peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

cleanup

Browse Source
This commit is contained in:
Giulio De Pasquale 2021-10-06 17:31:41 +00:00
parent caedfac586
commit ced9c72d4a
1 changed files with 49 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
hosts/proxy/default.nix
View File

@ -9,61 +9,62 @@
boot.loader.grub.enable = true; boot.loader.grub.enable = true;
boot.loader.grub.version = 2; boot.loader.grub.version = 2;
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true;
networking.hostName = "proxy";
environment.systemPackages = with pkgs; [
neovim
git
tcpdump
];
networking.nameservers = [ "10.4.0.2" "1.1.1.1" ];
networking.firewall.allowedTCPPorts = [ 22 ];
system.stateVersion = "21.05"; # Did you read the comment? system.stateVersion = "21.05"; # Did you read the comment?
boot.loader.grub.devices = [ "/dev/sda" ]; boot.loader.grub.devices = [ "/dev/sda" ];
services.openssh.permitRootLogin = "prohibit-password"; services.openssh.permitRootLogin = "prohibit-password";
services.openssh.passwordAuthentication = false; services.openssh.passwordAuthentication = false;
services.openssh.enable = true; services.openssh.enable = true;
networking.nat = { networking = {
enable = true; useDHCP = false;
externalInterface = "ens3"; hostName = "proxy";
internalInterfaces = ["wg0"]; nameservers = [ "10.4.0.2" "1.1.1.1" ];
forwardPorts = [
{ firewall.allowedTCPPorts = [ 22 ];
destination = "10.4.0.2:1194"; interfaces.ens3.useDHCP = true;
proto = "udp";
sourcePort = 1194;
}
];
};
networking.wireguard = { nat = {
interfaces."wg0" = { enable = true;
listenPort = 1195; externalInterface = "ens3";
ips = [ "10.4.0.1/24" ]; internalInterfaces = ["wg0"];
privateKeyFile = "/secrets/wireguard/server.key"; forwardPorts = [
postSetup = ''
/run/current-system/sw/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
'';
postShutdown = ''
/run/current-system/sw/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
'';
peers = [
{ {
# architect destination = "10.4.0.2:1194";
allowedIPs = [ "10.4.0.2" "10.3.0.0/24" ]; proto = "udp";
publicKey = "73oFhyQA3mgX4GmN6ul5HuOsgxa4INlzCPsyuXna0AA="; sourcePort = 1194;
} }
]; ];
}; };
};
users.users.root.openssh.authorizedKeys.keys = [ wireguard = {
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCuURERnIFe2XbNu6AsPe2DO11RuaHxVGUcaoJUsIB1F+VOggOVLhxSenOPYLm6NvvGeXVi95G5Sm1UZRcJEEkvxus4bSViV4t/Q2azfYFE27yRH/IeMMoWNPGYNm5Bok2qFb4vHifra9FffwXnOzr0nDDTdHXCft4TO5nsenLJwqu5zOO1CR7J52otY7LheNPyzbGxgIkB3Y7LeOj1+/xXSOJ379NOL2RQBobsg7k442WCX7tU6AC1ct3W+93tcJUUdzJKTT9TJ+XmhdjXNWhDd+QZUNAMr+nKoEdExHp0H40/wIhcLD2OV95gX4i/YBzCg4OQOqZqWiibiEQfGTSAh5aD+nX/PqjXf0XSLEUOA81biLFu28oO8gocjwnhgqmlghvO4SG1rs6uZ8EyPyWsrVMjy8B9FX4aloKqua3aicgC+upjLl3x+KkMJizlMB5Ew7KOjPsjXwMqeJmeBOEd6TSEctttR+lIp+/368FtwXeBxzx9MBT4620mnjWtVKM= giulio@gAluminum" interfaces."wg0" = {
]; listenPort = 1195;
} ips = [ "10.4.0.1/24" ];
privateKeyFile = "/secrets/wireguard/server.key";
postSetup = ''
/run/current-system/sw/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
'';
postShutdown = ''
/run/current-system/sw/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
'';
peers = [
{
allowedIPs = [ "10.4.0.2" "10.3.0.0/24" ];
publicKey = "73oFhyQA3mgX4GmN6ul5HuOsgxa4INlzCPsyuXna0AA=";
}
];
};
};
};
services = {
fail2ban.enable = true;
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCuURERnIFe2XbNu6AsPe2DO11RuaHxVGUcaoJUsIB1F+VOggOVLhxSenOPYLm6NvvGeXVi95G5Sm1UZRcJEEkvxus4bSViV4t/Q2azfYFE27yRH/IeMMoWNPGYNm5Bok2qFb4vHifra9FffwXnOzr0nDDTdHXCft4TO5nsenLJwqu5zOO1CR7J52otY7LheNPyzbGxgIkB3Y7LeOj1+/xXSOJ379NOL2RQBobsg7k442WCX7tU6AC1ct3W+93tcJUUdzJKTT9TJ+XmhdjXNWhDd+QZUNAMr+nKoEdExHp0H40/wIhcLD2OV95gX4i/YBzCg4OQOqZqWiibiEQfGTSAh5aD+nX/PqjXf0XSLEUOA81biLFu28oO8gocjwnhgqmlghvO4SG1rs6uZ8EyPyWsrVMjy8B9FX4aloKqua3aicgC+upjLl3x+KkMJizlMB5Ew7KOjPsjXwMqeJmeBOEd6TSEctttR+lIp+/368FtwXeBxzx9MBT4620mnjWtVKM= giulio@gAluminum"
];
}