domains/sourcephile.fr/nebula.nix

   1 { pkgs, lib, config, inputs, hostName, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   port = toString config.services.nebula.networks.${domain}.listen.port;
   5   iface = config.services.nebula.networks.${domain}.tun.device;
   6   IPv4Prefix = "10.0.0";
   7 in
   8 {
   9   environment.systemPackages = with pkgs; [ nebula ];
  10   systemd.services."nebula@${domain}" = {
  11     stopIfChanged = false;
  12     serviceConfig.LoadCredentialEncrypted = [
  13       "${hostName}.key:${builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${domain}/${hostName}.key.cred"; }}"
  14     ];
  15   };
  16   install.target = lib.mkDefault "\"\${NIXOS_TARGET:-root@${config.networking.hostName}.sp}\"";
  17   networking.hosts = {
  18     "${IPv4Prefix}.1" = [ "mermet.sp" ];
  19     "${IPv4Prefix}.2" = [ "losurdo.sp" ];
  20     "${IPv4Prefix}.3" = [ "oignon.sp" ];
  21     "${IPv4Prefix}.4" = [ "patate.sp" ];
  22     "${IPv4Prefix}.5" = [ "carotte.sp" ];
  23     "${IPv4Prefix}.6" = [ "aubergine.sp" ];
  24     "${IPv4Prefix}.7" = [ "courge.sp" ];
  25     "${IPv4Prefix}.8" = [ "blackberry.sp" ];
  26     "${IPv4Prefix}.9" = [ "pumpkin.sp" ];
  27   };
  28   services.nebula.networks.${domain} = {
  29     enable = true;
  30     ca = lib.mkDefault (builtins.path { path = inputs.self + "/domains/${domain}/nebula/ca.crt"; });
  31     cert = lib.mkDefault (builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${domain}/${hostName}.crt"; });
  32     key = "/run/credentials/nebula@${domain}.service/${hostName}.key";
  33     listen.host = lib.mkDefault "0.0.0.0";
  34     tun.device = lib.mkDefault "neb-sourcephile";
  35     staticHostMap = {
  36       "${IPv4Prefix}.1" = [ "mermet.${domain}:10001" ];
  37       "${IPv4Prefix}.2" = [ "losurdo.${domain}:10002" ];
  38     };
  39     lighthouses = [
  40       "${IPv4Prefix}.1"
  41       "${IPv4Prefix}.2"
  42     ];
  43     relays = [
  44       "${IPv4Prefix}.1"
  45     ];
  46     firewall = {
  47       inbound = [
  48         { port = "any"; proto = "icmp"; groups = [ "sourcephile" "intra" ]; }
  49       ];
  50       outbound = [
  51         { port = "any"; proto = "icmp"; groups = [ "sourcephile" "intra" ]; }
  52       ];
  53     };
  54     settings = {
  55       firewall = {
  56         conntrack = {
  57           tcp_timeout = "12m";
  58           udp_timeout = "3m";
  59           default_timeout = "10m";
  60         };
  61       };
  62       logging = {
  63         level = lib.mkDefault "info";
  64       };
  65       pki.disconnect_invalid = true;
  66       preferred_ranges = [
  67         "192.168.0.0/16"
  68       ];
  69       #cipher = "chachapoly";
  70       /*
  71       stats = {
  72         type = "prometheus";
  73         listen = "127.0.0.1:8080";
  74         path = "/metrics";
  75         namespace = "prometheusns";
  76         subsystem = "nebula";
  77         interval = "10s";
  78         message_metrics = false;
  79         lighthouse_metrics = false;
  80       };
  81       */
  82     };
  83   };
  84   networking.nftables.ruleset = ''
  85     table inet filter {
  86       chain input-lan {
  87         udp dport ${port} counter accept comment "Nebula ${domain}"
  88       }
  89       chain output-lan {
  90         udp sport ${port} counter accept comment "Nebula ${domain}"
  91       }
  92       chain input-net {
  93         udp dport ${port} counter accept comment "Nebula ${domain}"
  94       }
  95       chain output-net {
  96         udp sport ${port} counter accept comment "Nebula ${domain}"
  97       }
  98       chain input-${iface} {
  99         tcp dport ssh counter accept comment "SSH"
 100         udp dport 60000-60100 counter accept comment "Mosh"
 101       }
 102       chain output-${iface} {
 103         tcp dport ssh counter accept comment "SSH"
 104         udp dport 60000-60100 counter accept comment "Mosh"
 105       }
 106       chain input {
 107         iifname ${iface} jump input-${iface}
 108         iifname ${iface} log level warn prefix "input-${iface}: " counter drop
 109       }
 110       chain output {
 111         oifname ${iface} jump output-${iface}
 112         oifname ${iface} log level warn prefix "output-${iface}: " counter drop
 113       }
 114     }
 115   '';
 116   networking.networkmanager.unmanaged = [ iface ];
 117   services.fail2ban.ignoreIP = [
 118     "${IPv4Prefix}.1" # mermet.sp
 119     "${IPv4Prefix}.2" # losurdo.sp
 120     "${IPv4Prefix}.3" # oignon.sp
 121     "${IPv4Prefix}.9" # pumpkin.sp
 122   ];
 123 }