Compare commits
3 Commits
d43c8112ff
...
e5f2e111d3
| Author | SHA1 | Date | |
|---|---|---|---|
e5f2e111d3
|
|||
|
74f9b65585
|
|||
|
80b743816c
|
@ -21,9 +21,12 @@ let
|
||||
lan20_p6 = "${pd_from_wan}2"; # ::/64
|
||||
|
||||
ula_p = "fdab:07d3:581d"; # ::/48
|
||||
ula_p_lan = "${ula_p}:0001"; # ::/64
|
||||
ula_p_lan10 = "${ula_p}:0010"; # ::/64
|
||||
ula_p_lan20 = "${ula_p}:0020"; # ::/64
|
||||
lan_ula_p = "${ula_p}:0001"; # ::/64
|
||||
lan10_ula_p = "${ula_p}:0010"; # ::/64
|
||||
lan20_ula_p = "${ula_p}:0020"; # ::/64
|
||||
lan_ula_addr = "${lan_ula_p}::1";
|
||||
lan10_ula_addr = "${lan10_ula_p}::1";
|
||||
lan20_ula_addr = "${lan20_ula_p}::1";
|
||||
in
|
||||
{
|
||||
imports =
|
||||
@ -152,19 +155,20 @@ in
|
||||
# AddressAutoconfiguration = false;
|
||||
Prefix = "${lan_p6}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" "eui64" ];
|
||||
# Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
{
|
||||
Prefix = "${ula_p_lan}::/64";
|
||||
Prefix = "${lan_ula_p}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
];
|
||||
ipv6SendRAConfig = {
|
||||
Managed = true;
|
||||
OtherInformation = true;
|
||||
EmitDNS = true;
|
||||
DNS = [ "${lan_p6}::1" ];
|
||||
DNS = [ lan_ula_addr ];
|
||||
};
|
||||
};
|
||||
"30-vlan10" = {
|
||||
@ -177,12 +181,12 @@ in
|
||||
{
|
||||
Prefix = "${lan10_p6}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
{
|
||||
Prefix = "${ula_p_lan10}::/64";
|
||||
Prefix = "${lan10_ula_p}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
@ -196,12 +200,12 @@ in
|
||||
{
|
||||
Prefix = "${lan20_p6}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
{
|
||||
Prefix = "${ula_p_lan20}::/64";
|
||||
Prefix = "${lan20_ula_p}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
@ -217,15 +221,15 @@ in
|
||||
define LAN_IF = "${if_lan}"
|
||||
define LAN_IPV4_SUBNET = ${lan_p4}.0/24
|
||||
define LAN_IPV6_SUBNET = ${lan_p6}::/64
|
||||
define LAN_IPV6_ULA = ${lan_ula_p}::/64
|
||||
define LAN_IPV4_HOST = ${lan_p4}.100
|
||||
define LAN_IPV6_HOST = ${lan_p6}::1:1000
|
||||
|
||||
define ALLOWED_TCP_PORTS = { ssh, 19999 }
|
||||
define ALLOWED_UDP_PORTS = { 53 }
|
||||
define ALLOWED_TCP_PORTS = { ssh, https, 19999 }
|
||||
define ALLOWED_UDP_PORTS = { domain }
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
# type filter hook input priority filter; policy accept;
|
||||
|
||||
# Allow established and related connections
|
||||
ct state established,related accept
|
||||
@ -238,7 +242,7 @@ in
|
||||
ip6 nexthdr icmpv6 ip6 daddr fe80::/10 accept # TODO: not sure if necessary
|
||||
|
||||
# Allow all ICMPv6 from LAN
|
||||
iifname $LAN_IF ip6 saddr $LAN_IPV6_SUBNET ip6 nexthdr icmpv6 accept
|
||||
iifname $LAN_IF ip6 saddr { $LAN_IPV6_SUBNET, $LAN_IPV6_ULA } ip6 nexthdr icmpv6 accept
|
||||
# Allow DHCPv6 client traffic
|
||||
ip6 daddr { fe80::/10, ff02::/16 } udp dport dhcpv6-server accept
|
||||
|
||||
@ -247,9 +251,9 @@ in
|
||||
|
||||
# Allow specific services from LAN
|
||||
iifname $LAN_IF ip saddr $LAN_IPV4_SUBNET tcp dport $ALLOWED_TCP_PORTS accept
|
||||
iifname $LAN_IF ip6 saddr $LAN_IPV6_SUBNET tcp dport $ALLOWED_TCP_PORTS accept
|
||||
iifname $LAN_IF ip6 saddr { $LAN_IPV6_SUBNET, $LAN_IPV6_ULA } tcp dport $ALLOWED_TCP_PORTS accept
|
||||
iifname $LAN_IF ip saddr $LAN_IPV4_SUBNET udp dport $ALLOWED_UDP_PORTS accept
|
||||
iifname $LAN_IF ip6 saddr $LAN_IPV6_SUBNET udp dport $ALLOWED_UDP_PORTS accept
|
||||
iifname $LAN_IF ip6 saddr { $LAN_IPV6_SUBNET, $LAN_IPV6_ULA } udp dport $ALLOWED_UDP_PORTS accept
|
||||
|
||||
# Allow SSH from WAN (if needed)
|
||||
iifname $WAN_IF tcp dport ssh accept
|
||||
@ -257,7 +261,6 @@ in
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
# type filter hook forward priority filter; policy accept;
|
||||
|
||||
# Allow established and related connections
|
||||
ct state established,related accept
|
||||
@ -296,7 +299,7 @@ in
|
||||
oifname $WAN_IF ip saddr $LAN_IPV4_SUBNET masquerade
|
||||
