mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat: finish vlan setup

Browse source
This commit is contained in:
oddlama 2024-12-20 01:05:17 +01:00
parent d0448757bf
commit 297d19fa0c
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
16 changed files with 115 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

66
flake.lock generated
View file

@ -901,11 +901,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1734279981, "lastModified": 1734425854,
"narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=", "narHash": "sha256-nzE5UbJ41aPEKf8R2ZFYtLkqPmF7EIUbNEdHMBLg0Ig=",
"owner": "cachix", "owner": "cachix",
"repo": "git-hooks.nix", "repo": "git-hooks.nix",
"rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785", "rev": "0ddd26d0925f618c3a5d85a4fa5eb1e23a09491d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1113,11 +1113,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1734344598, "lastModified": 1734622215,
"narHash": "sha256-wNX3hsScqDdqKWOO87wETUEi7a/QlPVgpC/Lh5rFOuA=", "narHash": "sha256-OOfI0XhSJGHblfdNDhfnn8QnZxng63rWk9eeJ2tCbiI=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "83ecd50915a09dca928971139d3a102377a8d242", "rev": "1395379a7a36e40f2a76e7b9936cc52950baa1be",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1134,11 +1134,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1734093295, "lastModified": 1734344598,
"narHash": "sha256-hSwgGpcZtdDsk1dnzA0xj5cNaHgN9A99hRF/mxMtwS4=", "narHash": "sha256-wNX3hsScqDdqKWOO87wETUEi7a/QlPVgpC/Lh5rFOuA=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "66c5d8b62818ec4c1edb3e941f55ef78df8141a8", "rev": "83ecd50915a09dca928971139d3a102377a8d242",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1387,11 +1387,11 @@
"pre-commit-hooks": "pre-commit-hooks_4" "pre-commit-hooks": "pre-commit-hooks_4"
}, },
"locked": { "locked": {
"lastModified": 1734266385, "lastModified": 1734639503,
"narHash": "sha256-k9P9Sa6jw/Xre8UDp7Ukk75h4Tcq8ZrK+nz6A2MC1IM=", "narHash": "sha256-Z58HeNQpfbi94Cw8VxdF1GtU1S5AoWO0hfJTxA6wu78=",
"owner": "oddlama", "owner": "oddlama",
"repo": "nix-topology", "repo": "nix-topology",
"rev": "ba6f61e594a85eabebf1c8f373923b59b3b07448", "rev": "d6edd49bac68dc70e19b5e91617b9f04e8ac1c43",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1426,11 +1426,11 @@
"pre-commit-hooks": "pre-commit-hooks_5" "pre-commit-hooks": "pre-commit-hooks_5"
}, },
"locked": { "locked": {
"lastModified": 1734380133, "lastModified": 1734643696,
"narHash": "sha256-gvbWJGjTpGJwyvK72Rf+z0aMVgKzpu+UWxbh7naZtvY=", "narHash": "sha256-W5JSWhhThI9erzhZmpHy1gZGwSxEGPKYmOUBEXH/WGA=",
"owner": "oddlama", "owner": "oddlama",
"repo": "nixos-extra-modules", "repo": "nixos-extra-modules",
"rev": "558954ebb2959ea47bfa593f6a74ce54a21bfafd", "rev": "6a4736e0773a1852b0b6c5f71cbe96dd39c3caf1",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1447,11 +1447,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1734311693, "lastModified": 1734570415,
"narHash": "sha256-ODRrnbaUsOe3e4kp+uHl+iJxey5zE3kqiBqJWQxrlnY=", "narHash": "sha256-kcsDNcEr4hYuDc8l+ox41FvEPpmQTV3/3hgdx3tuxHw=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixos-generators", "repo": "nixos-generators",
"rev": "a5278f7c326205681f1f42a90fa46a75a13627eb", "rev": "b8f266f26bb757e7aec18adeee6919db6666c4f6",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1498,11 +1498,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1734119587, "lastModified": 1734424634,
"narHash": "sha256-AKU6qqskl0yf2+JdRdD0cfxX4b9x3KKV5RqA6wijmPM=", "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "3566ab7246670a43abd2ffa913cc62dad9cdf7d5", "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1711,11 +1711,11 @@
"treefmt-nix": "treefmt-nix_4" "treefmt-nix": "treefmt-nix_4"
}, },
"locked": { "locked": {
"lastModified": 1734368549, "lastModified": 1734567959,
"narHash": "sha256-D8LYUU+IWbpmyjOAKEnKVOhd7Qfe7q+DvUNZTYoitKY=", "narHash": "sha256-ghNQlnI/r6cnknY58x60695sFrYnI6ZUMg65bmoNGqw=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixvim", "repo": "nixvim",
"rev": "6c30476a4d5f761149945a65e74179f4492b1ea6", "rev": "37608b462772e35220e02bfbd9045d0946564436",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1928,11 +1928,11 @@
"nixpkgs-stable": "nixpkgs-stable_5" "nixpkgs-stable": "nixpkgs-stable_5"
}, },
"locked": { "locked": {
"lastModified": 1734379367, "lastModified": 1734425854,
"narHash": "sha256-Keu8z5VgT5gnCF4pmB+g7XZFftHpfl4qOn7nqBcywdE=", "narHash": "sha256-nzE5UbJ41aPEKf8R2ZFYtLkqPmF7EIUbNEdHMBLg0Ig=",
"owner": "cachix", "owner": "cachix",
"repo": "pre-commit-hooks.nix", "repo": "pre-commit-hooks.nix",
"rev": "0bb4be58f21ff38fc3cdbd6c778eb67db97f0b99", "rev": "0ddd26d0925f618c3a5d85a4fa5eb1e23a09491d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2223,11 +2223,11 @@
"tinted-tmux": "tinted-tmux" "tinted-tmux": "tinted-tmux"
}, },
"locked": { "locked": {
"lastModified": 1734110168, "lastModified": 1734531336,
"narHash": "sha256-Q0eeLYn45ErXlqGQyXmLLHGe1mqnUiK0Y9wZRa1SNFI=", "narHash": "sha256-BWwJTAiWmZudUdUbyets7e3zQfjvZYtkU51blBnUBjw=",
"owner": "danth", "owner": "danth",
"repo": "stylix", "repo": "stylix",
"rev": "a9e3779949925ef22f5a215c5f49cf520dea30b1", "rev": "a2d66f25478103ac9b4adc6d6713794f7005221e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2519,11 +2519,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1733761991, "lastModified": 1734543842,
"narHash": "sha256-s4DalCDepD22jtKL5Nw6f4LP5UwoMcPzPZgHWjAfqbQ=", "narHash": "sha256-/QceWozrNg915Db9x/Ie5k67n9wKgGdTFng+Z1Qw0kE=",
"owner": "numtide", "owner": "numtide",
"repo": "treefmt-nix", "repo": "treefmt-nix",
"rev": "0ce9d149d99bc383d1f2d85f31f6ebd146e46085", "rev": "76159fc74eeac0599c3618e3601ac2b980a29263",
"type": "github" "type": "github"
}, },
"original": { "original": {

