]> Git — Sourcephile - julm/julm-nix.git/blob - share/nebula/sourcephile.fr.nix
git: add patch alias for radicle
[julm/julm-nix.git] / share / nebula / sourcephile.fr.nix
1 { pkgs, lib, config, inputs, hostName, ... }:
2 let
3 domain = "sourcephile.fr";
4 port = toString config.services.nebula.networks.${domain}.listen.port;
5 iface = config.services.nebula.networks.${domain}.tun.device;
6 IPv4Prefix = "10.0.0";
7 in
8 {
9 environment.systemPackages = with pkgs; [ nebula ];
10 systemd.services."nebula@${domain}" = {
11 stopIfChanged = false;
12 serviceConfig.LoadCredentialEncrypted = [
13 "${hostName}.key:${builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${hostName}.key.cred"; }}"
14 ];
15 };
16 install.target = lib.mkDefault "\"\${NIXOS_TARGET:-root@${config.networking.hostName}.sp}\"";
17 networking.hosts = {
18 "${IPv4Prefix}.1" = [ "mermet.sp" ];
19 "${IPv4Prefix}.2" = [ "losurdo.sp" ];
20 "${IPv4Prefix}.3" = [ "oignon.sp" ];
21 "${IPv4Prefix}.4" = [ "patate.sp" ];
22 "${IPv4Prefix}.5" = [ "carotte.sp" ];
23 "${IPv4Prefix}.6" = [ "aubergine.sp" ];
24 "${IPv4Prefix}.7" = [ "courge.sp" ];
25 };
26 services.nebula.networks.${domain} = {
27 enable = true;
28 ca = lib.mkDefault (./. + "/${domain}/ca.crt");
29 cert = lib.mkDefault (builtins.path { path = inputs.self + "/share/nebula/${domain}/${hostName}.crt"; });
30 key = "/run/credentials/nebula@${domain}.service/${hostName}.key";
31 listen.host = lib.mkDefault "0.0.0.0";
32 tun.device = lib.mkDefault "neb-sourcephile";
33 staticHostMap = {
34 "${IPv4Prefix}.1" = [ "mermet.${domain}:10001" ];
35 "${IPv4Prefix}.2" = [ "losurdo.${domain}:10002" ];
36 };
37 lighthouses = [
38 "${IPv4Prefix}.1"
39 "${IPv4Prefix}.2"
40 ];
41 relays = [
42 "${IPv4Prefix}.1"
43 ];
44 firewall = {
45 inbound = [
46 { port = "any"; proto = "icmp"; groups = [ "sourcephile" "intra" ]; }
47 ];
48 outbound = [
49 { port = "any"; proto = "icmp"; groups = [ "sourcephile" "intra" ]; }
50 ];
51 };
52 settings = {
53 firewall = {
54 conntrack = {
55 tcp_timeout = "12m";
56 udp_timeout = "3m";
57 default_timeout = "10m";
58 };
59 };
60 logging = {
61 level = lib.mkDefault "info";
62 };
63 pki.disconnect_invalid = true;
64 preferred_ranges = [
65 "192.168.0.0/16"
66 ];
67 #cipher = "chachapoly";
68 /*
69 stats = {
70 type = "prometheus";
71 listen = "127.0.0.1:8080";
72 path = "/metrics";
73 namespace = "prometheusns";
74 subsystem = "nebula";
75 interval = "10s";
76 message_metrics = false;
77 lighthouse_metrics = false;
78 };
79 */
80 };
81 };
82 networking.nftables.ruleset = ''
83 table inet filter {
84 chain input-lan {
85 udp dport ${port} counter accept comment "Nebula ${domain}"
86 }
87 chain output-lan {
88 udp sport ${port} counter accept comment "Nebula ${domain}"
89 }
90 chain input-net {
91 udp dport ${port} counter accept comment "Nebula ${domain}"
92 }
93 chain output-net {
94 udp sport ${port} counter accept comment "Nebula ${domain}"
95 }
96 chain input-${iface} {
97 tcp dport ssh counter accept comment "SSH"
98 udp dport 60000-60100 counter accept comment "Mosh"
99 }
100 chain output-${iface} {
101 tcp dport ssh counter accept comment "SSH"
102 udp dport 60000-60100 counter accept comment "Mosh"
103 }
104 chain input {
105 iifname ${iface} jump input-${iface}
106 iifname ${iface} log level warn prefix "input-${iface}: " counter drop
107 }
108 chain output {
109 oifname ${iface} jump output-${iface}
110 oifname ${iface} log level warn prefix "output-${iface}: " counter drop
111 }
112 }
113 '';
114 networking.networkmanager.unmanaged = [ iface ];
115 services.fail2ban.ignoreIP = [
116 "${IPv4Prefix}.1" # mermet.sp
117 "${IPv4Prefix}.2" # losurdo.sp
118 "${IPv4Prefix}.3" # oignon.sp
119 ];
120 }