albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Add Linod eimage

Browse source
This commit is contained in:
iFargle 2023-12-05 13:27:06 +09:00
parent e074bfadc7
commit 0911f404fd
6 changed files with 246 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
flake.nix
View file

@ -38,6 +38,7 @@
nixosConfigurations = { nixosConfigurations = {
# Virtual # Virtual
osaka-vultr-01 = libx.mkHost { hostname = "osaka-vultr-01"; type = "small";}; osaka-vultr-01 = libx.mkHost { hostname = "osaka-vultr-01"; type = "small";};
osaka-linode-01 = libx.mkHost { hostname = "osaka-linode-01"; type = "small";};
nixos-vm-01 = libx.mkHost { hostname = "nixos-vm-01"; }; nixos-vm-01 = libx.mkHost { hostname = "nixos-vm-01"; };
# Physical # Physical
framework-server = libx.mkHost { hostname = "framework-server"; desktop = "gnome"; gpu = "intel"; }; framework-server = libx.mkHost { hostname = "framework-server"; desktop = "gnome"; gpu = "intel"; };
@ -50,6 +51,7 @@
homeConfigurations = { homeConfigurations = {
# Virtual # Virtual
"albert@osaka-vultr-01" = libx.mkHome { hostname = "osaka-vultr-01"; }; "albert@osaka-vultr-01" = libx.mkHome { hostname = "osaka-vultr-01"; };
"albert@osaka-linode-01" = libx.mkHome { hostname = "osaka-linode-01"; };
"albert@nixos-vm-01" = libx.mkHome { hostname = "nixos-vm-01"; }; "albert@nixos-vm-01" = libx.mkHome { hostname = "nixos-vm-01"; };
# Physical # Physical
"albert@framework-server" = libx.mkHome { hostname = "framework-server"; }; "albert@framework-server" = libx.mkHome { hostname = "framework-server"; };
@ -60,6 +62,7 @@
"albert@nixos-rpi4-03" = libx.mkHome { hostname = "nixos-rpi4-03"; platform = "aarch64-linux"; }; "albert@nixos-rpi4-03" = libx.mkHome { hostname = "nixos-rpi4-03"; platform = "aarch64-linux"; };
}; };
imageConfigurations = { imageConfigurations = {
nixos-linode-img = libx.mkImage { hostname = "nixos-linode-img"; format = "linode"; type = "minimal"; };
nixos-rpi4-img = libx.mkImage { hostname = "nixos-rpi4-img"; format = "sd-aarch64"; platform = "aarch64-linux"; }; nixos-rpi4-img = libx.mkImage { hostname = "nixos-rpi4-img"; format = "sd-aarch64"; platform = "aarch64-linux"; };
nixos-iso-console = libx.mkImage { hostname = "nixos-iso-console"; format = "iso"; }; nixos-iso-console = libx.mkImage { hostname = "nixos-iso-console"; format = "iso"; };
nixos-iso-desktop = libx.mkImage { hostname = "nixos-iso-desktop"; format = "iso"; desktop = "gnome"; }; nixos-iso-desktop = libx.mkImage { hostname = "nixos-iso-desktop"; format = "iso"; desktop = "gnome"; };

18
nixos/hosts/nixos-linode-img/default.nix Normal file
View file

@ -0,0 +1,18 @@
{ config, lib, pkgs, modulesPath, desktop, username, ... }: {
# Distributed Builds
nix.distributedBuilds = true;
nixpkgs.config.allowUnfree = false;
boot.initrd.availableKernelModules = [ "ata_piix" "ohci_pci" "virtio_pci" "virtio_blk" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "iptable_nat" "iptable_filter" "xt_nat" ];
boot.extraModulePackages = [ ];
virtualisation.hypervGuest.enable = true;
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
time.timeZone = "Asia/Tokyo";
networking.hostName = "nixos-linode-img";
networking.firewall.allowedTCPPorts = [ 22 ];
}

36
nixos/hosts/osaka-linode-01/default.nix Normal file
View file

@ -0,0 +1,36 @@
{ config, lib, pkgs, modulesPath, desktop, username, ... }: {
imports = [
./firewall.nix
./wireguard.nix
];
# Distributed Builds
nix.distributedBuilds = true;
nixpkgs.config.allowUnfree = false;
boot.initrd.availableKernelModules = [ "ata_piix" "ohci_pci" "virtio_pci" "virtio_blk" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "iptable_nat" "iptable_filter" "xt_nat" ];
boot.extraModulePackages = [ ];
virtualisation.hypervGuest.enable = true;
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
time.timeZone = "Asia/Tokyo";
networking.hostName = "osaka-linode-01";
# networking.firewall.allowedTCPPorts = [ 22 ];
# Generic Tailscale configs are in /nixos/common/services/tailscale.nix
# Set up the secrets file:
sops.secrets."tailscale_keys/osaka-linode-01" = {
owner = "root";
sopsFile = ../../../secrets/tailscale.yaml;
restartUnits = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
};
services.tailscale.authKeyFile = "/run/secrets/tailscale_keys/osaka-linode-01";
services.tailscale.extraUpFlags = [ "--advertise-exit-node" ];
}

