Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CaZzzer
|
4f8ac3a85f
|
Generated
+127
-7
@@ -31,6 +31,24 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gitignore": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -60,11 +78,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791642191,
|
||||
"narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
|
||||
"lastModified": 1790742230,
|
||||
"narHash": "sha256-5399J1/O3DyLSsYGVa950JtOUDB9Reqvy7FhfDuTVzk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
|
||||
"rev": "0aefa652eb6fd8b7396af25e8c81cb0790f12cc2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -97,6 +115,50 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-openclaw": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"home-manager": [
|
||||
"home-manager"
|
||||
],
|
||||
"nix-openclaw-tools": "nix-openclaw-tools",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"qmd": "qmd"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790163937,
|
||||
"narHash": "sha256-oSsWtQ8mAH9KZkJKHeS3RedhrfDaMs1Ktrqs8rTP8PU=",
|
||||
"owner": "openclaw",
|
||||
"repo": "nix-openclaw",
|
||||
"rev": "f62d33f760bcbdbc6a52ac589eae22bf99201f90",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "openclaw",
|
||||
"repo": "nix-openclaw",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-openclaw-tools": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790151707,
|
||||
"narHash": "sha256-buJkQpTHNMawudMv2p00KwPAIuHMtK4CZXk7DgfHkx0=",
|
||||
"owner": "openclaw",
|
||||
"repo": "nix-openclaw-tools",
|
||||
"rev": "8b674893eb3dfddc55ac76fa532a3b11b4330575",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "openclaw",
|
||||
"repo": "nix-openclaw-tools",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixlib": {
|
||||
"locked": {
|
||||
"lastModified": 1736643958,
|
||||
@@ -135,11 +197,27 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1791594108,
|
||||
"narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
|
||||
"lastModified": 1790055231,
|
||||
"narHash": "sha256-QpXotokGh5eeMG1Njiuh27oP0rK6t5+cMp7ymXSs7mc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
|
||||
"rev": "b6c98e9e6633ee64753b594ff4a5febf0367fc00",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1790578696,
|
||||
"narHash": "sha256-ZoxIApko70jCdbH3l20HWXOBaT2HZd87orzd2yJ9dVE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "7a0f122f5090cf4c2ade2a13a0e229d4e19ba71f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -195,12 +273,39 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"qmd": {
|
||||
"inputs": {
|
||||
"flake-utils": [
|
||||
"nix-openclaw",
|
||||
"flake-utils"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"nix-openclaw",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1786919312,
|
||||
"narHash": "sha256-/7Z94r/9rXqzKlz/YkB6/nToSCPamV4Dnxm8EhelTDo=",
|
||||
"owner": "tobi",
|
||||
"repo": "qmd",
|
||||
"rev": "facd35e01359e59d938bc9418e93fb9318addee3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tobi",
|
||||
"ref": "v2.8.3",
|
||||
"repo": "qmd",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager",
|
||||
"lanzaboote": "lanzaboote",
|
||||
"nix-openclaw": "nix-openclaw",
|
||||
"nixos-generators": "nixos-generators",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"plasma-manager": "plasma-manager",
|
||||
"secrix": "secrix"
|
||||
}
|
||||
@@ -245,6 +350,21 @@
|
||||
"repo": "secrix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
@@ -26,16 +26,26 @@
|
||||
url = "github:nix-community/lanzaboote/v1.1.0";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nix-openclaw = {
|
||||
url = "github:openclaw/nix-openclaw";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.home-manager.follows = "home-manager";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix, lanzaboote }:
|
||||
outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix, lanzaboote, nix-openclaw }:
|
||||
let
|
||||
hmModule = file: {
|
||||
imports = [ home-manager.nixosModules.home-manager ];
|
||||
|
||||
nixpkgs.overlays = [ nix-openclaw.overlays.default ];
|
||||
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.sharedModules = [ plasma-manager.homeModules.plasma-manager ];
|
||||
home-manager.sharedModules = [
|
||||
plasma-manager.homeModules.plasma-manager
|
||||
nix-openclaw.homeManagerModules.openclaw
|
||||
];
|
||||
|
||||
home-manager.users.cazzzer = import file;
|
||||
# Optionally, use home-manager.extraSpecialArgs to pass
|
||||
|
||||
@@ -33,6 +33,7 @@
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
lmstudio
|
||||
openclaw
|
||||
];
|
||||
|
||||
networking.hostName = "Yura-PC"; # Define your hostname.
