WIP: router: add keepalived

2025-06-09 19:31:58 -07:00
12 changed files with 43 additions and 66 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1760130406,
-        "narHash": "sha256-GKMwBaFRw/C1p1VtjDz4DyhyzjKUWyi1K50bh8lgA2E=",
+        "lastModified": 1749178927,
+        "narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "d305eece827a3fe317a2d70138f53feccaf890a1",
+        "rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
        "type": "github"
      },
      "original": {
@@ -43,11 +43,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751903740,
-        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
+        "lastModified": 1747663185,
+        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
+        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
        "type": "github"
      },
      "original": {
@@ -58,11 +58,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1760038930,
-        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
+        "lastModified": 1748929857,
+        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
+        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
        "type": "github"
      },
      "original": {
@@ -82,11 +82,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759321049,
-        "narHash": "sha256-8XkU4gIrLT2DJZWQyvsP5woXGZF5eE/7AnKfwQkiwYU=",
+        "lastModified": 1748196248,
+        "narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
        "owner": "nix-community",
        "repo": "plasma-manager",
-        "rev": "205dcfd4a30d4a5d1b4f28defee69daa7c7252cd",
+        "rev": "b7697abe89967839b273a863a3805345ea54ab56",
        "type": "github"
      },
      "original": {
@@ -111,11 +111,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753137768,
-        "narHash": "sha256-bCQ8IHak1hF38amAgz2YKIEwteU5eAkgoC0fwfoRxO0=",
+        "lastModified": 1746643487,
+        "narHash": "sha256-dcB/DArJObCvqE/ZEdQSDW2BZMeDyF83Se5KPfJvz60=",
        "owner": "Platonic-Systems",
        "repo": "secrix",
-        "rev": "f783b038ee639a589affcf3c612187dafcfa0476",
+        "rev": "4c64203fa5b377953b1fb6d5388187df8b60c6d5",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -31,7 +31,7 @@

      home-manager.useGlobalPkgs = true;
      home-manager.useUserPackages = true;
-      home-manager.sharedModules = [ plasma-manager.homeModules.plasma-manager ];
+      home-manager.sharedModules = [ plasma-manager.homeManagerModules.plasma-manager ];

      home-manager.users.cazzzer = import file;
      # Optionally, use home-manager.extraSpecialArgs to pass
--- a/hosts/Yura-PC/hardware-configuration.nix
+++ b/hosts/Yura-PC/hardware-configuration.nix
@@ -18,11 +18,6 @@
      fsType = "zfs";
    };

-  fileSystems."/nix" =
-    { device = "zroot/data/nix";
-      fsType = "zfs";
-    };
-
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/970C-6A15";
      fsType = "vfat";
--- a/hosts/common-desktop.nix
+++ b/hosts/common-desktop.nix
@@ -7,7 +7,7 @@
    "sysrq_always_enabled=1"
  ];

-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_16;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
  boot.loader = {
    efi.canTouchEfiVariables = true;
    timeout = 3;
@@ -24,9 +24,6 @@

  # Enable networking
  networking.networkmanager.enable = true;
-  networking.networkmanager.plugins = [
-    pkgs.networkmanager-openvpn
-  ];

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
@@ -61,7 +58,7 @@
  programs.git.enable = true;
  programs.git.lfs.enable = true;
  # https://nixos.wiki/wiki/Git
-  programs.git.package = pkgs.git.override { withLibsecret = true; doInstallCheck = false; };
+  programs.git.package = pkgs.git.override { withLibsecret = true; };
  programs.lazygit.enable = true;
  programs.neovim.enable = true;
  programs.wireshark.enable = true;
@@ -110,7 +107,6 @@
    jq
    ldns
    mediainfo
-    powertop
    rbw
    restic
    resticprofile
@@ -145,7 +141,6 @@
    android-studio
    rustup
    zed-editor
-    package-version-server # for zed
  ] ++ [
    # Python
    python3
@@ -168,8 +163,5 @@
    # Gleam
    gleam
    beamMinimal26Packages.erlang
-    
-    # Racket
-    racket
  ];
 }
--- a/modules/opts/kb-input/default.nix
+++ b/modules/opts/kb-input/default.nix
@@ -45,7 +45,7 @@ in {
      enable = true;
      type = "fcitx5";
      fcitx5.waylandFrontend = true;
-      # fcitx5.plasma6Support = true;
+      fcitx5.plasma6Support = true;
      fcitx5.addons = [ pkgs.fcitx5-mozc ];
    };
  };
--- a/modules/router/default.nix
+++ b/modules/router/default.nix
@@ -14,6 +14,7 @@ in
      ./kea.nix
      ./glance.nix
      ./services.nix
+      ./keepalived.nix
    ];
  # Secrix for secrets management
  secrix.hostPubKey = vars.pubkey;
@@ -76,7 +77,6 @@ in
    starship
    tealdeer
    transcrypt
-    wakeonlan
    waypipe
    whois
    wireguard-tools
--- a/modules/router/dns.nix
+++ b/modules/router/dns.nix
@@ -80,14 +80,11 @@ in
      "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
      "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"

-      "|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
-
      # Lab DNS rewrites
      "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"

      # Allowed exceptions
      "@@||googleads.g.doubleclick.net"
-      "@@||stats.grafana.org"
    ]
      # Alpina DNS rewrites
      ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;
--- a/modules/router/firewall.nix
+++ b/modules/router/firewall.nix
@@ -56,12 +56,6 @@ in
              udp . 45608 : ${vars.extra.opnsense.addr4} . 45608,
              udp . 35848 : ${vars.extra.opnsense.addr4} . 35848,
              udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
-              # Amnezia VPN server
-              udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
-              # Minecruft server
-              tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
-              udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
-              udp . 24454 : ${vars.extra.minecruft.addr4} . 24454,
          }
      }

--- a/modules/router/keepalived.nix
+++ b/modules/router/keepalived.nix
@@ -0,0 +1,10 @@
+{ config, lib, pkgs, ... }:
+let
+  vaks = import ./vaks.nix config;
+in
+{
+  services.keepalived = {
+    enable = true;
+
+  };
+}
--- a/modules/router/secrets/cf-api-key.age
+++ b/modules/router/secrets/cf-api-key.age
--- a/modules/router/services.nix
+++ b/modules/router/services.nix
@@ -58,17 +58,14 @@ in
    enable = true;
    package = pkgs.caddy.withPlugins {
      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-XwZ0Hkeh2FpQL/fInaSq+/3rCLmQRVvwBM0Y1G1FZNU=";
+      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
    };
-    virtualHosts."*.${domain}".extraConfig = ''
+    virtualHosts."grouter.${domain}".extraConfig = ''
      encode
      tls {
          dns cloudflare {env.CF_API_KEY}
          resolvers 1.1.1.1
      }
-
-      @grouter host grouter.${domain}
-      handle @grouter {
      @grafana path /grafana /grafana/*
      handle @grafana {
          reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
@@ -83,12 +80,6 @@ in
      handle /* {
          reverse_proxy localhost:${toString config.services.glance.settings.server.port}
      }
-      }
-
-      @hass host hass.${domain}
-      handle @hass {
-          reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
-      }
    '';
  };
 }
--- a/modules/router/vars.nix
+++ b/modules/router/vars.nix
@@ -135,7 +135,5 @@ rec {
        }
      ];
    };
-    amnezia.addr4 = "${ifs.lan10.p4}.31";
-    minecruft.addr4 = "${ifs.lan.p4}.11";
  };
 }