From 0f7e06553348894ca6f2004d3dc57dd737c35e50 Mon Sep 17 00:00:00 2001 From: Kjetil Orbekk Date: Sat, 9 Dec 2023 13:49:23 -0500 Subject: update --- config/hydra.nix | 57 -------- config/router.nix | 408 ------------------------------------------------------ 2 files changed, 465 deletions(-) delete mode 100644 config/hydra.nix delete mode 100644 config/router.nix (limited to 'config') diff --git a/config/hydra.nix b/config/hydra.nix deleted file mode 100644 index 5ebc605..0000000 --- a/config/hydra.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ config, lib, pkgs, ... }: -let hydraPort = (import ../data/aliases.nix).services.hydra.port; -in { - networking.firewall.allowedTCPPorts = [ hydraPort ]; - - virtualisation.virtualbox.host.enable = true; - - services.hydra = { - enable = true; - hydraURL = "https://hydra.orbekk.com"; - notificationSender = "kj+hydra@orbekk.com"; - buildMachinesFiles = [ ]; - useSubstitutes = true; - port = hydraPort; - extraConfig = '' - store-uri = file:///nix/store?secret-key=/opt/secret/hydra_key/hydra.orbekk.com-1/secret - ''; - }; - - # From https://github.com/input-output-hk/iohk-nixops - systemd.services.hydra-manual-setup = { - description = "Create Keys for Hydra"; - serviceConfig.Type = "oneshot"; - serviceConfig.RemainAfterExit = true; - wantedBy = [ "multi-user.target" ]; - requires = [ "hydra-init.service" ]; - after = [ "hydra-init.service" ]; - environment = lib.mkForce config.systemd.services.hydra-init.environment; - script = '' - if [ ! -e /opt/secret/hydra_key/initialized ]; then - # create signing keys - /run/current-system/sw/bin/install -d -m 551 /opt/secret/hydra_key/hydra.orbekk.com-1 - /run/current-system/sw/bin/nix-store --generate-binary-cache-key hydra.orbekk.com-1 /opt/secret/hydra_key/hydra.orbekk.com-1/secret /opt/secret/hydra_key/hydra.orbekk.com-1/public - /run/current-system/sw/bin/chown -R hydra:hydra /opt/secret/hydra_key - /run/current-system/sw/bin/chmod 440 /opt/secret/hydra_key/hydra.orbekk.com-1/secret - /run/current-system/sw/bin/chmod 444 /opt/secret/hydra_key/hydra.orbekk.com-1/public - # done - touch /opt/secret/hydra_key/initialized - fi - ''; - }; - - nix = { - distributedBuilds = true; - nrBuildUsers = 30; - # Enable this if I run low on disk. - gc.automatic = lib.mkForce false; - buildMachines = [{ - hostName = "localhost"; - systems = [ "x86_64-linux" "i686-linux" ]; - maxJobs = "16"; - supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ]; - }]; - extraOptions = "auto-optimise-store = true"; - }; - nixpkgs.config = { allowUnfree = true; }; -} diff --git a/config/router.nix b/config/router.nix deleted file mode 100644 index cb2eeb2..0000000 --- a/config/router.nix +++ /dev/null @@ -1,408 +0,0 @@ -{ config, lib, pkgs, ... }: -let - wan-dev = "bond0.10"; - lan-dev = "bond0"; - # config.orbekk.nycmesh.listenPort - wireguardPorts = - [ config.orbekk.mullvad.listenPort config.orbekk.vpn.listenPort ]; - mullvadMark = 30; - heMark = 200; - # nycmeshMark = 32; - aliases = import ../data/aliases.nix; -in { - orbekk.mullvad.enable = true; - orbekk.nycmesh.enable = false; - - services.tftpd.enable = true; - services.openntpd.enable = true; - - environment.systemPackages = with pkgs; [ iptables ]; - - networking.useDHCP = false; - - networking.networkmanager.enable = lib.mkForce false; - - networking.nameservers = - [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ]; - - networking.vlans = builtins.listToAttrs (map (id: { - name = "${lan-dev}.