{ pkgs, lib, config, inputs, hostName, ... }: let domain = "sourcephile.fr"; port = toString config.services.nebula.networks.${domain}.listen.port; iface = config.services.nebula.networks.${domain}.tun.device; IPv4Prefix = "10.0.0"; in { environment.systemPackages = with pkgs; [ nebula ]; systemd.services."nebula@${domain}".serviceConfig.LoadCredentialEncrypted = [ "${hostName}.key:${inputs.self + "/hosts/${hostName}/nebula/${hostName}.key.cred"}" ]; install.target = lib.mkDefault "\"\${NIXOS_TARGET:-root@${config.networking.hostName}.sp}\""; networking.hosts = { "${IPv4Prefix}.1" = [ "mermet.sp" ]; "${IPv4Prefix}.2" = [ "losurdo.sp" ]; "${IPv4Prefix}.3" = [ "oignon.sp" ]; "${IPv4Prefix}.4" = [ "patate.sp" ]; "${IPv4Prefix}.5" = [ "carotte.sp" ]; "${IPv4Prefix}.6" = [ "aubergine.sp" ]; "${IPv4Prefix}.7" = [ "courge.sp" ]; }; services.nebula.networks.${domain} = { enable = true; ca = lib.mkDefault (./. + "/${domain}/ca.crt"); cert = lib.mkDefault (inputs.self + "/share/nebula/${domain}/${hostName}.crt"); key = "/run/credentials/nebula@${domain}.service/${hostName}.key"; listen.host = lib.mkDefault "0.0.0.0"; tun.device = lib.mkDefault "neb-sourcephile"; staticHostMap = { "${IPv4Prefix}.1" = [ "mermet.${domain}:10001" ]; "${IPv4Prefix}.2" = [ "losurdo.${domain}:10002" ]; }; lighthouses = [ "${IPv4Prefix}.1" "${IPv4Prefix}.2" ]; relays = [ "${IPv4Prefix}.1" ]; firewall = { inbound = [ { port = "any"; proto = "icmp"; groups = [ "sourcephile" "intra" ]; } ]; outbound = [ { port = "any"; proto = "icmp"; groups = [ "sourcephile" "intra" ]; } ]; }; settings = { firewall = { conntrack = { tcp_timeout = "12m"; udp_timeout = "3m"; default_timeout = "10m"; }; }; logging = { level = lib.mkDefault "info"; }; pki.disconnect_invalid = true; preferred_ranges = [ "192.168.0.0/16" ]; /* stats = { type = "prometheus"; listen = "127.0.0.1:8080"; path = "/metrics"; namespace = "prometheusns"; subsystem = "nebula"; interval = "10s"; message_metrics = false; lighthouse_metrics = false; }; */ }; }; networking.nftables.ruleset = '' table inet filter { chain input-lan { udp dport ${port} counter accept comment "Nebula ${domain}" } chain output-lan { udp sport ${port} counter accept comment "Nebula ${domain}" } chain input-net { udp dport ${port} counter accept comment "Nebula ${domain}" } chain output-net { udp sport ${port} counter accept comment "Nebula ${domain}" } chain input-${iface} { tcp dport ssh counter accept comment "SSH" udp dport 60000-60100 counter accept comment "Mosh" } chain output-${iface} { tcp dport ssh counter accept comment "SSH" udp dport 60000-60100 counter accept comment "Mosh" } chain input { iifname ${iface} jump input-${iface} iifname ${iface} log level warn prefix "input-${iface}: " counter drop } chain output { oifname ${iface} jump output-${iface} oifname ${iface} log level warn prefix "output-${iface}: " counter drop } } ''; networking.networkmanager.unmanaged = [ iface ]; services.fail2ban.ignoreIP = [ "${IPv4Prefix}.1" # mermet.sp "${IPv4Prefix}.2" # losurdo.sp "${IPv4Prefix}.3" # oignon.sp ]; }