25
globals.nix
View file

@ -2,6 +2,7 @@
inputs, inputs,
config, config,
lib, lib,
nodes,
... ...
}: }:
let let
@ -29,15 +30,8 @@ in
home-lan = { home-lan = {
vlans = { vlans = {
personal = {
id = 10;
cidrv4 = "192.168.10.0/24";
cidrv6 = "fd10::/64";
hosts.ward.id = 1;
hosts.ward-adguardhome.id = 3;
};
services = { services = {
id = 20; id = 5;
cidrv4 = "192.168.20.0/24"; cidrv4 = "192.168.20.0/24";
cidrv6 = "fd20::/64"; cidrv6 = "fd20::/64";
hosts.ward.id = 1; hosts.ward.id = 1;
@ -52,11 +46,18 @@ in
}; };
hosts.sire-samba = { hosts.sire-samba = {
id = 10; id = 10;
inherit (nodes.sire-samba.config.lib.microvm.interfaces.vlan-services) mac; inherit (nodes.sire-samba.config.lib.microvm.interfaces.lan) mac;
}; };
}; };
home = {
id = 10;
cidrv4 = "192.168.10.0/24";
cidrv6 = "fd10::/64";
hosts.ward.id = 1;
hosts.ward-adguardhome.id = 3;
};
devices = { devices = {
id = 30; id = 20;
cidrv4 = "192.168.30.0/24"; cidrv4 = "192.168.30.0/24";
cidrv6 = "fd30::/64"; cidrv6 = "fd30::/64";
hosts.ward.id = 1; hosts.ward.id = 1;
@ -71,14 +72,14 @@ in
}; };
}; };
iot = { iot = {
id = 40; id = 30;
cidrv4 = "192.168.40.0/24"; cidrv4 = "192.168.40.0/24";
cidrv6 = "fd40::/64"; cidrv6 = "fd40::/64";
hosts.ward.id = 1; hosts.ward.id = 1;
hosts.ward-adguardhome.id = 3; hosts.ward-adguardhome.id = 3;
}; };
guests = { guests = {
id = 50; id = 40;
cidrv4 = "192.168.50.0/24"; cidrv4 = "192.168.50.0/24";
cidrv6 = "fd50::/64"; cidrv6 = "fd50::/64";
hosts.ward.id = 1; hosts.ward.id = 1;