${toString id}"; - value = { - inherit id; - interface = lan-dev; - }; - }) [ 10 30 32 100 255 ]); - - networking.bonds.bond0 = { - interfaces = [ "eno1" "eno2" ]; - driverOptions = { - miimon = "1000"; - mode = "balance-rr"; - }; - }; - - systemd.services.update-dynamic-dns = { - description = "Update dynamic dns records"; - path = with pkgs; [ bash dnsutils nettools gawk iproute curl ]; - startLimitIntervalSec = 5; - script = toString ../tools/update-dns.sh; - }; - - networking.firewall = { - enable = lib.mkForce false; - allowedTCPPorts = lib.mkForce [ ]; - allowedUDPPorts = lib.mkForce [ ]; - allowPing = true; - logRefusedConnections = false; - checkReversePath = false; - }; - - services.ddclient = { - enable = true; - configFile = "/opt/secret/he-ddclient.conf"; - }; - # FIXME: Workaround for ddclient.conf not being available to ddclient. - systemd.services.ddclient.serviceConfig.DynamicUser = lib.mkForce false; - - services.ferm = { - enable = true; - config = '' - @def $DEV_UNTRUSTED_LAN = (${lan-dev}.30 ${lan-dev}.32); - @def $DEV_LAN = (${lan-dev}.100 vpn); - @def $DEV_ADMIN = (${lan-dev}.255); - @def $DEV_WAN = (${wan-dev} he0 mullvad); - @def $NET_LAN = (172.20.0.0/16); - @def $NET_HE = (2001:470:8e2e::/48); - - # Forward dns queries to dnsmasq on LAN interfaces. - domain (ip ip6) table nat chain PREROUTING { - interface ($DEV_LAN $DEV_UNTRUSTED_LAN) daddr $NET_LAN proto (tcp udp) dport 53 REDIRECT to-ports 2053; - } - - domain (ip ip6) table filter { - chain INPUT { - policy DROP; - - mod state state INVALID DROP; - mod state state (ESTABLISHED RELATED) ACCEPT; - - interface lo ACCEPT; - proto icmp ACCEPT; - - proto (udp udp) dport dhcpv6-client ACCEPT; - - proto 41 ACCEPT; # IPv6 sit tunnel - - interface ($DEV_WAN $DEV_LAN $DEV_UNTRUSTED_LAN) @subchain "wan_services" { - # Valheim - proto udp dport (3400 3401 3402) ACCEPT; - - proto (tcp udp) dport 2053 ACCEPT; - proto (tcp udp) dport (bootpc bootps) ACCEPT; - proto tcp dport ssh ACCEPT; - proto (tcp udp) dport domain ACCEPT; - proto tcp dport (http https) ACCEPT; - proto udp dport (${ - lib.concatStringsSep " " (map toString wireguardPorts) - }) ACCEPT; - } - - interface ($DEV_LAN $DEV_UNTRUSTED_LAN) { - proto (tcp udp) dport 1080 ACCEPT; # socks proxy - } - - interface ($DEV_LAN $DEV_ADMIN) @subchain "lan_services" { - proto (tcp udp) dport 5000 ACCEPT; # random debugging - - proto (tcp udp) dport postgresql ACCEPT; # internal network only! - - proto (tcp udp) dport (ssh domain bootpc bootps ntp) ACCEPT; - # prometheus temp rule - proto tcp dport 11112 ACCEPT; - proto (tcp udp) dport tftp ACCEPT; - - # RTMP streaming - proto (tcp udp) dport 1935 ACCEPT; - - # Chromecast - # proto udp dport 32768:61000 ACCEPT; - # proto udp dport (5353 1900) ACCEPT; - # proto tcp dport (8008 8009) ACCEPT; - - # Samba - proto tcp dport (139 445) ACCEPT; - proto udp dport (137 138) ACCEPT; - - # Project Zomboid - proto udp dport (16261 16262) ACCEPT; - - # interface $DEV_LAN jump logdrop; - } - } - - chain OUTPUT policy ACCEPT; - - chain FORWARD { - policy DROP; - - mod state state INVALID DROP; - mod state state (ESTABLISHED RELATED) ACCEPT; - - interface $DEV_UNTRUSTED_LAN outerface $DEV_WAN ACCEPT; - interface $DEV_LAN ACCEPT; - - # jump logdrop; - } - } - - domain ip6 table filter chain INPUT { - proto ipv6-icmp ACCEPT; - } - - domain (ip ip6) table filter chain logdrop { - LOG log-level warning log-prefix "dropped "; - DROP; - } - - domain (ip ip6) table filter chain INPUT { - interface $DEV_WAN DROP; - # jump logdrop; - } - - domain ip table nat { - chain POSTROUTING { - saddr $NET_LAN outerface $DEV_WAN MASQUERADE; - } - } - - domain (ip ip6) table mangle { - chain PREROUTING { - interface ${lan-dev}.30 MARK set-mark ${toString mullvadMark}; - # Route HE traffic via tunnel. - # saddr $NET_HE MARK set-mark ${toString heMark}; - # saddr 2001:470:1f06:1194::2/64 MARK set-mark ${toString heMark}; - } - } - ''; - }; - - services = { - openssh.enable = lib.mkDefault true; - openssh.settings.PasswordAuthentication = false; - }; - - boot.kernel.sysctl = { - "net.ipv4.conf.all.forwarding" = true; - "net.ipv4.conf.default.forwarding" = true; - "net.ipv6.conf.all.forwarding" = true; - "net.ipv6.conf.default.forwarding" = true; - }; - - #services.hostapd = { - # enable = true; - # # driver = "iwlwifi"; - # ssid = "2c"; - # wpaPassphrase = "mintchip"; - # interface = "${lan-dev}"; - # hwMode = "g"; - # channel = 11; - # extraConfig = '' - # country_code=US - # wpa_key_mgmt=WPA-PSK - # rsn_pairwise=CCMP - # ''; - #}; - - networking.dhcpcd = { - # Wait for v4 and v6 addresses. - # wait = "both"; - extraConfig = '' - noipv6rs - nohook resolv.conf - interface ${wan-dev} - dhcp - # ipv6rs - # iaid 0 - # ia_pd 0//56 ${lan-dev}.100/2/64 - ''; - runHook = '' - # if [[ $reason =~ BOUND6|REBIND6 ]]; then - # ip=${pkgs.iproute}/bin/ip - # $ip addr add dev $interface "''${new_dhcp6_ia_pd1_prefix1}/64" || true - # if [[ $new_dhcp6_ia_pd1_prefix1 != $old_dhcp6_ia_pd1_prefix1 ]]; then - # $ip addr delete dev $interface "''${old_dhcp6_ia_pd1_prefix1}/64" - # fi - # fi - systemctl restart update-dynamic-dns.service - ''; - }; - systemd.services.dhcpcd = { - after = [ "network-addresses-${wan-dev}.service" ]; - preStart = lib.mkAfter '' - ${pkgs.iproute}/bin/ip link set dev ${wan-dev} address ${ - config.networking.interfaces.${wan-dev}.macAddress - }; - ''; - }; - - services.dnsmasq = { - enable = true; - servers = [ "1.1.1.1" "8.8.8.8" "8.8.4.4" ]; - resolveLocalQueries = false; - extraConfig = '' - port=2053 - - no-resolv - no-hosts - - address=/localhost/::1 - address=/localhost/127.0.0.1 - - enable-ra - dhcp-authoritative - - # Null AAAA response on these domains - server=/netflix.com/# - address=/netflix.com/:: - server=/netflix.net/# - address=/netflix.net/:: - server=/nflxext.com/# - address=/nflxext.com/:: - server=/nflximg.net/# - address=/nflximg.net/:: - server=/nflxvideo.net/# - address=/nflxvideo.net/:: - server=/nflxso.net/# - address=/nflxso.net/:: - - dhcp-range=vlan30,172.20.30.50,172.20.30.254,5m - dhcp-option=net:vlan30,option:router,172.20.30.1 - dhcp-option=net:vlan30,option:dns-server,193.138.218.74 - dhcp-option=net:vlan30,option:domain-search,nyc.orbekk.com - - dhcp-range=vlan100,172.20.100.50,172.20.100.254,5m - dhcp-host=vlan100,d8:3b:bf:59:22:de,172.20.100.10 - dhcp-range=vlan100,::100,::500,constructor:bond0.100,ra-only - dhcp-option=net:vlan100,option:router,172.20.100.1 - dhcp-option=net:vlan100,option:dns-server,172.20.100.1 - dhcp-option=net:vlan100,option:domain-search,nyc.orbekk.com - - dhcp-range=vlan32,172.20.32.50,172.20.32.254,5m - dhcp-range=vlan32,::100,::500,constructor:bond0.32,ra-only - dhcp-option=net:vlan32,option:router,172.20.32.1 - dhcp-option=net:vlan32,option:dns-server,172.20.32.1 - dhcp-option=net:vlan32,option:domain-search,nyc.orbekk.com - ''; - }; - - networking.sits.he0 = { - dev = wan-dev; - remote = "209.51.161.14"; - }; - - networking.iproute2.enable = true; - # ${toString nycmeshMark} nycmesh - networking.iproute2.rttablesExtraConfig = '' - ${toString mullvadMark} mullvad - ${toString heMark} he - ''; - - systemd.services.network-route-setup = { - description = "HE tunnel route setup"; - requires = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; - path = [ pkgs.iproute ]; - script = '' - #ip -6 rule add from 2001:470:8e2e::/48 lookup he prio 0 || true - #ip -6 route replace default dev he0 src 2001:470:8e2e:20::d table he - ip -6 route flush cache - ip -6 rule add fwmark ${toString heMark} table he || true - ''; - }; - - networking.wireguard.interfaces.mullvad.postSetup = '' - ip rule add fwmark ${toString mullvadMark} table mullvad - ip route replace default dev mullvad table mullvad - ip route flush cache - ''; - - # networking.wireguard.interfaces.nycmesh.postSetup = '' - # ip rule add fwmark ${toString nycmeshMark} table nycmesh - # ip route replace default via 10.70.73.1 onlink dev nycmesh table nycmesh - # ip route flush cache - # ''; - - # boot.kernel.sysctl."net.ipv6.conf.${wan-dev}.disable_ipv6" = true; - - networking.interfaces.${wan-dev} = { - macAddress = "3c:97:0e:19:7e:5c"; - useDHCP = true; - }; - - networking.interfaces.he0.ipv6 = { - addresses = [ - { - address = "2001:470:1f06:1194::2"; - prefixLength = 64; - } - { - address = "2001:470:8e2e:20::d"; - prefixLength = 64; - } - ]; - routes = [ - { - address = "::"; - prefixLength = 0; - } - { - address = "::"; - prefixLength = 0; - options = { table = "he"; }; - } - ]; - }; - - networking.interfaces."${lan-dev}".useDHCP = false; - networking.interfaces."${lan-dev}.255" = { - ipv4.addresses = [{ - address = "10.10.255.3"; - prefixLength = 24; - }]; - ipv6.addresses = [{ - address = "2001:470:8e2e:ffff::3"; - prefixLength = 64; - }]; - useDHCP = false; - }; - networking.interfaces."${lan-dev}.100" = { - ipv4.addresses = [{ - address = "172.20.100.1"; - prefixLength = 24; - }]; - ipv6.addresses = [{ - address = "2001:470:8e2e:100::1"; - prefixLength = 64; - }]; - useDHCP = false; - }; - networking.interfaces."${lan-dev}.30" = { - ipv4.addresses = [{ - address = "172.20.30.1"; - prefixLength = 24; - }]; - useDHCP = false; - }; - networking.interfaces."${lan-dev}.32" = { - ipv4.addresses = [{ - address = "172.20.32.1"; - prefixLength = 23; - }]; - ipv6.addresses = [{ - address = "2001:470:8e2e:32::1"; - prefixLength = 64; - }]; - useDHCP = false; - }; -} -- cgit v1.2.3