adtya/configuration.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: adtya:fba9d776686b2ec38854bd44cf9401f9b3758c0a
Branches Tags
adtya:main
..
compare: adtya:e9b1b817c6a1a06134a7538beb38bf4b6829eff3
Branches Tags
adtya:main

No commits in common. "fba9d776686b2ec38854bd44cf9401f9b3758c0a" and "e9b1b817c6a1a06134a7538beb38bf4b6829eff3" have entirely different histories.
fba9d77668 ... e9b1b817c6

11 changed files with 148 additions and 232 deletions
Show stats Expand all files Collapse all files

6
flake.nix
View file

@ -61,12 +61,6 @@
inherit system; inherit system;
config = { config = {
allowUnfree = true; allowUnfree = true;
permittedInsecurePackages = [
"aspnetcore-runtime-wrapped-6.0.36"
"aspnetcore-runtime-6.0.36"
"dotnet-sdk-wrapped-6.0.428"
"dotnet-sdk-6.0.428"
];
}; };
overlays = [ (import ./extra-packages) ]; overlays = [ (import ./extra-packages) ];
}; };

47
hosts/bifrost/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = true; }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/bifrost/pk" = { "wireguard/bifrost/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,36 +12,25 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = tr
allowedUDPPorts = [ 51821 ]; allowedUDPPorts = [ 51821 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51821;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51821; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path; peers = with wireguard-peers; [
}; (rico0 // { endpoint = null; })
wireguardPeers = with wireguard-peers; [ (rico1 // { endpoint = null; })
rico0 (rico2 // { endpoint = null; })
rico1 (wynne // { endpoint = null; })
rico2 (layne // { endpoint = null; })
wynne
layne
skipper skipper
kowalski kowalski
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

40
hosts/layne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/layne/pk" = { "wireguard/layne/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,35 +12,25 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51834 ]; allowedUDPPorts = [ 51834 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51834;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51834; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/layne/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0 rico0
rico1 rico1
rico2 rico2
wynne wynne
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };
} }

39
hosts/rico0/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/rico0/pk" = { "wireguard/rico0/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51830 ]; allowedUDPPorts = [ 51830 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51830;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51830; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/rico0/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico1 rico1
rico2 rico2
wynne wynne
layne layne
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

39
hosts/rico1/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/rico1/pk" = { "wireguard/rico1/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51831 ]; allowedUDPPorts = [ 51831 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51831;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51831; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/rico1/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0 rico0
rico2 rico2
wynne wynne
layne layne
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

39
hosts/rico2/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/rico2/pk" = { "wireguard/rico2/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51832 ]; allowedUDPPorts = [ 51832 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51832;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51832; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/rico2/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0 rico0
rico1 rico1
wynne wynne
layne layne
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

1
hosts/shared/caddy.nix
View file

@ -21,6 +21,7 @@
''; '';
}; };
systemd.services.caddy = { systemd.services.caddy = {
after = [ "wg-quick-Homelab.service" ];
serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path; serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path;
}; };
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];

11
hosts/shared/wireguard-peers.nix
View file

@ -1,13 +1,12 @@
{ noEndpoints ? false }:
let let
mkPeer = Endpoint: PublicKey: AllowedIPs: { mkPeer = endpoint: publicKey: allowedIPs: {
inherit PublicKey AllowedIPs; inherit endpoint publicKey allowedIPs;
} // (if (noEndpoints) then { } else { inherit Endpoint; }); };
in in
{ {
bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ]; bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ];
skipper = mkPeer "" "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ]; skipper = mkPeer null "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer "" "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ]; kowalski = mkPeer null "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ]; rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ];
rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ]; rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ];
rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ]; rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ];

4
hosts/skipper/default.nix
View file

@ -10,10 +10,6 @@
./security.nix ./security.nix
]; ];
nodeconfig.facts = {
wireguard-ip = "10.10.10.2";
};
console.useXkbConfig = true; console.useXkbConfig = true;
environment.sessionVariables = { environment.sessionVariables = {

43
hosts/skipper/network/wireguard.nix
View file

@ -1,41 +1,32 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let
wireguard-peers = import ../../shared/wireguard-peers.nix;
in
{
sops.secrets = { sops.secrets = {
"wireguard/skipper/pk" = { "wireguard/skipper/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
firewall = { firewall = {
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
enable = true; Homelab = {
netdevs."99-Homelab" = { listenPort = 51822;
netdevConfig = { privateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
Name = "Homelab"; address = [
Kind = "wireguard"; "10.10.10.2/24"
}; ];
wireguardConfig = { dns = [ "10.10.10.1" ];
ListenPort = 51822; peers = with wireguard-peers; [
PrivateKeyFile = config.sops.secrets."wireguard/skipper/pk".path; (bifrost // { allowedIPs = [ "10.10.10.0/24" ]; })
};
wireguardPeers = with wireguard-peers; [
(bifrost // { AllowedIPs = [ "10.10.10.0/24" ]; })
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

39
hosts/wynne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/wynne/pk" = { "wireguard/wynne/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51833 ]; allowedUDPPorts = [ 51833 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51833;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51833; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/wynne/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [
(bifrost // { PersistentKeepalive = 20; })
rico0 rico0
rico1 rico1
rico2 rico2
layne layne
]; ];
}; };
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };