888 lines
25 KiB
Nix
888 lines
25 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
let
|
||
domain = "cazzzer.com";
|
||
ldomain = "l.${domain}";
|
||
sysdomain = "sys.${domain}";
|
||
links = {
|
||
wanMAC = "bc:24:11:09:49:b0";
|
||
lanMAC = "bc:24:11:48:9c:85";
|
||
wanLL = "fe80::be24:11ff:fe09:49b0";
|
||
lanLL = "fe80::be24:11ff:fe48:9c85";
|
||
};
|
||
|
||
mkIfConfig = {
|
||
name_,
|
||
domain_,
|
||
p4_, # /24
|
||
p6_, # /64
|
||
ulaPrefix_, # /64
|
||
token? 1,
|
||
ip6Token_? "::${toString token}",
|
||
ulaToken_? "::${toString token}",
|
||
}: rec {
|
||
name = name_;
|
||
domain = domain_;
|
||
p4 = p4_;
|
||
p4Size = 24;
|
||
net4 = "${p4}.0/${toString p4Size}";
|
||
addr4 = "${p4}.${toString token}";
|
||
addr4Sized = "${addr4}/${toString p4Size}";
|
||
p6 = p6_;
|
||
p6Size = 64;
|
||
net6 = "${p6}::/${toString p6Size}";
|
||
ip6Token = ip6Token_;
|
||
addr6 = "${p6}${ip6Token}";
|
||
addr6Sized = "${addr6}/${toString p6Size}";
|
||
ulaPrefix = ulaPrefix_;
|
||
ulaSize = 64;
|
||
ulaNet = "${ulaPrefix}::/${toString ulaSize}";
|
||
ulaToken = ulaToken_;
|
||
ulaAddr = "${ulaPrefix}${ulaToken}";
|
||
ulaAddrSized = "${ulaAddr}/${toString ulaSize}";
|
||
};
|
||
|
||
p4 = "10.17"; # .0.0/16
|
||
pdFromWan = ""; # ::/60
|
||
ulaPrefix = "fdab:07d3:581d"; # ::/48
|
||
ifs = rec {
|
||
wan = rec {
|
||
name = "wan";
|
||
addr4 = "192.168.1.62";
|
||
p4Size = 24;
|
||
addr4Sized = "${addr4}/${toString p4Size}";
|
||
gw4 = "192.168.1.254";
|
||
};
|
||
lan = mkIfConfig {
|
||
name_ = "lan";
|
||
domain_ = "lan.${ldomain}";
|
||
p4_ = "${p4}.1"; # .0/24
|
||
p6_ = "${pdFromWan}f"; # ::/64
|
||
ulaPrefix_ = "${ulaPrefix}:0001"; # ::/64
|
||
};
|
||
lan10 = mkIfConfig {
|
||
name_ = "${lan.name}.10";
|
||
domain_ = "lab.${ldomain}";
|
||
p4_ = "${p4}.10"; # .0/24
|
||
p6_ = "${pdFromWan}9"; # ::/64
|
||
ulaPrefix_ = "${ulaPrefix}:0010"; # ::/64
|
||
};
|
||
lan20 = mkIfConfig {
|
||
name_ = "${lan.name}.20";
|
||
domain_ = "life.${ldomain}";
|
||
p4_ = "${p4}.20"; # .0/24
|
||
p6_ = "${pdFromWan}0"; # ::/64 managed by Att box
|
||
ulaPrefix_ = "${ulaPrefix}:0020"; # ::/64
|
||
ip6Token_ = "::2:1"; # override ipv6 for lan20, since the Att box uses ::1 here
|
||
};
|
||
lan30 = mkIfConfig {
|
||
name_ = "${lan.name}.30";
|
||
domain_ = "iot.${ldomain}";
|
||
p4_ = "${p4}.30"; # .0/24
|
||
p6_ = "${pdFromWan}c"; # ::/64
|
||
ulaPrefix_ = "${ulaPrefix}:0030"; # ::/64
|
||
};
|
||
lan40 = mkIfConfig {
|
||
name_ = "${lan.name}.40";
|
||
domain_ = "kube.${ldomain}";
|
||
p4_ = "${p4}.40"; # .0/24
|
||
p6_ = "${pdFromWan}b"; # ::/64
|
||
ulaPrefix_ = "${ulaPrefix}:0040"; # ::/64
|
||
};
|
||
lan50 = mkIfConfig {
|
||
name_ = "${lan.name}.50";
|
||
domain_ = "prox.${ldomain}";
|
||
p4_ = "${p4}.50"; # .0/24
