adtya/configuration.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: adtya:e9b1b817c6a1a06134a7538beb38bf4b6829eff3
Branches Tags
adtya:main
...
compare: adtya:fba9d776686b2ec38854bd44cf9401f9b3758c0a
Branches Tags
adtya:main

2 commits
e9b1b817c6 ... fba9d77668

Author SHA1 Message Date
Adithya Nair
fba9d77668
replace wg-quick with systemd-networkd 2024-12-07 02:28:11 +05:30
Adithya Nair
90c0d22af4
workaround to build sonarr 
NixOS/nixpkgs#360592
 2024-12-07 02:27:42 +05:30
11 changed files with 232 additions and 148 deletions
Show stats Expand all files Collapse all files

6
flake.nix
View file

@ -61,6 +61,12 @@
inherit system; inherit system;
config = { config = {
allowUnfree = true; allowUnfree = true;
permittedInsecurePackages = [
"aspnetcore-runtime-wrapped-6.0.36"
"aspnetcore-runtime-6.0.36"
"dotnet-sdk-wrapped-6.0.428"
"dotnet-sdk-6.0.428"
];
}; };
overlays = [ (import ./extra-packages) ]; overlays = [ (import ./extra-packages) ];
}; };

55
hosts/bifrost/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in { let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = true; }; in {
sops.secrets = { sops.secrets = {
"wireguard/bifrost/pk" = { "wireguard/bifrost/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
@ -12,25 +12,36 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51821 ]; allowedUDPPorts = [ 51821 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { netdevs."99-Homelab" = {
listenPort = 51821; netdevConfig = {
privateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path; Name = "Homelab";
address = [ Kind = "wireguard";
"${config.nodeconfig.facts.wireguard-ip}/24" };
]; wireguardConfig = {
dns = [ "10.10.10.1" ]; ListenPort = 51821;
peers = with wireguard-peers; [ PrivateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
(rico0 // { endpoint = null; }) };
(rico1 // { endpoint = null; }) wireguardPeers = with wireguard-peers; [
(rico2 // { endpoint = null; }) rico0
(wynne // { endpoint = null; }) rico1
(layne // { endpoint = null; }) rico2
skipper wynne
kowalski layne
]; skipper
}; kowalski
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

52
hosts/layne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in { let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = { sops.secrets = {
"wireguard/layne/pk" = { "wireguard/layne/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
@ -12,25 +12,35 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51834 ]; allowedUDPPorts = [ 51834 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { netdevs."99-Homelab" = {
listenPort = 51834; netdevConfig = {
privateKeyFile = config.sops.secrets."wireguard/layne/pk".path; Name = "Homelab";
address = [ Kind = "wireguard";
"${config.nodeconfig.facts.wireguard-ip}/24" };
]; wireguardConfig = {
dns = [ "10.10.10.1" ]; ListenPort = 51834;
peers = with wireguard-peers; [ PrivateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
(bifrost // { persistentKeepalive = 20; }) };
rico0 wireguardPeers = with wireguard-peers; [
rico1 (bifrost // { PersistentKeepalive = 20; })
rico2 rico0
wynne rico1
]; rico2
}; wynne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };
} }

51
hosts/rico0/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in { let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = { sops.secrets = {
"wireguard/rico0/pk" = { "wireguard/rico0/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51830 ]; allowedUDPPorts = [ 51830 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { netdevs."99-Homelab" = {
listenPort = 51830; netdevConfig = {
privateKeyFile = config.sops.secrets."wireguard/rico0/pk".path; Name = "Homelab";
address = [ Kind = "wireguard";
"${config.nodeconfig.facts.wireguard-ip}/24" };
]; wireguardConfig = {
dns = [ "10.10.10.1" ]; ListenPort = 51830;
peers = with wireguard-peers; [ PrivateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
(bifrost // { persistentKeepalive = 20; }) };
rico1 wireguardPeers = with wireguard-peers; [
rico2 (bifrost // { PersistentKeepalive = 20; })
wynne rico1
layne rico2
]; wynne
}; layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

51
hosts/rico1/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in { let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = { sops.secrets = {
"wireguard/rico1/pk" = { "wireguard/rico1/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51831 ]; allowedUDPPorts = [ 51831 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { netdevs."99-Homelab" = {
listenPort = 51831; netdevConfig = {
privateKeyFile = config.sops.secrets."wireguard/rico1/pk".path; Name = "Homelab";
address = [ Kind = "wireguard";
"${config.nodeconfig.facts.wireguard-ip}/24" };
]; wireguardConfig = {
dns = [ "10.10.10.1" ]; ListenPort = 51831;
peers = with wireguard-peers; [ PrivateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
(bifrost // { persistentKeepalive = 20; }) };
rico0 wireguardPeers = with wireguard-peers; [
rico2 (bifrost // { PersistentKeepalive = 20; })
wynne rico0
layne rico2
]; wynne
}; layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

