NixiN/nixin-krops
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(config): no ip range in config + format

Browse source
This commit is contained in:
Florian Schmitt 2024-12-27 11:16:49 +03:00
parent 65dbfc7190
commit 5873dcac0f
7 changed files with 179 additions and 94 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

77
config/arachnide/configuration.nix
View file

@ -1,23 +1,27 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
./hardware-configuration.nix
./network-configuration.nix
./proxy-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
/var/src/modules/reverse-proxy-traefik.nix
/var/src/modules/nginx.nix
/var/src/modules/nixin-web.nix
/var/src/modules/forgejo.nix
/var/src/modules/forgejo-runner.nix
/var/src/modules/nextcloud.nix
/var/src/modules/etherpad.nix
/var/src/modules/excalidraw.nix
];
imports = [
./hardware-configuration.nix
./network-configuration.nix
./proxy-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
/var/src/modules/reverse-proxy-traefik.nix
/var/src/modules/nginx.nix
/var/src/modules/nixin-web.nix
/var/src/modules/forgejo.nix
/var/src/modules/forgejo-runner.nix
/var/src/modules/nextcloud.nix
/var/src/modules/etherpad.nix
/var/src/modules/excalidraw.nix
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
@ -30,9 +34,12 @@
};
nixin.wg.client = {
ipv4 = "192.168.12.2/32";
ipv6 = "2a01:4f9:1a:9a05::2/128";
allowedIPs = [ "0.0.0.0/0" "::/0" ];
ipv4 = "192.168.12.2";
ipv6 = "2a01:4f9:1a:9a05::2";
allowedIPs = [
"0.0.0.0/0"
"::/0"
];
endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
};
@ -58,9 +65,11 @@
#in lib.strings.trim pwd;
admin-email = "sysadmin@lab12.fr";
admin-user = "operator";
admin-pwd = let
pwd = builtins.readFile <secrets/forgejo>;
in lib.strings.trim pwd;
admin-pwd =
let
pwd = builtins.readFile <secrets/forgejo>;
in
lib.strings.trim pwd;
};
nixin.forgejo-runner = {
@ -74,9 +83,11 @@
nixin.nextcloud = {
domain = "nuage.lab12.fr";
admin-user = "operator";
admin-pwd = let
pwd = builtins.readFile <secrets/nextcloud-admin>;
in lib.strings.trim pwd;
admin-pwd =
let
pwd = builtins.readFile <secrets/nextcloud-admin>;
in
lib.strings.trim pwd;
host-address = "10.10.2.1";
container-address = "10.10.2.2";
address-prefix = "/24";
@ -90,13 +101,19 @@
domain = "draw.lab12.fr";
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ];
networking.firewall.allowedTCPPorts = [
80
144
443
];
networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; }
{
from = 60000;
to = 61000;
}
];
# Or disable the firewall altogether.
# networking.firewall.enable = false;

42
config/dromadaire/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
imports = [
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
@ -21,19 +25,29 @@
};
nixin.wg.client = {
ipv4 = "192.168.12.11/32";
ipv6 = "2a01:4f9:1a:9a05::11/128";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ];
ipv4 = "192.168.12.11";
ipv6 = "2a01:4f9:1a:9a05::11";
allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ];
networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; }
{
from = 60000;
to = 61000;
}
];
# Or disable the firewall altogether.
# networking.firewall.enable = false;

42
config/framboise/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
imports = [
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
# Bootloader.
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
@ -23,19 +27,29 @@
};
nixin.wg.client = {
ipv4 = "192.168.12.10/32";
ipv6 = "2a01:4f9:1a:9a05::10/128";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ];
ipv4 = "192.168.12.10";
ipv6 = "2a01:4f9:1a:9a05::10";
allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ];
networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; }
{
from = 60000;
to = 61000;
}
];
# Or disable the firewall altogether.
# networking.firewall.enable = false;

42
config/grille-pain/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
imports = [
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
# Bootloader.
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
@ -23,19 +27,29 @@
};
nixin.wg.client = {
ipv4 = "192.168.12.7/32";
ipv6 = "2a01:4f9:1a:9a05::7/128";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ];
ipv4 = "192.168.12.7";
ipv6 = "2a01:4f9:1a:9a05::7";
allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ];
networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; }
{
from = 60000;
to = 61000;
}
];
# Or disable the firewall altogether.
# networking.firewall.enable = false;

42
config/plancha/configuration.nix
View file

@ -1,14 +1,18 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
imports = [
./hardware-configuration.nix
./network-configuration.nix
/var/src/modules/nixin-base.nix
/var/src/modules/users.nix
/var/src/modules/wireguard-client.nix
];
# Bootloader.
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
@ -23,19 +27,29 @@
};
nixin.wg.client = {
ipv4 = "192.168.12.12/32";
ipv6 = "2a01:4f9:1a:9a05::12/128";
allowedIPs = [ "192.168.12.0/24" "2a01:4f9:1a:9a05::/64" ];
ipv4 = "192.168.12.12";
ipv6 = "2a01:4f9:1a:9a05::12";
allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"
];
endpoint = "vpn.lab12.fr:51812";
endpointKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 144 443 ];
networking.firewall.allowedTCPPorts = [
80
144
443
];
#networking.firewall.allowedUDPPorts = [ 53 ];
# allow UDP port range for mosh
networking.firewall.allowedUDPPortRanges = [
{ from = 60000; to = 61000; }
{
from = 60000;
to = 61000;
}
];
# Or disable the firewall altogether.
# networking.firewall.enable = false;

4
config/sanji/configuration.nix
View file

@ -19,8 +19,8 @@
};
nixin.wg.client = {
ipv4 = "192.168.12.5/32";
ipv6 = "2a01:4f9:1a:9a05::5/128";
ipv4 = "192.168.12.5";
ipv6 = "2a01:4f9:1a:9a05::5";
allowedIPs = [
"192.168.12.0/24"
"2a01:4f9:1a:9a05::/64"

20
modules/wireguard-client.nix
View file

@ -1,8 +1,12 @@
# Wireguard VPN client configuration
{ config, pkgs, lib, ... }:
{
config,
lib,
...
}:
let
inherit (lib) mkOption mkDefault;
inherit (lib) mkOption;
in
{
@ -20,8 +24,16 @@ in
networking = {
wg-quick.interfaces = {
wg0 = {
address = [ config.nixin.wg.client.ipv4 config.nixin.wg.client.ipv6 ];
dns = [ "80.67.169.12" "80.67.169.40" "2001:910:800::12" "2001:910:800::40" ];
address = [
"${config.nixin.wg.client.ipv4}/32"
"${config.nixin.wg.client.ipv6}/128"
];
dns = [
"80.67.169.12"
"80.67.169.40"
"2001:910:800::12"
"2001:910:800::40"
];
privateKeyFile = "/var/src/secrets/wg-private.key";
peers = [