|
||
p6_ = "${pdFromWan}a"; # ::/64
|
||
ulaPrefix_ = "${ulaPrefix}:0050"; # ::/64
|
||
};
|
||
};
|
||
|
||
# Reservations added to Kea
|
||
reservations.lan.v4.reservations = [
|
||
{
|
||
hw-address = "64:66:b3:78:9c:09";
|
||
hostname = "openwrt";
|
||
ip-address = "${ifs.lan.p4}.2";
|
||
}
|
||
{
|
||
hw-address = "40:86:cb:19:9d:70";
|
||
hostname = "dlink-switchy";
|
||
ip-address = "${ifs.lan.p4}.3";
|
||
}
|
||
{
|
||
hw-address = "6c:cd:d6:af:4f:6f";
|
||
hostname = "netgear-switchy";
|
||
ip-address = "${ifs.lan.p4}.4";
|
||
}
|
||
{
|
||
hw-address = "74:d4:35:1d:0e:80";
|
||
hostname = "pve-1";
|
||
ip-address = "${ifs.lan.p4}.5";
|
||
}
|
||
{
|
||
hw-address = "00:25:90:f3:d0:e0";
|
||
hostname = "pve-2";
|
||
ip-address = "${ifs.lan.p4}.6";
|
||
}
|
||
{
|
||
hw-address = "a8:a1:59:d0:57:87";
|
||
hostname = "pve-3";
|
||
ip-address = "${ifs.lan.p4}.7";
|
||
}
|
||
{
|
||
hw-address = "22:d0:43:c6:31:92";
|
||
hostname = "truenas";
|
||
ip-address = "${ifs.lan.p4}.10";
|
||
}
|
||
{
|
||
hw-address = "1e:d5:56:ec:c7:4a";
|
||
hostname = "debbi";
|
||
ip-address = "${ifs.lan.p4}.11";
|
||
}
|
||
{
|
||
hw-address = "ee:42:75:2e:f1:a6";
|
||
hostname = "etappi";
|
||
ip-address = "${ifs.lan.p4}.12";
|
||
}
|
||
];
|
||
|
||
reservations.lan.v6.reservations = [
|
||
{
|
||
duid = "00:03:00:01:64:66:b3:78:9c:09";
|
||
hostname = "openwrt";
|
||
ip-addresses = [ "${ifs.lan.p6}::1:2" ];
|
||
}
|
||
{
|
||
duid = "00:01:00:01:2e:c0:63:23:22:d0:43:c6:31:92";
|
||
hostname = "truenas";
|
||
ip-addresses = [ "${ifs.lan.p6}::10:1" ];
|
||
}
|
||
{
|
||
duid = "00:02:00:00:ab:11:09:41:25:21:32:71:e3:77";
|
||
hostname = "debbi";
|
||
ip-addresses = [ "${ifs.lan.p6}::11:1" ];
|
||
}
|
||
{
|
||
duid = "00:02:00:00:ab:11:6b:56:93:72:0b:3c:84:11";
|
||
hostname = "etappi";
|
||
ip-addresses = [ "${ifs.lan.p6}::12:1" ];
|
||
}
|
||
];
|
||
|
||
reservations.lan20.v4.reservations = [
|
||
{
|
||
# Router
|
||
hw-address = "1c:3b:f3:da:5f:cc";
|
||
hostname = "archer-ax3000";
|
||
ip-address = "${ifs.lan20.p4}.2";
|
||
}
|
||
{
|
||
# Printer
|
||
hw-address = "30:cd:a7:c5:40:71";
|
||
hostname = "SEC30CDA7C54071";
|
||
ip-address = "${ifs.lan20.p4}.9";
|
||
}
|
||
{
|
||
# 3D Printer
|
||
hw-address = "20:f8:5e:ff:ae:5f";
|
||
hostname = "GS_ffae5f";
|
||
ip-address = "${ifs.lan20.p4}.11";
|
||
}
|
||
{
|
||
hw-address = "70:85:c2:d8:87:3f";
|
||
hostname = "Yura-PC";
|
||
ip-address = "${ifs.lan20.p4}.40";
|
||
}
|
||
];
|
||
|
||
alpinaDomains = [
|
||
"|"
|
||
"|nc."
|
||
"|sonarr."
|
||
"|radarr."
|
||
"|prowlarr."
|
||
"|qbit."
|
||
"|gitea."
|
||
"|traefik."
|
||
"|auth."
|
||
"||s3."
|
||
"|minio."
|
||
"|jellyfin."
|
||
"|whoami."
|
||
"|grafana."
|
||
"|influxdb."
|
||
"|uptime."
|
||
"|opnsense."
