diff options
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/ganymede/caddy.nix | 5 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 13 | ||||
| -rw-r--r-- | hosts/ganymede/networking.nix | 80 | ||||
| -rw-r--r-- | hosts/ganymede/nixos.nix | 22 | ||||
| -rw-r--r-- | hosts/ganymede/wireguard.nix | 25 | ||||
| -rw-r--r-- | hosts/mercury/battery.nix | 44 | ||||
| -rw-r--r-- | hosts/mercury/config.nix | 17 | ||||
| -rw-r--r-- | hosts/mercury/mercury-wg-key.age | 6 | ||||
| -rw-r--r-- | hosts/mercury/networking.nix | 42 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 1 | ||||
| -rw-r--r-- | hosts/mercury/wireguard.nix | 18 |
11 files changed, 200 insertions, 73 deletions
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix index 08a779b..06ca720 100644 --- a/hosts/ganymede/caddy.nix +++ b/hosts/ganymede/caddy.nix @@ -36,6 +36,11 @@ }; }; + # merge logs from subdomains + services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce '' + output file /var/log/caddy/access-williamsfam.us.com.log + ''; + collinux.services.glance.homelabServices."website" = { url = "https://williamsfam.us.com"; icon = "mdi:web"; diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index ed397ef..92eddee 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -28,19 +28,6 @@ }; }; - system.network = { - dns.areYouAServer = true; - static = { - ip = "192.168.50.2/24"; - gateway = "192.168.50.1"; - }; - - wireless.static = { - ssid = "williams"; - pskFile = config.collinux.secrets."williams-psk".path; - }; - }; - services = { sshd.enable = true; # :22 minecraft.enable = true; # :19132 diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix new file mode 100644 index 0000000..082068c --- /dev/null +++ b/hosts/ganymede/networking.nix @@ -0,0 +1,80 @@ +{ + config, + pkgs, + lib, + ... +}: let + static = { + ssid = "williams"; + pskFile = config.collinux.secrets."williams-psk".path; + ip = "192.168.50.2/24"; + gateway = "192.168.50.1"; + }; +in { + networking = { + dhcpcd.enable = false; + useDHCP = false; + networkmanager.enable = false; + + useNetworkd = true; + + firewall = { + enable = true; + checkReversePath = "loose"; + }; + + resolvconf.enable = true; + nameservers = ["127.0.0.1"]; + + wireless = { + enable = true; + networks.${static.ssid}.pskRaw = "ext:psk"; + secretsFile = static.pskFile; + }; + }; + systemd = { + services."disable-wifi-powersave" = { + description = "Disable wifi powersaving using iw"; + after = ["network.target"]; + serviceConfig.ExecStart = "${lib.getExe pkgs.iw} dev wlp108s0 set power_save off"; + wantedBy = ["default.target"]; + }; + + network = { + enable = true; + wait-online = { + enable = true; + anyInterface = true; + }; + + networks."11-default" = { + name = "wl*"; + networkConfig = { + Address = static.ip; + Gateway = static.gateway; + DHCP = "no"; + }; + }; + }; + }; + + services = { + resolved.enable = false; + + unbound = { + enable = true; + settings.server = { + interface = ["0.0.0.0"]; + port = 53; + access-control = [ + "127.0.0.0/8 allow" + "10.100.0.0/24 allow" + "0.0.0.0/0 refuse" + ]; + + local-zone = [''"ganymede." redirect'']; + local-data = [''"ganymede. IN A 10.100.0.1"'']; + }; + }; + }; +} diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 873cd2f..314b72a 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -1,31 +1,15 @@ -{ - config, - pkgs, - lib, - inputs, - ... -}: { +{inputs, ...