router: services: add secret for grafana key

flake.lock

@@ -60,11 +60,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790742230,
-        "narHash": "sha256-5399J1/O3DyLSsYGVa950JtOUDB9Reqvy7FhfDuTVzk=",
+        "lastModified": 1791642191,
+        "narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0aefa652eb6fd8b7396af25e8c81cb0790f12cc2",
+        "rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
         "type": "github"
       },
       "original": {
@@ -135,11 +135,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790578696,
-        "narHash": "sha256-ZoxIApko70jCdbH3l20HWXOBaT2HZd87orzd2yJ9dVE=",
+        "lastModified": 1791594108,
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7a0f122f5090cf4c2ade2a13a0e229d4e19ba71f",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
         "type": "github"
       },
       "original": {

hosts/router/hardware-configuration.nix

@@ -14,12 +14,12 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
+    { device = "/dev/disk/by-uuid/0dec41bf-aba0-4b7b-9f61-bbb572e5bd1e";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/12CE-A600";
+    { device = "/dev/disk/by-uuid/9F5E-672F";
       fsType = "vfat";
       options = [ "fmask=0022" "dmask=0022" ];
     };

modules/router/default.nix

@@ -27,7 +27,7 @@ in
 
   boot.loader.timeout = 2;
   boot.loader.systemd-boot.configurationLimit = 5;
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_18;
   boot.growPartition = true;
 
   # Enable the X11 windowing system.

modules/router/dns.nix

@@ -54,17 +54,17 @@ in
       enable_dnssec = true;
       bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
       upstream_dns = [
-        # Default upstreams
-        "quic://p0.freedns.controld.com"
-        "tls://one.one.one.one"
-        "tls://dns.quad9.net"
-
         # Adguard uses upstream and not rewrite rules to resolve cname rewrites,
         # and obviously my sysdomain entries don't exist in cloudflare.
         "[/${sysdomain}/][::1]"           # Sys domains to self (for cname rewrites)
 
         "[/${ldomain}/][::1]:1053"        # Local domains to Knot (ddns)
         "[/home/][${ifs.lan.ulaPrefix}::250]"  # .home domains to opnsense (temporary)
+
+        # Default upstreams
+        "quic://p0.freedns.controld.com"
+        "tls://one.one.one.one"
+        "tls://dns.quad9.net"
       ];
     };
     # https://adguard-dns.io/kb/general/dns-filtering-syntax/

modules/router/firewall.nix

@@ -58,6 +58,7 @@ in
               udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
               # Amnezia VPN server
               udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
+              tcp . 38247 : ${vars.extra.amnezia.addr4} . 22,
               # Minecruft server
               tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
               udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,

modules/router/ifconfig.nix

@@ -52,6 +52,9 @@ in
   # since my WAN and LAN20 are technically bridged.
   # https://networkengineering.stackexchange.com/questions/83071/why-linux-answers-arp-requests-for-ips-that-belong-to-different-network-interfac
   boot.kernel.sysctl."net.ipv4.conf.default.arp_filter" = 1;
+  # Later I discovered that rp_filter might also be good to set
+  # Strict mode (1) drops packets if the src ip isn't a local route on the interface
+  boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = 1;
 
   # It is impossible to do multiple prefix requests with networkd,
   # so I use dhcpcd for this

modules/router/secrets/grafana-secret-key.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 D2MY/A txjDSEsRr2CJtC9rDIiY9H8aX0us53vhnqJStt+XvlA
+vjmrx5ByEhbHE/hBEQq3gRqY8b5/mjHLs+He3D/27LM
+--- rp66vDf9qnM7f9S5YD/X/99YsufPWmvz+V8z8htB2Ow
+9‡Ài¨*¡-oš·}Ć(Š5[¬[ÕyKr)¾-­cùäóŽù¼R0?Ë8`Èô×{

modules/router/services.nix

@@ -29,10 +29,12 @@ in
   };
 
   # https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
+  secrix.services.grafana.secrets.security-key.encrypted.file = ./secrets/grafana-secret-key.age;
   services.grafana = {
     enable = true;
     settings = {
       security.allow_embedding = true;
+      security.secret_key = "$__file{${config.secrix.services.grafana.secrets.security-key.decrypted.path}}";
       server = {
         http_port = 3001;
         domain = "grouter.${domain}";
@@ -57,8 +59,8 @@ in
   services.caddy = {
     enable = true;
     package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-F7d4HwM4oCkQrFMr4SFSC0r52ONxY+PW6z5BJawW8Ok=";
+      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
+      hash = "sha256-xRJ5evsAJ2akg47j3Bt6YDXJOgX88B/rKNP50KSVyNY=";
     };
     virtualHosts."*.${domain}".extraConfig = ''
       encode