summaryrefslogtreecommitdiff
path: root/config
diff options
context:
space:
mode:
Diffstat (limited to 'config')
-rw-r--r--config/hydra.nix57
-rw-r--r--config/router.nix408
2 files changed, 0 insertions, 465 deletions
diff --git a/config/hydra.nix b/config/hydra.nix
deleted file mode 100644
index 5ebc605..0000000
--- a/config/hydra.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ config, lib, pkgs, ... }:
-let hydraPort = (import ../data/aliases.nix).services.hydra.port;
-in {
- networking.firewall.allowedTCPPorts = [ hydraPort ];
-
- virtualisation.virtualbox.host.enable = true;
-
- services.hydra = {
- enable = true;
- hydraURL = "https://hydra.orbekk.com";
- notificationSender = "kj+hydra@orbekk.com";
- buildMachinesFiles = [ ];
- useSubstitutes = true;
- port = hydraPort;
- extraConfig = ''
- store-uri = file:///nix/store?secret-key=/opt/secret/hydra_key/hydra.orbekk.com-1/secret
- '';
- };
-
- # From https://github.com/input-output-hk/iohk-nixops
- systemd.services.hydra-manual-setup = {
- description = "Create Keys for Hydra";
- serviceConfig.Type = "oneshot";
- serviceConfig.RemainAfterExit = true;
- wantedBy = [ "multi-user.target" ];
- requires = [ "hydra-init.service" ];
- after = [ "hydra-init.service" ];
- environment = lib.mkForce config.systemd.services.hydra-init.environment;
- script = ''
- if [ ! -e /opt/secret/hydra_key/initialized ]; then
- # create signing keys
- /run/current-system/sw/bin/install -d -m 551 /opt/secret/hydra_key/hydra.orbekk.com-1
- /run/current-system/sw/bin/nix-store --generate-binary-cache-key hydra.orbekk.com-1 /opt/secret/hydra_key/hydra.orbekk.com-1/secret /opt/secret/hydra_key/hydra.orbekk.com-1/public
- /run/current-system/sw/bin/chown -R hydra:hydra /opt/secret/hydra_key
- /run/current-system/sw/bin/chmod 440 /opt/secret/hydra_key/hydra.orbekk.com-1/secret
- /run/current-system/sw/bin/chmod 444 /opt/secret/hydra_key/hydra.orbekk.com-1/public
- # done
- touch /opt/secret/hydra_key/initialized
- fi
- '';
- };
-
- nix = {
- distributedBuilds = true;
- nrBuildUsers = 30;
- # Enable this if I run low on disk.
- gc.automatic = lib.mkForce false;
- buildMachines = [{
- hostName = "localhost";
- systems = [ "x86_64-linux" "i686-linux" ];
- maxJobs = "16";
- supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ];
- }];
- extraOptions = "auto-optimise-store = true";
- };
- nixpkgs.config = { allowUnfree = true; };
-}
diff --git a/config/router.nix b/config/router.nix
deleted file mode 100644
index cb2eeb2..0000000
--- a/config/router.nix
+++ /dev/null
@@ -1,408 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
- wan-dev = "bond0.10";
- lan-dev = "bond0";
- # config.orbekk.nycmesh.listenPort
- wireguardPorts =
- [ config.orbekk.mullvad.listenPort config.orbekk.vpn.listenPort ];
- mullvadMark = 30;
- heMark = 200;
- # nycmeshMark = 32;
- aliases = import ../data/aliases.nix;
-in {
- orbekk.mullvad.enable = true;
- orbekk.nycmesh.enable = false;
-
- services.tftpd.enable = true;
- services.openntpd.enable = true;
-
- environment.systemPackages = with pkgs; [ iptables ];
-
- networking.useDHCP = false;
-
- networking.networkmanager.enable = lib.mkForce false;
-
- networking.nameservers =
- [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ];
-
- networking.vlans = builtins.listToAttrs (map (id: {
- name = "${lan-dev}.${toString id}";
- value = {
- inherit id;
- interface = lan-dev;
- };
- }) [ 10 30 32 100 255 ]);
-
- networking.bonds.bond0 = {
- interfaces = [ "eno1" "eno2" ];
- driverOptions = {
- miimon = "1000";
- mode = "balance-rr";
- };
- };
-
- systemd.services.update-dynamic-dns = {
- description = "Update dynamic dns records";
- path = with pkgs; [ bash dnsutils nettools gawk iproute curl ];
- startLimitIntervalSec = 5;
- script = toString ../tools/update-dns.sh;
- };
-
- networking.firewall = {
- enable = lib.mkForce false;
- allowedTCPPorts = lib.mkForce [ ];
- allowedUDPPorts = lib.mkForce [ ];
- allowPing = true;
- logRefusedConnections = false;
- checkReversePath = false;
- };
-
- services.ddclient = {
- enable = true;
- configFile = "/opt/secret/he-ddclient.conf";
- };
- # FIXME: Workaround for ddclient.conf not being available to ddclient.