}: { imports = [ inputs.disko.nixosModules.disko inputs.nixos-facter-modules.nixosModules.facter ./disks.nix ./caddy.nix + + ./networking.nix ./wireguard.nix ]; facter.reportPath = ./facter.json; - systemd.services."disable-wifi-powersave" = { - description = "Disable wifi powersaving using iw"; - after = ["network.target"]; - serviceConfig.ExecStart = "${pkgs.iw}/bin/iw dev wlp108s0 set power_save off"; - wantedBy = ["default.target"]; - }; - services.fail2ban.enable = true; - - # merge logs from subdomains - services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce '' - output file /var/log/caddy/access-williamsfam.us.com.log - ''; } diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix index de7afb5..3c3f1d6 100644 --- a/hosts/ganymede/wireguard.nix +++ b/hosts/ganymede/wireguard.nix @@ -2,6 +2,7 @@ config, hosts, pkgs, + lib, ... }: { environment.systemPackages = [pkgs.wireguard-tools]; @@ -10,19 +11,36 @@ networking.firewall = { allowedUDPPorts = [51820]; - trustedInterfaces = ["wg0"]; # bypass firewall inside wireguard + allowedTCPPorts = [51843]; + + trustedInterfaces = ["wg0"]; + }; + + systemd.services.udp2raw-server = { + description = "udp2raw WireGuard transport"; + wantedBy = ["multi-user.target"]; + after = ["network-online.target"]; + wants = ["network-online.target"]; + + serviceConfig = { + ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a"; + Restart = "on-failure"; + RestartSec = "2s"; + }; }; systemd.network.netdevs."50-wg0" = { netdevConfig = { Kind = "wireguard"; Name = "wg0"; - MTUBytes = "1300"; + MTUBytes = 1200; }; + wireguardConfig = { PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path; ListenPort = 51820; }; + wireguardPeers = [ { PublicKey = hosts.mercury.wg_pubkey; @@ -34,9 +52,12 @@ } ]; }; + systemd.network.networks."wg0" = { matchConfig.Name = "wg0"; + address = ["${hosts.ganymede.wg_ip}/24"]; + networkConfig = { IPMasquerade = "ipv4"; IPv4Forwarding = true; diff --git a/hosts/mercury/battery.nix b/hosts/mercury/battery.nix index 0aaa3cd..24de65b 100644 --- a/hosts/mercury/battery.nix +++ b/hosts/mercury/battery.nix @@ -1,4 +1,4 @@ -{...}: { +{pkgs, ...}: { # auto-cpufreq services.power-profiles-daemon.enable = false; # conflicts with auto-cpufreq services.tlp.enable = false; # conflicts with auto-cpufreq @@ -20,28 +20,28 @@ }; # Undervolt (BROKEN) - # services.undervolt = { - # enable = true; - # useTimer = false; - # # power-limit-long - # p1 = { - # window = 1; # no clue what this means - # limit = 40; - # }; + services.undervolt = { + enable = true; + useTimer = false; + # power-limit-long + p1 = { + window = 1; # no clue what this means + limit = 40; + }; - # # power-limit-short - # p2 = { - # window = 1; - # limit = 50; - # }; + # power-limit-short + p2 = { + window = 1; + limit = 50; + }; - # coreOffset = -50; # also applied to cache - # gpuOffset = -10; - # }; + coreOffset = -50; # also applied to cache + gpuOffset = -10; + }; - # environment.systemPackages = with pkgs; [ - # undervolt - # s-tui - # stress - # ]; + environment.systemPackages = with pkgs; [ + undervolt + s-tui + stress + ]; } diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix index ef383d7..923f7ff 100644 --- a/hosts/mercury/config.nix +++ b/hosts/mercury/config.nix @@ -1,4 +1,8 @@ -{config, ...