]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/iodine.nix
losurdo: syncoid: move to LoadCredentialEncrypted=
[sourcephile-nix.git] / hosts / mermet / iodine.nix
1 { pkgs, lib, config, credentials, host, ... }:
2 let
3 domain = "i.sourcephile.fr";
4 dnsIface = "iode";
5 gwIface = config.networking.defaultGateway.interface;
6 in
7 {
8 systemd.services.iodined.serviceConfig.LoadCredentialEncrypted = "password:${credentials}/iodine/password.secret";
9 systemd.sockets.iodined = {
10 enable = true;
11 listenDatagrams = [ "127.0.0.1:1053" ];
12 socketConfig.BindToDevice = "lo";
13 socketConfig.ReusePort = true;
14 wantedBy = [ "sockets.target" ];
15 };
16 services.iodine.server = {
17 enable = true;
18 ip = "10.53.53.1/24";
19 passwordFile = "$CREDENTIALS_DIRECTORY/password";
20 inherit domain;
21 extraConfig = "-4 -c -d ${dnsIface} -i 1800 -n ${host.ipv4}";
22 };
23 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
24 networking.nftables.ruleset = ''
25 table inet filter {
26 chain input {
27 iifname ${dnsIface} udp dport domain counter accept comment "unbound: DNS"
28 }
29 chain forward {
30 iifname ${dnsIface} oifname ${gwIface} counter accept
31 iifname ${gwIface} oifname ${dnsIface} counter accept
32 }
33 }
34 table inet nat {
35 chain postrouting {
36 iifname ${dnsIface} oifname ${gwIface} masquerade
37 }
38 }
39 '';
40 services.unbound.settings.server = {
41 interface = [ "10.53.53.1" ];
42 access-control = [ "10.53.53.0/24 allow" ];
43 };
44 }