mirror of
https://github.com/foo-dogsquared/nixos-config.git
synced 2025-04-19 18:19:12 +00:00
hosts/plover: change network attribute name
It is somewhat not great naming at first.
This commit is contained in:
parent
eb1003f7e6
commit
4b2777cda2
@ -9,8 +9,8 @@ let
|
|||||||
wireguardPeers;
|
wireguardPeers;
|
||||||
|
|
||||||
wireguardAllowedIPs = [
|
wireguardAllowedIPs = [
|
||||||
"${interfaces.internal.IPv4.address}/16"
|
"${interfaces.lan.IPv4.address}/16"
|
||||||
"${interfaces.internal.IPv6.address}/64"
|
"${interfaces.lan.IPv6.address}/64"
|
||||||
];
|
];
|
||||||
wireguardIFName = "wireguard0";
|
wireguardIFName = "wireguard0";
|
||||||
in
|
in
|
||||||
@ -248,7 +248,7 @@ in
|
|||||||
{
|
{
|
||||||
privateKeyFile = config.sops.secrets."ni/wireguard/private-key".path;
|
privateKeyFile = config.sops.secrets."ni/wireguard/private-key".path;
|
||||||
listenPort = wireguardPort;
|
listenPort = wireguardPort;
|
||||||
dns = with interfaces.internal; [ IPv4.address IPv6.address ];
|
dns = with interfaces.lan; [ IPv4.address IPv6.address ];
|
||||||
postUp =
|
postUp =
|
||||||
let
|
let
|
||||||
resolvectl = "${lib.getBin pkgs.systemd}/bin/resolvectl";
|
resolvectl = "${lib.getBin pkgs.systemd}/bin/resolvectl";
|
||||||
@ -269,7 +269,7 @@ in
|
|||||||
publicKey = lib.removeSuffix "\n" (lib.readFile ../plover/files/wireguard/wireguard-public-key-plover);
|
publicKey = lib.removeSuffix "\n" (lib.readFile ../plover/files/wireguard/wireguard-public-key-plover);
|
||||||
presharedKeyFile = config.sops.secrets."ni/wireguard/preshared-keys/plover".path;
|
presharedKeyFile = config.sops.secrets."ni/wireguard/preshared-keys/plover".path;
|
||||||
allowedIPs = wireguardAllowedIPs;
|
allowedIPs = wireguardAllowedIPs;
|
||||||
endpoint = "${interfaces.main'.IPv4.address}:${toString wireguardPort}";
|
endpoint = "${interfaces.wan.IPv4.address}:${toString wireguardPort}";
|
||||||
persistentKeepalive = 25;
|
persistentKeepalive = 25;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -62,12 +62,12 @@ in
|
|||||||
# https://discourse.nixos.org/t/nixos-on-hetzner-cloud-servers-ipv6/221/
|
# https://discourse.nixos.org/t/nixos-on-hetzner-cloud-servers-ipv6/221/
|
||||||
systemd.network = {
|
systemd.network = {
|
||||||
enable = true;
|
enable = true;
|
||||||
wait-online.ignoredInterfaces = [ "lo" interfaces.internal.ifname ];
|
wait-online.ignoredInterfaces = [ "lo" interfaces.lan.ifname ];
|
||||||
|
|
||||||
# For more information, you can look at Hetzner documentation from
|
# For more information, you can look at Hetzner documentation from
|
||||||
# https://docs.hetzner.com/robot/dedicated-server/ip/additional-ip-adresses/
|
# https://docs.hetzner.com/robot/dedicated-server/ip/additional-ip-adresses/
|
||||||
networks = {
|
networks = {
|
||||||
"10-wan" = with interfaces.main'; {
|
"10-wan" = with interfaces.wan; {
|
||||||
matchConfig.Name = lib.concatStringsSep " " mainEthernetInterfaceNames;
|
matchConfig.Name = lib.concatStringsSep " " mainEthernetInterfaceNames;
|
||||||
|
|
||||||
# Setting up IPv6.
|
# Setting up IPv6.
|
||||||
@ -96,7 +96,7 @@ in
|
|||||||
};
|
};
|
||||||
|
|
||||||
# The interface for our LAN.
|
# The interface for our LAN.
|
||||||
"20-lan" = with interfaces.internal; {
|
"20-lan" = with interfaces.lan; {
|
||||||
matchConfig.Name = lib.concatStringsSep " " internalEthernetInterfaceNames;
|
matchConfig.Name = lib.concatStringsSep " " internalEthernetInterfaceNames;
|
||||||
|
|
||||||
# Take note of the private subnets set in your Hetzner Cloud instance
|
# Take note of the private subnets set in your Hetzner Cloud instance
|
||||||
|
@ -30,7 +30,7 @@ rec {
|
|||||||
{
|
{
|
||||||
# This is the public-facing interface. Any interface name with a prime
|
# This is the public-facing interface. Any interface name with a prime
|
||||||
# symbol means it's a public-facing interface.
|
# symbol means it's a public-facing interface.
|
||||||
main' = {
|
wan = {
|
||||||
ifname = "ens3";
|
ifname = "ens3";
|
||||||
# The gateways for the public addresses are retrieved from the following
|
# The gateways for the public addresses are retrieved from the following
|
||||||
# pages:
|
# pages:
|
||||||
@ -47,7 +47,7 @@ rec {
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
internal = {
|
lan = {
|
||||||
ifname = "ens10";
|
ifname = "ens10";
|
||||||
IPv4 = {
|
IPv4 = {
|
||||||
address = "172.27.0.1";
|
address = "172.27.0.1";
|
||||||
|
@ -7,7 +7,7 @@ let
|
|||||||
inherit (import ../hardware/networks.nix) interfaces;
|
inherit (import ../hardware/networks.nix) interfaces;
|
||||||
|
|
||||||
atuinInternalDomain = "atuin.${config.networking.fqdn}";
|
atuinInternalDomain = "atuin.${config.networking.fqdn}";
|
||||||
host = interfaces.internal.IPv4.address;
|
host = interfaces.lan.IPv4.address;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