|
||
"|vpgen."
|
||
"|woodpecker."
|
||
"||pgrok."
|
||
"|sync."
|
||
];
|
||
|
||
mkVlanDev = { id, name }: {
|
||
netdevConfig = {
|
||
Kind = "vlan";
|
||
Name = name;
|
||
};
|
||
vlanConfig.Id = id;
|
||
};
|
||
|
||
mkLanConfig = ifObj: {
|
||
matchConfig.Name = ifObj.name;
|
||
networkConfig = {
|
||
IPv4Forwarding = true;
|
||
IPv6SendRA = (ifObj.name != ifs.lan10.name); # TODO: temporary test, remove
|
||
Address = [ ifObj.addr4Sized ifObj.addr6Sized ifObj.ulaAddrSized ];
|
||
};
|
||
ipv6Prefixes = [
|
||
{
|
||
Prefix = ifObj.net6;
|
||
Assign = true;
|
||
# Token = [ "static::1" "eui64" ];
|
||
Token = [ "static:${ifObj.ip6Token}" ];
|
||
}
|
||
{
|
||
Prefix = ifObj.ulaNet;
|
||
Assign = true;
|
||
Token = [ "static:${ifObj.ulaToken}" ];
|
||
}
|
||
];
|
||
ipv6RoutePrefixes = [ { Route = "${ulaPrefix}::/48"; } ];
|
||
ipv6SendRAConfig = {
|
||
# don't manage the att box subnet
|
||
# should work fine either way though
|
||
Managed = (ifObj.p6 != "${pdFromWan}0");
|
||
OtherInformation = (ifObj.p6 != "${pdFromWan}0");
|
||
EmitDNS = true;
|
||
DNS = [ ifObj.ulaAddr ];
|
||
};
|
||
};
|
||
|
||
mkDhcp4Subnet = id: ifObj: {
|
||
id = id;
|
||
subnet = ifObj.net4;
|
||
pools = [ { pool = "${ifObj.p4}.100 - ${ifObj.p4}.199"; } ];
|
||
ddns-qualifying-suffix = "4.${ifObj.domain}";
|
||
option-data = [
|
||
{ name = "routers"; data = ifObj.addr4; }
|
||
{ name = "domain-name-servers"; data = ifObj.addr4; }
|
||
{ name = "domain-name"; data = "4.${ifObj.domain}"; }
|
||
];
|
||
};
|
||
|
||
mkDhcp6Subnet = id: ifObj: {
|
||
id = id;
|
||
interface = ifObj.name;
|
||
subnet = ifObj.net6;
|
||
rapid-commit = true;
|
||
pools = [ { pool = "${ifObj.p6}::1:1000/116"; } ];
|
||
ddns-qualifying-suffix = "6.${ifObj.domain}";
|
||
option-data = [
|
||
{ name = "domain-search"; data = "6.${ifObj.domain}"; }
|
||
];
|
||
};
|
||
in
|
||
{
|
||
imports =
|
||
[ # Include the results of the hardware scan.
|
||
./hardware-configuration.nix
|
||
];
|
||
|
||
# Bootloader.
|
||
boot.loader.systemd-boot.enable = true;
|
||
boot.loader.efi.canTouchEfiVariables = false;
|
||
boot.kernelParams = [
|
||
"sysrq_always_enabled=1"
|
||
];
|
||
|
||
boot.loader.timeout = 2;
|
||
boot.loader.systemd-boot.configurationLimit = 5;
|
||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||
boot.growPartition = true;
|
||
boot.kernel.sysctl = {
|
||
"net.ipv4.conf.all.forwarding" = true;
|
||
"net.ipv6.conf.all.forwarding" = true;
|
||
|
||
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
|
||
# For upstream quic dns
|
||
"net.core.wmem_max" = 7500000;
|
||
"net.core.rmem_max" = 7500000;
|
||
};
|
||
|
||
networking.hostName = "grouter";
|
||
|
||
# It is impossible to do multiple prefix requests with networkd,
|
||
# so I use dhcpcd for this
|
||
# https://github.com/systemd/systemd/issues/22571
|
||
networking.dhcpcd.enable = true;
|
||
# https://github.com/systemd/systemd/issues/22571#issuecomment-2094905496
|
||
# https://gist.github.com/csamsel/0f8cca3b2e64d7e4cc47819ec5ba9396
|
||
networking.dhcpcd.extraConfig = ''
|
||
duid
|
||
ipv6only
|
||
nodhcp6
|
||
noipv6rs
|
||
nohook resolv.conf, yp, hostname, ntp
|
||
option rapid_commit
|
||
|
||
interface ${ifs.wan.name}
|
||
ipv6rs
|
||
dhcp6
|
||
duid
|
||
ipv6only
|
||
nohook resolv.conf, yp, hostname, ntp
|
||
option rapid_commit
|
||
|
||
