NixiN/nixin-krops
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(config): no ip range in config + format

Browse source
This commit is contained in:
Florian Schmitt 2024-12-27 11:16:49 +03:00
parent 65dbfc7190
commit 5873dcac0f
7 changed files with 179 additions and 94 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

81
config/arachnide/configuration.nix
View file

@ -1,23 +1,27 @@
{ config, pkgs, lib, ... }: {
config,
pkgs,
lib,
...
}:
{ {
imports = imports = [
[ ./hardware-configuration.nix
./hardware-configuration.nix ./network-configuration.nix
./network-configuration.nix ./proxy-configuration.nix
./proxy-configuration.nix /var/src/modules/nixin-base.nix
/var/src/modules/nixin-base.nix /var/src/modules/users.nix
/var/src/modules/users.nix /var/src/modules/wireguard-client.nix
/var/src/modules/wireguard-client.nix /var/src/modules/reverse-proxy-traefik.nix
/var/src/modules/reverse-proxy-traefik.nix /var/src/modules/nginx.nix
/var/src/modules/nginx.nix /var/src/modules/nixin-web.nix
/var/src/modules/nixin-web.nix /var/src/modules/forgejo.nix
/var/src/modules/forgejo.nix /var/src/modules/forgejo-runner.nix
/var/src/modules/forgejo-runner.nix /var/src/modules/nextcloud.nix
/var/src/modules/nextcloud.nix /var/src/modules/etherpad.nix
/var/src/modules/etherpad.nix /var/src/modules/excalidraw.nix
/var/src/modules/excalidraw.nix ];
];
# Bootloader. # Bootloader.
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
@ -30,9 +34,12 @@
}; };
nixin.wg.client = { nixin.wg.client = {
ipv4 = "192.168.12.2/32"; ipv4 = "192.168.12.2";
ipv6 = "2a01:4f9:1a:9a05::2/128"; ipv6 = "2a01:4f9:1a:9a05::2";
allowedIPs = [ "0.0.0.0/0" "::/0" ]; allowedIPs = [
"0.0.0.0/0"
"::/0"
];
endpoint = "vpn.lab12.fr:51812"; endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w="; endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
}; };
@ -53,19 +60,21 @@
smtp-user = "mr.robot@lab12.org"; smtp-user = "mr.robot@lab12.org";
smtp-from = "no-reply@lab12.org"; smtp-from = "no-reply@lab12.org";
smtp-pwd-file = toString <secrets/smtp>; smtp-pwd-file = toString <secrets/smtp>;
#smtp-pwd = let #smtp-pwd = let
# pwd = builtins.readFile <secrets/smtp>; # pwd = builtins.readFile <secrets/smtp>;
#in lib.strings.trim pwd; #in lib.strings.trim pwd;
admin-email = "sysadmin@lab12.fr"; admin-email = "sysadmin@lab12.fr";
admin-user = "operator"; admin-user = "operator";
admin-pwd = let admin-pwd =
pwd = builtins.readFile <secrets/forgejo>; let
in lib.strings.trim pwd; pwd = builtins.readFile <secrets/forgejo>;
in
lib.strings.trim pwd;
}; };
nixin.forgejo-runner = { nixin.forgejo-runner = {
token-file = "/etc/forgejo/runner.token"; token-file = "/etc/forgejo/runner.token";
#token = let #token = let
# pwd = builtins.readFile <secrets/forgejo-runner-token>; # pwd = builtins.readFile <secrets/forgejo-runner-token>;
#in lib.strings.trim pwd; #in lib.strings.trim pwd;
url = "https://forge.lab12.fr"; url = "https://forge.lab12.fr";
@ -74,9 +83,11 @@
nixin.nextcloud = { nixin.nextcloud = {
domain = "nuage.lab12.fr"; domain = "nuage.lab12.fr";
admin-user = "operator"; admin-user = "operator";
admin-pwd = let admin-pwd =
pwd = builtins.readFile <secrets/nextcloud-admin>; let
in lib.strings.trim pwd; pwd = builtins.readFile <secrets/nextcloud-admin>;
in
lib.strings.trim pwd;
host-address = "10.10.2.1"; host-address = "10.10.2.1";
container-address = "10.10.2.2"; container-address = "10.10.2.2";
address-prefix = "/24"; address-prefix = "/24";
@ -90,13 +101,19 @@
domain = "draw.lab12.fr"; domain = "draw.lab12.fr";
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ]; networking.firewall.allowedTCPPorts = [
80
144
443
];
networking.firewall.allowedUDPPorts = [ 53 ]; networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh # allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [ networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; } {
from = 60000;
to = 61000;
}
]; ];
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;

42
config/dromadaire/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }: {
config,
pkgs,
lib,
...
}:
{ {
imports = imports = [
[ ./hardware-configuration.nix
./hardware-configuration.nix ./network-configuration.nix
./network-configuration.nix /var/src/modules/nixin-base.nix
/var/src/modules/nixin-base.nix /var/src/modules/users.nix
/var/src/modules/users.nix /var/src/modules/wireguard-client.nix
/var/src/modules/wireguard-client.nix ];
];
# Bootloader. # Bootloader.
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
@ -21,19 +25,29 @@
}; };
nixin.wg.client = { nixin.wg.client = {
ipv4 = "192.168.12.11/32"; ipv4 = "192.168.12.11";
ipv6 = "2a01:4f9:1a:9a05::11/128"; ipv6 = "2a01:4f9:1a:9a05::11";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ]; allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812"; endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w="; endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ]; networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ]; #networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh # allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [ networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; } {
from = 60000;
to = 61000;
}
]; ];
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;

