machines/losurdo/networking/upnpc.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   inherit (config.security) gnupg;
   4   inherit (config.users) users groups;
   5   inherit (config.networking) domain;
   6 in
   7 {
   8 options = {
   9 };
  10 config = {
  11 networking.nftables.ruleset = ''
  12   # Create a set for remembering the port on which ssdp replies will be received
  13   add set filter ssdp_out {type inet_service \; timeout 5s \;}
  14   # Create a rule for accepting any ssdp packets going to a remembered port.
  15   add rule filter net2fw udp dport @ssdp_out accept
  16   # Create a rule for adding the ports to the set
  17   add rule filter fw2net ip daddr 239.255.255.250 udp dport 1900 set add udp sport @ssdp_out
  18   '' + lib.optionalString networking.enableIPv6 ''
  19   # The same for ipv6
  20   add rule filter fw2net ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 set add udp sport @ssdp_out
  21   '';
  22
  23 /*
  24 systemd.services.nsupdate = {
  25   after = [
  26     "network-online.target"
  27     gnupg.secrets."knot/tsig/${domain}/bureau1.key".service
  28   ];
  29   wants = [
  30     gnupg.secrets."knot/tsig/${domain}/bureau1.key".service
  31   ];
  32   wantedBy = [ "multi-user.target" ];
  33   startAt = "*:0/5";
  34   serviceConfig = {
  35     Type = "simple";
  36     ExecStart = pkgs.writeShellScript "nsupdate" ''
  37       set -eux
  38       ip=$(${pkgs.curl}/bin/curl -s4 https://whoami.sourcephile.fr/addr)
  39       test -n "$ip"
  40       ${pkgs.knot-dns}/bin/knsupdate -k ${gnupg.secrets."knot/tsig/${domain}/bureau1.key".path} <<EOF
  41       server ns.sourcephile.fr
  42       zone sourcephile.fr
  43       origin sourcephile.fr
  44       update delete bureau1     A
  45       update add    bureau1 300 A $ip
  46       show
  47       send
  48       EOF
  49     '';
  50     Restart = "on-failure";
  51     #RestartSec = "5s";
  52     DynamicUser = true;
  53     User = users."nsupdate".name;
  54   };
  55 };
  56 users.users."nsupdate".isSystemUser = true;
  57 users.users."nsupdate".extraGroups = [ groups."keys".name ];
  58 security.gnupg.secrets."knot/tsig/${domain}/bureau1.key" = {
  59   user = users."nsupdate".name;
  60 };
  61 */
  62 };
  63 }