mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

feat: finish migration to new globals system for wireguard

Browse source
This commit is contained in:
oddlama 2025-09-13 23:23:28 +02:00
parent b885d1062b
commit a1623fb97c
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
29 changed files with 204 additions and 214 deletions
Download patch file Download diff file Expand all files Collapse all files

2
config/home-manager.nix
View file

@ -10,7 +10,7 @@
useUserPackages = true; useUserPackages = true;
verbose = true; verbose = true;
sharedModules = [ sharedModules = [
inputs.nixos-extra-modules.homeManagerModules.default (inputs.nixos-extra-modules + "/hm-modules")
inputs.nix-index-database.hmModules.nix-index inputs.nix-index-database.hmModules.nix-index
inputs.nixvim.homeManagerModules.nixvim inputs.nixvim.homeManagerModules.nixvim
{ {

12
flake.lock generated
View file

@ -1060,11 +1060,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1757698511, "lastModified": 1757784838,
"narHash": "sha256-UqHHGydF/q3jfYXCpvYLA0TWtvByOp1NwOKCUjhYmPs=", "narHash": "sha256-6aHo1++bAFdW1z+0tfuxM9EmxHvon90mHo8/+izXMcY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "a3fcc92180c7462082cd849498369591dfb20855", "rev": "6e28513cf2ee9a985c339fcef24d44f43d23456b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1462,11 +1462,11 @@
"pre-commit-hooks": "pre-commit-hooks_5" "pre-commit-hooks": "pre-commit-hooks_5"
}, },
"locked": { "locked": {
"lastModified": 1745053097, "lastModified": 1757798853,
"narHash": "sha256-BEW57utyWCqP4U+MzCXFqbvEC8LE3iZv5dsPMrmTJ9Q=", "narHash": "sha256-xQrM5P9YqJfngr7/N0SsFp1p5BMt4NwkWa+3AktIWFU=",
"owner": "oddlama", "owner": "oddlama",
"repo": "nixos-extra-modules", "repo": "nixos-extra-modules",
"rev": "7565d8554b0fc9d621851150e7939d34a3a8cd6c", "rev": "4c6b6489a41339809e4dc73086db16425cad6466",
"type": "github" "type": "github"
}, },
"original": { "original": {

16
flake/hosts.nix
View file

@ -1,4 +1,7 @@
{ inputs, ... }: { config, inputs, ... }:
let
topConfig = config;
in
{ {
flake = flake =
{ {
@ -12,7 +15,6 @@
filterAttrs filterAttrs
flip flip
genAttrs genAttrs
mapAttrs
mapAttrs' mapAttrs'
nameValuePair nameValuePair
; ;
@ -30,6 +32,7 @@
inherit (pkgs) lib; inherit (pkgs) lib;
inherit (config) nodes globals; inherit (config) nodes globals;
inherit inputs minimal; inherit inputs minimal;
extraModules = topConfig.globals.optModules;
}; };
modules = [ modules = [
{ {
@ -49,7 +52,8 @@
node.secretsDir = ../hosts/${name}/secrets; node.secretsDir = ../hosts/${name}/secrets;
} }
../hosts/${name} ../hosts/${name}
]; ]
++ topConfig.globals.optModules;
}; };
# Get all folders in hosts/ # Get all folders in hosts/
@ -66,7 +70,7 @@
# True NixOS nodes can define additional guest nodes that are built # True NixOS nodes can define additional guest nodes that are built
# together with it. We collect all defined guests from each node here # together with it. We collect all defined guests from each node here
# to allow accessing any node via the unified attribute `nodes`. # to allow accessing any node via the unified attribute `nodes`.
guestConfigs = flip concatMapAttrs config.nixosConfigurations ( guestConfigurations = flip concatMapAttrs config.nixosConfigurations (
_: node: _: node:
flip mapAttrs' (node.config.guests or { }) ( flip mapAttrs' (node.config.guests or { }) (
guestName: guestDef: guestName: guestDef:
@ -81,8 +85,6 @@
# All nixosSystem instanciations are collected here, so that we can refer # All nixosSystem instanciations are collected here, so that we can refer
# to any system via nodes.<name> # to any system via nodes.<name>
nodes = config.nixosConfigurations // config.guestConfigs; nodes = config.nixosConfigurations // config.guestConfigurations;
# Add a shorthand to easily target toplevel derivations
"@" = mapAttrs (_: v: v.config.system.build.toplevel) config.nodes;
}; };
} }

