treewide: move nixos modules
This commit is contained in:
parent
d84be7c616
commit
8eff4c5e4f
73 changed files with 62 additions and 62 deletions
9
modules/nixos/base/network/default.nix
Normal file
9
modules/nixos/base/network/default.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./mobile.nix
|
||||
./ovh.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
}
|
||||
93
modules/nixos/base/network/mobile.nix
Normal file
93
modules/nixos/base/network/mobile.nix
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
options.chvp.base.network.mobile = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
example = true;
|
||||
};
|
||||
wireless-interface = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "wlp2s0";
|
||||
};
|
||||
wired-interfaces = lib.mkOption {
|
||||
example = { "enp0s29f0u1u2" = { macAddress = "10:65:30:85:bb:18"; }; };
|
||||
};
|
||||
};
|
||||
|
||||
config = with config.chvp.base.network.mobile; lib.mkIf enable {
|
||||
environment.systemPackages = [ pkgs.wpa_supplicant_gui ];
|
||||
users.users.charlotte.extraGroups = [ "network" ];
|
||||
users.groups.network = { };
|
||||
networking = {
|
||||
useDHCP = false;
|
||||
wireless = {
|
||||
enable = true;
|
||||
interfaces = [ wireless-interface ];
|
||||
environmentFile = config.age.secrets."passwords/networks.age".path;
|
||||
userControlled = {
|
||||
enable = true;
|
||||
group = "network";
|
||||
};
|
||||
networks = {
|
||||
"Public Universal Friend".psk = "@PSK_PUF@";
|
||||
AndroidAP.psk = "@PSK_AndroidAP@";
|
||||
draadloosnw.psk = "@PSK_draadloosnw@";
|
||||
werknet.psk = "@PSK_werknet@";
|
||||
Secorima.psk = "@PSK_Secorima@";
|
||||
"Mediaraven Guest".psk = "@PSK_Mediaraven@";
|
||||
"down".psk = "@PSK_down@";
|
||||
"Zeus WPI" = {
|
||||
psk = "@PSK_Zeus@";
|
||||
hidden = true;
|
||||
};
|
||||
"Zeus Event 5G".psk = "@PSK_Zeus@";
|
||||
"Rode Kruis-Gent (internet)".psk = "@PSK_RKG@";
|
||||
"CityStayNet".psk = "@PSK_CityStayNet@";
|
||||
eduroam = {
|
||||
authProtocols = [ "WPA-EAP" ];
|
||||
auth = ''
|
||||
eap=PEAP
|
||||
identity="@EDUROAM_USER@"
|
||||
password="@EDUROAM_PASS@"
|
||||
'';
|
||||
extraConfig = ''
|
||||
phase1="peaplabel=0"
|
||||
phase2="auth=MSCHAPV2"
|
||||
group=CCMP TKIP
|
||||
ca_cert="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
||||
altsubject_match="DNS:radius.ugent.be"
|
||||
'';
|
||||
};
|
||||
"GUK-huis".psk = "@PSK_GUKhuis@";
|
||||
"DasNetwerk".psk = "@PSK_DasNetwerk@";
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks = {
|
||||
"${wireless-interface}" = {
|
||||
enable = true;
|
||||
DHCP = "yes";
|
||||
matchConfig = { Name = wireless-interface; };
|
||||
dhcpV4Config = { RouteMetric = 20; };
|
||||
ipv6AcceptRAConfig = { RouteMetric = 20; };
|
||||
};
|
||||
} // lib.mapAttrs
|
||||
(name: attrs: {
|
||||
enable = true;
|
||||
DHCP = "yes";
|
||||
matchConfig = { Name = name; };
|
||||
dhcpV4Config = { RouteMetric = 10; };
|
||||
ipv6AcceptRAConfig = { RouteMetric = 10; };
|
||||
} // attrs)
|
||||
wired-interfaces;
|
||||
wait-online.anyInterface = true;
|
||||
};
|
||||
|
||||
age.secrets."passwords/networks.age" = {
|
||||
file = ../../../../secrets/passwords/networks.age;
|
||||
};
|
||||
};
|
||||
}
|
||||
63
modules/nixos/base/network/ovh.nix
Normal file
63
modules/nixos/base/network/ovh.nix
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
{
|
||||
options.chvp.base.network.ovh = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
example = true;
|
||||
};
|
||||
publicIPV4 = lib.mkOption {
|
||||
example = {
|
||||
ip = "1.2.3.4";
|
||||
gateway = "1.2.3.254";
|
||||
};
|
||||
};
|
||||
publicIPV6 = lib.mkOption {
|
||||
example = {
|
||||
ip = "1:2:3:4::";
|
||||
gateway = "1:2:3:ff:ff:ff:ff:ff";
|
||||
};
|
||||
};
|
||||
internalIPV4 = lib.mkOption {
|
||||
example = "192.168.0.1";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.chvp.base.network.ovh.enable {
|
||||
networking.useDHCP = false;
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks = with config.chvp.base.network.ovh; {
|
||||
eno3 = {
|
||||
enable = true;
|
||||
matchConfig = { Name = "eno3"; };
|
||||
address = [
|
||||
"${publicIPV4.ip}/24"
|
||||
"${publicIPV6.ip}/64"
|
||||
];
|
||||
gateway = [ publicIPV4.gateway ];
|
||||
routes = [
|
||||
{
|
||||
Gateway = publicIPV6.gateway;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"1.0.0.1"
|
||||
"2606:4700:4700::1111"
|
||||
"2606:4700:4700::1001"
|
||||
];
|
||||
};
|
||||
eno4 = {
|
||||
enable = true;
|
||||
matchConfig = { Name = "eno4"; };
|
||||
