hosts/losurdo/nebula.nix

   1 { pkgs, lib, config, inputs, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   port = 10002;
   5   ipv4Prefix = "10.0.0";
   6 in
   7 {
   8   imports = [
   9     (inputs.julm-nix + "/share/nebula/sourcephile.fr.nix")
  10   ];
  11   services.nebula.networks.${domain} = {
  12     enable = true;
  13     listen.port = port;
  14     isLighthouse = true;
  15     isRelay = false;
  16     firewall = {
  17       outbound = [{ port = "any"; proto = "any"; host = "any"; }];
  18       inbound = [{ port = "any"; proto = "any"; host = "any"; }];
  19     };
  20   };
  21   networking.nftables.ruleset = ''
  22   '';
  23   services.fail2ban.ignoreIP = [
  24     "${ipv4Prefix}.1/24"
  25   ];
  26   networking.networkmanager.unmanaged = [ config.services.nebula.networks.${domain}.tun.device ];
  27   # Apparently required to get NAT reflection.
  28   services.upnpc.enable = true;
  29   services.upnpc.redirections = [
  30     {
  31       description = "Nebula ${domain}";
  32       externalPort = port;
  33       protocol = "UDP";
  34       duration = 30 * 60;
  35       service.requiredBy = [ "nebula@${domain}.service" ];
  36       service.before = [ "nebula@${domain}.service" ];
  37     }
  38   ];
  39   systemd.services."nebula@${domain}" = {
  40     unitConfig = {
  41       Upholds = [ "upnpc-${toString port}.service" ];
  42     };
  43   };
  44   #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  45 }