}: { +{ + config, + pkgs, + ... +}: { collinux = { theme = "catppuccin"; @@ -12,30 +16,25 @@ user.useRun0 = true; desktop = { - wallpaper = - if (config.collinux.theme == "catppuccin") - then ./wallpapers/astronaut.jpg - else ./wallpapers/hintergrund2.png; + wallpaper = "${pkgs.gnome-backgrounds}/share/backgrounds/gnome/blobs-d.svg"; + gtk.enable = true; qt.enable = true; greetd = { enable = true; autologin.enable = true; - # cosmic-greeter.enable = true; }; wm = { niri.enable = true; kdeDesktopPortal.enable = true; - components.fuzzel.enable = true; # noctalia launcher SUCKS }; programs = { firefox.enable = true; research.enable = true; - foot.enable = true; }; }; @@ -47,7 +46,7 @@ secureBoot.enable = true; }; - network.wireless.dynamic = true; + # network.wireless.dynamic = true; audio.enable = true; bluetooth.enable = true; diff --git a/hosts/mercury/mercury-wg-key.age b/hosts/mercury/mercury-wg-key.age deleted file mode 100644 index 397f99c..0000000 --- a/hosts/mercury/mercury-wg-key.age +++ /dev/null @@ -1,6 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 azBilg t589gal+hWbEiNH9vFQFb94UU2ElhLUwBpSg+6516wg -ZmRj3LLDctDPpDKGg3HvI4r7Ex6Sf0ERcPJlqUJXv0w ---- IpOHjk3TkNRT8aW1ocgCie/ljv/sWWFRuaYGhxlf948 -0:,̅;ǛTɿ NRAkllD:5%{.Й -V8Ƀ8nBR
\ No newline at end of file diff --git a/hosts/mercury/networking.nix b/hosts/mercury/networking.nix new file mode 100644 index 0000000..cc1f995 --- /dev/null +++ b/hosts/mercury/networking.nix @@ -0,0 +1,42 @@ +{ + networking = { + useDHCP = false; + networkmanager.enable = false; + dhcpcd.enable = false; + resolvconf.enable = false; + + useNetworkd = true; # tells other services that we're using networkd (ex. tailscale) + + wireless.iwd = { + enable = true; + settings = { + General.EnableNetworkConfiguration = false; # delegate to networkd + Network.NameResolvingService = "systemd"; # delegate to systemd-resolved + }; + }; + }; + + systemd.network = { + enable = true; + + networks."11-default" = { + name = "wl*"; + networkConfig.DHCP = "yes"; + + # never accept dhcp dns + # dhcpV4Config.UseDNS = "no"; + # dhcpV6Config.UseDNS = "no"; + }; + }; + + services.resolved = { + enable = true; + settings.Resolve = { + # DNSOverTLS = true; + # DNSSEC = "allow-downgrade"; + + # LLMNR = false; + # MulticastDNS = false; + }; + }; +} diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index 5937aeb..4fe5756 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -4,6 +4,7 @@ ./battery.nix ./wireguard.nix + ./networking.nix inputs.nixos-facter-modules.nixosModules.facter inputs.lanzaboote.nixosModules.lanzaboote diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix index 627e649..105d10b 100644 --- a/hosts/mercury/wireguard.nix +++ b/hosts/mercury/wireguard.nix @@ -2,15 +2,29 @@ config, hosts, pkgs, + lib, ... }: { environment.systemPackages = [pkgs.wireguard-tools]; + systemd.services.udp2raw-client = { + description = "udp2raw WireGuard transport"; + wantedBy = ["multi-user.target"]; + after = ["network-online.target"]; + wants = ["network-online.target"]; + + serviceConfig = { + ExecStart = "${lib.getExe pkgs.udp2raw} -c -l 127.0.0.1:51820 -r 70.130.121.193:51843 -k shared-secret -a"; + Restart = "on-failure"; + RestartSec = "2s"; + }; + }; + systemd.network.netdevs."10-wg" = { netdevConfig = { Kind = "wireguard"; Name = "wg0"; - MTUBytes = "1300"; + MTUBytes = 1200; }; wireguardConfig = { PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path; @@ -20,7 +34,7 @@ { PublicKey = hosts.ganymede.wg_pubkey; AllowedIPs = ["10.100.0.0/24"]; - Endpoint = "williamsfam.us.com:51820"; + Endpoint = "127.0.0.1:51820"; } ]; }; |