6
hosts/sire/default.nix
View file

@ -95,7 +95,9 @@
{ {
node.secretsDir = ./secrets/${guestName}; node.secretsDir = ./secrets/${guestName};
networking.nftables.firewall = { networking.nftables.firewall = {
zones.untrusted.interfaces = [ config.guests.${guestName}.networking.mainLinkName ]; zones.untrusted.interfaces = lib.mkIf (
lib.length config.guests.${guestName}.networking.links == 1
) config.guests.${guestName}.networking.links;
}; };
} }
]; ];
@ -106,8 +108,8 @@
backend = "microvm"; backend = "microvm";
microvm = { microvm = {
system = "x86_64-linux"; system = "x86_64-linux";
macvtap = "lan";
baseMac = config.repo.secrets.local.networking.interfaces.lan.mac; baseMac = config.repo.secrets.local.networking.interfaces.lan.mac;
interfaces.lan = { };
}; };
extraSpecialArgs = { extraSpecialArgs = {
inherit (inputs.self) nodes globals; inherit (inputs.self) nodes globals;

30
hosts/sire/guests/grafana.nix
View file

@ -65,12 +65,13 @@ in
group = "influxdb2"; group = "influxdb2";
}; };
services.influxdb2.provision.organizations.machines.auths."grafana machines:telegraf (${config.node.name})" = { services.influxdb2.provision.organizations.machines.auths."grafana machines:telegraf (${config.node.name})" =
readBuckets = [ "telegraf" ]; {
writeBuckets = [ "telegraf" ]; readBuckets = [ "telegraf" ];
tokenFile = writeBuckets = [ "telegraf" ];
nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-machines-${config.node.name}".path; tokenFile =
}; nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-machines-${config.node.name}".path;
};
age.secrets."grafana-influxdb-token-home-${config.node.name}" = { age.secrets."grafana-influxdb-token-home-${config.node.name}" = {
inherit (config.age.secrets.grafana-influxdb-token-home) rekeyFile; inherit (config.age.secrets.grafana-influxdb-token-home) rekeyFile;
@ -78,12 +79,13 @@ in
group = "influxdb2"; group = "influxdb2";
}; };
services.influxdb2.provision.organizations.home.auths."grafana home:home_assistant (${config.node.name})" = { services.influxdb2.provision.organizations.home.auths."grafana home:home_assistant (${config.node.name})" =
readBuckets = [ "home_assistant" ]; {
writeBuckets = [ "home_assistant" ]; readBuckets = [ "home_assistant" ];
tokenFile = writeBuckets = [ "home_assistant" ];
nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-home-${config.node.name}".path; tokenFile =
}; nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-home-${config.node.name}".path;
};
}; };
globals.services.grafana.domain = grafanaDomain; globals.services.grafana.domain = grafanaDomain;
@ -144,8 +146,8 @@ in
proxyWebsockets = true; proxyWebsockets = true;
}; };
extraConfig = '' extraConfig = ''
allow ${globals.net.home-lan.cidrv4}; allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.cidrv6}; allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all; deny all;
''; '';
}; };

4
hosts/sire/guests/immich.nix
View file

@ -249,8 +249,8 @@ in
proxy_read_timeout 600s; proxy_read_timeout 600s;
proxy_send_timeout 600s; proxy_send_timeout 600s;
send_timeout 600s; send_timeout 600s;
allow ${globals.net.home-lan.cidrv4}; allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.cidrv6}; allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all; deny all;
''; '';
}; };

