hosts/mermet/iodine.nix

   1 { pkgs, lib, config, credentials, host, ... }:
   2 let
   3   domain = "i.sourcephile.fr";
   4   iface = "iode";
   5   gateway = config.networking.defaultGateway.interface;
   6 in
   7 {
   8 systemd.services.iodined.serviceConfig.LoadCredentialEncrypted = "password:${credentials}/iodine/password.secret";
   9 systemd.sockets.iodined = {
  10   enable = true;
  11   listenDatagrams = [ "127.0.0.1:1053" ];
  12   socketConfig.BindToDevice = "lo";
  13   socketConfig.ReusePort = true;
  14   wantedBy = [ "sockets.target" ];
  15 };
  16 services.iodine.server = {
  17   enable = true;
  18   ip = "10.53.53.1/24";
  19   passwordFile = "$CREDENTIALS_DIRECTORY/password";
  20   inherit domain;
  21   extraConfig = "-4 -c -d ${iface} -i 1800 -n ${host.ipv4}";
  22 };
  23 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  24 networking.nftables.ruleset = ''
  25   # Forwarding
  26   add rule inet filter forward iifname "${iface}" oifname "${gateway}" counter accept
  27   add rule inet filter forward iifname "${gateway}" oifname "${iface}" counter accept
  28
  29   # Masquerading
  30   add rule inet nat postrouting iifname "${iface}" oifname "${gateway}" masquerade
  31
  32   # Servicing
  33   add rule inet filter input iifname "${iface}" udp dport 53 counter accept comment "Unbound"
  34 '';
  35 services.unbound.settings.server = {
  36   interface = [ "10.53.53.1" ];
  37   access-control = [ "10.53.53.0/24 allow" ];
  38 };
  39 }