adtya/configuration.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: adtya:fba9d776686b2ec38854bd44cf9401f9b3758c0a
Branches Tags
adtya:main
..
compare: adtya:e9b1b817c6a1a06134a7538beb38bf4b6829eff3
Branches Tags
adtya:main

No commits in common. "fba9d776686b2ec38854bd44cf9401f9b3758c0a" and "e9b1b817c6a1a06134a7538beb38bf4b6829eff3" have entirely different histories.
fba9d77668 ... e9b1b817c6

11 changed files with 148 additions and 232 deletions
Show stats Expand all files Collapse all files

6
flake.nix
View file

@ -61,12 +61,6 @@
inherit system;
config = {
allowUnfree = true;
permittedInsecurePackages = [
"aspnetcore-runtime-wrapped-6.0.36"
"aspnetcore-runtime-6.0.36"
"dotnet-sdk-wrapped-6.0.428"
"dotnet-sdk-6.0.428"
];
};
overlays = [ (import ./extra-packages) ];
};

55
hosts/bifrost/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = true; }; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = {
"wireguard/bifrost/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
@ -12,36 +12,25 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = tr
allowedUDPPorts = [ 51821 ];
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51821;
PrivateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
};
wireguardPeers = with wireguard-peers; [
rico0
rico1
rico2
wynne
layne
skipper
kowalski
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51821;
privateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(rico0 // { endpoint = null; })
(rico1 // { endpoint = null; })
(rico2 // { endpoint = null; })
(wynne // { endpoint = null; })
(layne // { endpoint = null; })
skipper
kowalski
];
};
};
};
};

52
hosts/layne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = {
"wireguard/layne/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
@ -12,35 +12,25 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51834 ];
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51834;
PrivateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico1
rico2
wynne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51834;
privateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico1
rico2
wynne
];
};
};
};
};
}

51
hosts/rico0/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = {
"wireguard/rico0/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51830 ];
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51830;
PrivateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico1
rico2
wynne
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51830;
privateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico1
rico2
wynne
layne
];
};
};
};
};

51
hosts/rico1/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = {
"wireguard/rico1/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51831 ];
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51831;
PrivateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico2
wynne
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51831;
privateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico2
wynne
layne
];
};
};
};
};

51
hosts/rico2/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = {
"wireguard/rico2/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51832 ];
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51832;
PrivateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico1
wynne
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51832;
privateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico1
wynne
layne
];
};
};
};
};

1
hosts/shared/caddy.nix
View file

@ -21,6 +21,7 @@
'';
};
systemd.services.caddy = {
after = [ "wg-quick-Homelab.service" ];
serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path;
};
networking.firewall.allowedTCPPorts = [ 80 443 ];

11
hosts/shared/wireguard-peers.nix
View file

@ -1,13 +1,12 @@
{ noEndpoints ? false }:
let
mkPeer = Endpoint: PublicKey: AllowedIPs: {
inherit PublicKey AllowedIPs;
} // (if (noEndpoints) then { } else { inherit Endpoint; });
mkPeer = endpoint: publicKey: allowedIPs: {
inherit endpoint publicKey allowedIPs;
};
in
{
bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ];
skipper = mkPeer "" "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer "" "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
skipper = mkPeer null "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer null "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ];
rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ];
rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ];

4
hosts/skipper/default.nix
View file

@ -10,10 +10,6 @@
./security.nix
];
nodeconfig.facts = {
wireguard-ip = "10.10.10.2";
};
console.useXkbConfig = true;
environment.sessionVariables = {

47
hosts/skipper/network/wireguard.nix
View file

@ -1,41 +1,32 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
let
wireguard-peers = import ../../shared/wireguard-peers.nix;
in
{
sops.secrets = {
"wireguard/skipper/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
firewall = {
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
enable = true;
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51822;
PrivateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { AllowedIPs = [ "10.10.10.0/24" ]; })
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51822;
privateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
address = [
"10.10.10.2/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { allowedIPs = [ "10.10.10.0/24" ]; })
];
};
};
};
};

51
hosts/wynne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = {
"wireguard/wynne/pk" = {
mode = "400";
owner = config.users.users.systemd-network.name;
group = config.users.users.systemd-network.group;
owner = config.users.users.root.name;
group = config.users.users.root.group;
};
};
networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51833 ];
trustedInterfaces = [ "Homelab" ];
};
};
systemd.network = {
netdevs."99-Homelab" = {
netdevConfig = {
Name = "Homelab";
Kind = "wireguard";
};
wireguardConfig = {
ListenPort = 51833;
PrivateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
};
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0
rico1
rico2
layne
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
wg-quick = {
interfaces = {
Homelab = {
listenPort = 51833;
privateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
dns = [ "10.10.10.1" ];
peers = with wireguard-peers; [
(bifrost // { persistentKeepalive = 20; })
rico0
rico1
rico2
layne
];
};
};
};
};