42
config/framboise/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }: {
config,
pkgs,
lib,
...
}:
{ {
imports = imports = [
[ ./hardware-configuration.nix
./hardware-configuration.nix ./network-configuration.nix
./network-configuration.nix /var/src/modules/nixin-base.nix
/var/src/modules/nixin-base.nix /var/src/modules/users.nix
/var/src/modules/users.nix /var/src/modules/wireguard-client.nix
/var/src/modules/wireguard-client.nix ];
];
# Bootloader. # Bootloader.
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default) # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
@ -23,19 +27,29 @@
}; };
nixin.wg.client = { nixin.wg.client = {
ipv4 = "192.168.12.10/32"; ipv4 = "192.168.12.10";
ipv6 = "2a01:4f9:1a:9a05::10/128"; ipv6 = "2a01:4f9:1a:9a05::10";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ]; allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812"; endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w="; endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ]; networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ]; #networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh # allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [ networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; } {
from = 60000;
to = 61000;
}
]; ];
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;

42
config/grille-pain/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }: {
config,
pkgs,
lib,
...
}:
{ {
imports = imports = [
[ ./hardware-configuration.nix
./hardware-configuration.nix ./network-configuration.nix
./network-configuration.nix /var/src/modules/nixin-base.nix
/var/src/modules/nixin-base.nix /var/src/modules/users.nix
/var/src/modules/users.nix /var/src/modules/wireguard-client.nix
/var/src/modules/wireguard-client.nix ];
];
# Bootloader. # Bootloader.
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default) # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
@ -23,19 +27,29 @@
}; };
nixin.wg.client = { nixin.wg.client = {
ipv4 = "192.168.12.7/32"; ipv4 = "192.168.12.7";
ipv6 = "2a01:4f9:1a:9a05::7/128"; ipv6 = "2a01:4f9:1a:9a05::7";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ]; allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812"; endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w="; endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ]; networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ]; #networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh # allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [ networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; } {
from = 60000;
to = 61000;
}
]; ];
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;

42
config/plancha/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }: {
config,
pkgs,
lib,
...
}:
{ {
imports = imports = [
[ ./hardware-configuration.nix
./hardware-configuration.nix ./network-configuration.nix
./network-configuration.nix /var/src/modules/nixin-base.nix
/var/src/modules/nixin-base.nix /var/src/modules/users.nix
/var/src/modules/users.nix /var/src/modules/wireguard-client.nix
/var/src/modules/wireguard-client.nix ];
];
# Bootloader. # Bootloader.
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default) # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
@ -23,19 +27,29 @@
}; };
nixin.wg.client = { nixin.wg.client = {
ipv4 = "192.168.12.12/32"; ipv4 = "192.168.12.12";
ipv6 = "2a01:4f9:1a:9a05::12/128"; ipv6 = "2a01:4f9:1a:9a05::12";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ]; allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812"; endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w="; endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ]; networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ]; #networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh # allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [ networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; } {
from = 60000;
to = 61000;
}
]; ];
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;

4
config/sanji/configuration.nix
View file

@ -19,8 +19,8 @@
}; };
nixin.wg.client = { nixin.wg.client = {
ipv4 = "192.168.12.5/32"; ipv4 = "192.168.12.5";
ipv6 = "2a01:4f9:1a:9a05::5/128"; ipv6 = "2a01:4f9:1a:9a05::5";
allowedIPs = [ allowedIPs = [
"192.168.12.0/24" "192.168.12.0/24"
"2a01:4f9:1a:9a05::/64" "2a01:4f9:1a:9a05::/64"

20
modules/wireguard-client.nix
View file

@ -1,8 +1,12 @@
# Wireguard VPN client configuration # Wireguard VPN client configuration
{ config, pkgs, lib, ... }: {
config,
lib,
...
}:
let let
inherit (lib) mkOption mkDefault; inherit (lib) mkOption;
in in
{ {
@ -20,8 +24,16 @@ in
networking = { networking = {
wg-quick.interfaces = { wg-quick.interfaces = {
wg0 = { wg0 = {
address = [ config.nixin.wg.client.ipv4 config.nixin.wg.client.ipv6 ]; address = [
dns = [ "80.67.169.12" "80.67.169.40" "2001:910:800::12" "2001:910:800::40" ]; "${config.nixin.wg.client.ipv4}/32"
"${config.nixin.wg.client.ipv6}/128"
];
dns = [
"80.67.169.12"
"80.67.169.40"
"2001:910:800::12"
"2001:910:800::40"
];
privateKeyFile = "/var/src/secrets/wg-private.key"; privateKeyFile = "/var/src/secrets/wg-private.key";
peers = [ peers = [