hosts/plover: update networking setup

This commit is contained in:
Gabriel Arazas 2023-02-09 14:17:59 +08:00
parent f07aa33220
commit 9a07f06512
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
4 changed files with 64 additions and 59 deletions

View File

@ -55,14 +55,21 @@ in
};
};
services.fail2ban.ignoreIP = [
"172.16.0.0/12"
"fc00::/7"
services.fail2ban = {
ignoreIP = [
# VPN clients.
"${interfaces.wireguard0.IPv4.address}/13"
"${interfaces.wireguard0.IPv6.address}/64"
];
# Those from the tunneling services.
"${interfaces.wireguard0.IPv4.address}/16"
"${interfaces.wireguard0.IPv6.address}/64"
];
# We're going to be unforgiving with this one since we only have key
# authentication and password authentication is disabled anyways.
jails.sshd = ''
enabled = true
maxretry = 1
port = 22
'';
};
# TODO: Put the secrets to the respective service module.
sops.secrets =

View File

@ -50,11 +50,10 @@ in
dhcpcd.enable = false;
};
# The main DNS server (not exactly by choice).
services.resolved = {
enable = true;
dnssec = "true";
};
# The local DNS resolver. This should be used in conjunction with an
# authoritative DNS server as a forwarder. Also, it should live in its
# default address at 127.0.0.53 (as of systemd v252).
services.resolved.enable = true;
# The interface configuration is based from the following discussion:
# https://discourse.nixos.org/t/nixos-on-hetzner-cloud-servers-ipv6/221/
@ -98,6 +97,8 @@ in
IPv6.gateway
];
# Using the authoritative DNS server to enable accessing them nice
# internal services with domain names.
networkConfig.DNS = [
"127.0.0.1"
"::1"

View File

@ -5,22 +5,26 @@ let
inherit (builtins) toString;
in
rec {
privateIPv6Prefix = "fdee:b0de:5685";
privateIPv6Prefix = "fc00:b0de:5685::";
# These blocks should be used sparingly with how wide these blocks cover.
# Plus, they shouldn't be treated as subnets.
clientNetworks = [
"172.24.0.0/13"
"10.128.0.0/9"
"fd00::/8"
];
serverNetworks = [
"172.16.0.0/13"
"10.0.0.0/9"
"fc00::/8"
];
interfaces = let
ploverInternalNetworkGateway = "172.16.0.1";
widdeerLan = "10.0.0.1";
ipv6Gateway = "fe80::1";
in
interfaces =
let
ploverInternalNetworkGateway = "172.16.0.1";
ipv6Gateway = "fe80::1";
in
{
# This is the public-facing interface. Any interface name with a prime
# symbol means it's a public-facing interface.
@ -34,55 +38,52 @@ rec {
address = "65.109.224.213";
gateway = "172.31.1.1";
};
IPv6 = {
address = "2a01:4f9:c012:607a::1";
gateway = ipv6Gateway;
};
};
# /16 block for IPv4, /64 for IPv6.
internal = {
IPv4 = {
address = "172.27.0.1";
gateway = ploverInternalNetworkGateway;
internal = {
IPv4 = {
address = "172.27.0.1";
gateway = ploverInternalNetworkGateway;
};
IPv6 = {
address = "${privateIPv6Prefix}1";
gateway = ipv6Gateway;
};
};
IPv6 = {
address = "${privateIPv6Prefix}:1::";
gateway = ipv6Gateway;
};
};
# /16 BLOCK for IPv4, /64 for IPv6.
wireguard0 = {
IPv4 = {
address = "10.210.0.1";
gateway = widdeerLan;
};
IPv6 = {
address = "${privateIPv6Prefix}:12ae::";
gateway = ipv6Gateway;
wireguard0 = {
IPv4 = {
address = "172.28.0.1";
gateway = ploverInternalNetworkGateway;
};
IPv6 = {
address = "${wireguardIPv6Prefix}1";
gateway = ipv6Gateway;
};
};
};
};
# Wireguard-related things.
wireguardPort = 51820;
wireguardIPHostPart = "10.210.0";
wireguardIPv6Prefix = interfaces.wireguard0.IPv6.address;
# These are all fixed IP addresses. They should be /32 IPv4 block and /128
# IPv6 block.
# This IPv4 network block should have /13 for the Wireguard network.
wireguardIPv4Prefix = "172.28.0";
# This IPv6 network prefix should have /64 for the entire Wireguard network.
wireguardIPv6Prefix = "fd00:ffff::";
# These are all fixed IP addresses. However, they should be assigned in /16
# and /64 for IPv4 and IPv6 block respectively.
wireguardPeers = {
server = with interfaces.wireguard0; {
IPv4 = IPv4.address;
IPv6 = IPv6.address;
};
desktop = {
IPv4 = "${wireguardIPHostPart}.2";
IPv4 = "${wireguardIPv4Prefix}.2";
IPv6 = "${wireguardIPv6Prefix}2";
};
phone = {
IPv4 = "${wireguardIPHostPart}.3";
IPv4 = "${wireguardIPv4Prefix}.3";
IPv6 = "${wireguardIPv6Prefix}3";
};
};

View File

@ -9,8 +9,8 @@ let
wireguardIFName = "wireguard0";
desktopPeerAddresses = with wireguardPeers.desktop; [ "${IPv4}/24" "${IPv6}/96" ];
phonePeerAddresses = with wireguardPeers.phone; [ "${IPv4}/24" "${IPv6}/96" ];
desktopPeerAddresses = with wireguardPeers.desktop; [ "${IPv4}/14" "${IPv6}/64" ];
phonePeerAddresses = with wireguardPeers.phone; [ "${IPv4}/14" "${IPv6}/64" ];
internalDomains = [
"~${config.networking.fqdn}"
@ -57,14 +57,10 @@ in
networks."99-${wireguardIFName}" = {
matchConfig.Name = wireguardIFName;
networkConfig = {
DNS = with interfaces.internal; [
"127.0.0.1"
"::1"
];
Domains = lib.concatStringsSep " " internalDomains;
DNSDefaultRoute = false;
};
networkConfig.DNS = with interfaces.internal; [
"127.0.0.1"
"::1"
];
address = with interfaces.wireguard0; [
"${IPv4.address}/32"