|
||||
|
||||
@@ -14,12 +14,12 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0dec41bf-aba0-4b7b-9f61-bbb572e5bd1e";
|
||||
{ device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/9F5E-672F";
|
||||
{ device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
@@ -9,7 +9,6 @@ in
|
||||
./opts.nix
|
||||
./ifconfig.nix
|
||||
./wireguard.nix
|
||||
./tailscale.nix
|
||||
./firewall.nix
|
||||
./dns.nix
|
||||
./kea.nix
|
||||
@@ -28,7 +27,7 @@ in
|
||||
|
||||
boot.loader.timeout = 2;
|
||||
boot.loader.systemd-boot.configurationLimit = 5;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_18;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||||
boot.growPartition = true;
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
|
||||
@@ -54,17 +54,17 @@ in
|
||||
enable_dnssec = true;
|
||||
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
||||
upstream_dns = [
|
||||
# Default upstreams
|
||||
"quic://p0.freedns.controld.com"
|
||||
"tls://one.one.one.one"
|
||||
"tls://dns.quad9.net"
|
||||
|
||||
# Adguard uses upstream and not rewrite rules to resolve cname rewrites,
|
||||
# and obviously my sysdomain entries don't exist in cloudflare.
|
||||
"[/${sysdomain}/][::1]" # Sys domains to self (for cname rewrites)
|
||||
|
||||
"[/${ldomain}/][::1]:1053" # Local domains to Knot (ddns)
|
||||
"[/home/][${ifs.lan.ulaPrefix}::250]" # .home domains to opnsense (temporary)
|
||||
|
||||
# Default upstreams
|
||||
"quic://p0.freedns.controld.com"
|
||||
"tls://one.one.one.one"
|
||||
"tls://dns.quad9.net"
|
||||
];
|
||||
};
|
||||
# https://adguard-dns.io/kb/general/dns-filtering-syntax/
|
||||
|
||||
@@ -15,11 +15,6 @@ let
|
||||
${ifs.lan50.name},
|
||||
${ifs.wg0.name},
|
||||
}
|
||||
# Tailscale is its own zone, since tailnet traffic is already filtered by tailscale ACLs
|
||||
# and needs some special handling (exit node NAT with CGNAT/ULA addrs)
|
||||
define ZONE_TAILSCALE_IFS = { ${ifs.ts0.name} }
|
||||
define TAILSCALE_NET4 = ${ifs.ts0.net4}
|
||||
define TAILSCALE_NET6 = ${ifs.ts0.net6}
|
||||
define OPNSENSE_NET6 = ${vars.extra.opnsense.net6}
|
||||
define ZONE_LAN_EXTRA_NET6 = {
|
||||
# TODO: reevaluate this statement
|
||||
@@ -63,7 +58,6 @@ in
|
||||
udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
|
||||
# Amnezia VPN server
|
||||
udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
|
||||
tcp . 38247 : ${vars.extra.amnezia.addr4} . 22,
|
||||
# Minecruft server
|
||||
tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
|
||||
udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
|
||||
@@ -85,8 +79,6 @@ in
|
||||
|
||||
# Masquerade LAN addrs
|
||||
oifname $ZONE_WAN_IFS ip saddr $RFC1918 masquerade
|
||||
# Masquerade tailnet addrs (tailscale exit node)
|
||||
oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
@@ -104,28 +96,12 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
# IPv6 masquerading for tailnet addrs only (tailscale exit node)
|
||||
# Tailscale only assigns ULAs from $TAILSCALE_NET6, so NAT is unavoidable here
|
||||
networking.nftables.tables.nat6_tailscale = {
|
||||
family = "ip6";
|
||||
content = ''
|
||||
${nftIdentifiers}
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
networking.nftables.tables.firewall = {
|
||||
family = "inet";
|
||||
content = ''