51
hosts/rico2/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in { let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = { sops.secrets = {
"wireguard/rico2/pk" = { "wireguard/rico2/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51832 ]; allowedUDPPorts = [ 51832 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { netdevs."99-Homelab" = {
listenPort = 51832; netdevConfig = {
privateKeyFile = config.sops.secrets."wireguard/rico2/pk".path; Name = "Homelab";
address = [ Kind = "wireguard";
"${config.nodeconfig.facts.wireguard-ip}/24" };
]; wireguardConfig = {
dns = [ "10.10.10.1" ]; ListenPort = 51832;
peers = with wireguard-peers; [ PrivateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
(bifrost // { persistentKeepalive = 20; }) };
rico0 wireguardPeers = with wireguard-peers; [
rico1 (bifrost // { PersistentKeepalive = 20; })
wynne rico0
layne rico1
]; wynne
}; layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

1
hosts/shared/caddy.nix
View file

@ -21,7 +21,6 @@
''; '';
}; };
systemd.services.caddy = { systemd.services.caddy = {
after = [ "wg-quick-Homelab.service" ];
serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path; serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path;
}; };
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];

11
hosts/shared/wireguard-peers.nix
View file

@ -1,12 +1,13 @@
{ noEndpoints ? false }:
let let
mkPeer = endpoint: publicKey: allowedIPs: { mkPeer = Endpoint: PublicKey: AllowedIPs: {
inherit endpoint publicKey allowedIPs; inherit PublicKey AllowedIPs;
}; } // (if (noEndpoints) then { } else { inherit Endpoint; });
in in
{ {
bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ]; bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ];
skipper = mkPeer null "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ]; skipper = mkPeer "" "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer null "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ]; kowalski = mkPeer "" "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ]; rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ];
rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ]; rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ];
rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ]; rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ];

4
hosts/skipper/default.nix
View file

@ -10,6 +10,10 @@
./security.nix ./security.nix
]; ];
nodeconfig.facts = {
wireguard-ip = "10.10.10.2";
};
console.useXkbConfig = true; console.useXkbConfig = true;
environment.sessionVariables = { environment.sessionVariables = {

47
hosts/skipper/network/wireguard.nix
View file

@ -1,32 +1,41 @@
{ config, ... }: { config, ... }:
let let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
wireguard-peers = import ../../shared/wireguard-peers.nix;
in
{
sops.secrets = { sops.secrets = {
"wireguard/skipper/pk" = { "wireguard/skipper/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
firewall = { firewall = {
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { enable = true;
listenPort = 51822; netdevs."99-Homelab" = {
privateKeyFile = config.sops.secrets."wireguard/skipper/pk".path; netdevConfig = {
address = [ Name = "Homelab";
"10.10.10.2/24" Kind = "wireguard";
]; };
dns = [ "10.10.10.1" ]; wireguardConfig = {
peers = with wireguard-peers; [ ListenPort = 51822;
(bifrost // { allowedIPs = [ "10.10.10.0/24" ]; }) PrivateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
]; };
}; wireguardPeers = with wireguard-peers; [
(bifrost // { AllowedIPs = [ "10.10.10.0/24" ]; })
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

51
hosts/wynne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix; in { let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
sops.secrets = { sops.secrets = {
"wireguard/wynne/pk" = { "wireguard/wynne/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.root.name; owner = config.users.users.systemd-network.name;
group = config.users.users.root.group; group = config.users.users.systemd-network.group;
}; };
}; };
networking = { networking = {
@ -12,23 +12,34 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
allowedUDPPorts = [ 51833 ]; allowedUDPPorts = [ 51833 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
wg-quick = { };
interfaces = { systemd.network = {
Homelab = { netdevs."99-Homelab" = {
listenPort = 51833; netdevConfig = {
privateKeyFile = config.sops.secrets."wireguard/wynne/pk".path; Name = "Homelab";
address = [ Kind = "wireguard";
"${config.nodeconfig.facts.wireguard-ip}/24" };
]; wireguardConfig = {
dns = [ "10.10.10.1" ]; ListenPort = 51833;
peers = with wireguard-peers; [ PrivateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
(bifrost // { persistentKeepalive = 20; }) };
rico0 wireguardPeers = with wireguard-peers; [
rico1 (bifrost // { PersistentKeepalive = 20; })
rico2 rico0
layne rico1
]; rico2
}; layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };