commit 5c38a8b5ea3ce7b74ab9fed4b008ada13e4df932
parent cb533f5757ebd7cef7761f2a454c186256446a5a
Author: MTRNord <mtrnord1@gmail.com>
Date: Sat, 27 Jan 2024 17:04:14 +0100
meow
Diffstat:
6 files changed, 7 insertions(+), 346 deletions(-)
diff --git a/nixos/common/lib/envoy.nix b/nixos/common/lib/envoy.nix
@@ -1,173 +0,0 @@
-{
- lib,
- pkgs,
- config,
- ...
-}: {
- services = {
- envoy = {
- enable = false;
- settings = {
- admin = {
- access_log_path = "/dev/null";
- address = {
- socket_address = {
- protocol = "TCP";
- address = "0.0.0.0";
- port_value = "9901";
- };
- };
- };
- static_resources = {
- listeners = [
- {
- name = "postgres";
- address = {
- socket_address = {
- address = "10.100.12.1";
- port_value = 5000;
- };
- };
- filter_chains = [
- {
- filters = [
- # {
- # name = "envoy.filters.network.postgres_proxy";
- # typed_config = {
- # "@type" = "type.googleapis.com/envoy.extensions.filters.network.postgres_proxy.v3alpha.PostgresProxy";
- # stat_prefix = "destination";
- # };
- # }
- {
- name = "envoy.filters.network.tcp_proxy";
- typed_config = {
- "@type" = "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy";
- stat_prefix = "destination";
- cluster = "postgres_cluster";
- };
- }
- ];
- }
- ];
- }
- {
- name = "postgres_100.64.0.1";
- address = {
- socket_address = {
- address = "100.64.0.1";
- port_value = 5000;
- };
- };
- filter_chains = [
- {
- filters = [
- # {
- # name = "envoy.filters.network.postgres_proxy";
- # typed_config = {
- # "@type" = "type.googleapis.com/envoy.extensions.filters.network.postgres_proxy.v3alpha.PostgresProxy";
- # stat_prefix = "destination";
- # };
- # }
- {
- name = "envoy.filters.network.tcp_proxy";
- typed_config = {
- "@type" = "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy";
- stat_prefix = "destination";
- cluster = "postgres_cluster";
- };
- }
- ];
- }
- ];
- }
- {
- name = "postgres_127.0.0.1";
- address = {
- socket_address = {
- address = "127.0.0.1";
- port_value = 5000;
- };
- };
- filter_chains = [
- {
- filters = [
- # {
- # name = "envoy.filters.network.postgres_proxy";
- # typed_config = {
- # "@type" = "type.googleapis.com/envoy.extensions.filters.network.postgres_proxy.v3alpha.PostgresProxy";
- # stat_prefix = "destination";
- # };
- # }
- {
- name = "envoy.filters.network.tcp_proxy";
- typed_config = {
- "@type" = "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy";
- stat_prefix = "destination";
- cluster = "postgres_cluster";
- };
- }
- ];
- }
- ];
- }
- ];
- clusters = [
- {
- name = "postgres_cluster";
- connect_timeout = "0.25s";
- type = "STATIC";
- lb_policy = "LEAST_REQUEST";
- per_connection_buffer_limit_bytes = 16777216;
- load_assignment = {
- cluster_name = "postgres_cluster";
- endpoints = [
- {
- lb_endpoints = [
- {
- endpoint = {
- health_check_config = {
- port_value = 8008;
- };
- address = {
- socket_address = {
- address = "10.100.0.2";
- port_value = 5432;
- };
- };
- };
- }
- {
- endpoint = {
- health_check_config = {
- port_value = 8008;
- };
- address = {
- socket_address = {
- address = "10.100.0.1";
- port_value = 5432;
- };
- };
- };
- }
- ];
- }
- ];
- };
- health_checks = [
- {
- timeout = "1s";
- interval = "5s";
- unhealthy_threshold = 3;
- healthy_threshold = 2;
- http_health_check = {
- path = "/";
- };
- }
- ];
- }
- ];
- };
- };
- };
- };
-}
diff --git a/nixos/common/lib/patroni.nix b/nixos/common/lib/patroni.nix
@@ -19,13 +19,8 @@
listen_addresses = "100.64.0.1";
};
authentication = ''
- host all all 10.100.12.1/32 md5
- host all all 10.0.0.0/16 md5
- host replication all 10.100.12.1/32 md5
- host replication all 10.0.0.0/16 md5
host all all 10.100.0.0/10 md5
host replication all 10.100.0.0/10 md5
- host all all 10.244.0.0/10 md5
'';
};
diff --git a/nixos/common/lib/pgbouncer.nix b/nixos/common/lib/pgbouncer.nix
@@ -45,8 +45,10 @@
group = config.users.users.pgbouncer.group;
text = ''
host all all 127.0.0.1/32 md5
- host all all 10.100.12.1/32 md5
+ host all all 10.100.0.0/10 md5
+ host replication all 10.100.0.0/10 md5
host all all 10.0.0.0/16 md5
+ host replication all 10.100.0.0/10 md5
'';
};
# "pgbouncer/pgbouncer.ini" = {
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -38,8 +38,6 @@ in {
../common/lib/patroni.nix
../common/lib/confd.nix
../common/lib/pgbouncer.nix
- #../common/lib/pgadmin.nix
- ../common/lib/envoy.nix
../common/lib/fail2ban.nix
../common/lib/podman.nix
../common/lib/asterisk.nix
@@ -199,66 +197,6 @@ in {
nameservers = ["8.8.8.8" "8.8.4.4"];
- wg-quick.interfaces = {
- nordgedanken = {
- address = ["10.100.0.1/24" "fe99:13::1/64"];
- listenPort = 51820;
- mtu = 1420;
- privateKeyFile = config.sops.secrets."wireguard/worker-1/wg0/private_key".path;
- table = "off";
- preUp = ''
- iptables -t mangle -A FORWARD -o nordgedanken -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- '';
- postUp = ''
- iptables -t mangle -A FORWARD -o nordgedanken -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- ip link set nordgedanken multicast on
- '';
-
- peers = [
- # big one
- {
- publicKey = "M+OpQ/umgERHB+K6JJkszVChrRPqqYvMstbr28HRrSE=";
- allowedIPs = [
- "0.0.0.0/0"
- "ff00::/8"
- "224.0.0.0/4"
- ];
- persistentKeepalive = 25;
- endpoint = "10.0.1.2:51831";
- }
- ];
- };
- worker2 = {
- address = ["10.100.0.1/24" "fe99:13::1/64"];
- listenPort = 51821;
- mtu = 1420;
- privateKeyFile = config.sops.secrets."wireguard/worker-1/wg1/private_key".path;
- table = "off";
- preUp = ''
- iptables -t mangle -A FORWARD -o worker2 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- '';
- postUp = ''
- iptables -t mangle -A FORWARD -o worker2 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- ip link set worker2 multicast on
- '';
-
- peers = [
- # worker-2
- {
- publicKey = "bVSjGeOiIO5XXPVkGLrYD4wTV52BFBOLSuCeSD97MUs=";
- allowedIPs = [
- "0.0.0.0/0"
- "ff00::/8"
- "224.0.0.0/4"
- "fe99:13::1/64"
- ];
- persistentKeepalive = 25;
- endpoint = "10.0.2.2:51841";
- }
- ];
- };
- };
-
firewall = let
blockedV4 = [
"158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670
@@ -558,8 +496,8 @@ in {
bird-lg = {
proxy = {
enable = true;
- allowedIPs = ["10.100.0.1" "fe99:13::1"];
- listenAddress = "10.100.0.1:8000";
