diff options
| -rw-r--r-- | flake.lock | 192 | ||||
| -rw-r--r-- | nixos/configurations/dean.nix | 6 | ||||
| -rw-r--r-- | nixos/modules/openvpn.nix | 21 | ||||
| -rw-r--r-- | nixos/modules/wireguad.nix | 39 |
4 files changed, 152 insertions, 106 deletions
@@ -60,6 +60,23 @@ "type": "indirect" } }, + "flake-utils_10": { + "inputs": { + "systems": "systems_10" + }, + "locked": { + "lastModified": 1705309234, + "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", + "type": "github" + }, + "original": { + "id": "flake-utils", + "type": "indirect" + } + }, "flake-utils_2": { "inputs": { "systems": "systems_3" @@ -113,11 +130,11 @@ "systems": "systems_5" }, "locked": { - "lastModified": 1705309234, - "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", "type": "github" }, "original": { @@ -130,11 +147,11 @@ "systems": "systems_6" }, "locked": { - "lastModified": 1705309234, - "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", "type": "github" }, "original": { @@ -147,11 +164,11 @@ "systems": "systems_7" }, "locked": { - "lastModified": 1694529238, - "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", "type": "github" }, "original": { @@ -164,11 +181,11 @@ "systems": "systems_8" }, "locked": { - "lastModified": 1681202837, - "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=", + "lastModified": 1709126324, + "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", "owner": "numtide", "repo": "flake-utils", - "rev": "cfacdce06f30d2b68473a46042957675eebb3401", + "rev": "d465f4819400de7c8d874d50b982301f28a84605", "type": "github" }, "original": { @@ -181,11 +198,11 @@ "systems": "systems_9" }, "locked": { - "lastModified": 1705309234, - "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", + "lastModified": 1681202837, + "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=", "owner": "numtide", "repo": "flake-utils", - "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", + "rev": "cfacdce06f30d2b68473a46042957675eebb3401", "type": "github" }, "original": { @@ -217,22 +234,40 @@ "libshv": { "inputs": { "flake-utils": "flake-utils_7", + "necrolog": "necrolog", + "nixpkgs": "nixpkgs_8" + }, + "locked": { + "lastModified": 1712426213, + "narHash": "sha256-KDPqP9z5LT6Bau2uq7dgyNrx3fZpiXl/g+0//ICZ0a8=", + "owner": "silicon-heaven", + "repo": "libshv", + "rev": "0639a8d9139f69592baa9c8914d6f40e6aa2d3ac", + "type": "github" + }, + "original": { + "owner": "silicon-heaven", + "repo": "libshv", + "type": "github" + } + }, + "necrolog": { + "inputs": { + "flake-utils": "flake-utils_8", "nixpkgs": "nixpkgs_7" }, "locked": { - "lastModified": 1705505951, - "narHash": "sha256-9AK1KZr0enr02k6OLfb3qODxKzkEKpNePwGrYrSiyIw=", - "ref": "refs/heads/master", - "rev": "a2a4ffd904113d3e2208843efe06f2d8914d81c0", - "revCount": 2399, - "submodules": true, - "type": "git", - "url": "https://github.com/silicon-heaven/libshv.git" + "lastModified": 