This commit is contained in:
Giulio De Pasquale 2021-10-11 11:34:26 +02:00
commit c9966c2f9b
7 changed files with 212 additions and 60 deletions

5
acme.nix Normal file
View File

@ -0,0 +1,5 @@
{ ... }:
{
security.acme.acceptTerms = true;
security.acme.email = "sysadmin@giugl.io";
}

View File

@ -1,4 +1,4 @@
{ pkgs, variables, ... }: { config, pkgs, variables, lib, ... }:
{ {
console = { console = {
@ -49,10 +49,4 @@
tree tree
smartmontools smartmontools
]; ];
fileSystems."/var/cache" = {
device = "tmpfs";
fsType = "tmpfs";
options = ["size=3G"];
};
} }

View File

@ -8,57 +8,13 @@
}; };
}; };
outputs = { self, nixpkgs, nixos-unstable, home-manager }: outputs = { self, nixpkgs, nixos-unstable, home-manager }: let
let util = import ./utils.nix { inherit nixpkgs nixos-unstable home-manager; };
system = "x86_64-linux";
unstable = import nixos-unstable {
inherit system;
config.allowUnfree = true;
};
pkgs = import nixpkgs {
inherit system;
config.allowUnfree = true;
overlays = [ (final: prev: { inherit unstable; }) ];
};
in { in {
nixosConfigurations.architect = nixpkgs.lib.nixosSystem { nixosConfigurations = {
inherit system; architect = util.mkHost { name = "architect"; };
gAluminum = util.mkHost { name = "gAluminum"; };
modules = [ proxy = util.mkHost { name = "proxy"; };
{
nixpkgs.pkgs = pkgs;
nix.nixPath = [
"nixpkgs=${nixpkgs}"
"unstable=${nixos-unstable}"
];
nix.registry.nixpkgs.flake = nixpkgs;
nix.registry.unstable.flake = nixos-unstable;
}
home-manager.nixosModules.home-manager
./hosts/architect/default.nix
];
};
nixosConfigurations.gAluminum = nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{
nixpkgs.pkgs = pkgs;
nix.nixPath = [
"nixpkgs=${nixpkgs}"
"unstable=${nixos-unstable}"
];
nix.registry.nixpkgs.flake = nixpkgs;
nix.registry.unstable.flake = nixos-unstable;
}
home-manager.nixosModules.home-manager
./hosts/gAluminum/default.nix
];
}; };
}; };
} }

66
hosts/proxy/coturn.nix Normal file
View File

@ -0,0 +1,66 @@
{pkgs, config, ...}:
let
realm = "turn.giugl.io";
static-auth-secret = "69duck duck fuck420";
in {
services.coturn = rec {
enable = true;
no-cli = true;
no-tcp-relay = true;
min-port = 49000;
max-port = 50000;
use-auth-secret = true;
# cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
# pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
extraConfig = ''
# for debugging
verbose
# ban private IP ranges
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
'';
};
# open the firewall
networking.firewall = {
interfaces.ens3 = let
range = with config.services.coturn; [ {
from = min-port;
to = max-port;
} ];
in
{
allowedUDPPortRanges = range;
allowedUDPPorts = [ 3478 ];
allowedTCPPortRanges = range;
allowedTCPPorts = [ 3478 ];
};
};
# get a certificate
# security.acme.certs.${realm} = {
# webroot = "/var/lib/acme/acme-challenge";
# postRun = "systemctl restart coturn.service";
# group = "turnserver";
# };
}

70
hosts/proxy/default.nix Normal file
View File

@ -0,0 +1,70 @@
{ config, pkgs, ... }:
{
imports =
[
./hardware-configuration.nix
./coturn.nix
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
system.stateVersion = "21.05"; # Did you read the comment?
boot.loader.grub.devices = [ "/dev/sda" ];
services.openssh.permitRootLogin = "prohibit-password";
services.openssh.passwordAuthentication = false;
services.openssh.enable = true;
networking = {
useDHCP = false;
hostName = "proxy";
nameservers = [ "10.4.0.2" "1.1.1.1" ];
firewall.allowedTCPPorts = [ 22 ];
interfaces.ens3.useDHCP = true;
nat = {
enable = true;
externalInterface = "ens3";
internalInterfaces = ["wg0"];
forwardPorts = [
{
destination = "10.4.0.2:1194";
proto = "udp";
sourcePort = 1194;
}
];
};
wireguard = {
interfaces."wg0" = {
listenPort = 1195;
ips = [ "10.4.0.1/24" ];
privateKeyFile = "/secrets/wireguard/server.key";
postSetup = ''
/run/current-system/sw/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
'';
postShutdown = ''
/run/current-system/sw/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
'';
peers = [
{
allowedIPs = [ "10.4.0.2" "10.3.0.0/24" ];
publicKey = "73oFhyQA3mgX4GmN6ul5HuOsgxa4INlzCPsyuXna0AA=";
}
];
};
};
};
services = {
fail2ban.enable = true;
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCuURERnIFe2XbNu6AsPe2DO11RuaHxVGUcaoJUsIB1F+VOggOVLhxSenOPYLm6NvvGeXVi95G5Sm1UZRcJEEkvxus4bSViV4t/Q2azfYFE27yRH/IeMMoWNPGYNm5Bok2qFb4vHifra9FffwXnOzr0nDDTdHXCft4TO5nsenLJwqu5zOO1CR7J52otY7LheNPyzbGxgIkB3Y7LeOj1+/xXSOJ379NOL2RQBobsg7k442WCX7tU6AC1ct3W+93tcJUUdzJKTT9TJ+XmhdjXNWhDd+QZUNAMr+nKoEdExHp0H40/wIhcLD2OV95gX4i/YBzCg4OQOqZqWiibiEQfGTSAh5aD+nX/PqjXf0XSLEUOA81biLFu28oO8gocjwnhgqmlghvO4SG1rs6uZ8EyPyWsrVMjy8B9FX4aloKqua3aicgC+upjLl3x+KkMJizlMB5Ew7KOjPsjXwMqeJmeBOEd6TSEctttR+lIp+/368FtwXeBxzx9MBT4620mnjWtVKM= giulio@gAluminum"
];
}

View File

@ -0,0 +1,23 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/8b5bcd4a-02b8-4e11-b856-eda792b8b7b8";
fsType = "ext4";
};
swapDevices = [ ];
}

38
utils.nix Normal file
View File

@ -0,0 +1,38 @@
{ nixos-unstable, nixpkgs, home-manager, ... }:
{
mkHost = {name}:
let
system = "x86_64-linux";
unstable = import nixos-unstable {
inherit system;
config.allowUnfree = true;
};
pkgs = import nixpkgs {
inherit system;
config.allowUnfree = true;
overlays = [ (final: prev: { inherit unstable; }) ];
};
in nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{
nixpkgs.pkgs = pkgs;
nix.nixPath = [
"nixpkgs=${nixpkgs}"
"unstable=${nixos-unstable}"
];
nix.registry.nixpkgs.flake = nixpkgs;
nix.registry.unstable.flake = nixos-unstable;
}
./common.nix
./users.nix
home-manager.nixosModules.home-manager
./hosts/${name}/default.nix
./acme.nix
];
};
}