4
hosts/sire/guests/paperless.nix
View file

@ -79,8 +79,8 @@ in
useACMEWildcardHost = true; useACMEWildcardHost = true;
extraConfig = '' extraConfig = ''
client_max_body_size 512M; client_max_body_size 512M;
allow ${globals.net.home-lan.cidrv4}; allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.cidrv6}; allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all; deny all;
''; '';
locations."/" = { locations."/" = {

7
hosts/sire/guests/samba.nix
View file

@ -148,9 +148,9 @@ in
}; };
globals.monitoring.tcp.samba = { globals.monitoring.tcp.samba = {
host = globals.net.home-lan.hosts.sire-samba.ipv4; host = globals.net.home-lan.vlans.services.hosts.sire-samba.ipv4;
port = 445; port = 445;
network = "home-lan"; network = "home-lan.vlans.services";
}; };
services.samba = { services.samba = {
@ -179,7 +179,8 @@ in
# Deny access to all hosts by default. # Deny access to all hosts by default.
"hosts deny" = "0.0.0.0/0"; "hosts deny" = "0.0.0.0/0";
# Allow access to local network and TODO: wireguard # Allow access to local network and TODO: wireguard
"hosts allow" = "${globals.net.home-lan.cidrv4} ${globals.net.home-lan.cidrv6}"; "hosts allow" =
"${globals.net.home-lan.vlans.services.cidrv4} ${globals.net.home-lan.vlans.services.cidrv6}";
# Don't advertise inaccessible shares to users # Don't advertise inaccessible shares to users
"access based share enum" = "yes"; "access based share enum" = "yes";

14
hosts/sire/net.nix
View file

@ -8,16 +8,16 @@
networking.hostId = config.repo.secrets.local.networking.hostId; networking.hostId = config.repo.secrets.local.networking.hostId;
globals.monitoring.ping.sire = { globals.monitoring.ping.sire = {
hostv4 = lib.net.cidr.ip globals.net.home-lan.hosts.sire.cidrv4; hostv4 = lib.net.cidr.ip globals.net.home-lan.vlans.services.hosts.sire.cidrv4;
hostv6 = lib.net.cidr.ip globals.net.home-lan.hosts.sire.cidrv6; hostv6 = lib.net.cidr.ip globals.net.home-lan.vlans.services.hosts.sire.cidrv6;
network = "home-lan"; network = "home-lan.vlans.services";
}; };
boot.initrd.systemd.network = { boot.initrd.systemd.network = {
enable = true; enable = true;
networks."10-lan" = { networks."10-lan" = {
address = [ globals.net.home-lan.hosts.sire.cidrv4 ]; address = [ globals.net.home-lan.vlans.services.hosts.sire.cidrv4 ];
gateway = [ globals.net.home-lan.hosts.ward.ipv4 ]; gateway = [ globals.net.home-lan.vlans.services.hosts.ward.ipv4 ];
matchConfig.MACAddress = config.repo.secrets.local.networking.interfaces.lan.mac; matchConfig.MACAddress = config.repo.secrets.local.networking.interfaces.lan.mac;
networkConfig = { networkConfig = {
IPv6PrivacyExtensions = "yes"; IPv6PrivacyExtensions = "yes";
@ -54,8 +54,8 @@
''; '';
}; };
"20-lan-self" = { "20-lan-self" = {
address = [ globals.net.home-lan.hosts.sire.cidrv4 ]; address = [ globals.net.home-lan.vlans.services.hosts.sire.cidrv4 ];
gateway = [ globals.net.home-lan.hosts.ward.ipv4 ]; gateway = [ globals.net.home-lan.vlans.services.hosts.ward.ipv4 ];
matchConfig.Name = "lan-self"; matchConfig.Name = "lan-self";
networkConfig = { networkConfig = {
IPv6PrivacyExtensions = "yes"; IPv6PrivacyExtensions = "yes";

6
hosts/ward/default.nix
View file

@ -79,7 +79,9 @@
{ {
node.secretsDir = ./secrets/${guestName}; node.secretsDir = ./secrets/${guestName};
networking.nftables.firewall = { networking.nftables.firewall = {
zones.untrusted.interfaces = [ config.guests.${guestName}.networking.mainLinkName ]; zones.untrusted.interfaces = lib.mkIf (
lib.length config.guests.${guestName}.networking.links == 1
) config.guests.${guestName}.networking.links;
}; };
} }
]; ];
@ -90,8 +92,8 @@
backend = "microvm"; backend = "microvm";
microvm = { microvm = {
system = "x86_64-linux"; system = "x86_64-linux";
macvtap = "lan";
baseMac = config.repo.secrets.local.networking.interfaces.lan.mac; baseMac = config.repo.secrets.local.networking.interfaces.lan.mac;
interfaces.vlan-services = { };
}; };
extraSpecialArgs = { extraSpecialArgs = {
inherit (inputs.self) nodes globals; inherit (inputs.self) nodes globals;

