adtya/configuration.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: adtya:fba9d776686b2ec38854bd44cf9401f9b3758c0a
Branches Tags
adtya:main
..
compare: adtya:e9b1b817c6a1a06134a7538beb38bf4b6829eff3
Branches Tags
adtya:main

No commits in common. "fba9d776686b2ec38854bd44cf9401f9b3758c0a" and "e9b1b817c6a1a06134a7538beb38bf4b6829eff3" have entirely different histories.
fba9d77668 ... e9b1b817c6

11 changed files with 148 additions and 232 deletions
Show stats Expand all files Collapse all files

6
flake.nix
View file

@ -61,12 +61,6 @@
inherit system; inherit system;
config = { config = {
allowUnfree = true; allowUnfree = true;
permittedInsecurePackages = [
"aspnetcore-runtime-wrapped-6.0.36"
"aspnetcore-runtime-6.0.36"
"dotnet-sdk-wrapped-6.0.428"
"dotnet-sdk-6.0.428"
];
}; };
overlays = [ (import ./extra-packages) ]; overlays = [ (import ./extra-packages) ];
}; };

55
hosts/bifrost/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = true; }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/bifrost/pk" = { "wireguard/bifrost/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,36 +12,25 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { noEndpoints = tr
allowedUDPPorts = [ 51821 ]; allowedUDPPorts = [ 51821 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51821;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51821; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/bifrost/pk".path; peers = with wireguard-peers; [
}; (rico0 // { endpoint = null; })
wireguardPeers = with wireguard-peers; [ (rico1 // { endpoint = null; })
rico0 (rico2 // { endpoint = null; })
rico1 (wynne // { endpoint = null; })
rico2 (layne // { endpoint = null; })
wynne skipper
layne kowalski
skipper ];
kowalski };
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

52
hosts/layne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/layne/pk" = { "wireguard/layne/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,35 +12,25 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51834 ]; allowedUDPPorts = [ 51834 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51834;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/layne/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51834; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/layne/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [ rico0
(bifrost // { PersistentKeepalive = 20; }) rico1
rico0 rico2
rico1 wynne
rico2 ];
wynne };
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };
} }

51
hosts/rico0/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/rico0/pk" = { "wireguard/rico0/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51830 ]; allowedUDPPorts = [ 51830 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51830;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/rico0/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51830; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/rico0/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [ rico1
(bifrost // { PersistentKeepalive = 20; }) rico2
rico1 wynne
rico2 layne
wynne ];
layne };
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

51
hosts/rico1/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/rico1/pk" = { "wireguard/rico1/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51831 ]; allowedUDPPorts = [ 51831 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51831;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/rico1/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51831; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/rico1/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [ rico0
(bifrost // { PersistentKeepalive = 20; }) rico2
rico0 wynne
rico2 layne
wynne ];
layne };
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

51
hosts/rico2/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/rico2/pk" = { "wireguard/rico2/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51832 ]; allowedUDPPorts = [ 51832 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51832;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/rico2/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51832; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/rico2/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [ rico0
(bifrost // { PersistentKeepalive = 20; }) rico1
rico0 wynne
rico1 layne
wynne ];
layne };
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

1
hosts/shared/caddy.nix
View file

@ -21,6 +21,7 @@
''; '';
}; };
systemd.services.caddy = { systemd.services.caddy = {
after = [ "wg-quick-Homelab.service" ];
serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path; serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path;
}; };
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];