49
globals.nix
View file

@ -22,6 +22,50 @@ in
globals = { globals = {
wireguard = { wireguard = {
proxy-home = {
host = globals.net.home-lan.vlans.services.hosts.ward.ipv4;
port = 51444;
cidrv4 = "10.44.0.0/24";
cidrv6 = "fd00:44::/120";
hosts = {
sausebiene.id = 10;
sire-ente.id = 101;
sire-grafana.id = 221;
sire-immich.id = 225;
sire-influxdb.id = 141;
sire-loki.id = 109;
sire-paperless.id = 147;
sire-samba.id = 38;
ward.id = 94;
ward-adguardhome.id = 148;
ward-mealie.id = 128;
ward-web-proxy.id = 11;
};
};
proxy-sentinel = {
port = 51443;
cidrv4 = "10.43.0.0/24";
cidrv6 = "fd00:43::/120";
hosts = {
envoy.id = 135;
sentinel.id = 29;
sire-ai.id = 171;
sire-ente.id = 101;
sire-grafana.id = 221;
sire-immich.id = 225;
sire-influxdb.id = 141;
sire-loki.id = 109;
sire-minecraft.id = 163;
sire-paperless.id = 147;
sire.id = 14;
ward-adguardhome.id = 148;
ward-forgejo.id = 128;
ward-kanidm.id = 197;
ward-radicale.id = 252;
ward-vaultwarden.id = 142;
};
};
}; };
net = { net = {
@ -125,11 +169,6 @@ in
}; };
}; };
}; };
proxy-home = {
cidrv4 = "10.44.0.0/24";
cidrv6 = "fd00:44::/120";
};
}; };
monitoring = { monitoring = {

3
hosts/envoy/net.nix
View file

@ -46,7 +46,4 @@ in
}; };
networking.nftables.firewall.zones.untrusted.interfaces = [ "wan" ]; networking.nftables.firewall.zones.untrusted.interfaces = [ "wan" ];
# Allow accessing influx
wireguard.proxy-sentinel.client.via = "sentinel";
} }

7
hosts/sausebiene/esphome.nix
View file

@ -7,9 +7,10 @@ let
esphomeDomain = "esphome.${globals.domains.personal}"; esphomeDomain = "esphome.${globals.domains.personal}";
in in
{ {
wireguard.proxy-home.firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
config.services.esphome.port [
]; config.services.esphome.port
];
environment.persistence."/persist".directories = [ environment.persistence."/persist".directories = [
{ {

7
hosts/sausebiene/home-assistant.nix
View file

@ -12,9 +12,10 @@ in
{ {
imports = [ ./hass-modbus/mennekes-amtron-xtra.nix ]; imports = [ ./hass-modbus/mennekes-amtron-xtra.nix ];
wireguard.proxy-home.firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
config.services.home-assistant.config.http.server_port [
]; config.services.home-assistant.config.http.server_port
];
environment.persistence."/persist".directories = [ environment.persistence."/persist".directories = [
{ {