# this doesn't play well with networkd
|
||
# ia_na
|
||
# ia_pd 1 ${ifs.lan.name}/0
|
||
# ia_pd 2 ${ifs.lan10.name}/0
|
||
# ia_pd 3 ${ifs.lan20.name}/0
|
||
|
||
# request the leases just for routing (so that the att box knows we're here)
|
||
# actual ip assignments are static, based on $pdFromWan
|
||
# ia_pd 1/${ifs.lan.net6} -
|
||
ia_pd 10/${ifs.lan10.net6} -
|
||
# ia_pd 20/${pdFromWan}d::/64 - # for opnsense (legacy services)
|
||
# ia_pd 30/${ifs.lan30.net6} -
|
||
# ia_pd 40/${ifs.lan40.net6} -
|
||
# ia_pd 50/${ifs.lan50.net6} -
|
||
# ia_pd 7 -
|
||
# ia_pd 8 -
|
||
'';
|
||
|
||
networking.useNetworkd = false;
|
||
systemd.network.enable = false;
|
||
systemd.network = {
|
||
# Global options
|
||
config.networkConfig = {
|
||
IPv4Forwarding = true;
|
||
IPv6Forwarding = true;
|
||
};
|
||
|
||
# This is applied by udev, not networkd
|
||
# https://nixos.wiki/wiki/Systemd-networkd
|
||
# https://nixos.org/manual/nixos/stable/#sec-rename-ifs
|
||
links = {
|
||
"10-wan" = {
|
||
matchConfig.PermanentMACAddress = links.wanMAC;
|
||
linkConfig.Name = ifs.wan.name;
|
||
};
|
||
"10-lan" = {
|
||
matchConfig.PermanentMACAddress = links.lanMAC;
|
||
linkConfig.Name = ifs.lan.name;
|
||
};
|
||
};
|
||
|
||
netdevs = {
|
||
"10-vlan10" = mkVlanDev { id = 10; name = ifs.lan10.name; };
|
||
"10-vlan20" = mkVlanDev { id = 20; name = ifs.lan20.name; };
|
||
"10-vlan30" = mkVlanDev { id = 30; name = ifs.lan30.name; };
|
||
"10-vlan40" = mkVlanDev { id = 40; name = ifs.lan40.name; };
|
||
"10-vlan50" = mkVlanDev { id = 50; name = ifs.lan50.name; };
|
||
};
|
||
|
||
networks = {
|
||
"10-wan" = {
|
||
matchConfig.Name = ifs.wan.name;
|
||
networkConfig = {
|
||
# start a DHCP Client for IPv4 Addressing/Routing
|
||
# DHCP = "ipv4";
|
||
# accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
|
||
# let dhcpcd handle this
|
||
Address = [ ifs.wan.addr4Sized ];
|
||
IPv6AcceptRA = false;
|
||
};
|
||
routes = [ { Gateway = ifs.wan.gw4; } ];
|
||
# make routing on this interface a dependency for network-online.target
|
||
linkConfig.RequiredForOnline = "routable";
|
||
};
|
||
"20-lan" = (mkLanConfig ifs.lan) // {
|
||
vlan = [
|
||
ifs.lan10.name
|
||
ifs.lan20.name
|
||
ifs.lan30.name
|
||
ifs.lan40.name
|
||
ifs.lan50.name
|
||
];
|
||
};
|
||
# "30-vlan10" = mkLanConfig ifs.lan10;
|
||
"30-vlan20" = mkLanConfig ifs.lan20 // {
|
||
routes = [
|
||
{
|
||
# OPNsense subnet route
|
||
Destination = "${pdFromWan}d::/64";
|
||
Gateway = "fe80::1efd:8ff:fe71:954e";
|
||
}
|
||
];
|
||
};
|
||
"30-vlan30" = mkLanConfig ifs.lan30;
|
||
"30-vlan40" = mkLanConfig ifs.lan40;
|
||
"30-vlan50" = mkLanConfig ifs.lan50;
|
||
};
|
||
};
|
||
|
||
networking.vlans = {
|
||
${ifs.lan10.name} = { id = 10; interface = ifs.lan.name; };
|
||
};
|
||
networking.interfaces = {
|
||
${ifs.wan.name} = {
|
||
useDHCP = true;
|
||
ipv4.addresses = [ { address = ifs.wan.addr4; prefixLength = ifs.wan.p4Size; } ];
|
||
ipv6.addresses = [
|
||
{
|
||
address = "${pdFromWan}0::1:1";
|
||
prefixLength = 64;
|
||
}
|
||
];
|
||
ipv4.routes = [
|
||
{ address = "0.0.0.0"; prefixLength = 0; via = ifs.wan.gw4; }
|
||
];
|
||
};
|
||
${ifs.lan10.name} = {
|
||
ipv4.addresses = [ { address = ifs.lan10.addr4; prefixLength = ifs.lan10.p4Size; } ];
|
||
ipv6.addresses = [
|
||
{
|
||
address = ifs.lan10.addr6;
|
||
