diff options
| -rw-r--r-- | hosts/poweredge/configuration.nix | 1 | ||||
| -rw-r--r-- | hosts/poweredge/ddns-updater.nix | 7 | ||||
| -rw-r--r-- | hosts/poweredge/networking.nix | 39 | ||||
| -rw-r--r-- | hosts/poweredge/resources/secrets/wg1.yaml | 16 | ||||
| -rw-r--r-- | hosts/poweredge/wg1.nix | 7 | ||||
| -rw-r--r-- | nixos/services/router/dns-dhcp.nix | 3 | ||||
| -rw-r--r-- | nixos/services/router/routing.nix | 6 |
7 files changed, 60 insertions, 19 deletions
diff --git a/hosts/poweredge/configuration.nix b/hosts/poweredge/configuration.nix index 0c51f3c..a363592 100644 --- a/hosts/poweredge/configuration.nix +++ b/hosts/poweredge/configuration.nix @@ -5,6 +5,7 @@ in { ./ddns-updater.nix ./networking.nix #./notification-mailer.nix # TODO move some of this stuff to archetype + ./wg1.nix ]; # Setup bootloader diff --git a/hosts/poweredge/ddns-updater.nix b/hosts/poweredge/ddns-updater.nix index 30f6e05..103c23b 100644 --- a/hosts/poweredge/ddns-updater.nix +++ b/hosts/poweredge/ddns-updater.nix @@ -1,4 +1,4 @@ -{ config, ... }: { +{ config, lib, ... }: { # Password file for mail application password sops.secrets.ddns-updater-config.sopsFile = ./resources/secrets/ddns-updater-config.yaml; @@ -11,4 +11,9 @@ PERIOD = "5m"; }; }; + + # FIXME Required root permissions to open secret + systemd.services.ddns-updater = { + serviceConfig.DynamicUser = lib.mkForce false; + }; } diff --git a/hosts/poweredge/networking.nix b/hosts/poweredge/networking.nix index c293831..7632a86 100644 --- a/hosts/poweredge/networking.nix +++ b/hosts/poweredge/networking.nix @@ -1,5 +1,6 @@ { networking = { + enableIPv6 = false; # Label lan and wan interfaces _interfaceLabels = { enable = true; @@ -16,36 +17,40 @@ }]; wan0.useDHCP = true; }; - #defaultGateway.interface = "wan0"; - nameservers = [ "127.0.0.1" ]; # Firewall rules firewall = { interfaces.wan0 = { allowedUDPPorts = [ 51820 ]; }; }; - #nat.forwardPorts = [ - # { - # sourcePort = 2222; - # proto = "tcp"; - # destination = "10.1.1.1:22"; - # } - # { - # sourcePort = 22; - # proto = "tcp"; - # destination = "10.1.1.1:22"; - # } - #]; + # Additional advanced rules + # TODO add multi NAT feature to router service + nftables = { + enable = true; + tables = { + # NAT/masquerade wg1 allowing lan0 clients to access wg1 + wg-nat = { + family = "ip"; + content = '' + chain post { + type nat hook postrouting priority srcnat; policy accept; + iifname "lan0" oifname "wg1" masquerade comment "lan0 => wg1" + } + ''; + }; + }; + }; }; services._router = { dnsDhcpConfig = { - localDomain = "wg-router.pls.lan"; + localDomain = "home.lan"; dhcp = { defaultGateway = "192.168.1.1"; localhostIp = "192.168.1.1"; rangeStart = "192.168.1.50"; rangeEnd = "192.168.1.250"; + # TODO think about moving leases to another file staticLeases = { idrac-7N94GK2 = { macAddress = "50:9a:4c:5d:c3:7c"; @@ -71,6 +76,10 @@ macAddress = "e4:54:e8:bc:ba:05"; staticIp = "192.168.1.12"; }; + X230 = { + macAddress = "84:3a:4b:60:34:c4"; + staticIp = "192.168.1.13"; + }; }; }; }; diff --git a/hosts/poweredge/resources/secrets/wg1.yaml b/hosts/poweredge/resources/secrets/wg1.yaml new file mode 100644 index 0000000..6610514 --- /dev/null +++ b/hosts/poweredge/resources/secrets/wg1.yaml @@ -0,0 +1,16 @@ +wg1: ENC[AES256_GCM,data:1IySjV57HcywgiCZ/ZYbcr4Y9EbLrb6bE4kpG1DmDsLiRVFSfZA1UOoMGosot+7YiuE4xfZNHGSnzDrpE73gi5E9qYlvjhOfyLq06a1lK7Q0Wo/QrH9eSH05h6SA4E8sE0w2aKY/6cWfLaXTP1d7xLJA1OOCy7y+wIXrHQcA/TI5XIxikFSe+tT7rhKz128u6MIGl8VWzCp4RmoN94MAgWp0RoVt0VSHlvNPTbMuTZI0YPN1NgHjcf7KWnit33GXydmAWr+wym/oxxdT77O6wMPcGIsxmMLOPNy3K1sTezGTPSS1CSVniKIIW2HYZepGfaTlKwBFIn7ctmMrBvqmMcHiW+QIPwWbOC8UWHJAGklv3vCa7Q8XDUKlOPNdS0o73jb+BVUJWerwR4ik6NPu/H/lWgIETg1pd/Qv//nGsPeGRIUFKyKxoL/5E67+pA==,iv:d+T6wKhV1i/2kae03VPLMaTFB2yleeDFPm1lrfjvkx8=,tag:h/41zAlfz6oBo8jqz9NW7A==,type:str] +sops: + age: + - recipient: age1zfvmt2avdlfz0fvchczplc84u7m8vqausm7zytl9s4x9m9yax4cqy30zpz + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxOFFVRFl2MDhiUVRPdnZJ + b3BSZ0pSaG8vR3o3SGlmVENvN3ZObHU3eUc4CmJrdk8rbXpBMWhTZ2hvdlk0VWo1 + ejdnTDR4bFlUUXc4Smd0NEp6b3crZFUKLS0tIFBsQUdRWjZLSDY1ZlFaRDdLOVhs + MFFGY0NSU3NaK2U0U1NndUIyYm54ZWsKZ6q9j1fNaNSzBA0rbZYyUWt3U2V/7/9/ + FZTKd8mH/uCoxvK8unlVZ9uYNADRh2smp7LwK1AWie/6khAIFqVBeg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-31T02:00:52Z" + mac: ENC[AES256_GCM,data:VXBQSegpiLmT5pF0XVB8NTVzhn4QDE2WfVznANVdrXC4BqFYoQXscW+4BcMmwkUqz5MjeKNF4KgRwtpKWVyRXG7EXVEGeA/NdysAxM9eSD4YrQZLqWzG8UKStyFG7jgHw/YA3H94hJ3rYnhsA9Kb3DHEmnQSZskTOmn2ppyUunQ=,iv:/rVWmaXl149Prhv35wBDZN6c+HgQ6PYSb8RIE30t7MI=,tag:SZ7mI9XDsIjhliFyWO14ug==,type:str] + unencrypted_suffix: _unencrypted + version: 3.12.1 diff --git a/hosts/poweredge/wg1.nix b/hosts/poweredge/wg1.nix new file mode 100644 index 0000000..d94efb6 --- /dev/null +++ b/hosts/poweredge/wg1.nix @@ -0,0 +1,7 @@ +{ config, pkgs, inputs, ... }: { + sops.secrets.wg1.sopsFile = ./resources/secrets/wg1.yaml; + + networking.wg-quick.interfaces = { + wg1.configFile = config.sops.secrets.wg1.path; + }; +} diff --git a/nixos/services/router/dns-dhcp.nix b/nixos/services/router/dns-dhcp.nix index 48e0b8e..4c041c2 100644 --- a/nixos/services/router/dns-dhcp.nix +++ b/nixos/services/router/dns-dhcp.nix @@ -204,5 +204,8 @@ in { # Search localDomain so host can resolve short names # This is eq. to dnsmasq's dhcp-option "domain-search" for clients, it just adds a search rule to resolv.conf networking.search = [ cfg.localDomain ]; + + # Add localhost as default nameserver + networking.nameservers = lib.mkDefault [ cfg.dhcp.localhostIp ]; }; } diff --git a/nixos/services/router/routing.nix b/nixos/services/router/routing.nix index 25d91dd..6682538 100644 --- a/nixos/services/router/routing.nix +++ b/nixos/services/router/routing.nix @@ -35,9 +35,9 @@ in { ''; }; nat = { - enable = true; - externalInterface = cfg.interfaces.wan; - internalInterfaces = [ cfg.interfaces.lan ]; + enable = lib.mkDefault true; + externalInterface = lib.mkDefault cfg.interfaces.wan; + internalInterfaces = lib.mkDefault [ cfg.interfaces.lan ]; }; }; }; |