fi/nix-infra
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add missing wireguard-tools dependency

Browse source
This commit is contained in:
yuri 2023-09-17 21:04:22 +02:00
commit d1f2b13232
7 changed files with 107 additions and 113 deletions
Download patch file Download diff file Expand all files Collapse all files

4
config/environments/openstack-vm/default.nix
View file

@ -1,7 +1,7 @@
{ lib, ... }: { lib, modulesPath, ... }:
{ {
imports = [ imports = [
./hardware-configuration.nix "${modulesPath}/virtualisation/openstack-config.nix"
]; ];
users.users.root.initialPassword = lib.mkForce null; users.users.root.initialPassword = lib.mkForce null;

24
config/environments/openstack-vm/hardware-configuration.nix
View file

@ -1,24 +0,0 @@
{ ... }:
{
fileSystems."/" = {
device = "/dev/disk/by-label/nixos";
fsType = "ext4";
autoResize = true;
};
boot = {
growPartition = true;
kernelParams = [ "console=tty1" ];
loader.grub = {
enable = true;
device = "/dev/vda";
extraConfig = ''
serial --unit=1 --speed=115200 --word=8 --parity=no --stop=1
terminal_output console serial
terminal_input console serial
'';
};
};
systemd.services."serial-getty@tty1".enable = true;
}

50
config/hosts/lifeline/configuration.nix
View file

@ -1,4 +1,4 @@
{ pkgs, ... }: { ... }:
{ {
boot.loader.grub = { boot.loader.grub = {
enable = true; enable = true;
@ -10,54 +10,6 @@
networking = { networking = {
hostName = "lifeline"; hostName = "lifeline";
useDHCP = true; useDHCP = true;
wireguard = {
enable = true;
interfaces.wg0 = {
privateKeyFile = "/secrets/wireguard-lifeline-mail-1-lifeline-privatekey.secret";
listenPort = 51820;
ips = [
"172.16.50.1/24"
];
peers = [
{
name = "mail-1";
publicKey = "CyKPjkY1ah/lE6V3R0XugNo28doeAtD8wEtAeDB7bHs=";
presharedKeyFile = "/secrets/wireguard-lifeline-mail-1-lifeline-psk.secret";
allowedIPs = [ "172.16.50.2/32" ];
}
];
postSetup = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
'';
};
};
nat = {
enable = true;
internalInterfaces = [ "wg0" ];
externalInterface = "ens6";
forwardPorts = [
{
destination = "172.16.50.2:25";
proto = "tcp";
sourcePort = 25;
}
{
destination = "172.16.50.2:465";
proto = "tcp";
sourcePort = 465;
}
{
destination = "172.16.50.2:993";
proto = "tcp";
sourcePort = 993;
}
];
};
firewall = { firewall = {
enable = true; enable = true;
allowedUDPPorts = [ 51820 ]; allowedUDPPorts = [ 51820 ];

12
config/hosts/mail-1/configuration.nix
View file

@ -30,7 +30,7 @@
via = "10.202.41.1"; via = "10.202.41.1";
} }
{ {
address = "217.160.117.160"; # address = "212.53.203.19"; # valkyrie.af.grzb.de
prefixLength = 32; prefixLength = 32;
via = "10.202.41.1"; via = "10.202.41.1";
} }
@ -44,15 +44,15 @@
]; ];
peers = [ peers = [
{ {
name = "lifeline"; name = "valkyrie";
publicKey = "g3xZ5oJCbPtzYDPTVAS400FDw6kirGR+7300bwiZDUY="; publicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
presharedKeyFile = "/secrets/wireguard-lifeline-mail-1-mail-1-psk.secret"; presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-mail-1-psk.secret";
endpoint = "lifeline.io.grzb.de:51820"; endpoint = "212.53.203.19:51821";
allowedIPs = [ "0.0.0.0/0" ]; allowedIPs = [ "0.0.0.0/0" ];
persistentKeepalive = 25; persistentKeepalive = 25;
} }
]; ];
privateKeyFile = "/secrets/wireguard-lifeline-mail-1-mail-1-privatekey.secret"; privateKeyFile = "/secrets/wireguard-mail-1-wg0-privatekey.secret";
}; };
}; };
}; };