6
hosts/ward/guests/adguardhome.nix
View file

@ -16,9 +16,9 @@ in
globals.services.adguardhome.domain = adguardhomeDomain; globals.services.adguardhome.domain = adguardhomeDomain;
globals.monitoring.dns.adguardhome = { globals.monitoring.dns.adguardhome = {
server = globals.net.home-lan.hosts.ward-adguardhome.ipv4; server = globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv4;
domain = "."; domain = ".";
network = "home-lan"; network = "home-lan.vlans.services";
}; };
nodes.sentinel = { nodes.sentinel = {
@ -99,7 +99,7 @@ in
map map
(domain: { (domain: {
inherit domain; inherit domain;
answer = globals.net.home-lan.hosts.ward-web-proxy.ipv4; answer = globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4;
}) })
[ [
# FIXME: dont hardcode, filter global service domains by internal state # FIXME: dont hardcode, filter global service domains by internal state

6
hosts/ward/guests/web-proxy.nix
View file

@ -22,7 +22,7 @@ in
meta.telegraf.availableMonitoringNetworks = [ meta.telegraf.availableMonitoringNetworks = [
"internet" "internet"
"home-wan" "home-wan"
"home-lan" "home-lan.vlans.services"
]; ];
age.secrets.acme-cloudflare-dns-token = { age.secrets.acme-cloudflare-dns-token = {
@ -70,8 +70,8 @@ in
# is over TLS. # is over TLS.
extraConfig = '' extraConfig = ''
proxy_ssl_verify off; proxy_ssl_verify off;
allow ${globals.net.home-lan.cidrv4}; allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.cidrv6}; allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all; deny all;
''; '';
}; };

8
hosts/ward/kea.nix
View file

@ -5,7 +5,11 @@
... ...
}: }:
let let
inherit (lib) net; inherit (lib)
flip
mapAttrsToList
net
;
in in
{ {
environment.persistence."/persist".directories = [ environment.persistence."/persist".directories = [
@ -32,7 +36,7 @@ in
interfaces = map (name: "me-${name}") (builtins.attrNames globals.net.home-lan.vlans); interfaces = map (name: "me-${name}") (builtins.attrNames globals.net.home-lan.vlans);
service-sockets-max-retries = -1; service-sockets-max-retries = -1;
}; };
subnet4 = lib.mapAttrsToList globals.net.home-lan.vlans ( subnet4 = flip mapAttrsToList globals.net.home-lan.vlans (
vlanName: vlanCfg: [ vlanName: vlanCfg: [
{ {
inherit (vlanCfg) id; inherit (vlanCfg) id;

