nixos

commit 29a228e88dc78935f21dd58700c89b92bacc4e77
parent d89381273c5f81da6bcce85aa81f34dc2bd333cd
Author: MTRNord <mtrnord1@gmail.com>
Date:   Fri, 11 Aug 2023 22:40:56 +0200

Set nameservers and ipv4 forwarding and update

Diffstat:
M
flake.lock
 | 
18
+++++++++---------
M
nixos/worker-1/configuration.nix
 | 
22
+++++++++++++++++++---

2 files changed, 28 insertions(+), 12 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -18,11 +18,11 @@
     },
     "hardware": {
       "locked": {
-        "lastModified": 1691566999,
-        "narHash": "sha256-c4G++nXzVgJbXe5tuUZxSS+SbDqynO/nG3wocRcP6YE=",
+        "lastModified": 1691730710,
+        "narHash": "sha256-q/UBet5RdX8CBjOIpI2Y8EB8DXYr9cb7WuNGTP9HKf8=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "8ff521acd2c8132c62141c2990deb7406e32b335",
+        "rev": "f61352cf8066ddd3dfe9058e62184bae7382672d",
         "type": "github"
       },
       "original": {
@@ -107,11 +107,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1691472822,
-        "narHash": "sha256-XVfYZ2oB3lNPVq6sHCY9WkdQ8lHoIDzzbpg8bB6oBxA=",
+        "lastModified": 1691654369,
+        "narHash": "sha256-gSILTEx1jRaJjwZxRlnu3ZwMn1FVNk80qlwiCX8kmpo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "41c7605718399dcfa53dd7083793b6ae3bc969ff",
+        "rev": "ce5e4a6ef2e59d89a971bc434ca8ca222b9c7f5e",
         "type": "github"
       },
       "original": {
@@ -123,11 +123,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1691522891,
-        "narHash": "sha256-xqQqVryXKJoFQ/+RL0A7DihkLkev8dk6afM7B04TilU=",
+        "lastModified": 1691592289,
+        "narHash": "sha256-Lqpw7lrXlLkYra33tp57ms8tZ0StWhbcl80vk4D90F8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "78287547942dd8e8afff0ae47fb8e2553db79d7e",
+        "rev": "9034b46dc4c7596a87ab837bb8a07ef2d887e8c7",
         "type": "github"
       },
       "original": {
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -103,6 +103,8 @@
   boot.kernel.sysctl = {
     "net.core.default_qdisc" = "fq";
     "net.ipv4.tcp_congestion_control" = "bbr";
+    "net.ipv4.conf.all.forwarding" = true;
+    "net.ipv6.conf.all.forwarding" = true;
   };
 
   # Ensure a clean & sparkling /tmp on fresh boots.
@@ -117,6 +119,9 @@
     hostName = "worker-1";
     # networkmanager.enable = true;
 
+		nameservers = ["8.8.8.8" "8.8.4.4"];
+
+
     # Open ports in the firewall.
     firewall = {
       allowPing = true;
@@ -126,13 +131,26 @@
         22 # ssh
       ];
       allowedUDPPorts = [ ];
+      # TODO: Apply https://git.pixie.town/f0x/nixos/src/commit/ec359768c7fc40215e9a71b278ac7c33d7541277/nodes/aura/configuration.nix
+      # blockedV4 = [
+      #   # https://openai.com/gptbot-ranges.txt
+      #   "20.15.240.64/28"
+      #   "20.15.240.80/28"
+      #   "20.15.240.96/28"
+      #   "20.15.240.176/28"
+      #   "20.15.241.0/28"
+      #   "20.15.242.128/28"
+      #   "20.15.242.144/28"
+      #   "20.15.242.192/28"
+      #   "40.83.2.64/28"
+      # ];
     };
   };
 
   services.fail2ban.enable = true;
   # needed to ban on IPv4 and IPv6 for all ports
   services.fail2ban = {
-    extraPackages = [pkgs.ipset];
+    extraPackages = [ pkgs.ipset ];
     banaction = "iptables-ipset-proto6-allports";
   };
 
@@ -168,7 +186,6 @@
     };
     efi.canTouchEfiVariables = true;
   };
-  # TODO: Fix
   boot.kernelParams = [ "ip=dhcp" ];
 
   boot.initrd = {
@@ -275,7 +292,6 @@
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev"
         ];
-        # TODO: Be sure to add any other groups you need (such as networkmanager, audio, docker, etc)
         extraGroups = [ "wheel" ];
         shell = pkgs.zsh;
       };