376 lines
9 KiB
Nix
376 lines
9 KiB
Nix
{ pkgs, ... }: {
|
|
networking = {
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
80 # HTTP
|
|
443 # HTTPS
|
|
42420 # Vintage Story
|
|
25565 # Minecraft
|
|
1443 # Headscale DERP (tcp)
|
|
25 # Mailserver
|
|
143 # Mailserver
|
|
465 # Mailserver
|
|
587 # Mailserver
|
|
993 # Mailserver
|
|
4190 # Mailserver
|
|
4443 # Jitsi
|
|
];
|
|
allowedUDPPorts = [
|
|
3478 # Headscale DERP (udp)
|
|
10000 # Jitsi Meet (udp)
|
|
15636 # Enshrouded - Game
|
|
15637 # Enshrouded - Query Port
|
|
];
|
|
};
|
|
|
|
nftables = {
|
|
enable = true;
|
|
ruleset = ''
|
|
table ip nat {
|
|
chain PREROUTING {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
iifname "enp0s4" udp dport 10000 dnat to 10.100.0.2:10000;
|
|
iifname "enp0s4" udp dport 15636 dnat to 10.100.1.2:15636;
|
|
iifname "enp0s4" udp dport 15637 dnat to 10.100.1.2:15637;
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
|
|
nat = {
|
|
enable = true;
|
|
internalInterfaces = [ "enp0s4" ];
|
|
externalInterface = "wireguard0";
|
|
forwardPorts = [
|
|
{ sourcePort = 10000; proto = "udp"; destination = "10.100.0.2:10000"; }
|
|
{ sourcePort = 15636; proto = "udp"; destination = "10.100.1.2:15636"; }
|
|
{ sourcePort = 15637; proto = "udp"; destination = "10.100.1.2:15637"; }
|
|
];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = [ pkgs.cacert ];
|
|
|
|
services.haproxy = {
|
|
enable = true;
|
|
config = ''
|
|
defaults
|
|
timeout connect 10s
|
|
timeout client 30s
|
|
timeout server 30s
|
|
maxconn 3000
|
|
log global
|
|
|
|
frontend http
|
|
mode http
|
|
bind :80
|
|
# bind :443 ssl crt /Storage/Data/Docker/sysctl.io/letsencrypt/external/*.sysctl.io/combined.pem
|
|
|
|
acl is-blocked-ip src -f /etc/haproxy-blocked-ips
|
|
http-request deny if is-blocked-ip
|
|
|
|
http-request redirect scheme https unless { ssl_fc }
|
|
default_backend backend_http
|
|
backend backend_http
|
|
mode http
|
|
option forwardfor
|
|
option forwarded
|
|
# server framework-server 10.100.0.2:443 ssl verify required ca-file ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt sni req.hdr(Host)
|
|
server framework-server 10.100.0.2
|
|
|
|
frontend tcp
|
|
mode tcp
|
|
bind :25565
|
|
bind :4443
|
|
bind :443
|
|
|
|
acl is-blocked-ip src -f /etc/haproxy-blocked-ips
|
|
http-request deny if is-blocked-ip
|
|
|
|
default_backend backend_tcp
|
|
backend backend_tcp
|
|
mode tcp
|
|
server framework-server 10.100.0.2
|
|
|
|
frontend mail
|
|
mode tcp
|
|
bind :25
|
|
bind :143
|
|
bind :465
|
|
bind :587
|
|
bind :993
|
|
bind :4190
|
|
default_backend backend_mail
|
|
backend backend_mail
|
|
mode tcp
|
|
server mailserver-wg 10.100.1.3
|
|
|
|
frontend vintage-story
|
|
mode tcp
|
|
bind :42420
|
|
default_backend backend_vintage-story
|
|
backend backend_vintage-story
|
|
mode tcp
|
|
server vintage-story-wg 10.100.1.5
|
|
'';
|
|
};
|
|
|
|
environment.etc."haproxy-blocked-ips".text = ''
|
|
# https://openai.com/searchbot.json
|