address = [ "${internalIPV4}/16" ];
|
||||
routes = [
|
||||
{ Destination = "${internalIPV4}/16"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
141
modules/nixos/base/network/wireguard.nix
Normal file
141
modules/nixos/base/network/wireguard.nix
Normal file
|
|
@ -0,0 +1,141 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
data = {
|
||||
fairphone = {
|
||||
pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
|
||||
ip = "10.240.0.4";
|
||||
};
|
||||
kholinar = {
|
||||
pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
|
||||
privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
|
||||
ip = "10.240.0.3";
|
||||
};
|
||||
lasting-integrity = {
|
||||
pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
|
||||
privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
|
||||
ip = "10.240.0.1";
|
||||
};
|
||||
urithiru = {
|
||||
pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
|
||||
privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
|
||||
ip = "10.240.0.2";
|
||||
};
|
||||
};
|
||||
subnet = "10.240.0.0/24";
|
||||
pskFile = config.age.secrets."files/wireguard/psk".path;
|
||||
in
|
||||
{
|
||||
options.chvp.base.network.wireguard = {
|
||||
server = lib.mkOption {
|
||||
default = false;
|
||||
example = true;
|
||||
};
|
||||
onCorporate = lib.mkOption {
|
||||
default = false;
|
||||
example = true;
|
||||
};
|
||||
};
|
||||
config = {
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
|
||||
allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
|
||||
trustedInterfaces = [ "wg0" ];
|
||||
};
|
||||
boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
|
||||
services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
|
||||
enable = true;
|
||||
resolveLocalQueries = true;
|
||||
settings = {
|
||||
server = {
|
||||
interface = [ "10.240.0.1" "127.0.0.1" "::1" ];
|
||||
access-control = [
|
||||
"127.0.0.0/8 allow"
|
||||
"10.240.0.0/24 allow"
|
||||
];
|
||||
private-domain = "internal";
|
||||
domain-insecure = "internal";
|
||||
local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data);
|
||||
local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data);
|
||||
};
|
||||
forward-zone = {
|
||||
name = ''"."'';
|
||||
forward-addr = [
|
||||
"1.1.1.1@853"
|
||||
"1.0.0.1@853"
|
||||
"2606:4700:4700::1111@853"
|
||||
"2606:4700:4700::1001@853"
|
||||
];
|
||||
forward-tls-upstream = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd = {
|
||||
network = {
|
||||
netdevs.wg0 = {
|
||||
enable = true;
|
||||
netdevConfig = {
|
||||
Name = "wg0";
|
||||
Kind = "wireguard";
|
||||
MTUBytes = "1342";
|
||||
};
|
||||
wireguardConfig =
|
||||
if config.chvp.base.network.wireguard.server then {
|
||||
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
|
||||
ListenPort = 51820;
|
||||
} else {
|
||||
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
|
||||
};
|
||||
wireguardPeers =
|
||||
if config.chvp.base.network.wireguard.server then
|
||||
(builtins.map
|
||||
(name: {
|
||||
PublicKey = data.${name}.pubkey;
|
||||
AllowedIPs = "${data.${name}.ip}/32";
|
||||
PresharedKeyFile = pskFile;
|
||||
})
|
||||
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
|
||||
else
|
||||
([{
|
||||
PublicKey = data.lasting-integrity.pubkey;
|
||||
AllowedIPs = subnet;
|
||||
Endpoint =
|
||||
if config.chvp.base.network.wireguard.onCorporate
|
||||
then "127.0.0.1:51820"
|
||||
else "lasting-integrity.vanpetegem.me:51820";
|
||||
PresharedKeyFile = pskFile;
|
||||
PersistentKeepalive = 25;
|
||||
}]);
|
||||
};
|
||||
networks.wg0 = {
|
||||
enable = true;
|
||||
name = "wg0";
|
||||
address = [ "${data.${config.networking.hostName}.ip}/32" ];
|
||||
domains = [ "internal" ];
|
||||
dns = [ data.lasting-integrity.ip ];
|
||||
linkConfig.MTUBytes = "1342";
|
||||
routes = [
|
||||
(
|
||||
if config.chvp.base.network.wireguard.server then {
|
||||
Gateway = "${data.${config.networking.hostName}.ip}";
|
||||
Destination = subnet;
|
||||
} else {
|
||||
Gateway = "${data.lasting-integrity.ip}";
|
||||
Destination = subnet;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
)
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
age.secrets."files/wireguard/psk" = {
|
||||
file = ../../../../secrets/files/wireguard/psk.age;
|
||||
owner = "systemd-network";
|
||||
};
|
||||
age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
|
||||
file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
|
||||
owner = "systemd-network";
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue