0xa/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

delete legacy stuff and reformat

Browse source
This commit is contained in:
Grisha Shipunov 2025-01-11 03:55:19 +01:00
parent 595d4935de
commit 62e2519639
51 changed files with 714 additions and 1056 deletions
Download patch file Download diff file Expand all files Collapse all files

49
hosts/toaster/network/default.nix
View file

@ -1,4 +1,5 @@
{ lib, config, ... }: {
{ lib, config, ... }:
{
imports = [
./mullvad.nix
./dumpdvb.nix
@ -8,32 +9,34 @@
# Networkmanager shouldn't interfere with systemd managed interfaces
networking.networkmanager.unmanaged =
let
systemd_netdevs = lib.attrsets.attrValues (lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs);
systemd_netdevs = lib.attrsets.attrValues (
lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs
);
in
systemd_netdevs;
systemd.network = {
enable = true;
wait-online.enable = false; # uplink is managed by networkmanager
};
systemd.network = {
enable = true;
wait-online.enable = false; # uplink is managed by networkmanager
};
users.users."0xa".extraGroups = [ "networkmanager" ];
users.users."0xa".extraGroups = [ "networkmanager" ];
networking = {
hostName = "toaster";
firewall.enable = true;
wireguard.enable = true;
};
networking = {
hostName = "toaster";
firewall.enable = true;
wireguard.enable = true;
};
services.resolved = {
enable = true;
dnssec = "false";
fallbackDns = [
"9.9.9.9"
"2620:fe::fe"
"149.112.112.112"
"2620:fe::9"
];
};
services.resolved = {
enable = true;
dnssec = "false";
fallbackDns = [
"9.9.9.9"
"2620:fe::fe"
"149.112.112.112"
"2620:fe::9"
];
};
}
}

8
hosts/toaster/network/dumpdvb.nix
View file

@ -1,4 +1,5 @@
{ config, ... }: {
{ config, ... }:
{
systemd.network = {
# Wireguard
# Dump-dvb
@ -27,7 +28,10 @@
IPv6AcceptRA = true;
};
routes = [
{ Gateway = "10.13.37.1"; Destination = "10.13.37.0/24"; }
{
Gateway = "10.13.37.1";
Destination = "10.13.37.0/24";
}
];
};
};

99
hosts/toaster/network/mullvad.nix
View file

@ -1,10 +1,14 @@
{ config, lib, ... }: {
{ config, lib, ... }:
{
systemd.network =
let
pubkey = "BChJDLOwZu9Q1oH0UcrxcHP6xxHhyRbjrBUsE0e07Vk=";
pubkey = "BChJDLOwZu9Q1oH0UcrxcHP6xxHhyRbjrBUsE0e07Vk=";
endpoint = "169.150.196.15";
port = "51820";
addr = [ "10.74.16.48/32" "fc00:bbbb:bbbb:bb01::b:102f/128" ];
addr = [
"10.74.16.48/32"
"fc00:bbbb:bbbb:bb01::b:102f/128"
];
in
{
netdevs."10-wg-mullvad" = {
@ -21,7 +25,10 @@
{
PublicKey = pubkey;
Endpoint = "${endpoint}:${port}";
AllowedIPs = [ "0.0.0.0/0" "::0/0" ];
AllowedIPs = [
"0.0.0.0/0"
"::0/0"
];
}
];
};
@ -33,44 +40,52 @@
DNSDefaultRoute = true;
Domains = [ "~." ];
};
routes = map
(gate: {
Gateway = gate;
Table = 1000;
}) [
"0.0.0.0"
"::"
];
routes =
map
(gate: {
Gateway = gate;
Table = 1000;
})
[
"0.0.0.0"
"::"
];
routingPolicyRules = [ {
Family = "both";
FirewallMark = 34952; # 0x8888
InvertRule = true;
Table = "1000";
Priority = 100;
}
{
Family = "both";
SuppressPrefixLength = 0;
Table = "main";
Priority = 90;
} ] ++ map (net: {
# only route global addresses over VPN
Priority = 80;
To = net;
}) [
# Mullvad endpoint
"${endpoint}/32"
# "10.0.0.0/8"
"10.13.37.0/24"
# 0xa-mgmt
"10.89.87.0/24"
# "172.16.0.0/12"
"172.16.0.0/12"
# "182.168.0.0/16"
"182.168.0.0/16"
# "fc00::/7"
];
routingPolicyRules =
[
{
Family = "both";
FirewallMark = 34952; # 0x8888
InvertRule = true;
Table = "1000";
Priority = 100;
}
{
Family = "both";
SuppressPrefixLength = 0;
Table = "main";
Priority = 90;
}
]
++ map
(net: {
# only route global addresses over VPN
Priority = 80;
To = net;
})
[
# Mullvad endpoint
"${endpoint}/32"
# "10.0.0.0/8"
"10.13.37.0/24"
# 0xa-mgmt
"10.89.87.0/24"
# "172.16.0.0/12"
"172.16.0.0/12"
# "182.168.0.0/16"
"182.168.0.0/16"
# "fc00::/7"
];
};
};
};
}