1710239929, + "narHash": "sha256-Sy7absZtICGCYJkBV1/4wpI72743WgDHaMLJk7BhmLQ=", + "owner": "fvacek", + "repo": "necrolog", + "rev": "87ed76143e10a5d07d881795eac11a1429a09012", + "type": "github" }, "original": { - "submodules": true, - "type": "git", - "url": "https://github.com/silicon-heaven/libshv.git" + "owner": "fvacek", + "repo": "necrolog", + "type": "github" } }, "nixdeploy": { @@ -256,11 +291,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1711352745, - "narHash": "sha256-luvqik+i3HTvCbXQZgB6uggvEcxI9uae0nmrgtXJ17U=", + "lastModified": 1712324865, + "narHash": "sha256-+BatEWd4HlMeK7Ora+gYIkarjxFVCg9oKrIeybHIIX4=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "9a763a7acc4cfbb8603bb0231fec3eda864f81c0", + "rev": "f3b959627bca46a9f7052b8fbc464b8323e68c2c", "type": "github" }, "original": { @@ -286,6 +321,20 @@ }, "nixpkgs_10": { "locked": { + "lastModified": 1682109806, + "narHash": "sha256-d9g7RKNShMLboTWwukM+RObDWWpHKaqTYXB48clBWXI=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "2362848adf8def2866fabbffc50462e929d7fffb", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "type": "indirect" + } + }, + "nixpkgs_11": { + "locked": { "lastModified": 1707877513, "narHash": "sha256-sp0w2apswd3wv0sAEF7StOGHkns3XUQaO5erhWFZWXk=", "owner": "NixOS", @@ -314,11 +363,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1712152126, - "narHash": "sha256-EPSuQvOHJ3KeuOj/Q1rnXtsh+I7RYMXnG7mr/kHIE1w=", + "lastModified": 1712435251, + "narHash": "sha256-LWr+It6EMsG7pSo1BGSWLD1Px+ruoebzCGscRqNRB7E=", "owner": "cynerd", "repo": "nixpkgs", - "rev": "b61a1a8c48358a010a341db02ae2777645ab8751", + "rev": "af2fc37c473b4c1f4508c16ea25eb2747e7934b2", "type": "github" }, "original": { @@ -358,11 +407,11 @@ }, "nixpkgs_6": { "locked": { - "lastModified": 1705566941, - "narHash": "sha256-CLNtVRDA8eUPk+bxsCCZtRO0Cp+SpHdn1nNOLoFypLs=", + "lastModified": 1712388808, + "narHash": "sha256-9ogU4c3vUmuMDoRlbQCeq3OKx0XJmgHcLZ4XywJNYWI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b06ff4bf8f4ad900fe0c2a61fc2946edc3a84be7", + "rev": "fe4295b9ecd88764c1abf6179e03b1a828ca0e9a", "type": "github" }, "original": { @@ -372,11 +421,11 @@ }, "nixpkgs_7": { "locked": { - "lastModified": 1694948089, - "narHash": "sha256-d2B282GmQ9o8klc22/Rbbbj6r99EnELQpOQjWMyv0rU=", + "lastModified": 1709780214, + "narHash": "sha256-p4iDKdveHMhfGAlpxmkCtfQO3WRzmlD11aIcThwPqhk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "5148520bfab61f99fd25fb9ff7bfbb50dad3c9db", + "rev": "f945939fd679284d736112d3d5410eb867f3b31c", "type": "github" }, "original": { @@ -386,11 +435,11 @@ }, "nixpkgs_8": { "locked": { - "lastModified": 1705566941, - "narHash": "sha256-CLNtVRDA8eUPk+bxsCCZtRO0Cp+SpHdn1nNOLoFypLs=", + "lastModified": 1710222005, + "narHash": "sha256-irXySffHz7b82dZIme6peyAu+8tTJr1zyxcfUPhqUrg=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b06ff4bf8f4ad900fe0c2a61fc2946edc3a84be7", + "rev": "9a9a7552431c4f1a3b2eee9398641babf7c30d0e", "type": "github" }, "original": { @@ -400,11 +449,11 @@ }, "nixpkgs_9": { "locked": { - "lastModified": 1682109806, - "narHash": "sha256-d9g7RKNShMLboTWwukM+RObDWWpHKaqTYXB48clBWXI=", + "lastModified": 