forked from mirrors_public/oddlama_nix-config
feat: add firezone gateway and allow trafic
This commit is contained in:
parent
3725789765
commit
c4891afe7d
10 changed files with 54 additions and 2 deletions
|
@ -7,6 +7,21 @@
|
|||
nodes,
|
||||
...
|
||||
}:
|
||||
let
|
||||
# FIXME: dont hardcode, filter global service domains by internal state
|
||||
# FIXME: new entry here? make new adguardhome entry too.
|
||||
# FIXME: new entry here? make new firezone entry too.
|
||||
homeDomains = [
|
||||
globals.services.grafana.domain
|
||||
globals.services.immich.domain
|
||||
globals.services.influxdb.domain
|
||||
globals.services.loki.domain
|
||||
globals.services.paperless.domain
|
||||
globals.services.esphome.domain
|
||||
globals.services.home-assistant.domain
|
||||
"fritzbox.${globals.domains.personal}"
|
||||
];
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
inputs.nixos-hardware.nixosModules.common-cpu-intel
|
||||
|
@ -63,6 +78,9 @@
|
|||
rekeyFile = config.node.secretsDir + "/firezone-gateway-token.age";
|
||||
};
|
||||
|
||||
networking.hosts.${globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv6} = homeDomains;
|
||||
networking.hosts.${globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4} = homeDomains;
|
||||
systemd.services.firezone-gateway.environment.HEALTH_CHECK_ADDR = "127.0.0.1:17999";
|
||||
services.firezone.gateway = {
|
||||
enable = true;
|
||||
name = "ward";
|
||||
|
|
|
@ -110,6 +110,7 @@ in
|
|||
[
|
||||
# FIXME: dont hardcode, filter global service domains by internal state
|
||||
# FIXME: new entry here? make new firezone entry too.
|
||||
# FIXME: new entry here? make new firezone gateway on ward entry too.
|
||||
globals.services.grafana.domain
|
||||
globals.services.immich.domain
|
||||
globals.services.influxdb.domain
|
||||
|
|
|
@ -169,6 +169,7 @@
|
|||
{
|
||||
untrusted.interfaces = [ "wan" ];
|
||||
proxy-home.interfaces = [ "proxy-home" ];
|
||||
firezone.interfaces = [ "tun-firezone" ];
|
||||
adguardhome.ipv4Addresses = [ globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv4 ];
|
||||
adguardhome.ipv6Addresses = [ globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv6 ];
|
||||
web-proxy.ipv4Addresses = [ globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4 ];
|
||||
|
@ -260,6 +261,28 @@
|
|||
to = [ "proxy-home" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
# masquerade firezone traffic
|
||||
masquerade-firezone = {
|
||||
from = [ "firezone" ];
|
||||
to = [ "vlan-services" ];
|
||||
masquerade = true;
|
||||
late = true; # Only accept after any rejects have been processed
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
# forward firezone traffic
|
||||
forward-incoming-firezone-traffic = {
|
||||
from = [ "firezone" ];
|
||||
to = [ "vlan-services" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
|
||||
forward-outgoing-firezone-traffic = {
|
||||
from = [ "vlan-services" ];
|
||||
to = [ "firezone" ];
|
||||
verdict = "accept";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue