154 lines
4.1 KiB
Nix
154 lines
4.1 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
with lib; let
|
|
cfg = config.dadada.networking;
|
|
vpnPubKey = "x/y6I59buVzv9Lfzl+b17mGWbzxU+3Ke9mQNa1DLsDI=";
|
|
in {
|
|
options = {
|
|
dadada.networking = {
|
|
localResolver = {
|
|
enable = mkEnableOption "Enable local caching name server";
|
|
uwu = mkEnableOption "Enable uwupn";
|
|
s0 = mkEnableOption "Enable s0";
|
|
};
|
|
wanInterfaces = mkOption {
|
|
type = with types; listOf str;
|
|
description = "WAN network interfaces";
|
|
default = [];
|
|
};
|
|
vpnExtension = mkOption {
|
|
type = with types; nullOr str;
|
|
description = "Last part of VPN address";
|
|
default = null;
|
|
};
|
|
enableBsShare = mkEnableOption "Enable network share at BS location";
|
|
};
|
|
};
|
|
|
|
config = {
|
|
networking.resolvconf.useLocalResolver = mkIf cfg.localResolver.enable true;
|
|
networking.networkmanager.dns = mkIf cfg.localResolver.enable "unbound";
|
|
|
|
services.unbound = mkIf cfg.localResolver.enable {
|
|
enable = true;
|
|
localControlSocketPath = "/run/unbound/unbound.ctl";
|
|
settings = {
|
|
server = {
|
|
prefer-ip6 = true;
|
|
|
|
prefetch = true;
|
|
prefetch-key = true;
|
|
serve-expired = true;
|
|
|
|
aggressive-nsec = true;
|
|
hide-identity = true;
|
|
hide-version = true;
|
|
|
|
use-caps-for-id = true;
|
|
|
|
private-address = [
|
|
"127.0.0.0/8"
|
|
"10.0.0.0/8"
|
|
"172.16.0.0/12"
|
|
"192.168.0.0/16"
|
|
"169.254.0.0/16"
|
|
"fd00::/8"
|
|
"fe80::/10"
|
|
"::ffff:0:0/96"
|
|
];
|
|
private-domain = [
|
|
"dadada.li"
|
|
(mkIf cfg.localResolver.uwu "uwu")
|
|
(mkIf cfg.localResolver.s0 "s0")
|
|
];
|
|
domain-insecure = [
|
|
"dadada.li"
|
|
(mkIf cfg.localResolver.uwu "uwu")
|
|
(mkIf cfg.localResolver.s0 "s0")
|
|
];
|
|
interface = [
|
|
"127.0.0.1"
|
|
"::1"
|
|
];
|
|
};
|
|
forward-zone = [
|
|
{
|
|
name = ".";
|
|
forward-tls-upstream = "yes";
|
|
forward-addr = [
|
|
"2620:fe::fe@853#dns.quad9.net"
|
|
"2620:fe::9@853#dns.quad9.net"
|
|
"9.9.9.9@853#dns.quad9.net"
|
|
"149.112.112.112@853#dns.quad9.net"
|
|
];
|
|
}
|
|
(
|
|
mkIf cfg.localResolver.uwu {
|
|
name = "uwu.";
|
|
forward-addr = [
|
|
"fc00:1337:dead:beef::10.11.0.1"
|
|
"10.11.0.1"
|
|
];
|
|
}
|
|
)
|
|
(
|
|
mkIf cfg.localResolver.s0 {
|
|
name = "s0.";
|
|
forward-addr = [
|
|
"192.168.178.1"
|
|
];
|
|
}
|
|
)
|
|
{
|
|
name = "dyn.dadada.li.";
|
|
forward-addr = [
|
|
"fd42:9c3b:f96d:201::1"
|
|
];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
networking.useDHCP = false;
|
|
|
|
networking.interfaces = listToAttrs (forEach cfg.wanInterfaces (i:
|
|
nameValuePair i {
|
|
useDHCP = true;
|
|
}));
|
|
|
|
networking.wireguard.interfaces = mkIf (cfg.vpnExtension != null) {
|
|
dadada = {
|
|
ips = ["fd42:9c3b:f96d:201::${cfg.vpnExtension}/64"];
|
|
listenPort = 51234;
|
|
|
|
privateKeyFile = "/var/lib/wireguard/privkey";
|
|
|
|
peers = [
|
|
{
|
|
publicKey = vpnPubKey;
|
|
allowedIPs = ["fd42:9c3b:f96d::/48"];
|
|
endpoint = "vpn.dadada.li:51234";
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# https://lists.zx2c4.com/pipermail/wireguard/2017-November/002028.html
|
|
systemd.timers.wg-reresolve-dns = mkIf (cfg.vpnExtension != null) {
|
|
wantedBy = ["timers.target"];
|
|
partOf = ["wg-reresolve-dns.service"];
|
|
timerConfig.OnCalendar = "hourly";
|
|
};
|
|
systemd.services.wg-reresolve-dns = mkIf (cfg.vpnExtension != null) {
|
|
serviceConfig.Type = "oneshot";
|
|
script = ''
|
|
${pkgs.wireguard-tools}/bin/wg set dadada peer ${vpnPubKey} endpoint vpn.dadada.li:51234 persistent-keepalive 25 allowed-ips fd42:9c3b:f96d::/48
|
|
'';
|
|
};
|
|
};
|
|
}
|