- systemd.services.ddclient.serviceConfig.DynamicUser = lib.mkForce false;
-
- services.ferm = {
- enable = true;
- config = ''
- @def $DEV_UNTRUSTED_LAN = (${lan-dev}.30 ${lan-dev}.32);
- @def $DEV_LAN = (${lan-dev}.100 vpn);
- @def $DEV_ADMIN = (${lan-dev}.255);
- @def $DEV_WAN = (${wan-dev} he0 mullvad);
- @def $NET_LAN = (172.20.0.0/16);
- @def $NET_HE = (2001:470:8e2e::/48);
-
- # Forward dns queries to dnsmasq on LAN interfaces.
- domain (ip ip6) table nat chain PREROUTING {
- interface ($DEV_LAN $DEV_UNTRUSTED_LAN) daddr $NET_LAN proto (tcp udp) dport 53 REDIRECT to-ports 2053;
- }
-
- domain (ip ip6) table filter {
- chain INPUT {
- policy DROP;
-
- mod state state INVALID DROP;
- mod state state (ESTABLISHED RELATED) ACCEPT;
-
- interface lo ACCEPT;
- proto icmp ACCEPT;
-
- proto (udp udp) dport dhcpv6-client ACCEPT;
-
- proto 41 ACCEPT; # IPv6 sit tunnel
-
- interface ($DEV_WAN $DEV_LAN $DEV_UNTRUSTED_LAN) @subchain "wan_services" {
- # Valheim
- proto udp dport (3400 3401 3402) ACCEPT;
-
- proto (tcp udp) dport 2053 ACCEPT;
- proto (tcp udp) dport (bootpc bootps) ACCEPT;
- proto tcp dport ssh ACCEPT;
- proto (tcp udp) dport domain ACCEPT;
- proto tcp dport (http https) ACCEPT;
- proto udp dport (${
- lib.concatStringsSep " " (map toString wireguardPorts)
- }) ACCEPT;
- }
-
- interface ($DEV_LAN $DEV_UNTRUSTED_LAN) {
- proto (tcp udp) dport 1080 ACCEPT; # socks proxy
- }
-
- interface ($DEV_LAN $DEV_ADMIN) @subchain "lan_services" {
- proto (tcp udp) dport 5000 ACCEPT; # random debugging
-
- proto (tcp udp) dport postgresql ACCEPT; # internal network only!
-
- proto (tcp udp) dport (ssh domain bootpc bootps ntp) ACCEPT;
- # prometheus temp rule
- proto tcp dport 11112 ACCEPT;
- proto (tcp udp) dport tftp ACCEPT;
-
- # RTMP streaming
- proto (tcp udp) dport 1935 ACCEPT;
-
- # Chromecast
- # proto udp dport 32768:61000 ACCEPT;
- # proto udp dport (5353 1900) ACCEPT;
- # proto tcp dport (8008 8009) ACCEPT;
-
- # Samba
- proto tcp dport (139 445) ACCEPT;
- proto udp dport (137 138) ACCEPT;
-
- # Project Zomboid
- proto udp dport (16261 16262) ACCEPT;
-
- # interface $DEV_LAN jump logdrop;
- }
- }
-
- chain OUTPUT policy ACCEPT;
-
- chain FORWARD {
- policy DROP;
-
- mod state state INVALID DROP;
- mod state state (ESTABLISHED RELATED) ACCEPT;
-
- interface $DEV_UNTRUSTED_LAN outerface $DEV_WAN ACCEPT;
- interface $DEV_LAN ACCEPT;
-
- # jump logdrop;
- }
- }
-
- domain ip6 table filter chain INPUT {
- proto ipv6-icmp ACCEPT;
- }
-
- domain (ip ip6) table filter chain logdrop {
- LOG log-level warning log-prefix "dropped ";
- DROP;
- }
-
- domain (ip ip6) table filter chain INPUT {
- interface $DEV_WAN DROP;
- # jump logdrop;
- }
-
- domain ip table nat {
- chain POSTROUTING {
- saddr $NET_LAN outerface $DEV_WAN MASQUERADE;
- }
- }
-
- domain (ip ip6) table mangle {
- chain PREROUTING {
- interface ${lan-dev}.30 MARK set-mark ${toString mullvadMark};
- # Route HE traffic via tunnel.
