From 12d840c7bfb26f01d580fe1d7591b2c66d3fde2c Mon Sep 17 00:00:00 2001 From: oddlama Date: Sun, 16 Apr 2023 00:34:35 +0200 Subject: [PATCH] feat(core): add nixos-nftables-firewall; and move some things from core/default.nix to more approriate locations --- flake.nix | 6 +++ hosts/common/core/default.nix | 74 ++++++++--------------------------- hosts/common/core/net.nix | 42 ++++++++++++++++++++ hosts/common/core/nix.nix | 13 ++++++ hosts/nom/net.nix | 5 --- hosts/ward/net.nix | 23 +++++------ hosts/zackbiene/net.nix | 13 ------ modules/wireguard.nix | 7 ++-- nix/generate-node.nix | 2 + 9 files changed, 92 insertions(+), 93 deletions(-) create mode 100644 hosts/common/core/net.nix diff --git a/flake.nix b/flake.nix index 1e96687..04d4791 100644 --- a/flake.nix +++ b/flake.nix @@ -16,6 +16,12 @@ impermanence.url = "github:nix-community/impermanence"; nixos-hardware.url = "github:NixOS/nixos-hardware"; + + nixos-nftables-firewall = { + url = "github:thelegy/nixos-nftables-firewall"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; microvm = { diff --git a/hosts/common/core/default.nix b/hosts/common/core/default.nix index 28c3130..57c32c4 100644 --- a/hosts/common/core/default.nix +++ b/hosts/common/core/default.nix @@ -4,17 +4,12 @@ pkgs, config, nodeName, - nodeSecrets, ... -}: let - dummyConfig = pkgs.writeText "configuration.nix" '' - assert builtins.trace "This is a dummy config, use colmena!" false; - { } - ''; -in { +}: { imports = [ ./inputrc.nix ./issue.nix + ./net.nix ./nix.nix ./resolved.nix ./ssh.nix @@ -25,27 +20,31 @@ in { ]; # Setup secret rekeying parameters - rekey.forceRekeyOnSystem = "x86_64-linux"; - rekey.hostPubkey = let - pubkeyPath = ../.. + "/${nodeName}/secrets/host.pub"; - in - lib.mkIf (lib.pathExists pubkeyPath || lib.trace "Missing pubkey for ${nodeName}: ${toString pubkeyPath} not found, using dummy replacement key for now." false) - pubkeyPath; - rekey.masterIdentities = inputs.self.secrets.masterIdentities; - rekey.extraEncryptionPubkeys = inputs.self.secrets.extraEncryptionPubkeys; + rekey = { + inherit + (inputs.self.secrets) + masterIdentities + extraEncryptionPubkeys + ; + + forceRekeyOnSystem = "x86_64-linux"; + hostPubkey = let + pubkeyPath = ../.. + "/${nodeName}/secrets/host.pub"; + in + lib.mkIf (lib.pathExists pubkeyPath || lib.trace "Missing pubkey for ${nodeName}: ${toString pubkeyPath} not found, using dummy replacement key for now." false) + pubkeyPath; + }; boot = { kernelParams = ["log_buf_len=10M"]; tmpOnTmpfs = true; }; - environment.etc."nixos/configuration.nix".source = dummyConfig; # Disable sudo which is entierly unnecessary. security.sudo.enable = false; time.timeZone = lib.mkDefault "Europe/Berlin"; i18n.defaultLocale = "C.UTF-8"; - console.keyMap = "de-latin1-nodeadkeys"; hardware = { @@ -53,48 +52,7 @@ in { enableAllFirmware = true; }; - networking = { - hostName = lib.mkDefault nodeName; - # FIXME: would like to use mkForce false for useDHCP, but nixpkgs#215908 blocks that. - useDHCP = true; - useNetworkd = true; - wireguard.enable = true; - dhcpcd.enable = false; - nftables.enable = true; - firewall.enable = true; - }; - - # Rename known network interfaces - services.udev.packages = let - interfaceNamesUdevRules = pkgs.writeTextFile { - name = "interface-names-udev-rules"; - text = lib.concatStringsSep "\n" (lib.mapAttrsToList ( - interface: attrs: ''SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="${attrs.mac}", NAME:="${interface}"'' - ) - nodeSecrets.networking.interfaces); - destination = "/etc/udev/rules.d/01-interface-names.rules"; - }; - in [interfaceNamesUdevRules]; - - nix.nixPath = [ - "nixos-config=${dummyConfig}" - "nixpkgs=/run/current-system/nixpkgs" - ]; - - system = { - extraSystemBuilderCmds = '' - ln -sv ${pkgs.path} $out/nixpkgs - ''; - - stateVersion = "23.05"; - }; - systemd.enableUnifiedCgroupHierarchy = true; - systemd.network = { - enable = true; - wait-online.anyInterface = true; - }; - users.mutableUsers = false; home-manager = { diff --git a/hosts/common/core/net.nix b/hosts/common/core/net.nix new file mode 100644 index 0000000..40bc9b7 --- /dev/null +++ b/hosts/common/core/net.nix @@ -0,0 +1,42 @@ +{ + lib, + pkgs, + nodeName, + nodeSecrets, + ... +}: let + inherit + (lib) + concatStringsSep + mapAttrsToList + mkDefault + mkForce + ; +in { + networking = { + hostName = mkDefault nodeName; + useDHCP = mkForce false; + useNetworkd = true; + wireguard.enable = true; + dhcpcd.enable = false; + nftables.enable = true; + firewall.enable = true; + }; + + # Rename known network interfaces + services.udev.packages = let + interfaceNamesUdevRules = pkgs.writeTextFile { + name = "interface-names-udev-rules"; + text = concatStringsSep "\n" (mapAttrsToList ( + interface: attrs: ''SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="${attrs.mac}", NAME:="${interface}"'' + ) + nodeSecrets.networking.interfaces); + destination = "/etc/udev/rules.d/01-interface-names.rules"; + }; + in [interfaceNamesUdevRules]; + + systemd.network = { + enable = true; + wait-online.anyInterface = true; + }; +} diff --git a/hosts/common/core/nix.nix b/hosts/common/core/nix.nix index 3342874..1b097a4 100644 --- a/hosts/common/core/nix.nix +++ b/hosts/common/core/nix.nix @@ -3,6 +3,11 @@ pkgs, ... }: { + environment.etc."nixos/configuration.nix".source = pkgs.writeText "configuration.nix" '' + assert builtins.trace "This is a dummy config, use colmena!" false; + { } + ''; + nix = { settings = { auto-optimise-store = true; @@ -30,6 +35,7 @@ plugin-files = ${pkgs.nix-plugins}/lib/nix/plugins extra-builtins-file = ${../../../nix/extra-builtins.nix} ''; + nixPath = ["nixpkgs=/run/current-system/nixpkgs"]; optimise.automatic = true; gc.automatic = true; # Define global flakes for this system @@ -40,4 +46,11 @@ templates.flake = inputs.templates; }; }; + + system = { + extraSystemBuilderCmds = '' + ln -sv ${pkgs.path} $out/nixpkgs + ''; + stateVersion = "23.05"; + }; } diff --git a/hosts/nom/net.nix b/hosts/nom/net.nix index 80d20c9..3d19200 100644 --- a/hosts/nom/net.nix +++ b/hosts/nom/net.nix @@ -20,9 +20,4 @@ dhcpV6Config.RouteMetric = 40; }; }; - - extra.wireguard.vms = { - via = "ward"; - addresses = ["10.0.0.10/32"]; - }; } diff --git a/hosts/ward/net.nix b/hosts/ward/net.nix index c024612..23298e1 100644 --- a/hosts/ward/net.nix +++ b/hosts/ward/net.nix @@ -22,18 +22,13 @@ }; }; - extra.wireguard.vms = { - server = { - enable = true; - host = "ward"; - port = 51822; - openFirewall = true; - externalPeers = { - test1 = ["10.0.0.91/32"]; - test2 = ["10.0.0.92/32"]; - test3 = ["10.0.0.93/32"]; - }; - }; - addresses = ["10.0.0.1/24"]; - }; + #extra.wireguard.vms = { + # server = { + # enable = true; + # host = "192.168.1.231"; + # port = 51822; + # openFirewall = true; + # }; + # addresses = ["10.0.0.1/24"]; + #}; } diff --git a/hosts/zackbiene/net.nix b/hosts/zackbiene/net.nix index a20477e..85fbb1f 100644 --- a/hosts/zackbiene/net.nix +++ b/hosts/zackbiene/net.nix @@ -17,17 +17,4 @@ }; }; }; - - extra.wireguard.vms = { - server = { - enable = true; - host = "vms"; - port = 51822; - openFirewall = true; - externalPeers = { - zack1 = ["10.0.0.90/32"]; - }; - }; - addresses = ["10.0.0.2/24"]; - }; } diff --git a/modules/wireguard.nix b/modules/wireguard.nix index a3d9aa8..d3eac73 100644 --- a/modules/wireguard.nix +++ b/modules/wireguard.nix @@ -102,9 +102,10 @@ # The allowed ips of a server node are it's own addreses, # plus each external peer's addresses, # plus each client's addresses that is connected via that node. - AllowedIPs = - snCfg.addresses - ++ attrValues snCfg.server.externalPeers; # TODO ++ map (n: (wgCfgOf n).addresses) snCfg.ourClientNodes; + AllowedIPs = snCfg.addresses; + # TODO this needed? or even wanted at all? + # ++ attrValues snCfg.server.externalPeers; + # ++ map (n: (wgCfgOf n).addresses) snCfg.ourClientNodes; Endpoint = "${snCfg.server.host}:${toString snCfg.server.port}"; }; }) (filterSelf associatedServerNodes) diff --git a/nix/generate-node.nix b/nix/generate-node.nix index 645fcf0..8d4e90f 100644 --- a/nix/generate-node.nix +++ b/nix/generate-node.nix @@ -4,6 +4,7 @@ home-manager, #impermanence, nixos-hardware, + nixos-nftables-firewall, nixpkgs, microvm, agenix, @@ -25,6 +26,7 @@ in secrets = self.secrets.content; nodeSecrets = self.secrets.content.nodes.${nodeName}; nixos-hardware = nixos-hardware.nixosModules; + nixos-nftables-firewall = nixos-nftables-firewall.nixosModules; #impermanence = impermanence.nixosModules; }; imports =