prefixLength = ifs.lan10.p6Size;
|
||
}
|
||
{
|
||
address = ifs.lan10.ulaAddr;
|
||
prefixLength = ifs.lan10.ulaSize;
|
||
}
|
||
];
|
||
};
|
||
};
|
||
networking.dhcpcd.allowInterfaces = [ ifs.wan.name ];
|
||
|
||
services.radvd.enable = true;
|
||
services.radvd.config = ''
|
||
interface ${ifs.lan10.name} {
|
||
RDNSS ${ifs.lan.ulaAddr} {
|
||
};
|
||
AdvSendAdvert on;
|
||
# MinRtrAdvInterval 3;
|
||
# MaxRtrAdvInterval 10;
|
||
AdvManagedFlag on;
|
||
# AdvOtherConfigFlag on;
|
||
prefix ${ifs.lan10.net6} {
|
||
AdvOnLink on;
|
||
AdvAutonomous on;
|
||
};
|
||
prefix ${ifs.lan10.ulaNet} {
|
||
AdvOnLink on;
|
||
AdvAutonomous on;
|
||
};
|
||
route ${ulaPrefix}::/48 {
|
||
};
|
||
};
|
||
'';
|
||
|
||
networking.firewall.enable = false;
|
||
networking.nftables.enable = true;
|
||
networking.nftables.tables.firewall = {
|
||
family = "inet";
|
||
content = ''
|
||
define ZONE_WAN_IFS = { ${ifs.wan.name} }
|
||
define ZONE_LAN_IFS = {
|
||
${ifs.lan.name},
|
||
${ifs.lan10.name},
|
||
${ifs.lan20.name},
|
||
${ifs.lan30.name},
|
||
${ifs.lan40.name},
|
||
${ifs.lan50.name},
|
||
}
|
||
define OPNSENSE_P6 = ${pdFromWan}d::/64
|
||
define RFC1918 = { 10.0.0.0/8, 172.12.0.0/12, 192.168.0.0/16 }
|
||
|
||
define ALLOWED_TCP_PORTS = { ssh, https }
|
||
define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain }
|
||
|
||
map port_forward_v4 {
|
||
type inet_proto . inet_service : ipv4_addr . inet_service
|
||
elements = {
|
||
tcp . 8006 : ${ifs.lan50.p4}.10 . 8006
|
||
}
|
||
}
|
||
set port_forward_v6 {
|
||
type inet_proto . ipv6_addr . inet_service
|
||
elements = {
|
||
tcp . ${ifs.lan.p6}::11:1 . https,
|
||
tcp . ${ifs.lan.p6}:1cd5:56ff:feec:c74a . https,
|
||
}
|
||
}
|
||
|
||
chain input {
|
||
type filter hook input priority filter; policy drop;
|
||
|
||
# Drop router adverts from self
|
||
# peculiarity due to wan and lan20 being bridged
|
||
# TODO: figure out a less jank way to do this
|
||
iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} icmpv6 type nd-router-advert log drop
|
||
iifname $ZONE_WAN_IFS ip6 saddr fe80::be24:11ff:fe83:d8de icmpv6 type nd-router-advert log drop
|
||
# iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} log drop
|
||
# iifname $ZONE_LAN_IFS ip6 saddr ${links.wanLL} log drop
|
||
ip6 nexthdr icmpv6 log prefix "ICMPv6: " accept
|
||
|
||
# Allow established and related connections
|
||
# All icmp stuff should (theoretically) be handled by ct related
|
||
# https://serverfault.com/a/632363
|
||
ct state established,related accept
|
||
|
||
# However, that doesn't happen for router advertisements from what I can tell
|
||
# TODO: more testing
|
||
# Allow ICMPv6 on local addrs
|
||
ip6 nexthdr icmpv6 ip6 saddr { fe80::/10, ${pdFromWan}0::/60 } accept
|
||
ip6 nexthdr icmpv6 ip6 daddr fe80::/10 accept # TODO: not sure if necessary
|
||
|
||
# Allow all traffic from loopback interface
|
||
iif lo accept
|
||
|
||
# Allow DHCPv6 client traffic
|
||
ip6 daddr { fe80::/10, ff02::/16 } th dport dhcpv6-server accept
|
||
|
||
# WAN zone input rules
|
||
iifname $ZONE_WAN_IFS jump zone_wan_input
|
||
# LAN zone input rules
|
||
iifname $ZONE_LAN_IFS accept
|
||
iifname $ZONE_LAN_IFS jump zone_lan_input
|
||
ip6 saddr $OPNSENSE_P6 jump zone_lan_input
|
||
|
||
# log
|
||
}
|
||
|
||
chain forward {
|
||