64
hosts/sausebiene/net.nix
View file

@ -59,43 +59,41 @@ in
} }
); );
systemd.network.networks = systemd.network.networks = {
{ "10-lan" = {
"10-lan" = { matchConfig.Name = "lan";
matchConfig.Name = "lan"; # This interface should only be used from attached vlans.
# This interface should only be used from attached vlans. # So don't acquire a link local address and only wait for
# So don't acquire a link local address and only wait for # this interface to gain a carrier.
# this interface to gain a carrier. networkConfig.LinkLocalAddressing = "no";
networkConfig.LinkLocalAddressing = "no"; linkConfig.RequiredForOnline = "carrier";
linkConfig.RequiredForOnline = "carrier"; vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans); };
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
address = [
vlanCfg.hosts.sausebiene.cidrv4
vlanCfg.hosts.sausebiene.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "vlan-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
}; };
} }
// lib.flip lib.concatMapAttrs localVlans ( );
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
address = [
vlanCfg.hosts.sausebiene.cidrv4
vlanCfg.hosts.sausebiene.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "vlan-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
};
}
);
networking.nftables.firewall = { networking.nftables.firewall = {
zones = zones = {
{ untrusted.interfaces = [ "vlan-services" ];
untrusted.interfaces = [ "vlan-services" ]; }
// lib.flip lib.concatMapAttrs localVlans (
vlanName: _: {
"vlan-${vlanName}".interfaces = [ "vlan-${vlanName}" ];
} }
// lib.flip lib.concatMapAttrs localVlans ( );
vlanName: _: {
"vlan-${vlanName}".interfaces = [ "vlan-${vlanName}" ];
}
);
rules = { rules = {
# Allow devices to be discovered through various protocols # Allow devices to be discovered through various protocols
@ -134,6 +132,4 @@ in
}; };
}; };
}; };
wireguard.proxy-home.client.via = "ward";
} }

16
hosts/sentinel/default.nix
View file

@ -22,13 +22,15 @@
nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.hostPlatform = "x86_64-linux";
boot.mode = "bios"; boot.mode = "bios";
wireguard.proxy-sentinel.firewallRuleForAll.allowedTCPPorts = [ globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForAll = {
80 allowedTCPPorts = [
443 80
]; 443
wireguard.proxy-sentinel.firewallRuleForAll.allowedUDPPorts = [ ];
443 allowedUDPPorts = [
]; 443
];
};
users.groups.acme.members = [ "nginx" ]; users.groups.acme.members = [ "nginx" ];
services.nginx.enable = true; services.nginx.enable = true;

4
hosts/sentinel/net.nix
View file

@ -55,9 +55,7 @@ in
globals.wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel = {
host = config.networking.fqdn; host = config.networking.fqdn;
port = 51443;
cidrv4 = "10.43.0.0/24";
cidrv6 = "fd00:43::/120";
openFirewall = true; openFirewall = true;
hosts.${config.node.name}.server = true;
}; };
} }

8
hosts/sire/guests/ai.nix
View file

@ -10,10 +10,10 @@ in
microvm.mem = 1024 * 16; microvm.mem = 1024 * 16;
microvm.vcpu = 20; microvm.vcpu = 20;
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.open-webui.port ]; config.services.open-webui.port
}; ];
networking.firewall.allowedTCPPorts = [ config.services.ollama.port ]; networking.firewall.allowedTCPPorts = [ config.services.ollama.port ];

12
hosts/sire/guests/ente.nix
View file

@ -80,21 +80,17 @@ let
}; };
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [
8080 8080
9000 9000
]; ];
};
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
client.via = "ward"; [
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
8080 8080
9000 9000
]; ];
};
globals.services.ente.domain = entePhotosDomain; globals.services.ente.domain = entePhotosDomain;
# FIXME: also monitor from internal network # FIXME: also monitor from internal network

12
hosts/sire/guests/grafana.nix
View file

@ -9,19 +9,15 @@ let
grafanaDomain = "grafana.${globals.domains.me}"; grafanaDomain = "grafana.${globals.domains.me}";
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [
config.services.grafana.settings.server.http_port config.services.grafana.settings.server.http_port
]; ];
};
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
client.via = "ward"; [
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
config.services.grafana.settings.server.http_port config.services.grafana.settings.server.http_port
]; ];
};
age.secrets.grafana-secret-key = { age.secrets.grafana-secret-key = {
rekeyFile = config.node.secretsDir + "/grafana-secret-key.age"; rekeyFile = config.node.secretsDir + "/grafana-secret-key.age";