11
hosts/shared/wireguard-peers.nix
View file

@ -1,13 +1,12 @@
{ noEndpoints ? false }:
let let
mkPeer = Endpoint: PublicKey: AllowedIPs: { mkPeer = endpoint: publicKey: allowedIPs: {
inherit PublicKey AllowedIPs; inherit endpoint publicKey allowedIPs;
} // (if (noEndpoints) then { } else { inherit Endpoint; }); };
in in
{ {
bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ]; bifrost = mkPeer "128.199.30.141:51821" "NNw/iDMCTq8mpHncrecEh4UlvtINX/UUDtCJf2ToFR4=" [ "10.10.10.1" "10.10.10.2" "10.10.10.3" ];
skipper = mkPeer "" "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ]; skipper = mkPeer null "ob8Ri5fYBCkksRnpbkq0kBlU0Ll3xjIPpMk8e9TKpl4=" [ "10.10.10.2" ];
kowalski = mkPeer "" "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ]; kowalski = mkPeer null "ZgtftftDNAnNsOKo34cgaP3lQim2HMmoCXayALIVsFU=" [ "10.10.10.3" ];
rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ]; rico0 = mkPeer "192.168.1.10:51830" "9mfgKUM6hXllEUunvI8szlni9OFpKSbaLVZRAhAh51Q=" [ "10.10.10.10" ];
rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ]; rico1 = mkPeer "192.168.1.11:51831" "lFtIm7CX3gcHMAu673ptRzNDQh5QEa7FbzlHSQerRg0=" [ "10.10.10.11" ];
rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ]; rico2 = mkPeer "192.168.1.12:51832" "FyFlOHfAprr474cJCXKRvgsU6o22xaQ8gzs1563AQnI=" [ "10.10.10.12" ];

4
hosts/skipper/default.nix
View file

@ -10,10 +10,6 @@
./security.nix ./security.nix
]; ];
nodeconfig.facts = {
wireguard-ip = "10.10.10.2";
};
console.useXkbConfig = true; console.useXkbConfig = true;
environment.sessionVariables = { environment.sessionVariables = {

47
hosts/skipper/network/wireguard.nix
View file

@ -1,41 +1,32 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let
wireguard-peers = import ../../shared/wireguard-peers.nix;
in
{
sops.secrets = { sops.secrets = {
"wireguard/skipper/pk" = { "wireguard/skipper/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
firewall = { firewall = {
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
enable = true; Homelab = {
netdevs."99-Homelab" = { listenPort = 51822;
netdevConfig = { privateKeyFile = config.sops.secrets."wireguard/skipper/pk".path;
Name = "Homelab"; address = [
Kind = "wireguard"; "10.10.10.2/24"
}; ];
wireguardConfig = { dns = [ "10.10.10.1" ];
ListenPort = 51822; peers = with wireguard-peers; [
PrivateKeyFile = config.sops.secrets."wireguard/skipper/pk".path; (bifrost // { allowedIPs = [ "10.10.10.0/24" ]; })
}; ];
wireguardPeers = with wireguard-peers; [ };
(bifrost // { AllowedIPs = [ "10.10.10.0/24" ]; })
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };

51
hosts/wynne/network/wireguard.nix
View file

@ -1,10 +1,10 @@
{ config, ... }: { config, ... }:
let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in { let wireguard-peers = import ../../shared/wireguard-peers.nix; in {
sops.secrets = { sops.secrets = {
"wireguard/wynne/pk" = { "wireguard/wynne/pk" = {
mode = "400"; mode = "400";
owner = config.users.users.systemd-network.name; owner = config.users.users.root.name;
group = config.users.users.systemd-network.group; group = config.users.users.root.group;
}; };
}; };
networking = { networking = {
@ -12,34 +12,23 @@ let wireguard-peers = import ../../shared/wireguard-peers.nix { }; in {
allowedUDPPorts = [ 51833 ]; allowedUDPPorts = [ 51833 ];
trustedInterfaces = [ "Homelab" ]; trustedInterfaces = [ "Homelab" ];
}; };
}; wg-quick = {
systemd.network = { interfaces = {
netdevs."99-Homelab" = { Homelab = {
netdevConfig = { listenPort = 51833;
Name = "Homelab"; privateKeyFile = config.sops.secrets."wireguard/wynne/pk".path;
Kind = "wireguard"; address = [
}; "${config.nodeconfig.facts.wireguard-ip}/24"
wireguardConfig = { ];
ListenPort = 51833; dns = [ "10.10.10.1" ];
PrivateKeyFile = config.sops.secrets."wireguard/wynne/pk".path; peers = with wireguard-peers; [
}; (bifrost // { persistentKeepalive = 20; })
wireguardPeers = with wireguard-peers; [ rico0
(bifrost // { PersistentKeepalive = 20; }) rico1
rico0 rico2
rico1 layne
rico2 ];
layne };
];
};
networks."99-Homelab" = {
matchConfig = {
Name = "Homelab";
};
networkConfig = {
DNS = "10.10.10.1";
Address = [
"${config.nodeconfig.facts.wireguard-ip}/24"
];
}; };
}; };
}; };