138 lines
3.0 KiB
Nix
138 lines
3.0 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
wireguard_port = 1194;
|
|
|
|
latest-ddclient = pkgs.ddclient.overrideAttrs (old: rec {
|
|
src = pkgs.fetchFromGitHub {
|
|
owner = "ddclient";
|
|
repo = "ddclient";
|
|
rev = "3136871720a3c2abf730c9485edc351563765d0e";
|
|
sha256 = "sha256-qb1DF0DaVbPgQokGx0t7VVk3pe3KuA8mNRPrBMzhWvU=";
|
|
};
|
|
});
|
|
|
|
in {
|
|
# Enable systemd-networkd
|
|
networking = {
|
|
hostName = "zion";
|
|
hostId = "4e74ea68";
|
|
useDHCP = false;
|
|
useNetworkd = true;
|
|
dhcpcd.enable = false;
|
|
};
|
|
systemd.network.wait-online.enable = false;
|
|
|
|
# Assign a static IP
|
|
systemd.network.networks."24-home" = {
|
|
name = "end0";
|
|
matchConfig.Name = "end0";
|
|
address = [ "192.168.13.2/24" ];
|
|
gateway = [ "192.168.13.1" ];
|
|
dns = [ "192.168.13.2" ];
|
|
networkConfig.DNSSEC = "no";
|
|
};
|
|
|
|
# Enable zeroconf
|
|
services.avahi = {
|
|
enable = true;
|
|
nssmdns = true;
|
|
openFirewall = true;
|
|
publish = {
|
|
enable = true;
|
|
userServices = true;
|
|
};
|
|
};
|
|
|
|
# Dynamic DNS configuration
|
|
services.ddclient = {
|
|
enable = true;
|
|
quiet = true;
|
|
use = "web, web=freedns";
|
|
package = latest-ddclient;
|
|
interval = "30min";
|
|
protocol = "duckdns";
|
|
domains = [ "coolneng.duckdns.org" ];
|
|
passwordFile = config.age.secrets.ddclient.path;
|
|
};
|
|
|
|
# Firewall configuration
|
|
networking.firewall = {
|
|
allowedTCPPorts = [
|
|
80 # HTTP
|
|
443 # HTTPS
|
|
53 # DNS
|
|
8448 # Matrix
|
|
1883 # MQTT
|
|
];
|
|
allowedUDPPorts = [
|
|
wireguard_port # Wireguard
|
|
53 # DNS
|
|
];
|
|
extraCommands = ''
|
|
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ${
|
|
config.systemd.network.networks."24-home".name
|
|
} -j MASQUERADE
|
|
'';
|
|
};
|
|
|
|
# Wireguard setup
|
|
systemd.network.netdevs."wg0" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
Name = "wg0";
|
|
};
|
|
wireguardConfig = {
|
|
ListenPort = wireguard_port;
|
|
PrivateKeyFile = config.age.secrets.wireguard.path;
|
|
};
|
|
wireguardPeers = [
|
|
# panacea
|
|
{
|
|
wireguardPeerConfig = {
|
|
PublicKey = "XMkTztU2Y8hw6Fu/2o4Gszij+EmNacvFMXuZyHS1n38=";
|
|
AllowedIPs = [ "10.8.0.2/32" ];
|
|
};
|
|
}
|
|
# caravanserai
|
|
{
|
|
wireguardPeerConfig = {
|
|
PublicKey = "eeKfAgMisM3K4ZOErev05RJ9LS2NLqL4x9jyi4XhM1Q=";
|
|
AllowedIPs = [ "10.8.0.3/32" ];
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
systemd.network.networks."wg0" = {
|
|
matchConfig.Name = "wg0";
|
|
networkConfig = {
|
|
Address = "10.8.0.1/24";
|
|
IPForward = true;
|
|
IPMasquerade = "ipv4";
|
|
};
|
|
};
|
|
|
|
# DNS server with ad-block
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
domain-needed = true;
|
|
bogus-priv = true;
|
|
no-resolv = true;
|
|
|
|
listen-address = [ "127.0.0.1" "192.168.13.2" "10.8.0.1" ];
|
|
bind-interfaces = true;
|
|
server = [ "51.158.108.203" "137.220.55.93" ];
|
|
|
|
cache-size = 10000;
|
|
local-ttl = 300;
|
|
|
|
conf-file = "/var/lib/dnsmasq/dnsmasq.blacklist.txt";
|
|
|
|
address = "/coolneng.duckdns.org/192.168.13.2";
|
|
};
|
|
};
|
|
|
|
}
|