dadada/nix-config
dadada/nix-config
1
0
Fork 0
Code Issues 2 Pull requests 5 Projects Releases Packages Wiki Activity Actions

Remove networking module

Browse source
This commit is contained in:
Tim Schubert 2023-10-29 19:05:04 +01:00 • committed by Tim Schubert
parent dc685affee
commit e4c9dee575
5 changed files with 22 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nixos/agares/configuration.nix
View file

@ -16,7 +16,6 @@
dadada = {
admin.enable = true;
networking.localResolver.enable = true;
};
services.smartd.enable = true;

24
nixos/gorgon/configuration.nix
View file

@ -72,12 +72,6 @@ in
dadada = {
steam.enable = true;
yubikey.enable = true;
networking = {
enableBsShare = true;
vpnExtension = "3";
};
sway.enable = false;
};
programs.adb.enable = true;
@ -187,6 +181,24 @@ in
];
};
# https://lists.zx2c4.com/pipermail/wireguard/2017-November/002028.html
systemd.timers.wg-reresolve-dns = {
wantedBy = [ "timers.target" ];
partOf = [ "wg-reresolve-dns.service" ];
timerConfig.OnCalendar = "hourly";
};
systemd.services.wg-reresolve-dns =
let
vpnPubKey = "x/y6I59buVzv9Lfzl+b17mGWbzxU+3Ke9mQNa1DLsDI=";
in
{
serviceConfig.Type = "oneshot";
script = ''
${pkgs.wireguard-tools}/bin/wg set dadada peer ${vpnPubKey} endpoint vpn.dadada.li:51234 persistent-keepalive 25 allowed-ips fd42:9c3b:f96d::/48
'';
};
#networking.wg-quick.interfaces.mullvad = {
# address = [ "10.68.15.202/32" "fc00:bbbb:bbbb:bb01::5:fc9/128" ];
# privateKeyFile = "/var/lib/wireguard/mullvad";

1
nixos/modules/default.nix
View file

@ -9,7 +9,6 @@
headphones = import ./headphones.nix;
homepage = import ./homepage.nix;
miniflux = import ./miniflux.nix;
networking = import ./networking.nix;
inputs = import ./inputs.nix;
nixpkgs = import ./nixpkgs.nix;
packages = import ./packages.nix;

167
nixos/modules/networking.nix
View file

@ -1,167 +0,0 @@
{ config
, pkgs
, lib
, ...
}:
with lib; let
cfg = config.dadada.networking;
vpnPubKey = "x/y6I59buVzv9Lfzl+b17mGWbzxU+3Ke9mQNa1DLsDI=";
in
{
options = {
dadada.networking = {
localResolver = {
enable = mkEnableOption "Enable local caching name server";
uwu = mkEnableOption "Enable uwupn";
s0 = mkEnableOption "Enable s0";
};
wanInterfaces = mkOption {
type = with types; listOf str;
description = "WAN network interfaces";
default = [ ];
};
vpnExtension = mkOption {
type = with types; nullOr str;
description = "Last part of VPN address";
default = null;
};
enableBsShare = mkEnableOption "Enable network share at BS location";
};
};
config = {
networking.resolvconf.useLocalResolver = mkIf cfg.localResolver.enable true;
networking.networkmanager.dns = mkIf cfg.localResolver.enable "unbound";
services.unbound = mkIf cfg.localResolver.enable {
enable = true;
localControlSocketPath = "/run/unbound/unbound.ctl";
settings = {
server = {
prefer-ip6 = true;
prefetch = true;
prefetch-key = true;
serve-expired = false;
aggressive-nsec = true;
hide-identity = true;
hide-version = true;
use-caps-for-id = true;
private-address = [
"127.0.0.0/8"
"10.0.0.0/8"
"172.16.0.0/12"
"192.168.0.0/16"
"169.254.0.0/16"
"fd00::/8"
"fe80::/10"
"::ffff:0:0/96"
];
private-domain = [
"dadada.li"
(mkIf cfg.localResolver.uwu "uwu")
(mkIf cfg.localResolver.s0 "space.stratum0.net")
(mkIf cfg.localResolver.s0 "s0")
];
domain-insecure = [
"dadada.li"
(mkIf cfg.localResolver.uwu "uwu")
(mkIf cfg.localResolver.s0 "space.stratum0.net")
(mkIf cfg.localResolver.s0 "s0")
];
interface = [
"127.0.0.1"
"::1"
];
};
forward-zone = [
{
name = ".";
forward-tls-upstream = "yes";
forward-addr = [
"2620:fe::fe@853#dns.quad9.net"
"2620:fe::9@853#dns.quad9.net"
"9.9.9.9@853#dns.quad9.net"
"149.112.112.112@853#dns.quad9.net"
];
}
(
mkIf cfg.localResolver.uwu {
name = "uwu.";
forward-addr = [
"fc00:1337:dead:beef::10.11.0.1"
"10.11.0.1"
];
}
)
(
mkIf cfg.localResolver.s0 {
name = "space.stratum0.net.";
forward-addr = [
"192.168.178.1"
];
}
)
(
mkIf cfg.localResolver.s0 {
name = "s0.";
forward-addr = [
"192.168.178.1"
];
}
)
{
name = "dyn.dadada.li.";
forward-addr = [
"fd42:9c3b:f96d:201::1"
];
}
];
};
};
networking.useDHCP = false;
networking.interfaces = listToAttrs (forEach cfg.wanInterfaces (i:
nameValuePair i {
useDHCP = true;
}));
networking.wireguard.interfaces = mkIf (cfg.vpnExtension != null) {
dadada = {
ips = [ "fd42:9c3b:f96d:201::${cfg.vpnExtension}/64" "192.168.120.${cfg.vpnExtension}/24" ];
listenPort = 51234;
privateKeyFile = "/var/lib/wireguard/privkey";
postSetup = ''
${pkgs.systemd}/bin/resolvectl domain dadada ~bs.dadada.li
${pkgs.systemd}/bin/resolvectl dns dadada fd42:9c3b:f96d:201::
${pkgs.systemd}/bin/resolvectl dnssec dadada false
'';
peers = [
{
publicKey = vpnPubKey;
allowedIPs = [ "fd42:9c3b:f96d::/48" "192.168.0.0/17" ];
endpoint = "vpn.dadada.li:51234";
persistentKeepalive = 25;
}
];
};
};
# https://lists.zx2c4.com/pipermail/wireguard/2017-November/002028.html
systemd.timers.wg-reresolve-dns = mkIf (cfg.vpnExtension != null) {
wantedBy = [ "timers.target" ];
partOf = [ "wg-reresolve-dns.service" ];
timerConfig.OnCalendar = "hourly";
};
systemd.services.wg-reresolve-dns = mkIf (cfg.vpnExtension != null) {
serviceConfig.Type = "oneshot";
script = ''
${pkgs.wireguard-tools}/bin/wg set dadada peer ${vpnPubKey} endpoint vpn.dadada.li:51234 persistent-keepalive 25 allowed-ips fd42:9c3b:f96d::/48
'';
};
};
}

5
nixos/modules/profiles/base.nix
View file

@ -50,6 +50,9 @@ in
};
networking.networkmanager.dns = mkDefault "systemd-resolved";
services.resolved.enable = mkDefault true;
services.resolved = {
enable = mkDefault true;
fallbackDns = [ "9.9.9.9#dns.quad9.net" "2620:fe::fe:11#dns11.quad9.net" ];
};
}