekom-secret.age
Normal file
9
secrets/etc-ppp-telekom-secret.age
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 L7f05w HrgIGi6lUHRxv9JkCfrZaEHYlB0uBOhwVrE7FA7fWR0
|
||||||
|
YJEklSLR9XWt9Z3Vwjgc9hR7JgcYr7l1lxCCU4TJeOw
|
||||||
|
-> ssh-ed25519 Otklkw ght72AYlMNBSIdVFjgEmmtNvn0fAfmJSJv6ipacc8XQ
|
||||||
|
M8qx5eXPdKQo+S1iBGuH3UtOCZxKNpgkMVd5hYaC4/k
|
||||||
|
-> W)K(iXJ-grease B=`{E
|
||||||
|
52GLQ+oAwz2AphOjy9U5s9m4rn+YLqauNMvZHQy0l4aEijJr/xdkrgizKs7QpA
|
||||||
|
--- WG1fXgkKmTl1uge3LGCQFa40X1noXQcMDr21hlhfAu8
|
||||||
|
OmU’Á¥
ªí–sG m
;<>jIü‡ pÊ㘦x[Ån—Ý•™Ð»!<21>n—
W´nšž=„0Z¿ÝÆœ½«<C2BD>I£Úw-Ïò
%£46
|
||||||
|
|
@ -23,7 +23,10 @@ in
|
||||||
"paperless.age".publicKeys = [ systems.gorgon dadada ];
|
"paperless.age".publicKeys = [ systems.gorgon dadada ];
|
||||||
"surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
|
"surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
|
||||||
"ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
|
"ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
|
||||||
"ddns-credentials.age".publicKeys = [ systems.ninurta dadada ];
|
"ddns-credentials.age".publicKeys = [ systems.agares systems.ninurta dadada ];
|
||||||
|
"etc-ppp-chap-secrets.age".publicKeys = [ systems.agares dadada ];
|
||||||
|
"etc-ppp-telekom-secret.age".publicKeys = [ systems.agares dadada ];
|
||||||
|
"wg-privkey-vpn-dadada-li.age".publicKeys = [ systems.agares dadada ];
|
||||||
} //
|
} //
|
||||||
backupSecrets "ninurta" //
|
backupSecrets "ninurta" //
|
||||||
backupSecrets "gorgon" //
|
backupSecrets "gorgon" //
|
||||||
|
|
|
||||||
10
secrets/wg-privkey-vpn-dadada-li.age
Normal file
10
secrets/wg-privkey-vpn-dadada-li.age
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 L7f05w 626jkdszE7nFjXsB8InmF9c7z0g6Lx45rXviJJVipgk
|
||||||
|
HOo5D8bIXEUWN+OQOrAtsheqEFpoTEljiQN9iLsGYFw
|
||||||
|
-> ssh-ed25519 Otklkw MoBeg8zEAs7S8yRN4kMWFmh1wpFG9a3sIl7B3933U0I
|
||||||
|
KHbNqlQgIfC4oOaXnCHuiXxlmqjwrnR72IdTd18yCVQ
|
||||||
|
-> ~\AYPd-grease +[i?zA&
|
||||||
|
k2qPi9GkmpHdaMnPqWsMPWdqa00MdrneQSDEixtbPmedrzPD1w
|
||||||
|
--- R5nczLpf0MEbOrJBfTOM2mHkh3zbWxZRAn6Ke4PsHSg
|
||||||
|
[V$·ôãÂðžq
|
||||||
|
¬@ “<_–ÅèT<C3A8>ˆYfxMž «<>|£<1A>Ø<EFBFBD>)ú¼<7F>Uøkœ”]93½Rý î¶]…Äúâ ß!rĬ¹»¤„K
|
||||||
Loading…
Add table
Add a link
Reference in a new issue