|
||||
${nftIdentifiers}
|
||||
define ALLOWED_TCP_PORTS = { ssh }
|
||||
define ALLOWED_UDP_PORTS = {
|
||||
${toString vars.ifs.wg0.listenPort},
|
||||
${toString vars.ifs.ts0.listenPort}, # tailscale direct connections
|
||||
}
|
||||
define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
|
||||
define ALLOWED_TCP_LAN_PORTS = { ssh, https }
|
||||
define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
|
||||
set port_forward_v6 {
|
||||
@@ -184,8 +160,6 @@ in
|
||||
# iifname $ZONE_LAN_IFS accept
|
||||
iifname $ZONE_LAN_IFS jump zone_lan_input
|
||||
ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_input
|
||||
# Tailscale zone input rules
|
||||
iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_input
|
||||
|
||||
# log
|
||||
}
|
||||
@@ -201,8 +175,6 @@ in
|
||||
# LAN zone forward rules
|
||||
iifname $ZONE_LAN_IFS jump zone_lan_forward
|
||||
ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_forward
|
||||
# Tailscale zone forward rules
|
||||
iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_forward
|
||||
}
|
||||
|
||||
chain zone_wan_input {
|
||||
@@ -242,23 +214,6 @@ in
|
||||
|
||||
# Allow traffic between LANs
|
||||
oifname $ZONE_LAN_IFS accept
|
||||
|
||||
# Allow LAN to reach tailnet (no SNAT, tailnet peers see real LAN addrs)
|
||||
oifname $ZONE_TAILSCALE_IFS accept
|
||||
}
|
||||
|
||||
chain zone_tailscale_input {
|
||||
# Tailnet access is restricted by tailscale ACLs, treat like LAN
|
||||
jump zone_lan_input
|
||||
}
|
||||
|
||||
chain zone_tailscale_forward {
|
||||
# Subnet router: allow tailnet to LANs (advertised routes)
|
||||
oifname $ZONE_LAN_IFS accept
|
||||
|
||||
# Exit node: allow tailnet to WAN (masqueraded in nat4 / nat6_tailscale)
|
||||
oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 accept
|
||||
oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
|
||||
@@ -52,9 +52,6 @@ in
|
||||
# since my WAN and LAN20 are technically bridged.
|
||||
# https://networkengineering.stackexchange.com/questions/83071/why-linux-answers-arp-requests-for-ips-that-belong-to-different-network-interfac
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.arp_filter" = 1;
|
||||
# Later I discovered that rp_filter might also be good to set
|
||||
# Strict mode (1) drops packets if the src ip isn't a local route on the interface
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = 1;
|
||||
|
||||
# It is impossible to do multiple prefix requests with networkd,
|
||||
# so I use dhcpcd for this
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 D2MY/A txjDSEsRr2CJtC9rDIiY9H8aX0us53vhnqJStt+XvlA
|
||||
vjmrx5ByEhbHE/hBEQq3gRqY8b5/mjHLs+He3D/27LM
|
||||
--- rp66vDf9qnM7f9S5YD/X/99YsufPWmvz+V8z8htB2Ow
|
||||
9‡Ài¨*¡-oš·}Ć(Š5[¬ [ÕyK r)¾-cùäóŽù¼R0?Ë8`Èô×{
|
||||
@@ -29,12 +29,10 @@ in
|
||||
};
|
||||
|
||||
# https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
|
||||
secrix.services.grafana.secrets.security-key.encrypted.file = ./secrets/grafana-secret-key.age;
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings = {
|
||||
security.allow_embedding = true;
|
||||
security.secret_key = "$__file{${config.secrix.services.grafana.secrets.security-key.decrypted.path}}";
|
||||
server = {
|
||||
http_port = 3001;
|
||||
domain = "grouter.${domain}";
|
||||
@@ -59,8 +57,8 @@ in
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
package = pkgs.caddy.withPlugins {
|
||||
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
|
||||
hash = "sha256-xRJ5evsAJ2akg47j3Bt6YDXJOgX88B/rKNP50KSVyNY=";
|
||||
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
|
||||
hash = "sha256-F7d4HwM4oCkQrFMr4SFSC0r52ONxY+PW6z5BJawW8Ok=";
|
||||
};
|
||||
virtualHosts."*.${domain}".extraConfig = ''
|
||||
encode
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix config;
|
||||
ifs = vars.ifs;
|
||||
ts0 = ifs.ts0;
|
||||
|
||||
# Subnets advertised to the tailnet (still need to be approved in the admin console)
|
||||
advertisedRoutes = [
|
||||
"${vars.p4}.0.0/16" # all LAN v4 subnets
|
||||
"${vars.ulaPrefix}::/48" # all LAN ULA subnets
|
||||
];
|
||||
in
|
||||
{
|
||||
# One-time setup after deploying: `sudo tailscale up`
|
||||
# (state is persisted in /var/lib/tailscale)
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
port = ts0.listenPort;
|
||||
interfaceName = ts0.name;
|
||||
# Enables ip forwarding (already enabled globally by networkd anyway).
|
||||
# Not using "both", since that sets rp_filter to loose on all interfaces.
|
||||
useRoutingFeatures = "server";
|
||||
# Firewall is managed manually in firewall.nix (networking.firewall is disabled)
|
||||
openFirewall = false;
|
||||
# Applied with `tailscale set` on every start, so these stay declarative
|
||||
extraSetFlags = [
|
||||
# Don't let tailscale touch nftables/iptables, all rules live in firewall.nix
|
||||
"--netfilter-mode=off"
|
||||
# Don't SNAT tailnet -> LAN traffic, LAN hosts route back via the router anyway
|
||||
# (preserves real source addrs for logging/ACLs on LAN hosts)
|
||||
"--snat-subnet-routes=false"
|
||||
# The router is its own DNS server, don't let tailscale mess with resolv.conf
|
||||
"--accept-dns=false"
|
||||
"--advertise-routes=${lib.strings.concatStringsSep "," advertisedRoutes}"
|
||||
"--advertise-exit-node"
|
||||
];
|
||||
};
|
||||
|
||||
# networkd removes "foreign" ip rules when it (re)starts, which would wipe tailscale's
|
||||
# policy routing rules (table 52). This is extra important since networkd is
|
||||
# restarted every minute (see ifconfig.nix).
|
||||
# The nixpkgs tailscale module already marks tailscale0 as unmanaged in networkd.
|
||||
systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false;
|
||||
}
|
||||
@@ -111,14 +111,6 @@ rec {
|
||||
} // {
|
||||
listenPort = 51944;
|
||||
};
|
||||
# Tailscale addresses are assigned by the coordination server,
|
||||
# these are the fixed ranges tailscale allocates node addrs from.
|
||||
ts0 = {
|
||||
name = "tailscale0";
|
||||
listenPort = 41641;
|
||||
net4 = "100.64.0.0/10";
|
||||
net6 = "fd7a:115c:a1e0::/48";
|
||||
};
|
||||
};
|
||||
|
||||
extra = {
|
||||
|
||||
Reference in New Issue
Block a user