peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: peperunas:99cf228d80ef5ac56420fd717241d6a767038bae
Branches Tags
peperunas:master
peperunas:nixos-21.11
peperunas:laptopshit
..
compare: peperunas:9aea844ccbc83ff273f7a48db87861aee2bd481a
Branches Tags
peperunas:master
peperunas:nixos-21.11
peperunas:laptopshit

No commits in common. "99cf228d80ef5ac56420fd717241d6a767038bae" and "9aea844ccbc83ff273f7a48db87861aee2bd481a" have entirely different histories.
99cf228d80 ... 9aea844ccb

4 changed files with 17 additions and 11 deletions
Show Stats Expand all files Collapse all files

3
hosts/architect/firewall.nix
View File

@ -157,11 +157,12 @@ in {
ip daddr 255.255.255.255 accept comment "allow broadcast traffic"
ip daddr 224.0.0.0/4 accept comment "allow multicast traffic"
ip saddr ${lan-net} accept comment "lan > local"
ip saddr ${tailscale-net} accept comment "tailscale > local"
ip saddr {${lib.concatStringsSep "," gdevices-wg}} accept comment "vpn > local"
iifname ${wan-if} tcp dport {${open_tcp_ports}} accept
iifname ${wan-if} udp dport {${open_udp_ports}} accept
iifname ${tailscale-if} tcp dport {${open_tcp_ports_vpn}} accept
iifname ${tailscale-if} udp dport {${open_udp_ports_vpn}} accept
iifname ${vpn-if} tcp dport {${open_tcp_ports_vpn}} accept
iifname ${vpn-if} udp dport {${open_udp_ports_vpn}} accept
iifname ${vpn-if} icmp type echo-request accept

3
hosts/architect/network.nix
View File

@ -56,10 +56,7 @@ rec {
hotpottino-wg = "10.3.0.201";
dodino-wg = "10.3.0.202";
giuliophone-ts = "100.68.68.46";
architect-ts = "100.67.205.28";
giuliopc-ts = "100.124.78.64";
dodino-ts = "100.106.244.35";
# groups
gdevices-wg =

7
hosts/architect/tailscale.nix
View File

@ -2,9 +2,9 @@
let
network = import ./network.nix;
auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
ifname = "ts0";
in {
in rec {
services = {
tailscale = {
enable = true;
@ -14,8 +14,5 @@ in {
networking.extraHosts = ''
${network.architect-ts} architect.devs.giugl.io
${network.giuliopc-ts} kmerr.devs.giugl.io
${network.dodino-ts} dodino.devs.giugl.io
${network.giuliophone-ts} chuck.devs.giugl.io
'';
}

15
hosts/architect/wireguard.nix
View File

@ -2,8 +2,8 @@ with import ./network.nix; {
networking = {
extraHosts = ''
${architect-wg} architect.devs.giugl.io
${giuliopc-wg} kmerr.devs.giugl.io
${giuliophone-wg} chuck.devs.giugl.io
${giuliopc-wg} giuliopc.devs.giugl.io
${giuliophone-wg} giuliophone.devs.giugl.io
${manduria-wg} manduria.devs.giugl.io
${antonio-wg} antonio.devs.giugl.io
${gbeast-wg} gbeast.devs.giugl.io
@ -36,6 +36,17 @@ with import ./network.nix; {
'';
wireguard = {
# interfaces.${proxy-if} = {
# ips = [ "10.4.0.2/32" ];
# privateKeyFile = "/secrets/wireguard/proxy.key";
# peers = [{
# publicKey = "WmJBpXpYebcmJEF8nVTKMqQK01KyBe42vzc38K66rVs=";
# allowedIPs = [ "10.4.0.1/32" ];
# endpoint = "giugl.io:1195";
# persistentKeepalive = 21;
# }];
# };
interfaces.${vpn-if} = {
listenPort = 1194;
ips = [ "10.3.0.1/24" ];