type filter hook forward priority filter; policy drop;
|
||
|
||
# Allow established and related connections
|
||
ct state established,related accept
|
||
|
||
# WAN zone forward rules
|
||
iifname $ZONE_WAN_IFS jump zone_wan_forward
|
||
# LAN zone forward rules
|
||
iifname $ZONE_LAN_IFS jump zone_lan_forward
|
||
ip6 saddr $OPNSENSE_P6 jump zone_lan_forward
|
||
}
|
||
|
||
chain zone_wan_input {
|
||
# Allow SSH from WAN (if needed)
|
||
tcp dport ssh accept
|
||
}
|
||
|
||
chain zone_wan_forward {
|
||
# Port forwarding
|
||
ct status dnat accept
|
||
|
||
# Allowed IPv6 ports
|
||
meta l4proto . ip6 daddr . th dport @port_forward_v6 accept
|
||
}
|
||
|
||
chain zone_lan_input {
|
||
# Allow all ICMPv6 from LAN
|
||
ip6 nexthdr icmpv6 accept
|
||
|
||
# Allow all ICMP from LAN
|
||
ip protocol icmp accept
|
||
|
||
# Allow specific services from LAN
|
||
tcp dport $ALLOWED_TCP_PORTS accept
|
||
udp dport $ALLOWED_UDP_PORTS accept
|
||
}
|
||
|
||
chain zone_lan_forward {
|
||
# Allow port forwarded targets
|
||
# ct status dnat accept
|
||
|
||
# Allow all traffic from LAN to WAN, except ULAs
|
||
oifname $ZONE_WAN_IFS ip6 saddr fd00::/8 drop # Not sure if needed
|
||
oifname $ZONE_WAN_IFS accept;
|
||
|
||
# Allow traffic between LANs
|
||
oifname $ZONE_LAN_IFS accept
|
||
}
|
||
|
||
chain output {
|
||
# Accept anything out of self by default
|
||
type filter hook output priority filter; policy accept;
|
||
# NAT reflection
|
||
# oif lo ip daddr != 127.0.0.0/8 dnat ip to meta l4proto . th dport map @port_forward_v4
|
||
}
|
||
|
||
chain prerouting {
|
||
# Initial step, accept by default
|
||
type nat hook prerouting priority dstnat; policy accept;
|
||
|
||
# Port forwarding
|
||
fib daddr type local dnat ip to meta l4proto . th dport map @port_forward_v4
|
||
}
|
||
|
||
chain postrouting {
|
||
# Last step, accept by default
|
||
type nat hook postrouting priority srcnat; policy accept;
|
||
|
||
# Masquerade LAN addrs
|
||
oifname $ZONE_WAN_IFS ip saddr $RFC1918 masquerade
|
||
|
||
# Optional IPv6 masquerading (big L if enabled, don't forget to allow forwarding)
|
||
# oifname $ZONE_WAN_IFS ip6 saddr fd00::/8 masquerade
|
||
}
|
||
'';
|
||
};
|
||
|
||
services.kea.dhcp4.enable = true;
|
||
services.kea.dhcp4.settings = {
|
||
interfaces-config.interfaces = [
|
||
# ifs.lan.name
|
||
ifs.lan10.name
|
||
# ifs.lan20.name
|
||
# ifs.lan30.name
|
||
# ifs.lan40.name
|
||
# ifs.lan50.name
|
||
];
|
||
dhcp-ddns.enable-updates = true;
|
||
ddns-qualifying-suffix = "4.default.${ldomain}";
|
||
subnet4 = [
|
||
# ((mkDhcp4Subnet 1 ifs.lan) // reservations.lan.v4)
|
||
(mkDhcp4Subnet 10 ifs.lan10)
|
||
# ((mkDhcp4Subnet 20 ifs.lan20) // reservations.lan20.v4)
|
||
# (mkDhcp4Subnet 30 ifs.lan30)
|
||
# (mkDhcp4Subnet 40 ifs.lan40)
|
||
# (mkDhcp4Subnet 50 ifs.lan50)
|
||
];
|
||
};
|
||
|
||
services.kea.dhcp6.enable = true;
|
||
services.kea.dhcp6.settings = {
|
||
interfaces-config.interfaces = [
|
||
# ifs.lan.name
|
||
ifs.lan10.name
|
||
# ifs.lan20.name # Managed by Att box
|
||
# ifs.lan30.name
|
||
# ifs.lan40.name
|
||
# ifs.lan50.name
|
||
];
|
||
# TODO: https://kea.readthedocs.io/en/latest/arm/ddns.html#dual-stack-environments
|
||
dhcp-ddns.enable-updates = true;
|
||
ddns-qualifying-suffix = "6.default.${ldomain}";
|
||
subnet6 = [
|
||
# ((mkDhcp6Subnet 1 ifs.lan) // reservations.lan.v6)
|