18
hosts/ward/net.nix
View file

@ -9,9 +9,9 @@
networking.hostId = config.repo.secrets.local.networking.hostId; networking.hostId = config.repo.secrets.local.networking.hostId;
globals.monitoring.ping.ward = { globals.monitoring.ping.ward = {
hostv4 = lib.net.cidr.ip globals.net.home-lan.hosts.ward.cidrv4; hostv4 = lib.net.cidr.ip globals.net.home-lan.vlans.services.hosts.ward.cidrv4;
hostv6 = lib.net.cidr.ip globals.net.home-lan.hosts.ward.cidrv6; hostv6 = lib.net.cidr.ip globals.net.home-lan.vlans.services.hosts.ward.cidrv6;
network = "home-lan.vlans.devices"; network = "home-lan.vlans.services";
}; };
boot.initrd.availableKernelModules = [ "8021q" ]; boot.initrd.availableKernelModules = [ "8021q" ];
@ -43,8 +43,8 @@
}; };
"30-vlan-home" = { "30-vlan-home" = {
address = [ address = [
globals.net.home-lan.hosts.ward.cidrv4 globals.net.home-lan.vlans.home.hosts.ward.cidrv4
globals.net.home-lan.hosts.ward.cidrv6 globals.net.home-lan.vlans.home.hosts.ward.cidrv6
]; ];
matchConfig.Name = "vlan-home"; matchConfig.Name = "vlan-home";
networkConfig = { networkConfig = {
@ -157,7 +157,7 @@
# ipv6SendRAConfig = { # ipv6SendRAConfig = {
# Managed = true; # Managed = true;
# EmitDNS = true; # EmitDNS = true;
# FIXME: this is not the true ipv6 of adguardhome DNS = globals.net.home-lan.hosts.ward-adguardhome.ipv6; # FIXME: this is not the true ipv6 of adguardhome DNS = globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv6;
# FIXME: todo assign static additional to reservation in kea # FIXME: todo assign static additional to reservation in kea
# }; # };
linkConfig.RequiredForOnline = "routable"; linkConfig.RequiredForOnline = "routable";
@ -178,15 +178,15 @@
} }
// lib.flip lib.concatMapAttrs globals.net.home-lan.vlans ( // lib.flip lib.concatMapAttrs globals.net.home-lan.vlans (
vlanName: _: { vlanName: _: {
"me-${vlanName}".interfaces = [ "me-${vlanName}" ]; "vlan-${vlanName}".interfaces = [ "me-${vlanName}" ];
} }
); );
rules = { rules = {
masquerade-internet = { masquerade-internet = {
from = [ from = [
"vlan-home"
"vlan-services" "vlan-services"
"vlan-home"
"vlan-devices" "vlan-devices"
"vlan-guests" "vlan-guests"
]; ];
@ -222,7 +222,7 @@
#}; #};
wireguard.proxy-home.server = { wireguard.proxy-home.server = {
host = globals.net.home-lan.hosts.ward.ipv4; host = globals.net.home-lan.vlans.services.hosts.ward.ipv4;
port = 51444; port = 51444;
reservedAddresses = [ reservedAddresses = [
globals.net.proxy-home.cidrv4 globals.net.proxy-home.cidrv4

8
hosts/zackbiene/home-assistant.nix
View file

@ -154,7 +154,9 @@ in
}; };
# Connect to fritzbox via https proxy (to ensure valid cert) # Connect to fritzbox via https proxy (to ensure valid cert)
networking.hosts.${globals.net.home-lan.hosts.ward-web-proxy.ipv4} = [ fritzboxDomain ]; networking.hosts.${globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4} = [
fritzboxDomain
];
nodes.ward-web-proxy = { nodes.ward-web-proxy = {
services.nginx = { services.nginx = {
@ -174,8 +176,8 @@ in
proxyWebsockets = true; proxyWebsockets = true;
}; };
extraConfig = '' extraConfig = ''
allow ${globals.net.home-lan.cidrv4}; allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.cidrv6}; allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all; deny all;
''; '';
}; };

6
hosts/zackbiene/net.nix
View file

@ -14,7 +14,7 @@ in
globals.monitoring.ping.zackbiene = { globals.monitoring.ping.zackbiene = {
hostv4 = "zackbiene.local"; hostv4 = "zackbiene.local";
hostv6 = "zackbiene.local"; hostv6 = "zackbiene.local";
network = "home-lan"; network = "home-lan.vlans.services";
}; };
wireguard.proxy-home.client.via = "ward"; wireguard.proxy-home.client.via = "ward";
@ -70,8 +70,8 @@ in
lan-interface.interfaces = [ "lan1" ]; lan-interface.interfaces = [ "lan1" ];
lan = { lan = {
parent = "lan-interface"; parent = "lan-interface";
ipv4Addresses = [ globals.net.home-lan.cidrv4 ]; ipv4Addresses = [ globals.net.home-lan.vlans.services.cidrv4 ];
ipv6Addresses = [ globals.net.home-lan.cidrv6 ]; ipv6Addresses = [ globals.net.home-lan.vlans.services.cidrv6 ];
}; };
iot.interfaces = [ "wlan1" ]; iot.interfaces = [ "wlan1" ];
}; };

1
nix/globals.nix
View file

@ -14,6 +14,7 @@
specialArgs = { specialArgs = {
inherit (inputs.self.pkgs.x86_64-linux) lib; inherit (inputs.self.pkgs.x86_64-linux) lib;
inherit inputs; inherit inputs;
inherit (config) nodes;
}; };
modules = [ modules = [
../modules/globals.nix ../modules/globals.nix