|
20.42.10.176/28
|
|
172.203.190.128/28
|
|
51.8.102.0/24
|
|
|
|
# https://openai.com/chatgpt-user.json
|
|
# 23.98.142.176/28
|
|
# 40.84.180.224/28
|
|
# 13.65.240.240/28
|
|
# 20.97.189.96/28
|
|
# 20.161.75.208/28
|
|
# 52.225.75.208/28
|
|
# 52.156.77.144/28
|
|
# 40.84.221.208/28
|
|
# 40.84.221.224/28
|
|
# 40.84.180.64/28
|
|
# 23.98.179.16/28
|
|
|
|
# https://openai.com/gptbot.json
|
|
# 52.230.152.0/24
|
|
# 52.233.106.0/24
|
|
# 20.171.206.0/24
|
|
|
|
# https://developers.google.com/search/apis/ipranges/googlebot.json
|
|
2001:4860:4801:10::/64
|
|
2001:4860:4801:11::/64
|
|
2001:4860:4801:12::/64
|
|
2001:4860:4801:13::/64
|
|
2001:4860:4801:14::/64
|
|
2001:4860:4801:15::/64
|
|
2001:4860:4801:16::/64
|
|
2001:4860:4801:17::/64
|
|
2001:4860:4801:18::/64
|
|
2001:4860:4801:19::/64
|
|
2001:4860:4801:1a::/64
|
|
2001:4860:4801:1b::/64
|
|
2001:4860:4801:1c::/64
|
|
2001:4860:4801:1d::/64
|
|
2001:4860:4801:1e::/64
|
|
2001:4860:4801:1f::/64
|
|
2001:4860:4801:20::/64
|
|
2001:4860:4801:21::/64
|
|
2001:4860:4801:22::/64
|
|
2001:4860:4801:23::/64
|
|
2001:4860:4801:24::/64
|
|
2001:4860:4801:25::/64
|
|
2001:4860:4801:26::/64
|
|
2001:4860:4801:27::/64
|
|
2001:4860:4801:28::/64
|
|
2001:4860:4801:29::/64
|
|
2001:4860:4801:2::/64
|
|
2001:4860:4801:2a::/64
|
|
2001:4860:4801:2b::/64
|
|
2001:4860:4801:2c::/64
|
|
2001:4860:4801:2d::/64
|
|
2001:4860:4801:2e::/64
|
|
2001:4860:4801:2f::/64
|
|
2001:4860:4801:31::/64
|
|
2001:4860:4801:32::/64
|
|
2001:4860:4801:33::/64
|
|
2001:4860:4801:34::/64
|
|
2001:4860:4801:35::/64
|
|
2001:4860:4801:36::/64
|
|
2001:4860:4801:37::/64
|
|
2001:4860:4801:38::/64
|
|
2001:4860:4801:39::/64
|
|
2001:4860:4801:3a::/64
|
|
2001:4860:4801:3b::/64
|
|
2001:4860:4801:3c::/64
|
|
2001:4860:4801:3d::/64
|
|
2001:4860:4801:3e::/64
|
|
2001:4860:4801:40::/64
|
|
2001:4860:4801:41::/64
|
|
2001:4860:4801:42::/64
|
|
2001:4860:4801:43::/64
|
|
2001:4860:4801:44::/64
|
|
2001:4860:4801:45::/64
|
|
2001:4860:4801:46::/64
|
|
2001:4860:4801:47::/64
|
|
2001:4860:4801:48::/64
|
|
2001:4860:4801:49::/64
|
|
2001:4860:4801:4a::/64
|
|
2001:4860:4801:50::/64
|
|
2001:4860:4801:51::/64
|
|
2001:4860:4801:53::/64
|
|
2001:4860:4801:54::/64
|
|
2001:4860:4801:55::/64
|
|
2001:4860:4801:60::/64
|
|
2001:4860:4801:61::/64
|
|
2001:4860:4801:62::/64
|
|
2001:4860:4801:63::/64
|
|
2001:4860:4801:64::/64
|
|
2001:4860:4801:65::/64
|
|
2001:4860:4801:66::/64
|
|
2001:4860:4801:67::/64
|
|
2001:4860:4801:68::/64
|
|
2001:4860:4801:69::/64
|
|
2001:4860:4801:6a::/64
|
|
2001:4860:4801:6b::/64
|
|
2001:4860:4801:6c::/64
|
|
2001:4860:4801:6d::/64
|
|
2001:4860:4801:6e::/64
|
|
2001:4860:4801:6f::/64
|
|
2001:4860:4801:70::/64
|
|
2001:4860:4801:71::/64
|
|
2001:4860:4801:72::/64
|
|
2001:4860:4801:73::/64
|
|
2001:4860:4801:74::/64
|
|
2001:4860:4801:75::/64
|
|
2001:4860:4801:76::/64
|
|
2001:4860:4801:77::/64
|
|
2001:4860:4801:78::/64
|
|
2001:4860:4801:79::/64
|
|
2001:4860:4801:80::/64