# Atuin sync server because why not.
|
# Atuin sync server because why not.
|
||||||
|
@ -9,9 +9,9 @@ let
|
|||||||
inherit (import ../hardware/networks.nix) privateIPv6Prefix interfaces clientNetworks serverNetworks secondaryNameServers wireguardPeers;
|
inherit (import ../hardware/networks.nix) privateIPv6Prefix interfaces clientNetworks serverNetworks secondaryNameServers wireguardPeers;
|
||||||
|
|
||||||
domainZoneFile = pkgs.substituteAll {
|
domainZoneFile = pkgs.substituteAll {
|
||||||
ploverPublicIPv4 = interfaces.main'.IPv4.address;
|
|
||||||
ploverPublicIPv6 = interfaces.main'.IPv6.address;
|
|
||||||
src = ../../config/dns/${domain}.zone;
|
src = ../../config/dns/${domain}.zone;
|
||||||
|
ploverWANIPv4 = interfaces.wan.IPv4.address;
|
||||||
|
ploverWANIPv6 = interfaces.wan.IPv6.address;
|
||||||
};
|
};
|
||||||
|
|
||||||
# The final location of the thing.
|
# The final location of the thing.
|
||||||
@ -43,12 +43,12 @@ let
|
|||||||
"${privateIPv6Prefix}::/48" # Private uses
|
"${privateIPv6Prefix}::/48" # Private uses
|
||||||
];
|
];
|
||||||
|
|
||||||
mainIP = with interfaces.main'; [
|
mainIP = with interfaces.wan; [
|
||||||
IPv4.address
|
IPv4.address
|
||||||
IPv6.address
|
IPv6.address
|
||||||
];
|
];
|
||||||
|
|
||||||
internalIP = with interfaces.internal; [
|
internalIP = with interfaces.lan; [
|
||||||
IPv4.address
|
IPv4.address
|
||||||
IPv6.address
|
IPv6.address
|
||||||
];
|
];
|
||||||
@ -105,7 +105,7 @@ in
|
|||||||
config = ''
|
config = ''
|
||||||
# The LAN.
|
# The LAN.
|
||||||
${fqdn} {
|
${fqdn} {
|
||||||
bind ${interfaces.internal.ifname}
|
bind ${interfaces.lan.ifname}
|
||||||
acl {
|
acl {
|
||||||
# Hetzner doesn't support DNSSEC yet though.
|
# Hetzner doesn't support DNSSEC yet though.
|
||||||
block type DS SIG RRSIG TA TSIG PTR DLV DNSKEY KEY NSEC NSEC3
|
block type DS SIG RRSIG TA TSIG PTR DLV DNSKEY KEY NSEC NSEC3
|
||||||
@ -116,11 +116,11 @@ in
|
|||||||
}
|
}
|
||||||
|
|
||||||
template IN A {
|
template IN A {
|
||||||
answer "{{ .Name }} IN 60 A ${interfaces.internal.IPv4.address}"
|
answer "{{ .Name }} IN 60 A ${interfaces.lan.IPv4.address}"
|
||||||
}
|
}
|
||||||
|
|
||||||
template IN AAAA {
|
template IN AAAA {
|
||||||
answer "{{ .Name }} IN 60 AAAA ${interfaces.internal.IPv6.address}"
|
answer "{{ .Name }} IN 60 AAAA ${interfaces.lan.IPv6.address}"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -8,7 +8,7 @@ let
|
|||||||
inherit (import ../hardware/networks.nix) interfaces wireguardPort wireguardPeers;
|
inherit (import ../hardware/networks.nix) interfaces wireguardPort wireguardPeers;
|
||||||
|
|
||||||
wireguardIFName = interfaces.wireguard0.ifname;
|
wireguardIFName = interfaces.wireguard0.ifname;
|
||||||
lanIFName = interfaces.internal.ifname;
|
lanIFName = interfaces.lan.ifname;
|
||||||
|
|
||||||
desktopPeerAddresses = with wireguardPeers.desktop; [ "${IPv4}/32" "${IPv6}/128" ];
|
desktopPeerAddresses = with wireguardPeers.desktop; [ "${IPv4}/32" "${IPv6}/128" ];
|
||||||
phonePeerAddresses = with wireguardPeers.phone; [ "${IPv4}/32" "${IPv6}/128" ];
|
phonePeerAddresses = with wireguardPeers.phone; [ "${IPv4}/32" "${IPv6}/128" ];
|
||||||
@ -36,7 +36,7 @@ in
|
|||||||
|
|
||||||
chain postrouting {
|
chain postrouting {
|
||||||
type nat hook postrouting priority srcnat; policy accept;
|
type nat hook postrouting priority srcnat; policy accept;
|
||||||
iifname ${wireguardIFName} snat to ip ${interfaces.internal.IPv4.address} comment "Make packets from Wireguard interface appear as coming from the LAN interface"
|
iifname ${wireguardIFName} snat to ip ${interfaces.lan.IPv4.address} comment "Make packets from Wireguard interface appear as coming from the LAN interface"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
'';
|
'';
|
||||||
|
Loading…
Reference in New Issue
Block a user