111
config/hosts/valkyrie/configuration.nix
View file

@ -1,4 +1,4 @@
{ ... }: { pkgs, ... }:
{ {
boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = true; boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = true;
@ -8,41 +8,90 @@
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [ 80 443 ]; allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 51827 51828 ]; allowedUDPPorts = [ 51820 51821 51827 51828 ];
}; };
wireguard = { wireguard = {
enable = true; enable = true;
interfaces.wg0 = { interfaces = {
listenPort = 51820; # Site-to-site WireGuard setup also used for nftables dnat IP refresh thingy
ips = [ wg0 = {
"10.203.10.3/24" listenPort = 51820;
]; ips = [
peers = [ "10.203.10.3/24"
{ ];
name = "site1-grzb"; peers = [
publicKey = "SJ8xCRb4hWm5EnXoV4FnwgbiaxmY2wI+xzfk+3HXERg="; {
presharedKeyFile = "/secrets/wireguard-valkyrie-site1-grzb-psk.secret"; name = "site1-grzb";
endpoint = "site1.grzb.de:51826"; publicKey = "SJ8xCRb4hWm5EnXoV4FnwgbiaxmY2wI+xzfk+3HXERg=";
allowedIPs = [ "10.203.10.1/32" "10.201.0.0/16" ]; presharedKeyFile = "/secrets/wireguard-valkyrie-site1-grzb-psk.secret";
} endpoint = "site1.grzb.de:51826";
{ allowedIPs = [ "10.203.10.1/32" "10.201.0.0/16" ];
name = "site2-grzb"; }
publicKey = "BbNeBTe6HwQuHPK+ZQXWYRZJJMPdS0h81n07omYyRl4="; {
presharedKeyFile = "/secrets/wireguard-valkyrie-site2-grzb-psk.secret"; name = "site2-grzb";
endpoint = "site2.grzb.de:51826"; publicKey = "BbNeBTe6HwQuHPK+ZQXWYRZJJMPdS0h81n07omYyRl4=";
allowedIPs = [ "10.203.10.2/32" "10.202.0.0/16" ]; presharedKeyFile = "/secrets/wireguard-valkyrie-site2-grzb-psk.secret";
} endpoint = "site2.grzb.de:51826";
{ allowedIPs = [ "10.203.10.2/32" "10.202.0.0/16" ];
name = "site2-jsts"; }
publicKey = "u9h+D8XZ62ABnetBRKnf6tjs+tJwM8fQ4d6ipOCLFyE="; {
presharedKeyFile = "/secrets/wireguard-valkyrie-site1-jsts-psk.secret"; name = "site2-jsts";
endpoint = "site1.jsts.xyz:51823"; publicKey = "u9h+D8XZ62ABnetBRKnf6tjs+tJwM8fQ4d6ipOCLFyE=";
allowedIPs = [ "10.203.10.4/32" ]; presharedKeyFile = "/secrets/wireguard-valkyrie-site1-jsts-psk.secret";
} endpoint = "site1.jsts.xyz:51823";
]; allowedIPs = [ "10.203.10.4/32" ];
privateKeyFile = "/secrets/wireguard-valkyrie-wg0-privatekey.secret"; }
];
privateKeyFile = "/secrets/wireguard-valkyrie-wg0-privatekey.secret";
};
# mail-1 VPN
wg1 = {
listenPort = 51821;
ips = [
"172.16.50.1/24"
];
peers = [
{
name = "mail-1";
publicKey = "CyKPjkY1ah/lE6V3R0XugNo28doeAtD8wEtAeDB7bHs=";
presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-valkyrie-psk.secret";
allowedIPs = [ "172.16.50.2/32" ];
}
];
postSetup = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
'';
privateKeyFile = "/secrets/wireguard-valkyrie-wg1-privatekey.secret";
};
}; };
}; };
nat = {
enable = true;
internalInterfaces = [ "wg1" ];
externalInterface = "ens3";
forwardPorts = [
{
destination = "172.16.50.2:25";
proto = "tcp";
sourcePort = 25;
}
{
destination = "172.16.50.2:465";
proto = "tcp";
sourcePort = 465;
}
{
destination = "172.16.50.2:993";
proto = "tcp";
sourcePort = 993;
}
];
};
}; };
services.prometheus.exporters.node.enable = false; services.prometheus.exporters.node.enable = false;

16
config/hosts/valkyrie/secrets.nix
View file

@ -32,4 +32,20 @@
permissions = "0640"; permissions = "0640";
uploadAt = "pre-activation"; uploadAt = "pre-activation";
}; };
deployment.keys."wireguard-valkyrie-wg1-privatekey.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/valkyrie-wg1-privatekey" ];
destDir = "/secrets";
user = "root";
group = "root";
permissions = "0640";
uploadAt = "pre-activation";
};
deployment.keys."wireguard-valkyrie-mail-1-valkyrie-psk.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/valkyrie-mail-1/psk" ];
destDir = "/secrets";
user = "root";
group = "root";
permissions = "0640";
uploadAt = "pre-activation";
};
} }

1
pkgs/wireguard-nat-nftables/default.nix
View file

@ -10,6 +10,7 @@ pkgs-overlay.python310Packages.buildPythonApplication {
version = "0.0.1"; version = "0.0.1";
propagatedBuildInputs = with pkgs-overlay; [ propagatedBuildInputs = with pkgs-overlay; [
wireguard-tools
python310Packages.nftables python310Packages.nftables
]; ];