mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 14:50:40 +02:00
Code Activity

feat: finish migration to new globals system for wireguard

Browse source
This commit is contained in:
oddlama 2025-09-13 23:23:28 +02:00
parent b885d1062b
commit a1623fb97c
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
29 changed files with 204 additions and 214 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/envoy/net.nix
View file

@ -46,7 +46,4 @@ in
};
networking.nftables.firewall.zones.untrusted.interfaces = [ "wan" ];
# Allow accessing influx
wireguard.proxy-sentinel.client.via = "sentinel";
}

7
hosts/sausebiene/esphome.nix
View file

@ -7,9 +7,10 @@ let
esphomeDomain = "esphome.${globals.domains.personal}";
in
{
wireguard.proxy-home.firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
config.services.esphome.port
];
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.esphome.port
];
environment.persistence."/persist".directories = [
{

7
hosts/sausebiene/home-assistant.nix
View file

@ -12,9 +12,10 @@ in
{
imports = [ ./hass-modbus/mennekes-amtron-xtra.nix ];
wireguard.proxy-home.firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
config.services.home-assistant.config.http.server_port
];
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.home-assistant.config.http.server_port
];
environment.persistence."/persist".directories = [
{

64
hosts/sausebiene/net.nix
View file

@ -59,43 +59,41 @@ in
}
);
systemd.network.networks =
{
"10-lan" = {
matchConfig.Name = "lan";
# This interface should only be used from attached vlans.
# So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
linkConfig.RequiredForOnline = "carrier";
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
systemd.network.networks = {
"10-lan" = {
matchConfig.Name = "lan";
# This interface should only be used from attached vlans.
# So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
linkConfig.RequiredForOnline = "carrier";
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
};
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
address = [
vlanCfg.hosts.sausebiene.cidrv4
vlanCfg.hosts.sausebiene.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "vlan-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
};
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
address = [
vlanCfg.hosts.sausebiene.cidrv4
vlanCfg.hosts.sausebiene.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "vlan-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
};
}
);
);
networking.nftables.firewall = {
zones =
{
untrusted.interfaces = [ "vlan-services" ];
zones = {
untrusted.interfaces = [ "vlan-services" ];
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: _: {
"vlan-${vlanName}".interfaces = [ "vlan-${vlanName}" ];
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: _: {
"vlan-${vlanName}".interfaces = [ "vlan-${vlanName}" ];
}
);
);
rules = {
# Allow devices to be discovered through various protocols
@ -134,6 +132,4 @@ in
};
};
};
wireguard.proxy-home.client.via = "ward";
}

16
hosts/sentinel/default.nix
View file

@ -22,13 +22,15 @@
nixpkgs.hostPlatform = "x86_64-linux";
boot.mode = "bios";
wireguard.proxy-sentinel.firewallRuleForAll.allowedTCPPorts = [
80
443
];
wireguard.proxy-sentinel.firewallRuleForAll.allowedUDPPorts = [
443
];
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForAll = {
allowedTCPPorts = [
80
443
];
allowedUDPPorts = [
443
];
};
users.groups.acme.members = [ "nginx" ];
services.nginx.enable = true;

4
hosts/sentinel/net.nix
View file

@ -55,9 +55,7 @@ in
globals.wireguard.proxy-sentinel = {
host = config.networking.fqdn;
port = 51443;
cidrv4 = "10.43.0.0/24";
cidrv6 = "fd00:43::/120";
openFirewall = true;
hosts.${config.node.name}.server = true;
};
}

8
hosts/sire/guests/ai.nix
View file

@ -10,10 +10,10 @@ in
microvm.mem = 1024 * 16;
microvm.vcpu = 20;
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.open-webui.port ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.open-webui.port
];
networking.firewall.allowedTCPPorts = [ config.services.ollama.port ];

12
hosts/sire/guests/ente.nix
View file

@ -80,21 +80,17 @@ let
};
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
8080
9000
];
};
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
8080
9000
];
};
globals.services.ente.domain = entePhotosDomain;
# FIXME: also monitor from internal network

