dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos: Test setup with public networking

Browse Source
This commit is contained in:
Jack O'Sullivan
2022-05-28 22:59:50 +01:00
parent 32421f7af1
commit e6e4a1d38e
6 changed files with 98 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
nixos/vms/estuary/default.nix
View File

@@ -11,7 +11,8 @@
address = "10.100.0.1";
gateway = null;
};
ipv6.address = "2a0e:97c0:4d1:0::1";
#ipv6.address = "2a0e:97c0:4d1:0::1";
ipv6.address = "2a0e:97c0:4d0:bbb0::1";
};
configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -62,13 +63,6 @@
};
networks = {
#"80-wan" = {
# matchConfig.Name = "wan";
# address = [
# "1.2.3.4/24"
# "2a00::2/64"
# ];
#};
"80-wan" = {
matchConfig.Name = "wan";
DHCP = "ipv4";
@@ -76,6 +70,13 @@
UseDNS = false;
UseHostname = false;
};
address = [
"2a0e:97c0:4d0:bbbf::1/64"
];
gateway = [
"fe80::215:17ff:fe4b:494a"
];
networkConfig.IPv6AcceptRA = false;
};
"80-base" = mkMerge [
(networkdAssignment "base" assignments.internal)
@@ -92,7 +93,8 @@
};
ipv6Prefixes = [
{
ipv6PrefixConfig.Prefix = "2a0e:97c0:4d1:0::/64";
#ipv6PrefixConfig.Prefix = "2a0e:97c0:4d1:0::/64";
ipv6PrefixConfig.Prefix = "2a0e:97c0:4d0:bbb0::/64";
}
];
}
@@ -101,17 +103,40 @@
};
my = {
#deploy.generate.system.mode = "boot";
secrets.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhxM5mnguExkcLue47QKk1vA72OoPc3HOqqoHqHHfa1";
server.enable = true;
firewall = {
trustedInterfaces = [ "base" ];
udp.allowed = [ 5353 ];
tcp.allowed = [ 5353 ];
nat = {
enable = true;
externalInterface = "wan";
};
extraRules = ''
table nat {
table inet filter {
chain routing-tcp {
# Safe enough to allow all SSH
tcp dport ssh accept
}
chain routing-udp {
}
chain filter-routing {
tcp flags & (fin|syn|rst|ack) == syn ct state new jump routing-tcp
meta l4proto udp ct state new jump routing-udp
return
}
chain forward {
iifname wan oifname base jump filter-routing
}
}
table inet nat {
chain prerouting {
iifname wan meta l4proto { udp, tcp } th dport domain redirect to :5353
}
chain postrouting {
ip saddr 10.100.0.0/16 masquerade
}

13
nixos/vms/estuary/dns.nix
View File

@@ -5,8 +5,8 @@ let
ptrDots = 2;
reverseZone = "100.10.in-addr.arpa";
ptrDots6 = 20;
reverseZone6 = "1.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa";
ptrDots6 = 17;
reverseZone6 = "b.b.b.0.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa";
authZones = attrNames config.my.pdns.auth.bind.zones;
in
@@ -22,6 +22,8 @@ in
allowFrom = [
"127.0.0.0/8" "::1/128"
"10.100.0.0/16" "2a0e:97c0:4d1::/48"
# TODO: Remove when moving to proper net!
"2a0e:97c0:4d0::/48"
];
};
forwardZones = genAttrs authZones (_: "127.0.0.1:5353");
@@ -46,8 +48,8 @@ in
resolver = "127.0.0.1";
expand-alias = true;
local-address = [
"127.0.0.1:5353" "[::]:5353"
] ++ (optional (!config.my.build.isDevVM) "192.168.122.126");
"0.0.0.0:5353" "[::]:5353"
];
also-notify = [ "127.0.0.1" ];
};
@@ -85,7 +87,8 @@ in
)
@ IN NS ns
ns IN ALIAS ${config.networking.fqdn}.
ns IN A 188.141.14.6
ns IN AAAA 2a0e:97c0:4d0:bbbf::1
@ IN ALIAS ${config.networking.fqdn}.