1712328247, + "narHash": "sha256-cswxdMQH0fATfonhXgVfxliuZMfkdrCQQud4cO76eDw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "2362848adf8def2866fabbffc50462e929d7fffb", + "rev": "8311011fcea909e0cc9684ada784dae080fbfb60", "type": "github" }, "original": { @@ -433,11 +482,11 @@ }, "personal-secret": { "locked": { - "lastModified": 1711963377, - "narHash": "sha256-0hTTeEEzK4ZhFmjfT4gVzliNlhfJFmugGuSFYCeUpq4=", + "lastModified": 1712662959, + "narHash": "sha256-Ksch1uGwLgvONf6a6BVBKca7/nhTtS6f9/idS4rKZkA=", "ref": "refs/heads/master", - "rev": "a402800a9d82061610250f2f37aebd5694896c50", - "revCount": 104, + "rev": "bda29b5fccbfd107934caf9196c4504f727d92dd", + "revCount": 105, "type": "git", "url": "ssh://git@cynerd.cz/nixos-personal-secret" }, @@ -450,18 +499,18 @@ "inputs": { "flake-utils": "flake-utils_6", "libshv": "libshv", - "nixpkgs": "nixpkgs_8" + "nixpkgs": "nixpkgs_9" }, "locked": { - "lastModified": 1705600354, - "narHash": "sha256-zJ0JMQe5qOIGYwZAR4B7KTow/cF+rQhyuZr/1n4sxLQ=", - "owner": "elektroline-predator", + "lastModified": 1712430672, + "narHash": "sha256-WKPEaBEu3GB3feu4/vubBKxvs7/tmfvalPCsANnnSW0=", + "owner": "silicon-heaven", "repo": "pyshv", - "rev": "71d5af3f93e5ee8657c6695c723fab78de47cca9", + "rev": "84bfbc700432dec5483e6af6777dd076aadef54f", "type": "gitlab" }, "original": { - "owner": "elektroline-predator", + "owner": "silicon-heaven", "repo": "pyshv", "type": "gitlab" } @@ -508,11 +557,11 @@ "pyshv": "pyshv" }, "locked": { - "lastModified": 1706541874, - "narHash": "sha256-V9YGU0tdo5BLzEZ0AV7Tt5tD3b8noln7Slhd2kocfRM=", + "lastModified": 1712433922, + "narHash": "sha256-pLgYcPnWADRFh9dAmaMkkekcKVJ2cc9E+EQFvqE3q9Y=", "owner": "silicon-heaven", "repo": "shvcli", - "rev": "483c31dc70ff5173119b0610dcc26855e89edce9", + "rev": "cd5eedb592a7bc6bade45fb7a28d73f04fd2d53b", "type": "github" }, "original": { @@ -523,8 +572,8 @@ }, "shvspy": { "inputs": { - "flake-utils": "flake-utils_8", - "nixpkgs": "nixpkgs_9" + "flake-utils": "flake-utils_9", + "nixpkgs": "nixpkgs_10" }, "locked": { "lastModified": 1712139264, @@ -557,6 +606,21 @@ "type": "github" } }, + "systems_10": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "systems_2": { "locked": { "lastModified": 1681028828, @@ -679,8 +743,8 @@ }, "usbkey": { "inputs": { - "flake-utils": "flake-utils_9", - "nixpkgs": "nixpkgs_10" + "flake-utils": "flake-utils_10", + "nixpkgs": "nixpkgs_11" }, "locked": { "lastModified": 1707940956, @@ -698,11 +762,11 @@ }, "vpsadminos": { "locked": { - "lastModified": 1711619904, - "narHash": "sha256-BVmRhYvidQAT5t63EzGKOCGRlhCrfjLjf1oz8BozBns=", + "lastModified": 1712417990, + "narHash": "sha256-/5OLzJChXDwVbE95slgngbYoT0TsOZgOq+wWuYppsBE=", "owner": "vpsfreecz", "repo": "vpsadminos", - "rev": "8c8eb700db5d18e07d167e048756135f877442d9", + "rev": "300142a781b920466949e349857258501e700e2d", "type": "github" }, "original": { diff --git a/nixos/configurations/dean.nix b/nixos/configurations/dean.nix index c903794..adc9e87 100644 --- a/nixos/configurations/dean.nix +++ b/nixos/configurations/dean.nix @@ -16,11 +16,6 @@ in { networking = { useNetworkd = true; useDHCP = false; - nat = { - enable = true; - externalInterface = "brlan"; - internalInterfaces = ["wg"]; - }; }; systemd.network = { netdevs."brlab".netdevConfig = { @@ -39,7 +34,6 @@ in { matchConfig.Name = "lan* end0"; networkConfig.Bridge = "brlan"; }; - "wg".networkConfig.IPForward = mkForce "yes"; }; # TODO investigate why it doesn't work wait-online.enable = false; diff --git a/nixos/modules/openvpn.nix b/nixos/modules/openvpn.nix index 789d430..6a21721 100644 --- a/nixos/modules/openvpn.nix +++ b/nixos/modules/openvpn.nix @@ -1,6 +1,7 @@ { config, lib, + pkgs, ... }: let inherit (lib) mkOption types mkIf; @@ -27,9 +28,25 @@ in { config = "config /run/secrets/old.ovpn"; }; elektroline = mkIf cnf.elektroline { - autoStart = false; config = "config /run/secrets/elektroline.ovpn"; - updateResolvConf = true; + up = '' + domain="" + dns=() + for optionname in ''${!foreign_option_*} ; do + read -r p1 p2 p3 <<<"''${!optionname}" + [[ "$p1" == "dhcp-option" ]] || continue + case "$p2" in + DNS) + dns+=("$p3") + ;; + DOMAIN) + domain="$p3" + ;; + esac + done + ${pkgs.systemd}/bin/resolvectl dns "$dev" "''${dns[@]}" + ${pkgs.systemd}/bin/resolvectl domain "$dev" "~$domain" + ''; }; }; }; diff --git a/nixos/modules/wireguad.nix b/nixos/modules/wireguad.nix index aad392a..eb25a6e 100644 --- a/nixos/modules/wireguad.nix +++ b/nixos/modules/wireguad.nix @@ -6,7 +6,7 @@ }: let inherit (lib) any all mkEnableOption mkIf mapAttrsToList optional optionals optionalAttrs filterAttrs; inherit (config.networking) hostName; - endpoints = ["lipwig" "spt-omnia" "adm-omnia" "dean"]; + endpoints = ["lipwig" "spt-omnia" "adm-omnia"]; is_endpoint = any (v: v == hostName) endpoints; in { options = { @@ -62,18 +62,6 @@ in { # } # // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;}); #} - { - wireguardPeerConfig = - { - AllowedIPs = [ - "${config.cynerd.hosts.wg.dean}/32" - "10.0.0.0/22" - "10.0.20.0/24" - ]; - PublicKey = config.secrets.wireguardPubs.dean; - } - // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;}); - } ] ++ (optionals is_endpoint (mapAttrsToList (n: v: { wireguardPeerConfig = { @@ -87,9 +75,9 @@ in { networkConfig = { Address = "${config.cynerd.hosts.wg."${hostName}"}/24"; IPForward = is_endpoint; - DNS = mkIf (hostName != "dean") ["10.0.20.30" "10.0.20.31"]; - DNSSEC = false; - Domains = mkIf (hostName != "dean") "~elektroline.cz"; + #DNS = mkIf (hostName != "dean") ["10.0.20.30" "10.0.20.31"]; + #DNSSEC = false; + #Domains = mkIf (hostName != "dean") "~elektroline.cz"; }; routes = (optional (hostName != "lipwig") { @@ -115,24 +103,7 @@ in { Destination = "10.8.3.0/24"; Metric = 2048; }; - }) - ++ (optionals (hostName != "dean") [ - # Elektroline - { - routeConfig = { - Gateway = config.cynerd.hosts.wg.dean; - Destination = "10.0.0.0/22"; - Metric = 2048; - }; - } - { - routeConfig = { - Gateway = config.cynerd.hosts.wg.dean; - Destination = "10.0.20.0/24"; - Metric = 2048; - }; - } - ]); + }); }; }; networking.firewall.allowedUDPPorts = [51820]; |