12
hosts/sire/guests/grafana.nix
View file

@ -9,19 +9,15 @@ let
grafanaDomain = "grafana.${globals.domains.me}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.grafana.settings.server.http_port
];
};
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.grafana.settings.server.http_port
];
};
age.secrets.grafana-secret-key = {
rekeyFile = config.node.secretsDir + "/grafana-secret-key.age";

12
hosts/sire/guests/immich.nix
View file

@ -19,14 +19,10 @@ in
group = "immich";
};
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ 2283 ];
};
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ 2283 ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[ 2283 ];
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[ 2283 ];
globals.services.immich.domain = immichDomain;
globals.monitoring.http.immich = {

13
hosts/sire/guests/influxdb.nix
View file

@ -10,15 +10,10 @@ let
influxdbPort = 8086;
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ influxdbPort ];
};
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ influxdbPort ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[ influxdbPort ];
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[ influxdbPort ];
age.secrets.github-access-token = {
rekeyFile = config.node.secretsDir + "/github-access-token.age";

12
hosts/sire/guests/loki.nix
View file

@ -10,19 +10,15 @@ let
lokiDomain = "loki.${globals.domains.me}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.loki.configuration.server.http_listen_port
];
};
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.loki.configuration.server.http_listen_port
];
};
globals.services.loki.domain = lokiDomain;

6
hosts/sire/guests/minecraft.nix
View file

@ -350,14 +350,12 @@ in
microvm.mem = 1024 * 24;
microvm.vcpu = 16;
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
80
25565
25566
];
};
users.groups.minecraft.members = [ "nginx" ];
users.users.minecraft = {

16
hosts/sire/guests/paperless.nix
View file

@ -14,15 +14,15 @@ in
microvm.mem = 1024 * 9;
microvm.vcpu = 8;
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.paperless.port ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.paperless.port
];
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ config.services.paperless.port ];
};
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.paperless.port
];
globals.services.paperless.domain = paperlessDomain;
# FIXME: also monitor from internal network

9
hosts/sire/guests/samba.nix
View file

@ -27,7 +27,8 @@ let
"create mask" = "0740";
"directory mask" = "0750";
"acl allow execute always" = "yes";
} // cfg;
}
// cfg;
};
mkGroupShares =
@ -77,9 +78,6 @@ let
);
in
{
# For influxdb communication channel
wireguard.proxy-home.client.via = "ward";
age.secrets."samba-passdb.tdb" = {
rekeyFile = config.node.secretsDir + "/samba-passdb.tdb.age";
mode = "600";
@ -383,7 +381,8 @@ in
users.groups = {
paperless.gid = config.ids.gids.paperless;
} // lib.mapAttrs (_: cfg: { gid = cfg.id; }) (smbUsers // smbGroups);
}
// lib.mapAttrs (_: cfg: { gid = cfg.id; }) (smbUsers // smbGroups);
backups.storageBoxes.dusk = {
subuser = "samba";

70
hosts/sire/net.nix
View file

@ -71,52 +71,48 @@ in
}
);
systemd.network.networks =
{
"10-lan" = {
matchConfig.Name = "lan";
# This interface should only be used from attached vlans.
systemd.network.networks = {
"10-lan" = {
matchConfig.Name = "lan";
# This interface should only be used from attached vlans.
# So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
linkConfig.RequiredForOnline = "carrier";
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
};
# Remaining macvtap interfaces should not be touched.
"90-macvtap-ignore" = {
matchConfig.Kind = "macvtap";
linkConfig.ActivationPolicy = "manual";
linkConfig.Unmanaged = "yes";
};
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
matchConfig.Name = "vlan-${vlanName}";
# This interface should only be used from attached macvlans.
# So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
networkConfig.MACVLAN = "me-${vlanName}";
linkConfig.RequiredForOnline = "carrier";
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
};
# Remaining macvtap interfaces should not be touched.
"90-macvtap-ignore" = {
matchConfig.Kind = "macvtap";
linkConfig.ActivationPolicy = "manual";
linkConfig.Unmanaged = "yes";
"40-me-${vlanName}" = {
address = [
vlanCfg.hosts.sire.cidrv4
vlanCfg.hosts.sire.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "me-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
};
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
matchConfig.Name = "vlan-${vlanName}";
# This interface should only be used from attached macvlans.
# So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
networkConfig.MACVLAN = "me-${vlanName}";
linkConfig.RequiredForOnline = "carrier";
};
"40-me-${vlanName}" = {
address = [
vlanCfg.hosts.sire.cidrv4
vlanCfg.hosts.sire.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "me-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
};
}
);
);
networking.nftables.firewall = {
zones.untrusted.interfaces = [ "me-services" ];
};
# Allow accessing influx
wireguard.proxy-sentinel.client.via = "sentinel";
}