|
||||
# Optional IPv6 masquerading (big L if enabled)
|
||||
# oifname $WAN_IF ip6 saddr $LAN_IPV6_SUBNET masquerade
|
||||
# oifname $WAN_IF ip6 saddr $LAN_IPV6_ULA masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
@ -341,20 +344,21 @@ in
|
||||
if_lan
|
||||
];
|
||||
# TODO: https://kea.readthedocs.io/en/latest/arm/ddns.html#dual-stack-environments
|
||||
dhcp-ddns.enable-updates = false;
|
||||
ddns-qualifying-suffix = "default.${ldomain}";
|
||||
dhcp-ddns.enable-updates = true;
|
||||
ddns-qualifying-suffix = "default6.${ldomain}";
|
||||
subnet6 = [
|
||||
{
|
||||
id = 1;
|
||||
interface = if_lan;
|
||||
subnet = "${lan_p6}::/64";
|
||||
ddns-qualifying-suffix = "lan.${ldomain}";
|
||||
ddns-qualifying-suffix = "lan6.${ldomain}";
|
||||
rapid-commit = true;
|
||||
pools = [ { pool = "${lan_p6}::1:1000/116"; } ];
|
||||
option-data = [
|
||||
reservations = [
|
||||
{
|
||||
name = "dns-servers";
|
||||
data = "${lan_p6}::1";
|
||||
duid = "00:04:59:c3:ce:9a:08:cf:fb:b7:fe:74:9c:e3:b7:44:bf:01";
|
||||
hostname = "archy";
|
||||
ip-addresses = [ "${lan_p6}::69" ];
|
||||
}
|
||||
];
|
||||
}
|
||||
@ -381,34 +385,26 @@ in
|
||||
services.resolved.enable = false;
|
||||
networking.resolvconf.enable = true;
|
||||
networking.resolvconf.useLocalResolver = true;
|
||||
services.coredns.enable = true;
|
||||
services.coredns.config = ''
|
||||
. {
|
||||
cache {
|
||||
prefetch 100
|
||||
}
|
||||
# Static aliases
|
||||
hosts /etc/coredns.hosts {
|
||||
fallthrough
|
||||
}
|
||||
# Local domains to knot (ddns)
|
||||
forward ${ldomain}. [::1]:1053
|
||||
|
||||
# Quad9
|
||||
# forward . tls://[2620:fe::fe]:53 tls://9.9.9.9 tls://[2620:fe::9]:53 tls://149.112.112.112 {
|
||||
# tls_servername dns.quad9.net
|
||||
services.adguardhome.enable = true;
|
||||
services.adguardhome.mutableSettings = false;
|
||||
services.adguardhome.settings = {
|
||||
dns = {
|
||||
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
||||
upstream_dns = [
|
||||
"quic://p0.freedns.controld.com" # Default upstream
|
||||
"[/${ldomain}/][::1]:1053" # Local domains to Knot (ddns)
|
||||
];
|
||||
};
|
||||
# https://adguard-dns.io/kb/general/dns-filtering-syntax/
|
||||
user_rules = [
|
||||
# DNS rewrites
|
||||
"${lan_ula_addr} grouter.${domain}"
|
||||
|
||||
# Cloudflare (seems to be faster)
|
||||
forward . tls://[2606:4700:4700::1112]:53 tls://1.1.1.2 tls://[2606:4700:4700::1002]:53 tls://1.0.0.2 {
|
||||
tls_servername security.cloudflare-dns.com
|
||||
health_check 5s
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
environment.etc."coredns.hosts".text = ''
|
||||
::1 wow.${domain} hi.${domain}
|
||||
'';
|
||||
# Allowed exceptions
|
||||
"@@||googleads.g.doubleclick.net"
|
||||
];
|
||||
};
|
||||
|
||||
services.knot.enable = true;
|
||||
services.knot.settings = {
|
||||
@ -456,7 +452,51 @@ in
|
||||
chmod 644 "$ZONE_FILE"
|
||||
'';
|
||||
|
||||
services.netdata.enable = true;
|
||||
# https://wiki.nixos.org/wiki/Prometheus
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
exporters = {
|
||||
# TODO: DNS, Kea, Knot, other exporters
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
};
|
||||
};
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "node";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings.server.http_port = 3001;
|
||||
provision = {
|
||||
enable = true;
|
||||
datasources.settings.datasources = [
|
||||
{
|
||||
name = "Prometheus";
|
||||
type = "prometheus";
|
||||
url = "http://localhost:${toString config.services.prometheus.port}";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."grouter.${domain}".extraConfig = ''
|
||||
reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
|
||||
tls internal
|
||||
'';
|
||||
};
|
||||
|
||||
# services.netdata.enable = true;
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
# You can disable this if you're only using the Wayland session.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user