12
hosts/sire/guests/immich.nix
View file

@ -19,14 +19,10 @@ in
group = "immich"; group = "immich";
}; };
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [ 2283 ];
firewallRuleForNode.sentinel.allowedTCPPorts = [ 2283 ]; globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
}; [ 2283 ];
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ 2283 ];
};
globals.services.immich.domain = immichDomain; globals.services.immich.domain = immichDomain;
globals.monitoring.http.immich = { globals.monitoring.http.immich = {

13
hosts/sire/guests/influxdb.nix
View file

@ -10,15 +10,10 @@ let
influxdbPort = 8086; influxdbPort = 8086;
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [ influxdbPort ];
firewallRuleForNode.sentinel.allowedTCPPorts = [ influxdbPort ]; globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
}; [ influxdbPort ];
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ influxdbPort ];
};
age.secrets.github-access-token = { age.secrets.github-access-token = {
rekeyFile = config.node.secretsDir + "/github-access-token.age"; rekeyFile = config.node.secretsDir + "/github-access-token.age";

12
hosts/sire/guests/loki.nix
View file

@ -10,19 +10,15 @@ let
lokiDomain = "loki.${globals.domains.me}"; lokiDomain = "loki.${globals.domains.me}";
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [
config.services.loki.configuration.server.http_listen_port config.services.loki.configuration.server.http_listen_port
]; ];
};
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
client.via = "ward"; [
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
config.services.loki.configuration.server.http_listen_port config.services.loki.configuration.server.http_listen_port
]; ];
};
globals.services.loki.domain = lokiDomain; globals.services.loki.domain = lokiDomain;

6
hosts/sire/guests/minecraft.nix
View file

@ -350,14 +350,12 @@ in
microvm.mem = 1024 * 24; microvm.mem = 1024 * 24;
microvm.vcpu = 16; microvm.vcpu = 16;
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [
80 80
25565 25565
25566 25566
]; ];
};
users.groups.minecraft.members = [ "nginx" ]; users.groups.minecraft.members = [ "nginx" ];
users.users.minecraft = { users.users.minecraft = {

16
hosts/sire/guests/paperless.nix
View file

@ -14,15 +14,15 @@ in
microvm.mem = 1024 * 9; microvm.mem = 1024 * 9;
microvm.vcpu = 8; microvm.vcpu = 8;
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.paperless.port ]; config.services.paperless.port
}; ];
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
client.via = "ward"; [
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ config.services.paperless.port ]; config.services.paperless.port
}; ];
globals.services.paperless.domain = paperlessDomain; globals.services.paperless.domain = paperlessDomain;
# FIXME: also monitor from internal network # FIXME: also monitor from internal network

9
hosts/sire/guests/samba.nix
View file

@ -27,7 +27,8 @@ let
"create mask" = "0740"; "create mask" = "0740";
"directory mask" = "0750"; "directory mask" = "0750";
"acl allow execute always" = "yes"; "acl allow execute always" = "yes";
} // cfg; }
// cfg;
}; };
mkGroupShares = mkGroupShares =
@ -77,9 +78,6 @@ let
); );
in in
{ {
# For influxdb communication channel
wireguard.proxy-home.client.via = "ward";
age.secrets."samba-passdb.tdb" = { age.secrets."samba-passdb.tdb" = {
rekeyFile = config.node.secretsDir + "/samba-passdb.tdb.age"; rekeyFile = config.node.secretsDir + "/samba-passdb.tdb.age";
mode = "600"; mode = "600";
@ -383,7 +381,8 @@ in
users.groups = { users.groups = {
paperless.gid = config.ids.gids.paperless; paperless.gid = config.ids.gids.paperless;
} // lib.mapAttrs (_: cfg: { gid = cfg.id; }) (smbUsers // smbGroups); }
// lib.mapAttrs (_: cfg: { gid = cfg.id; }) (smbUsers // smbGroups);
backups.storageBoxes.dusk = { backups.storageBoxes.dusk = {
subuser = "samba"; subuser = "samba";

