domains/sourcephile.fr/nebula.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   inputs,
   6   hostName,
   7   ...
   8 }:
   9 let
  10   domain = "sourcephile.fr";
  11   port = toString config.services.nebula.networks.${domain}.listen.port;
  12   iface = config.services.nebula.networks.${domain}.tun.device;
  13   IPv4Prefix = "10.0.0";
  14 in
  15 {
  16   environment.systemPackages = with pkgs; [ nebula ];
  17   systemd.services."nebula@${domain}" = {
  18     reloadIfChanged = false;
  19     stopIfChanged = false;
  20     after = [ "chronyd.service" ];
  21     serviceConfig.LoadCredentialEncrypted = [
  22       "${hostName}.key:${
  23         builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${domain}/${hostName}.key.cred"; }
  24       }"
  25     ];
  26   };
  27   install.target = lib.mkDefault "\"\${NIXOS_TARGET:-root@${config.networking.hostName}.sp}\"";
  28   networking.hosts = {
  29     "${IPv4Prefix}.1" = [ "mermet.sp" ];
  30     "${IPv4Prefix}.2" = [ "losurdo.sp" ];
  31     "${IPv4Prefix}.3" = [ "oignon.sp" ];
  32     "${IPv4Prefix}.4" = [ "patate.sp" ];
  33     "${IPv4Prefix}.5" = [ "carotte.sp" ];
  34     "${IPv4Prefix}.6" = [ "aubergine.sp" ];
  35     "${IPv4Prefix}.7" = [ "courge.sp" ];
  36     "${IPv4Prefix}.8" = [ "blackberry.sp" ];
  37     "${IPv4Prefix}.9" = [ "pumpkin.sp" ];
  38     "${IPv4Prefix}.10" = [ "nan2gua1.sp" ];
  39   };
  40   services.nebula.networks.${domain} = {
  41     enable = true;
  42     ca = lib.mkDefault (builtins.path { path = inputs.self + "/domains/${domain}/nebula/ca.crt"; });
  43     cert = lib.mkDefault (
  44       builtins.path { path = inputs.self + "/hosts/${hostName}/nebula/${domain}/${hostName}.crt"; }
  45     );
  46     key = "/run/credentials/nebula@${domain}.service/${hostName}.key";
  47     listen.host = lib.mkDefault "0.0.0.0";
  48     tun.device = lib.mkDefault "neb-sourcephile";
  49     staticHostMap = {
  50       "${IPv4Prefix}.1" = [ "mermet.${domain}:10001" ];
  51       "${IPv4Prefix}.2" = [ "losurdo.${domain}:10002" ];
  52     };
  53     lighthouses = [
  54       "${IPv4Prefix}.1"
  55       "${IPv4Prefix}.2"
  56     ];
  57     relays = [
  58       "${IPv4Prefix}.1"
  59     ];
  60     firewall = {
  61       inbound = [
  62         {
  63           port = "any";
  64           proto = "icmp";
  65           groups = [
  66             "sourcephile"
  67             "intra"
  68           ];
  69         }
  70       ];
  71       outbound = [
  72         {
  73           port = "any";
  74           proto = "icmp";
  75           groups = [
  76             "sourcephile"
  77             "intra"
  78           ];
  79         }
  80       ];
  81     };
  82     settings = {
  83       firewall = {
  84         conntrack = {
  85           tcp_timeout = "12m";
  86           udp_timeout = "3m";
  87           default_timeout = "10m";
  88         };
  89       };
  90       logging = {
  91         level = lib.mkDefault "info";
  92       };
  93       pki.disconnect_invalid = true;
  94       preferred_ranges = [
  95         "192.168.0.0/16"
  96       ];
  97       #cipher = "chachapoly";
  98       /*
  99         stats = {
 100           type = "prometheus";
 101           listen = "127.0.0.1:8080";
 102           path = "/metrics";
 103           namespace = "prometheusns";
 104           subsystem = "nebula";
 105           interval = "10s";
 106           message_metrics = false;
 107           lighthouse_metrics = false;
 108         };
 109       */
 110     };
 111   };
 112   networking.nftables.ruleset = ''
 113     table inet filter {
 114       chain input-lan {
 115         udp dport ${port} counter accept comment "Nebula ${domain}"
 116       }
 117       chain output-lan {
 118         udp sport ${port} counter accept comment "Nebula ${domain}"
 119       }
 120       chain input-net {
 121         udp dport ${port} counter accept comment "Nebula ${domain}"
 122       }
 123       chain output-net {
 124         udp sport ${port} counter accept comment "Nebula ${domain}"
 125       }
 126       chain input-${iface} {
 127         tcp dport ssh counter accept comment "SSH"
 128         udp dport 60000-60100 counter accept comment "Mosh"
 129       }
 130       chain output-${iface} {
 131         tcp dport ssh counter accept comment "SSH"
 132         tcp dport {http,https} counter accept comment "HTTP"
 133         udp dport 60000-60100 counter accept comment "Mosh"
 134       }
 135       chain input {
 136         iifname ${iface} jump input-${iface} comment "MUST be before the address-based jumps to input-lan"
 137         iifname ${iface} log level warn prefix "input-${iface}: " counter drop
 138       }
 139       chain output {
 140         oifname ${iface} jump output-${iface}
 141         oifname ${iface} log level warn prefix "output-${iface}: " counter drop
 142       }
 143     }
 144   ''
 145   + lib.optionalString config.services.printing.enable ''
 146     table inet filter {
 147       chain output-${iface} {
 148         tcp dport { ipp, ipps } counter accept comment "printing: IPP"
 149       }
 150     }
 151   ''
 152   + lib.optionalString config.hardware.sane.enable ''
 153     table inet filter {
 154       chain output-${iface} {
 155         tcp dport sane-port counter accept comment "sane-net: SANE"
 156       }
 157     }
 158   '';
 159   networking.networkmanager.unmanaged = [ iface ];
 160   services.fail2ban.ignoreIP = [
 161     "${IPv4Prefix}.1" # mermet.sp
 162     "${IPv4Prefix}.2" # losurdo.sp
 163     "${IPv4Prefix}.3" # oignon.sp
 164     "${IPv4Prefix}.9" # pumpkin.sp
 165     "${IPv4Prefix}.10" # nan2gua1.sp
 166   ];
 167 }