0
hosts/toaster/network/oxalab.nix
View file

107
hosts/toaster/network/zw.nix
View file

@ -1,56 +1,61 @@
{ config, ... }: {
# zentralwerk
systemd.network = {
netdevs."10-wg-zentralwerk" = {
netdevConfig = {
Kind = "wireguard";
Name = "wg-zentralwerk";
Description = "Tunnel to the best basement in Dresden";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wg/zw".path;
RouteTable = "off";
};
wireguardPeers = [
{
PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
Endpoint = "81.201.149.152:1337";
AllowedIPs = [ "172.20.72.0/21" "172.22.90.0/24" "172.22.99.0/24" ];
PersistentKeepalive = 25;
}
];
{ config, ... }:
{
# zentralwerk
systemd.network = {
netdevs."10-wg-zentralwerk" = {
netdevConfig = {
Kind = "wireguard";
Name = "wg-zentralwerk";
Description = "Tunnel to the best basement in Dresden";
};
networks."10-wg-zentralwerk" = {
matchConfig.Name = "wg-zentralwerk";
networkConfig = {
Address = "172.20.76.226/21";
IPv6AcceptRA = true;
DNS = "172.20.73.8";
Domains = [
"~hq.c3d2.de"
"~serv.zentralwerk.org"
"~hq.zentralwerk.org"
"~cluster.zentralwerk.org"
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wg/zw".path;
RouteTable = "off";
};
wireguardPeers = [
{
PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
Endpoint = "81.201.149.152:1337";
AllowedIPs = [
"172.20.72.0/21"
"172.22.90.0/24"
"172.22.99.0/24"
];
};
routes = [
{
Gateway = "172.20.76.225";
Destination = "172.20.72.0/21";
Metric = 1023;
}
{
Gateway = "172.20.76.225";
Destination = "172.20.90.0/24";
Metric = 1023;
}
{
Gateway = "172.20.76.225";
Destination = "172.22.99.0/24";
Metric = 1023;
}
PersistentKeepalive = 25;
}
];
};
networks."10-wg-zentralwerk" = {
matchConfig.Name = "wg-zentralwerk";
networkConfig = {
Address = "172.20.76.226/21";
IPv6AcceptRA = true;
DNS = "172.20.73.8";
Domains = [
"~hq.c3d2.de"
"~serv.zentralwerk.org"
"~hq.zentralwerk.org"
"~cluster.zentralwerk.org"
];
};
routes = [
{
Gateway = "172.20.76.225";
Destination = "172.20.72.0/21";
Metric = 1023;
}
{
Gateway = "172.20.76.225";
Destination = "172.20.90.0/24";
Metric = 1023;
}
{
Gateway = "172.20.76.225";
Destination = "172.22.99.0/24";
Metric = 1023;
}
];
};
}
};
}