70
hosts/sire/net.nix
View file

@ -71,52 +71,48 @@ in
} }
); );
systemd.network.networks = systemd.network.networks = {
{ "10-lan" = {
"10-lan" = { matchConfig.Name = "lan";
matchConfig.Name = "lan"; # This interface should only be used from attached vlans.
# This interface should only be used from attached vlans. # So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
linkConfig.RequiredForOnline = "carrier";
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
};
# Remaining macvtap interfaces should not be touched.
"90-macvtap-ignore" = {
matchConfig.Kind = "macvtap";
linkConfig.ActivationPolicy = "manual";
linkConfig.Unmanaged = "yes";
};
}
// lib.flip lib.concatMapAttrs localVlans (
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
matchConfig.Name = "vlan-${vlanName}";
# This interface should only be used from attached macvlans.
# So don't acquire a link local address and only wait for # So don't acquire a link local address and only wait for
# this interface to gain a carrier. # this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no"; networkConfig.LinkLocalAddressing = "no";
networkConfig.MACVLAN = "me-${vlanName}";
linkConfig.RequiredForOnline = "carrier"; linkConfig.RequiredForOnline = "carrier";
vlan = map (name: "vlan-${name}") (builtins.attrNames localVlans);
}; };
# Remaining macvtap interfaces should not be touched. "40-me-${vlanName}" = {
"90-macvtap-ignore" = { address = [
matchConfig.Kind = "macvtap"; vlanCfg.hosts.sire.cidrv4
linkConfig.ActivationPolicy = "manual"; vlanCfg.hosts.sire.cidrv6
linkConfig.Unmanaged = "yes"; ];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "me-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
}; };
} }
// lib.flip lib.concatMapAttrs localVlans ( );
vlanName: vlanCfg: {
"30-vlan-${vlanName}" = {
matchConfig.Name = "vlan-${vlanName}";
# This interface should only be used from attached macvlans.
# So don't acquire a link local address and only wait for
# this interface to gain a carrier.
networkConfig.LinkLocalAddressing = "no";
networkConfig.MACVLAN = "me-${vlanName}";
linkConfig.RequiredForOnline = "carrier";
};
"40-me-${vlanName}" = {
address = [
vlanCfg.hosts.sire.cidrv4
vlanCfg.hosts.sire.cidrv6
];
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.ward.ipv4 ];
matchConfig.Name = "me-${vlanName}";
networkConfig.IPv6PrivacyExtensions = "yes";
linkConfig.RequiredForOnline = "routable";
};
}
);
networking.nftables.firewall = { networking.nftables.firewall = {
zones.untrusted.interfaces = [ "me-services" ]; zones.untrusted.interfaces = [ "me-services" ];
}; };
# Allow accessing influx
wireguard.proxy-sentinel.client.via = "sentinel";
} }

16
hosts/ward/guests/adguardhome.nix
View file

@ -8,16 +8,16 @@ let
adguardhomeDomain = "adguardhome.${globals.domains.me}"; adguardhomeDomain = "adguardhome.${globals.domains.me}";
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.adguardhome.port ]; config.services.adguardhome.port
}; ];
# Allow home-assistant to access it directly # Allow home-assistant to access it directly
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.sausebiene.allowedTCPPorts =
client.via = "ward"; [
firewallRuleForNode.sausebiene.allowedTCPPorts = [ config.services.adguardhome.port ]; config.services.adguardhome.port
}; ];
globals.services.adguardhome.domain = adguardhomeDomain; globals.services.adguardhome.domain = adguardhomeDomain;
globals.monitoring.dns.adguardhome = { globals.monitoring.dns.adguardhome = {

6
hosts/ward/guests/forgejo.nix
View file

@ -10,12 +10,10 @@ let
forgejoDomain = "git.${globals.domains.me}"; forgejoDomain = "git.${globals.domains.me}";
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [
config.services.forgejo.settings.server.HTTP_PORT config.services.forgejo.settings.server.HTTP_PORT
]; ];
};
age.secrets.forgejo-mailer-password.rekeyFile = age.secrets.forgejo-mailer-password.rekeyFile =
config.node.secretsDir + "/forgejo-mailer-password.age"; config.node.secretsDir + "/forgejo-mailer-password.age";