||
(mkDhcp6Subnet 10 ifs.lan10)
|
||
# (mkDhcp6Subnet 30 ifs.lan30)
|
||
# (mkDhcp6Subnet 40 ifs.lan40)
|
||
# (mkDhcp6Subnet 50 ifs.lan50)
|
||
];
|
||
};
|
||
|
||
services.kea.dhcp-ddns.enable = true;
|
||
services.kea.dhcp-ddns.settings = {
|
||
forward-ddns.ddns-domains = [
|
||
{
|
||
name = "${ldomain}.";
|
||
dns-servers = [ { ip-address = "::1"; port = 1053; } ];
|
||
}
|
||
];
|
||
};
|
||
|
||
services.resolved.enable = false;
|
||
networking.resolvconf.enable = true;
|
||
networking.resolvconf.useLocalResolver = true;
|
||
|
||
services.adguardhome.enable = true;
|
||
services.adguardhome.mutableSettings = false;
|
||
services.adguardhome.settings = {
|
||
dns = {
|
||
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
||
upstream_dns = [
|
||
"quic://p0.freedns.controld.com" # Default upstream
|
||
"[/${ldomain}/][::1]:1053" # Local domains to Knot (ddns)
|
||
"[/home/][${ifs.lan.ulaPrefix}::250]" # .home domains to opnsense (temporary)
|
||
];
|
||
};
|
||
# https://adguard-dns.io/kb/general/dns-filtering-syntax/
|
||
user_rules = [
|
||
# DNS rewrites
|
||
"|grouter.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
|
||
"|pve-1.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.5"
|
||
"|pve-3.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.7"
|
||
"|pve-1.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::5:1"
|
||
"|pve-3.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::7:1"
|
||
|
||
"||lab.${domain}^$dnsrewrite=${ifs.lan.p6}::12:1"
|
||
"||lab.${domain}^$dnsrewrite=${ifs.lan.p4}.12"
|
||
|
||
# Allowed exceptions
|
||
"@@||googleads.g.doubleclick.net"
|
||
]
|
||
# Alpina DNS rewrites
|
||
++ map (host: "${host}${domain}^$dnsrewrite=${ifs.lan.p6}:1cd5:56ff:feec:c74a") alpinaDomains
|
||
++ map (host: "${host}${domain}^$dnsrewrite=${ifs.lan.p4}.11") alpinaDomains;
|
||
};
|
||
|
||
services.knot.enable = true;
|
||
services.knot.settings = {
|
||
# server.listen = "0.0.0.0@1053";
|
||
server.listen = "::1@1053";
|
||
# TODO: templates
|
||
zone = [
|
||
{
|
||
domain = ldomain;
|
||
storage = "/var/lib/knot/zones";
|
||
file = "${ldomain}.zone";
|
||
acl = [ "allow_localhost_update" ];
|
||
}
|
||
];
|
||
acl = [
|
||
{
|
||
id = "allow_localhost_update";
|
||
address = [ "::1" "127.0.0.1" ];
|
||
action = [ "update" ];
|
||
}
|
||
];
|
||
};
|
||
# Ensure the zone file exists
|
||
system.activationScripts.knotZoneFile = ''
|
||
ZONE_DIR="/var/lib/knot/zones"
|
||
ZONE_FILE="$ZONE_DIR/${ldomain}.zone"
|
||
|
||
# Create the directory if it doesn't exist
|
||
mkdir -p "$ZONE_DIR"
|
||
|
||
# Check if the zone file exists
|
||
if [ ! -f "$ZONE_FILE" ]; then
|
||
# Create the zone file with a basic SOA record
|
||
# Serial; Refresh; Retry; Expire; Negative Cache TTL;
|
||
echo "${ldomain}. 3600 SOA ns.${ldomain}. admin.${ldomain}. 1 86400 900 691200 3600" > "$ZONE_FILE"
|
||
echo "Created new zone file: $ZONE_FILE"
|
||
else
|
||
echo "Zone file already exists: $ZONE_FILE"
|
||
fi
|
||
|
||
# Ensure proper ownership and permissions
|
||
chown -R knot:knot "/var/lib/knot"
|
||
chmod 644 "$ZONE_FILE"
|
||
'';
|
||
|
||
# https://wiki.nixos.org/wiki/Prometheus
|
||
services.prometheus = {
|
||
enable = true;
|
||
exporters = {
|
||
# TODO: DNS, Kea, Knot, other exporters
|
||
node = {
|
||
enable = true;
|
||
enabledCollectors = [ "systemd" ];