16
hosts/ward/guests/adguardhome.nix
View file

@ -8,16 +8,16 @@ let
adguardhomeDomain = "adguardhome.${globals.domains.me}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.adguardhome.port ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.adguardhome.port
];
# Allow home-assistant to access it directly
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.sausebiene.allowedTCPPorts = [ config.services.adguardhome.port ];
};
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.sausebiene.allowedTCPPorts =
[
config.services.adguardhome.port
];
globals.services.adguardhome.domain = adguardhomeDomain;
globals.monitoring.dns.adguardhome = {

6
hosts/ward/guests/forgejo.nix
View file

@ -10,12 +10,10 @@ let
forgejoDomain = "git.${globals.domains.me}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.forgejo.settings.server.HTTP_PORT
];
};
age.secrets.forgejo-mailer-password.rekeyFile =
config.node.secretsDir + "/forgejo-mailer-password.age";

6
hosts/ward/guests/kanidm.nix
View file

@ -15,10 +15,8 @@ let
};
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ kanidmPort ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[ kanidmPort ];
age.secrets."kanidm-self-signed.crt" = {
rekeyFile = config.node.secretsDir + "/kanidm-self-signed.crt.age";

8
hosts/ward/guests/mealie.nix
View file

@ -8,10 +8,10 @@ let
mealieDomain = "mealie.${globals.domains.me}";
in
{
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ config.services.mealie.port ];
};
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.mealie.port
];
# Mirror the original oauth2 secret, but prepend OIDC_CLIENT_SECRET=
# so it can be used as an EnvironmentFile

6
hosts/ward/guests/radicale.nix
View file

@ -7,10 +7,8 @@ let
radicaleDomain = "radicale.${globals.domains.personal}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ 8000 ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[ 8000 ];
globals.services.radicale.domain = radicaleDomain;
globals.monitoring.http.radicale = {

8
hosts/ward/guests/vaultwarden.nix
View file

@ -8,10 +8,10 @@ let
vaultwardenDomain = "pw.${globals.domains.personal}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.vaultwarden.config.rocketPort ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.vaultwarden.config.rocketPort
];
age.secrets.vaultwarden-env = {
rekeyFile = config.node.secretsDir + "/vaultwarden-env.age";

3
hosts/ward/guests/web-proxy.nix
View file

@ -10,8 +10,7 @@ in
{
microvm.mem = 1024 * 4; # Need more /tmp space so nginx can store intermediary files
wireguard.proxy-home = {
client.via = "ward";
globals.wireguard.proxy-home.hosts.${config.node.name} = {
firewallRuleForAll.allowedTCPPorts = [
80
443

7
hosts/ward/net.nix
View file

@ -331,11 +331,8 @@
};
};
globals.wireguard.proxy-home.server = {
host = globals.net.home-lan.vlans.services.hosts.ward.ipv4;
port = 51444;
inherit (globals.net.proxy-home) cidrv4;
inherit (globals.net.proxy-home) cidrv6;
globals.wireguard.proxy-home = {
openFirewall = false; # Explicitly opened only for lan
hosts.${config.node.name}.server = true;
};
}