6
hosts/ward/guests/kanidm.nix
View file

@ -15,10 +15,8 @@ let
}; };
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [ kanidmPort ];
firewallRuleForNode.sentinel.allowedTCPPorts = [ kanidmPort ];
};
age.secrets."kanidm-self-signed.crt" = { age.secrets."kanidm-self-signed.crt" = {
rekeyFile = config.node.secretsDir + "/kanidm-self-signed.crt.age"; rekeyFile = config.node.secretsDir + "/kanidm-self-signed.crt.age";

8
hosts/ward/guests/mealie.nix
View file

@ -8,10 +8,10 @@ let
mealieDomain = "mealie.${globals.domains.me}"; mealieDomain = "mealie.${globals.domains.me}";
in in
{ {
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
client.via = "ward"; [
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ config.services.mealie.port ]; config.services.mealie.port
}; ];
# Mirror the original oauth2 secret, but prepend OIDC_CLIENT_SECRET= # Mirror the original oauth2 secret, but prepend OIDC_CLIENT_SECRET=
# so it can be used as an EnvironmentFile # so it can be used as an EnvironmentFile

6
hosts/ward/guests/radicale.nix
View file

@ -7,10 +7,8 @@ let
radicaleDomain = "radicale.${globals.domains.personal}"; radicaleDomain = "radicale.${globals.domains.personal}";
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [ 8000 ];
firewallRuleForNode.sentinel.allowedTCPPorts = [ 8000 ];
};
globals.services.radicale.domain = radicaleDomain; globals.services.radicale.domain = radicaleDomain;
globals.monitoring.http.radicale = { globals.monitoring.http.radicale = {

8
hosts/ward/guests/vaultwarden.nix
View file

@ -8,10 +8,10 @@ let
vaultwardenDomain = "pw.${globals.domains.personal}"; vaultwardenDomain = "pw.${globals.domains.personal}";
in in
{ {
wireguard.proxy-sentinel = { globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
client.via = "sentinel"; [
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.vaultwarden.config.rocketPort ]; config.services.vaultwarden.config.rocketPort
}; ];
age.secrets.vaultwarden-env = { age.secrets.vaultwarden-env = {
rekeyFile = config.node.secretsDir + "/vaultwarden-env.age"; rekeyFile = config.node.secretsDir + "/vaultwarden-env.age";

3
hosts/ward/guests/web-proxy.nix
View file

@ -10,8 +10,7 @@ in
{ {
microvm.mem = 1024 * 4; # Need more /tmp space so nginx can store intermediary files microvm.mem = 1024 * 4; # Need more /tmp space so nginx can store intermediary files
wireguard.proxy-home = { globals.wireguard.proxy-home.hosts.${config.node.name} = {
client.via = "ward";
firewallRuleForAll.allowedTCPPorts = [ firewallRuleForAll.allowedTCPPorts = [
80 80
443 443

7
hosts/ward/net.nix
View file

@ -331,11 +331,8 @@
}; };
}; };
globals.wireguard.proxy-home.server = { globals.wireguard.proxy-home = {
host = globals.net.home-lan.vlans.services.hosts.ward.ipv4;
port = 51444;
inherit (globals.net.proxy-home) cidrv4;
inherit (globals.net.proxy-home) cidrv6;
openFirewall = false; # Explicitly opened only for lan openFirewall = false; # Explicitly opened only for lan
hosts.${config.node.name}.server = true;
}; };
} }

8
modules/globals.nix
View file

@ -1,6 +1,5 @@
{ {
lib, lib,
options,
... ...
}: }:
let let
@ -366,12 +365,5 @@ in
}; };
}; };
}; };
_globalsDefs = mkOption {
type = types.unspecified;
default = options.globals.definitions;
readOnly = true;
internal = true;
};
}; };
} }