blob: a3d82e1a0db511453eb526c7276c7b0de0b6331b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
{ config, pkgs, ... }: {
boot = {
initrd.kernelModules = [ "zfs" ];
kernel.sysctl = {
"net.ipv4.ip_forward" = true;
};
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
loader = {
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/efiboot/efi1";
};
systemd-boot = {
enable = true;
extraInstallCommands = ''
${pkgs.coreutils}/bin/cp -r /efiboot/efi1/* /efiboot/efi2
'';
};
timeout = 3;
};
supportedFilesystems = [ "zfs" ];
};
#environment.systemPackages = with pkgs; [
# wpa_supplicant
# somethingelse
#];
imports = [
./hardware-configuration.nix
./services.nix
../common/core
../common/optional/services/asterisk.nix
../common/optional/services/kea.nix
../common/optional/services/nsd.nix
../common/optional/services/openssh.nix
../common/optional/zfs.nix
../common/users/nipsy
../common/users/root
];
networking = {
hostId = "f9ca5efe";
hostName = "darkstar";
#defaultGateway = "192.168.1.1";
domain = "bitgnome.net";
interfaces = {
enp116s0 = {
ipv4.addresses = [
{ address = "192.168.1.1"; prefixLength = 24; }
];
};
vlan201 = {
useDHCP = true;
};
};
nameservers = [ "192.168.1.1" ];
nat = {
enable = true;
#enableIPv6 = true;
externalInterface = "vlan201";
internalInterfaces = [ "enp116s0" ];
};
nftables.enable = true;
useDHCP = false;
vlans = {
vlan201 = { id=201; interface="enp117s0"; };
};
#wireless.iwd = {
# enable = true;
# settings = {
# IPv6 = {
# Enabled = true;
# };
# Settings = {
# AutoConnect = true;
# };
# };
#};
};
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
defaultSopsFile = ../secrets/darkstar.yaml;
secrets = {
"kea-dhcp4_conf" = {};
"nftables/forward" = {};
"nftables/ssh" = {};
};
};
system.stateVersion = "23.11";
systemd.services."nftables-extra" = {
description = "nftables extra firewall rules";
script = ''
${pkgs.nftables}/bin/nft -a list chain inet nixos-fw input | ${pkgs.gnugrep}/bin/grep @anveo | ${pkgs.gnugrep}/bin/grep -Eo 'handle [[:digit:]]+$' | ${pkgs.gnused}/bin/sed -e 's/^handle //' | while read handle; do ${pkgs.nftables}/bin/nft delete rule inet nixos-fw input handle ${handle}; done
if ${pkgs.nftables}/bin/nft list set inet nixos-fw anveo 2>/dev/null; then ${pkgs.nftables}/bin/nft delete set inet nixos-fw anveo; fi
if ${pkgs.nftables}/bin/nft list ct helpers table inet nixos-fw | ${pkgs.gnugrep}/bin/grep -qE '^[[:space:]]*ct helper sip-5060 {$'; then ${pkgs.nftables}/bin/nft delete ct helper inet nixos-fw sip-5060; fi
${pkgs.nftables}/bin/nft add ct helper inet nixos-fw sip-5060 '{type "sip" protocol udp;}'
${pkgs.nftables}/bin/nft add set inet nixos-fw anveo '{type ipv4_addr; elements={ 72.9.149.25, 169.48.232.158, 176.9.39.206, 204.216.109.55 };}'
${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "vlan201" udp dport sip ip saddr @anveo ct helper set "sip-5060"'
${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "vlan201" udp dport sip ip saddr @anveo accept'
${pkgs.nftables}/bin/nft -f ${config.sops.secrets."nftables/forward".path}
${pkgs.nftables}/bin/nft -f ${config.sops.secrets."nftables/ssh".path}
'';
serviceConfig = {
RemainAfterExit = true;
Type = "oneshot";
};
unitConfig = {
ConditionPathExists = [
config.sops.secrets."nftables/forward".path
config.sops.secrets."nftables/ssh".path
];
};
wantedBy = [ "multi-user.target" ];
};
systemd.paths."nftables-extra" = {
pathConfig = {
PathExists = [
config.sops.secrets."nftables/forward".path
config.sops.secrets."nftables/ssh".path
];
};
wantedBy = [ "multi-user.target" ];
};
}
|
