From 0457c44807d6776ffcc83f31a8285f5afc2914e2 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Fri, 3 Jan 2025 19:06:42 +0100 Subject: fixup toaster network --- hosts/toaster/network/default.nix | 39 +++++++++++++++++++++ hosts/toaster/network/dumpdvb.nix | 34 ++++++++++++++++++ hosts/toaster/network/mullvad.nix | 74 +++++++++++++++++++++++++++++++++++++++ hosts/toaster/network/oxalab.nix | 0 hosts/toaster/network/zw.nix | 56 +++++++++++++++++++++++++++++ 5 files changed, 203 insertions(+) create mode 100644 hosts/toaster/network/default.nix create mode 100644 hosts/toaster/network/dumpdvb.nix create mode 100644 hosts/toaster/network/mullvad.nix create mode 100644 hosts/toaster/network/oxalab.nix create mode 100644 hosts/toaster/network/zw.nix (limited to 'hosts/toaster/network') diff --git a/hosts/toaster/network/default.nix b/hosts/toaster/network/default.nix new file mode 100644 index 0000000..2bb5b39 --- /dev/null +++ b/hosts/toaster/network/default.nix @@ -0,0 +1,39 @@ +{ lib, config, ... }: { + imports = [ + ./mullvad.nix + ./dumpdvb.nix + ./zw.nix + ]; + + # Networkmanager shouldn't interfere with systemd managed interfaces + networking.networkmanager.unmanaged = + let + systemd_netdevs = lib.attrsets.attrValues (lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs); + in + systemd_netdevs; + + systemd.network ={ + enable = true; + wait-online.enable = false; # uplink is managed by networkmanager + }; + + users.users."0xa".extraGroups = [ "networkmanager" ]; + + networking = { + hostName = "toaster"; + firewall.enable = true; + wireguard.enable = true; + }; + + services.resolved = { + enable = true; + dnssec = "allow-downgrade"; + fallbackDns = [ + "9.9.9.9" + "2620:fe::fe" + "149.112.112.112" + "2620:fe::9" + ]; + }; + + } diff --git a/hosts/toaster/network/dumpdvb.nix b/hosts/toaster/network/dumpdvb.nix new file mode 100644 index 0000000..84074bd --- /dev/null +++ b/hosts/toaster/network/dumpdvb.nix @@ -0,0 +1,34 @@ +{ config, ... }: { + systemd.network = { + # Wireguard + # Dump-dvb + netdevs."30-wg-dumpdvb" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-dumpdvb"; + Description = "dvb.solutions enterprise network"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/dvb".path; + }; + wireguardPeers = [ + { + PublicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY="; + Endpoint = "academicstrokes.com:51820"; + AllowedIPs = [ "10.13.37.0/24" ]; + PersistentKeepalive = 25; + } + ]; + }; + networks."30-wg-dumpdvb" = { + matchConfig.Name = "wg-dumpdvb"; + networkConfig = { + Address = "10.13.37.3/24"; + IPv6AcceptRA = true; + }; + routes = [ + { Gateway = "10.13.37.1"; Destination = "10.13.37.0/24"; } + ]; + }; + }; +} diff --git a/hosts/toaster/network/mullvad.nix b/hosts/toaster/network/mullvad.nix new file mode 100644 index 0000000..4b05c95 --- /dev/null +++ b/hosts/toaster/network/mullvad.nix @@ -0,0 +1,74 @@ +{ config, lib, ... }: { + systemd.network = + let + pubkey = "uUYbYGKoA6UBh1hfkAz5tAWFv4SmteYC9kWh7/K6Ah0="; + endpoint = "92.60.40.209:51820"; + addr = [ "10.74.16.48/32" "fc00:bbbb:bbbb:bb01::b:102f/128" ]; + in + { + netdevs."10-wg-mullvad" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-mullvad"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/mullvad".path; + FirewallMark = 34952; # 0x8888 + RouteTable = "off"; + }; + wireguardPeers = [ + { + PublicKey = pubkey; + Endpoint = endpoint; + AllowedIPs = [ "0.0.0.0/0" "::0/0" ]; + } + ]; + }; + networks."10-wg-mullvad" = { + matchConfig.Name = "wg-mullvad"; + address = addr; + networkConfig = { + DNS = "10.64.0.1"; + DNSDefaultRoute = true; + Domains = [ "~." ]; + }; + routes = map + (gate: { + Gateway = gate; + Table = 1000; + }) [ + "0.0.0.0" + "::" + ]; + + routingPolicyRules = [ { + Family = "both"; + FirewallMark = 34952; # 0x8888 + InvertRule = true; + Table = "1000"; + Priority = 100; + } + { + Family = "both"; + SuppressPrefixLength = 0; + Table = "main"; + Priority = 90; + } ] ++ map (net: { + # only route global addresses over VPN + Priority = 80; + To = net; + }) [ + # Mullvad endpoint + "92.60.40.209/32" + # "10.0.0.0/8" + "10.13.37.0/24" + "10.66.66.0/24" + # "172.16.0.0/12" + "172.16.0.0/12" + # "182.168.0.0/16" + "182.168.0.0/16" + # "fc00::/7" + ]; + }; + }; +} diff --git a/hosts/toaster/network/oxalab.nix b/hosts/toaster/network/oxalab.nix new file mode 100644 index 0000000..e69de29 diff --git a/hosts/toaster/network/zw.nix b/hosts/toaster/network/zw.nix new file mode 100644 index 0000000..af961be --- /dev/null +++ b/hosts/toaster/network/zw.nix @@ -0,0 +1,56 @@ +{ config, ... }: { + # zentralwerk + systemd.network = { + netdevs."10-wg-zentralwerk" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-zentralwerk"; + Description = "Tunnel to the best basement in Dresden"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/zw".path; + RouteTable = "off"; + }; + wireguardPeers = [ + { + PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo="; + Endpoint = "81.201.149.152:1337"; + AllowedIPs = [ "172.20.72.0/21" "172.22.90.0/24" "172.22.99.0/24" ]; + PersistentKeepalive = 25; + } + ]; + }; + networks."10-wg-zentralwerk" = { + matchConfig.Name = "wg-zentralwerk"; + networkConfig = { + Address = "172.20.76.226/21"; + IPv6AcceptRA = true; + DNS = "172.20.73.8"; + Domains = [ + "~hq.c3d2.de" + "~serv.zentralwerk.org" + "~hq.zentralwerk.org" + "~cluster.zentralwerk.org" + ]; + }; + routes = [ + { + Gateway = "172.20.76.225"; + Destination = "172.20.72.0/21"; + Metric = 1023; + } + { + Gateway = "172.20.76.225"; + Destination = "172.20.90.0/24"; + Metric = 1023; + } + { + Gateway = "172.20.76.225"; + Destination = "172.22.99.0/24"; + Metric = 1023; + } + + ]; + }; + }; + } -- cgit v1.3.1