domains/sourcephile.fr/nebula.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   inputs,
   6   hostName,
   7   ...
   8 }:
   9 let
  10   domain = "sourcephile.fr";
  11   port = toString config.services.nebula.networks.${domain}.listen.port;
  12   iface = config.services.nebula.networks.${domain}.tun.device;
  13   IPv4Prefix = "10.0.0";
  14 in
  15 {
  16   environment.systemPackages = with pkgs; [ nebula ];
  17   systemd.services."nebula@${domain}" = {
  18     reloadIfChanged = false;
  19     stopIfChanged = false;
  20     after = [ "chronyd.service" ];
  21     serviceConfig.LoadCredentialEncrypted = [
  22       "${hostName}.key:${
  23         builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${domain}/${hostName}.key.cred"; }
  24       }"
  25     ];
  26   };
  27   install.target = lib.mkDefault "root@${config.networking.hostName}.sp";
  28   networking.hosts = {
  29     "${IPv4Prefix}.1" = [ "mermet.sp" ];
  30     "${IPv4Prefix}.2" = [ "losurdo.sp" ];
  31     "${IPv4Prefix}.3" = [ "oignon.sp" ];
  32     "${IPv4Prefix}.4" = [ "patate.sp" ];
  33     "${IPv4Prefix}.5" = [ "carotte.sp" ];
  34     "${IPv4Prefix}.6" = [ "aubergine.sp" ];
  35     "${IPv4Prefix}.7" = [ "courge.sp" ];
  36     "${IPv4Prefix}.8" = [ "blackberry.sp" ];
  37     "${IPv4Prefix}.9" = [ "pumpkin.sp" ];
  38     "${IPv4Prefix}.10" = [ "nan2gua1.sp" ];
  39   };
  40   services.nebula.networks.${domain} = {
  41     enable = true;
  42     ca = lib.mkDefault (builtins.path { path = inputs.self + "/domains/${domain}/nebula/ca.crt"; });
  43     cert = lib.mkDefault (
  44       builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${domain}/${hostName}.crt"; }
  45     );
  46     key = "/run/credentials/nebula@${domain}.service/${hostName}.key";
  47     listen.host = lib.mkDefault "0.0.0.0";
  48     tun.device = lib.mkDefault "neb-sourcephile";
  49     staticHostMap = {
  50       "${IPv4Prefix}.1" = [
  51         "mermet.${domain}:10001"
  52         "80.67.180.129:10001"
  53       ];
  54       "${IPv4Prefix}.2" = [
  55         "losurdo.${domain}:10002"
  56         "88.140.48.201:10002"
  57       ];
  58     };
  59     lighthouses = [
  60       "${IPv4Prefix}.1"
  61       "${IPv4Prefix}.2"
  62     ];
  63     relays = [
  64       "${IPv4Prefix}.1"
  65     ];
  66     firewall = {
  67       inbound = [
  68         {
  69           port = "any";
  70           proto = "icmp";
  71           groups = [
  72             "sourcephile"
  73             "intra"
  74           ];
  75         }
  76       ];
  77       outbound = [
  78         {
  79           port = "any";
  80           proto = "icmp";
  81           groups = [
  82             "sourcephile"
  83             "intra"
  84           ];
  85         }
  86       ];
  87     };
  88     settings = {
  89       firewall = {
  90         conntrack = {
  91           tcp_timeout = "12m";
  92           udp_timeout = "3m";
  93           default_timeout = "10m";
  94         };
  95       };
  96       logging = {
  97         level = lib.mkDefault "info";
  98       };
  99       pki.disconnect_invalid = true;
 100       preferred_ranges = [
 101         "192.168.0.0/16"
 102       ];
 103       #cipher = "chachapoly";
 104       /*
 105         stats = {
 106           type = "prometheus";
 107           listen = "127.0.0.1:8080";
 108           path = "/metrics";
 109           namespace = "prometheusns";
 110           subsystem = "nebula";
 111           interval = "10s";
 112           message_metrics = false;
 113           lighthouse_metrics = false;
 114         };
 115       */
 116     };
 117   };
 118   networking.nftables.ruleset = ''
 119     table inet filter {
 120       chain input-lan {
 121         udp dport ${port} counter accept comment "Nebula ${domain}"
 122       }
 123       chain output-lan {
 124         udp sport ${port} counter accept comment "Nebula ${domain}"
 125       }
 126       chain input-net {
 127         udp dport ${port} counter accept comment "Nebula ${domain}"
 128       }
 129       chain output-net {
 130         udp sport ${port} counter accept comment "Nebula ${domain}"
 131       }
 132       chain input-${iface} {
 133         tcp dport ssh counter accept comment "SSH"
 134         udp dport 60000-60100 counter accept comment "Mosh"
 135       }
 136       chain output-${iface} {
 137         tcp dport ssh counter accept comment "SSH"
 138         tcp dport {http,https} counter accept comment "HTTP"
 139         udp dport 60000-60100 counter accept comment "Mosh"
 140       }
 141       chain input {
 142         iifname ${iface} jump input-${iface} comment "MUST be before the address-based jumps to input-lan"
 143         iifname ${iface} log level warn prefix "input-${iface}: " counter drop
 144       }
 145       chain output {
 146         oifname ${iface} jump output-${iface}
 147         oifname ${iface} log level warn prefix "output-${iface}: " counter drop
 148       }
 149     }
 150   ''
 151   + lib.optionalString config.services.printing.enable ''
 152     table inet filter {
 153       chain output-${iface} {
 154         tcp dport { ipp, ipps } counter accept comment "printing: IPP"
 155       }
 156     }
 157   ''
 158   + lib.optionalString config.hardware.sane.enable ''
 159     table inet filter {
 160       chain output-${iface} {
 161         tcp dport sane-port counter accept comment "sane-net: SANE"
 162       }
 163     }
 164   '';
 165   networking.networkmanager.unmanaged = [ iface ];
 166   services.fail2ban.ignoreIP = [
 167     "${IPv4Prefix}.1" # mermet.sp
 168     "${IPv4Prefix}.2" # losurdo.sp
 169     "${IPv4Prefix}.3" # oignon.sp
 170     "${IPv4Prefix}.9" # pumpkin.sp
 171     "${IPv4Prefix}.10" # nan2gua1.sp
 172   ];
 173 }