38
nixos/hosts/osaka-linode-01/disks.nix Normal file
View file

@ -0,0 +1,38 @@
{
boot.loader.grub.enableCryptodisk = true;
disko.devices.disk.vda = {
device = "/dev/vda";
type = "disk";
content = {
type = "gpt";
partitions = {
boot = {
size = "1M";
type = "EF02";
}; # partitions.boot
ESP = {
size = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
}; # ESP
luks = {
size = "100%";
content = {
type = "luks";
name = "crypted";
extraOpenArgs = [ "--allow-discards" ];
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
}; # content
}; # content
}; # luks.partitions
}; # partitions
}; # content
}; # disko.devices.disk.vda
}

98
nixos/hosts/osaka-linode-01/firewall.nix Normal file
View file

@ -0,0 +1,98 @@
{ config, lib, pkgs, ... }: {
networking.firewall.allowedUDPPorts = [
3478 # Headscale DERP UDP
10000 # Jitsi
];
networking.firewall.allowedTCPPorts = [
80 # HTTP
443 # HTTPS
25 # SMTP (explicit TLS => STARTTLS)
465 # ESMTP (implicit TLS)
587 # ESMTP (explicit TLS => STARTTLS)
143 # IMAP4 (explicit TLS => STARTTLS)
993 # IMAP4 (implicit TLS)
4190 # Sieve support
42420 # Vintage Story
25565 # Minecraft
1443 # Headscale DERP
4443 # jitsi-jvb
5222 # Jitsi
5347 # Jitsi
5280 # Jitsi
];
networking.firewall.extraCommands = ''
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# TCP PORTS ##################################################################################################
# PORT 80
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 80 -j MASQUERADE
# PORT 443
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 443 -j MASQUERADE
# PORT 25
iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 25 -j MASQUERADE
# PORT 465
iptables -t nat -A PREROUTING -p tcp --dport 465 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 465 -j MASQUERADE
# PORT 587
iptables -t nat -A PREROUTING -p tcp --dport 587 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 587 -j MASQUERADE
# PORT 143
iptables -t nat -A PREROUTING -p tcp --dport 143 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 143 -j MASQUERADE
# PORT 993
iptables -t nat -A PREROUTING -p tcp --dport 993 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 993 -j MASQUERADE
# PORT 4190
iptables -t nat -A PREROUTING -p tcp --dport 4190 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 4190 -j MASQUERADE
# PORT 42420
iptables -t nat -A PREROUTING -p tcp --dport 42420 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 42420 -j MASQUERADE
# PORT 25565
iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 25565 -j MASQUERADE
# PORT 1443
iptables -t nat -A PREROUTING -p tcp --dport 1443 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 1443 -j MASQUERADE
# PORT 4443
iptables -t nat -A PREROUTING -p tcp --dport 4443 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 4443 -j MASQUERADE
# PORT 5222
iptables -t nat -A PREROUTING -p tcp --dport 5222 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 5222 -j MASQUERADE
# PORT 5347
iptables -t nat -A PREROUTING -p tcp --dport 5347 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 5347 -j MASQUERADE
# PORT 5280
iptables -t nat -A PREROUTING -p tcp --dport 5280 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p tcp --dport 5280 -j MASQUERADE
# UDP PORTS ##################################################################################################
# PORT 10000
iptables -t nat -A PREROUTING -p udp --dport 10000 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p udp --dport 10000 -j MASQUERADE
# PORT 3478
iptables -t nat -A PREROUTING -p udp --dport 3478 -j DNAT --to-destination 10.100.0.2
iptables -t nat -A POSTROUTING -p udp --dport 3478 -j MASQUERADE
'';
}

49
nixos/hosts/osaka-linode-01/wireguard.nix Normal file
View file

@ -0,0 +1,49 @@
{ pkgs, config, lib, ... }: {
networking.firewall.allowedUDPPorts = [ 51820 ];
networking.firewall.interfaces.wireguard0.allowedTCPPorts = [ 22 ];
# Set up the secrets file:
sops.secrets."wireguard_keys/osaka-linode-01" = {
owner = "root";
sopsFile = ../../../secrets/wireguard.yaml;
};
sops.secrets."wireguard_keys/preshared_key" = {
owner = "root";
sopsFile = ../../../secrets/wireguard.yaml;
};
# Wireguard Forwarder
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = true;
"net.ipv4.conf.all.forwarding" = 1;
"net.ipv4.conf.default.forwarding" = 1;
};
networking.wireguard = {
enable = true;
interfaces = {
"wireguard0" = {
ips = [ "10.100.0.1/24" ];
listenPort = 51820;
privateKeyFile = "/run/secrets/wireguard_keys/osaka-linode-01";
postSetup = ''${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
postShutdown = ''${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eno3 -j MASQUERADE'';
peers = [
{ # nixos-rpi4-03
publicKey = "trHvfNtQ7HKMiJjxEXo2Iubq5G6egjx7gHiBlDmJ5Ek=";
presharedKeyFile = "/run/secrets/wireguard_keys/preshared_key";
persistentKeepalive = 5;
allowedIPs = [ "10.100.0.2/32" ];
}
];
};
};
};
networking.nat = {
enable = true;
internalInterfaces = [ "wireguard0" ];
externalInterface = "eno3";
};
}