- # saddr $NET_HE MARK set-mark ${toString heMark};
- # saddr 2001:470:1f06:1194::2/64 MARK set-mark ${toString heMark};
- }
- }
- '';
- };
-
- services = {
- openssh.enable = lib.mkDefault true;
- openssh.settings.PasswordAuthentication = false;
- };
-
- boot.kernel.sysctl = {
- "net.ipv4.conf.all.forwarding" = true;
- "net.ipv4.conf.default.forwarding" = true;
- "net.ipv6.conf.all.forwarding" = true;
- "net.ipv6.conf.default.forwarding" = true;
- };
-
- #services.hostapd = {
- # enable = true;
- # # driver = "iwlwifi";
- # ssid = "2c";
- # wpaPassphrase = "mintchip";
- # interface = "${lan-dev}";
- # hwMode = "g";
- # channel = 11;
- # extraConfig = ''
- # country_code=US
- # wpa_key_mgmt=WPA-PSK
- # rsn_pairwise=CCMP
- # '';
- #};
-
- networking.dhcpcd = {
- # Wait for v4 and v6 addresses.
- # wait = "both";
- extraConfig = ''
- noipv6rs
- nohook resolv.conf
- interface ${wan-dev}
- dhcp
- # ipv6rs
- # iaid 0
- # ia_pd 0//56 ${lan-dev}.100/2/64
- '';
- runHook = ''
- # if [[ $reason =~ BOUND6|REBIND6 ]]; then
- # ip=${pkgs.iproute}/bin/ip
- # $ip addr add dev $interface "''${new_dhcp6_ia_pd1_prefix1}/64" || true
- # if [[ $new_dhcp6_ia_pd1_prefix1 != $old_dhcp6_ia_pd1_prefix1 ]]; then
- # $ip addr delete dev $interface "''${old_dhcp6_ia_pd1_prefix1}/64"
- # fi
- # fi
- systemctl restart update-dynamic-dns.service
- '';
- };
- systemd.services.dhcpcd = {
- after = [ "network-addresses-${wan-dev}.service" ];
- preStart = lib.mkAfter ''
- ${pkgs.iproute}/bin/ip link set dev ${wan-dev} address ${
- config.networking.interfaces.${wan-dev}.macAddress
- };
- '';
- };
-
- services.dnsmasq = {
- enable = true;
- servers = [ "1.1.1.1" "8.8.8.8" "8.8.4.4" ];
- resolveLocalQueries = false;
- extraConfig = ''
- port=2053
-
- no-resolv
- no-hosts
-
- address=/localhost/::1
- address=/localhost/127.0.0.1
-
- enable-ra
- dhcp-authoritative
-
- # Null AAAA response on these domains
- server=/netflix.com/#
- address=/netflix.com/::
- server=/netflix.net/#
- address=/netflix.net/::
- server=/nflxext.com/#
- address=/nflxext.com/::
- server=/nflximg.net/#
- address=/nflximg.net/::
- server=/nflxvideo.net/#
- address=/nflxvideo.net/::
- server=/nflxso.net/#
- address=/nflxso.net/::
-
- dhcp-range=vlan30,172.20.30.50,172.20.30.254,5m
- dhcp-option=net:vlan30,option:router,172.20.30.1
- dhcp-option=net:vlan30,option:dns-server,193.138.218.74
- dhcp-option=net:vlan30,option:domain-search,nyc.orbekk.com
-
- dhcp-range=vlan100,172.20.100.50,172.20.100.254,5m
- dhcp-host=vlan100,d8:3b:bf:59:22:de,172.20.100.10
- dhcp-range=vlan100,::100,::500,constructor:bond0.100,ra-only
- dhcp-option=net:vlan100,option:router,172.20.100.1
- dhcp-option=net:vlan100,option:dns-server,172.20.100.1
- dhcp-option=net:vlan100,option:domain-search,nyc.orbekk.com
-
- dhcp-range=vlan32,172.20.32.50,172.20.32.254,5m
- dhcp-range=vlan32,::100,::500,constructor:bond0.32,ra-only