|
||
};
|
||
};
|
||
scrapeConfigs = [
|
||
{
|
||
job_name = "node";
|
||
static_configs = [{
|
||
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
|
||
}];
|
||
}
|
||
];
|
||
};
|
||
|
||
# https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
|
||
services.grafana = {
|
||
enable = true;
|
||
settings.server.http_port = 3001;
|
||
provision = {
|
||
enable = true;
|
||
datasources.settings.datasources = [
|
||
{
|
||
name = "Prometheus";
|
||
type = "prometheus";
|
||
url = "http://localhost:${toString config.services.prometheus.port}";
|
||
}
|
||
];
|
||
};
|
||
};
|
||
|
||
services.caddy = {
|
||
enable = true;
|
||
virtualHosts."grouter.${domain}".extraConfig = ''
|
||
reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
|
||
tls internal
|
||
'';
|
||
};
|
||
|
||
# services.netdata.enable = true;
|
||
|
||
# Enable the X11 windowing system.
|
||
# You can disable this if you're only using the Wayland session.
|
||
services.xserver.enable = false;
|
||
|
||
# Enable the KDE Plasma Desktop Environment.
|
||
# Useful for debugging with wireshark.
|
||
# services.displayManager.sddm.enable = true;
|
||
hardware.graphics.enable = true;
|
||
services.displayManager.sddm.wayland.enable = true;
|
||
services.desktopManager.plasma6.enable = true;
|
||
# No need for audio in VM
|
||
services.pipewire.enable = false;
|
||
|
||
# VM services
|
||
services.qemuGuest.enable = true;
|
||
services.spice-vdagentd.enable = true;
|
||
services.openssh.enable = true;
|
||
services.openssh.settings.PasswordAuthentication = false;
|
||
services.openssh.settings.KbdInteractiveAuthentication = false;
|
||
|
||
security.sudo.wheelNeedsPassword = false;
|
||
|
||
users.groups = {
|
||
cazzzer = {
|
||
gid = 1000;
|
||
};
|
||
};
|
||
users.users.cazzzer = {
|
||
password = "";
|
||
openssh.authorizedKeys.keys = [
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWgEzbEjbbu96MVQzkiuCrw+UGYAXN4sRe2zM6FVopq cazzzer@Yura-PC"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIApFeLVi3BOquL0Rt+gQK2CutNHaBDQ0m4PcGWf9Bc43 cazzzer@Yura-TPX13"
|
||
];
|
||
isNormalUser = true;
|
||
description = "Yura";
|
||
uid = 1000;
|
||
group = "cazzzer";
|
||
extraGroups = [ "wheel" "docker" "wireshark" ];
|
||
};
|
||
|
||
programs.firefox.enable = true;
|
||
programs.fish.enable = true;
|
||
programs.git.enable = true;
|
||
programs.neovim.enable = true;
|
||
programs.bat.enable = true;
|
||
programs.htop.enable = true;
|
||
programs.wireshark.enable = true;
|
||
programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
|
||
|
||
environment.systemPackages = with pkgs; [
|
||
dust
|
||
eza
|
||
fastfetch
|
||
fd
|
||
kdePackages.filelight
|
||
kdePackages.kate
|
||
kdePackages.yakuake
|
||
ldns
|
||
lsof
|
||
micro
|
||
mpv
|
||
ripgrep
|
||
rustscan
|
||
starship
|
||
tealdeer
|
||
waypipe
|
||
whois
|
||
];
|
||
|
||
# This value determines the NixOS release from which the default
|
||
# settings for stateful data, like file locations and database versions
|
||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||
# this value at the release version of the first install of this system.
|
||
# Before changing this value read the documentation for this option
|
||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||
system.stateVersion = "24.11"; # Did you read the comment?
|
||
}
|