|
|
2001:4860:4801:81::/64
|
|
2001:4860:4801:82::/64
|
|
2001:4860:4801:83::/64
|
|
2001:4860:4801:84::/64
|
|
2001:4860:4801:85::/64
|
|
2001:4860:4801:86::/64
|
|
2001:4860:4801:87::/64
|
|
2001:4860:4801:88::/64
|
|
2001:4860:4801:90::/64
|
|
2001:4860:4801:91::/64
|
|
2001:4860:4801:92::/64
|
|
2001:4860:4801:93::/64
|
|
2001:4860:4801:c::/64
|
|
2001:4860:4801:f::/64
|
|
192.178.5.0/27
|
|
192.178.6.0/27
|
|
34.100.182.96/28
|
|
34.101.50.144/28
|
|
34.118.254.0/28
|
|
34.118.66.0/28
|
|
34.126.178.96/28
|
|
34.146.150.144/28
|
|
34.147.110.144/28
|
|
34.151.74.144/28
|
|
34.152.50.64/28
|
|
34.154.114.144/28
|
|
34.155.98.32/28
|
|
34.165.18.176/28
|
|
34.175.160.64/28
|
|
34.176.130.16/28
|
|
34.22.85.0/27
|
|
34.64.82.64/28
|
|
34.65.242.112/28
|
|
34.80.50.80/28
|
|
34.88.194.0/28
|
|
34.89.10.80/28
|
|
34.89.198.80/28
|
|
34.96.162.48/28
|
|
35.247.243.240/28
|
|
66.249.64.0/27
|
|
66.249.64.128/27
|
|
66.249.64.160/27
|
|
66.249.64.224/27
|
|
66.249.64.32/27
|
|
66.249.64.64/27
|
|
66.249.64.96/27
|
|
66.249.65.0/27
|
|
66.249.65.160/27
|
|
66.249.65.192/27
|
|
66.249.65.224/27
|
|
66.249.65.32/27
|
|
66.249.65.64/27
|
|
66.249.65.96/27
|
|
66.249.66.0/27
|
|
66.249.66.160/27
|
|
66.249.66.192/27
|
|
66.249.66.32/27
|
|
66.249.66.64/27
|
|
66.249.66.96/27
|
|
66.249.68.0/27
|
|
66.249.68.32/27
|
|
66.249.68.64/27
|
|
66.249.69.0/27
|
|
66.249.69.128/27
|
|
66.249.69.160/27
|
|
66.249.69.192/27
|
|
66.249.69.224/27
|
|
66.249.69.32/27
|
|
66.249.69.64/27
|
|
66.249.69.96/27
|
|
66.249.70.0/27
|
|
66.249.70.128/27
|
|
66.249.70.160/27
|
|
66.249.70.192/27
|
|
66.249.70.224/27
|
|
66.249.70.32/27
|
|
66.249.70.64/27
|
|
66.249.70.96/27
|
|
66.249.71.0/27
|
|
66.249.71.128/27
|
|
66.249.71.160/27
|
|
66.249.71.192/27
|
|
66.249.71.224/27
|
|
66.249.71.32/27
|
|
66.249.71.64/27
|
|
66.249.71.96/27
|
|
66.249.72.0/27
|
|
66.249.72.128/27
|
|
66.249.72.160/27
|
|
66.249.72.192/27
|
|
66.249.72.224/27
|
|
66.249.72.32/27
|
|
66.249.72.64/27
|
|
66.249.72.96/27
|
|
66.249.73.0/27
|
|
66.249.73.128/27
|
|
66.249.73.160/27
|
|
66.249.73.192/27
|
|
66.249.73.224/27
|
|
66.249.73.32/27
|
|
66.249.73.64/27
|
|
66.249.73.96/27
|
|
66.249.74.0/27
|
|
66.249.74.128/27
|
|
66.249.74.32/27
|
|
66.249.74.64/27
|
|
66.249.74.96/27
|
|
66.249.75.0/27
|
|
66.249.75.128/27
|
|
66.249.75.160/27
|
|
66.249.75.192/27
|
|
66.249.75.224/27
|
|
66.249.75.32/27
|
|
66.249.75.64/27
|
|
66.249.75.96/27
|
|
66.249.76.0/27
|
|
66.249.76.128/27
|
|
66.249.76.160/27
|
|
66.249.76.192/27
|
|
66.249.76.224/27
|
|
66.249.76.32/27
|
|
66.249.76.64/27
|
|
66.249.76.96/27
|
|
66.249.77.0/27
|
|
66.249.77.128/27
|
|
66.249.77.160/27
|
|
66.249.77.192/27
|
|
66.249.77.224/27
|
|
66.249.77.32/27
|
|
66.249.77.64/27
|
|
66.249.77.96/27
|
|
66.249.78.0/27
|
|
66.249.78.32/27
|
|
66.249.79.0/27
|
|
66.249.79.128/27
|
|
66.249.79.160/27
|
|
66.249.79.192/27
|
|
66.249.79.224/27
|
|
66.249.79.32/27
|
|
66.249.79.64/27
|
|
66.249.79.96/27
|
|
'';
|
|
}
|