- dhcp-option=net:vlan32,option:router,172.20.32.1
- dhcp-option=net:vlan32,option:dns-server,172.20.32.1
- dhcp-option=net:vlan32,option:domain-search,nyc.orbekk.com
- '';
- };
-
- networking.sits.he0 = {
- dev = wan-dev;
- remote = "209.51.161.14";
- };
-
- networking.iproute2.enable = true;
- # ${toString nycmeshMark} nycmesh
- networking.iproute2.rttablesExtraConfig = ''
- ${toString mullvadMark} mullvad
- ${toString heMark} he
- '';
-
- systemd.services.network-route-setup = {
- description = "HE tunnel route setup";
- requires = [ "network-online.target" ];
- after = [ "network.target" "network-online.target" ];
- wantedBy = [ "multi-user.target" ];
- path = [ pkgs.iproute ];
- script = ''
- #ip -6 rule add from 2001:470:8e2e::/48 lookup he prio 0 || true
- #ip -6 route replace default dev he0 src 2001:470:8e2e:20::d table he
- ip -6 route flush cache
- ip -6 rule add fwmark ${toString heMark} table he || true
- '';
- };
-
- networking.wireguard.interfaces.mullvad.postSetup = ''
- ip rule add fwmark ${toString mullvadMark} table mullvad
- ip route replace default dev mullvad table mullvad
- ip route flush cache
- '';
-
- # networking.wireguard.interfaces.nycmesh.postSetup = ''
- # ip rule add fwmark ${toString nycmeshMark} table nycmesh
- # ip route replace default via 10.70.73.1 onlink dev nycmesh table nycmesh
- # ip route flush cache
- # '';
-
- # boot.kernel.sysctl."net.ipv6.conf.${wan-dev}.disable_ipv6" = true;
-
- networking.interfaces.${wan-dev} = {
- macAddress = "3c:97:0e:19:7e:5c";
- useDHCP = true;
- };
-
- networking.interfaces.he0.ipv6 = {
- addresses = [
- {
- address = "2001:470:1f06:1194::2";
- prefixLength = 64;
- }
- {
- address = "2001:470:8e2e:20::d";
- prefixLength = 64;
- }
- ];
- routes = [
- {
- address = "::";
- prefixLength = 0;
- }
- {
- address = "::";
- prefixLength = 0;
- options = { table = "he"; };
- }
- ];
- };
-
- networking.interfaces."${lan-dev}".useDHCP = false;
- networking.interfaces."${lan-dev}.255" = {
- ipv4.addresses = [{
- address = "10.10.255.3";
- prefixLength = 24;
- }];
- ipv6.addresses = [{
- address = "2001:470:8e2e:ffff::3";
- prefixLength = 64;
- }];
- useDHCP = false;
- };
- networking.interfaces."${lan-dev}.100" = {
- ipv4.addresses = [{
- address = "172.20.100.1";
- prefixLength = 24;
- }];
- ipv6.addresses = [{
- address = "2001:470:8e2e:100::1";
- prefixLength = 64;
- }];
- useDHCP = false;
- };
- networking.interfaces."${lan-dev}.30" = {
- ipv4.addresses = [{
- address = "172.20.30.1";
- prefixLength = 24;
- }];
- useDHCP = false;
- };
- networking.interfaces."${lan-dev}.32" = {
- ipv4.addresses = [{
- address = "172.20.32.1";
- prefixLength = 23;
- }];
- ipv6.addresses = [{
- address = "2001:470:8e2e:32::1";
- prefixLength = 64;
- }];
- useDHCP = false;
- };
-}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 03:04:14 +0000