+ allowedIPs = ["10.0.2.1" "fe99:13::1"];
+ listenAddress = "10.0.2.1:8000";
};
frontend = {
enable = true;
@@ -580,44 +518,6 @@ in {
extraGlobalDefs = ''
lvs_id LVS_BACK
'';
- # extraConfig = ''
- # # Virtual Servers definitions
- # virtual_server 10.100.12.1 5000 {
- # delay_loop 10
-
- # lb_algo wrr
- # lb_kind DS
-
- # persistence_timeout 10
- # protocol TCP
- # real_server 100.64.0.3 5432 {
- # weight 1
- # HTTP_GET {
- # url {
- # path /
- # }
-
- # connect_port 8008
- # connect_timeout 3
- # retry 3
- # delay_before_retry 2
- # }
- # }
- # real_server 100.64.0.1 5432 {
- # weight 1
- # HTTP_GET {
- # url {
- # path /
- # }
-
- # connect_port 8008
- # connect_timeout 3
- # retry 3
- # delay_before_retry 2
- # }
- # }
- # }
- # '';
vrrpInstances = {
VI_1 = {
state = "BACKUP";
diff --git a/nixos/worker-2/configuration.nix b/nixos/worker-2/configuration.nix
@@ -174,66 +174,6 @@ in {
nameservers = ["8.8.8.8" "8.8.4.4"];
- wg-quick.interfaces = {
- nordgedanken = {
- address = ["10.100.0.3/24" "fe99:13::3/64"];
- listenPort = 51840;
- mtu = 1420;
- privateKeyFile = config.sops.secrets."wireguard/worker-2/wg0/private_key".path;
- table = "off";
- preUp = ''
- iptables -t mangle -A FORWARD -o nordgedanken -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- '';
- postUp = ''
- iptables -t mangle -A FORWARD -o nordgedanken -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- ip link set nordgedanken multicast on
- '';
-
- peers = [
- # big one
- {
- publicKey = "oBqOZGvt83/u8QETTGxRi8wXqXih9IPDl+T5Snqx9yA=";
- allowedIPs = [
- "0.0.0.0/0"
- "ff00::/8"
- "224.0.0.0/4"
- ];
- persistentKeepalive = 25;
- endpoint = "10.0.1.2:51830";
- }
- ];
- };
- worker1 = {
- address = ["10.100.0.3/24" "fe99:13::3/64"];
- listenPort = 51841;
- mtu = 1420;
- privateKeyFile = config.sops.secrets."wireguard/worker-2/wg1/private_key".path;
- table = "off";
- preUp = ''
- iptables -t mangle -A FORWARD -o worker1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- '';
- postUp = ''
- iptables -t mangle -A FORWARD -o worker1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- ip link set worker1 multicast on
- '';
-
- peers = [
- # worker-1
- {
- publicKey = "gVNmams9FSNMrtZYVKEjr04NyEha8I7nxf6GPmdN0FQ=";
- allowedIPs = [
- "0.0.0.0/0"
- "ff00::/8"
- "224.0.0.0/4"
- "fe99:13::1/64"
- ];
- persistentKeepalive = 25;
- endpoint = "10.0.2.1:51821";
- }
- ];
- };
- };
-
firewall = let
blockedV4 = [
"158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670
@@ -656,8 +596,8 @@ in {
bird-lg = {
proxy = {
enable = true;
- allowedIPs = ["10.100.0.1"];
- listenAddress = "10.100.0.3:8000";
+ allowedIPs = ["10.0.2.1"];
+ listenAddress = "10.0.2.2:8000";
};
};
};
diff --git a/overlays/default.nix b/overlays/default.nix
@@ -27,9 +27,6 @@
'';
buildInputs = old.buildInputs ++ [pkgs.postgresql];
});
- # envoy = prev.envoy.overrideAttrs (old: {
- # bazelBuildFlags = old.bazelBuildFlags ++ [ "--//contrib/postgres_proxy/filters/network/source:enabled" ];
- # });
pgbouncer = prev.pgbouncer.overrideAttrs (old: {
src = pkgs.fetchFromGitHub {
owner = "pgbouncer";
