commit 86c02ded5b510d9d9651051d6dc355d455688588 parent 71ba2f6b5b1b19dc2b583bcff159f1b855b3d9b7 Author: MTRNord <mtrnord1@gmail.com> Date: Tue, 12 Sep 2023 15:01:11 +0200 Fix v6 Diffstat:
| M | nixos/worker-1/configuration.nix | | | 828 | ++++++++++++++++++++++++++++++++++++++++---------------------------------------- |
1 file changed, 414 insertions(+), 414 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix @@ -132,459 +132,459 @@ routes = [ { routeConfig.Gateway = "fe80::1"; } { routeConfig = { Gateway = "172.31.1.1"; GatewayOnLink = true; }; } - ] - } - }; + ]; }; + }; + }; - networking = { - hostName = "worker-1"; - enableIPv6 = true; - useNetworkd = true; - useDHCP = true; - # networkmanager.enable = true; - - nat = { - enable = true; - enableIPv6 = true; - externalInterface = "enp1s0"; - internalInterfaces = [ "wg0" ]; - }; + networking = { + hostName = "worker-1"; + enableIPv6 = true; + useNetworkd = true; + useDHCP = true; + # networkmanager.enable = true; + + nat = { + enable = true; + enableIPv6 = true; + externalInterface = "enp1s0"; + internalInterfaces = [ "wg0" ]; + }; - nameservers = [ "8.8.8.8" "8.8.4.4" ]; - - wg-quick.interfaces = { - wg0 = { - address = [ "10.100.0.1/24" "fe99:13::1/64" ]; - listenPort = 51820; - privateKeyFile = config.sops.secrets."wireguard/private_key".path; - table = "off"; - - peers = [ - { - publicKey = "M+OpQ/umgERHB+K6JJkszVChrRPqqYvMstbr28HRrSE="; - allowedIPs = [ - "0.0.0.0/0" - "::/0" - ]; - endpoint = "95.217.202.35:51820"; - } - ]; - }; + nameservers = [ "8.8.8.8" "8.8.4.4" ]; - }; + wg-quick.interfaces = { + wg0 = { + address = [ "10.100.0.1/24" "fe99:13::1/64" ]; + listenPort = 51820; + privateKeyFile = config.sops.secrets."wireguard/private_key".path; + table = "off"; - firewall = - let - blockedV4 = [ - "158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670 - "207.231.106.226" # fediverse.network / fedi.ninja - "45.81.20.80" # instances.social - "198.58.122.231" # fedimapper.tedivm.com - "142.93.3.121" # fedidb.org - "45.158.40.164" # fedi.buzz - "170.39.215.216" # fediverse.observer - "87.157.136.163" # fedi_stats - "94.31.103.67" # python/federation - "45.56.100.29" # scottherr? same as :5a13 - "173.230.137.240" # scottherr@mastodon.social - "138.37.89.34" - "104.21.80.126" # gangstalking.services - "172.67.181.16" # gangstalking.services - "198.98.54.220" # ryona.agency - "35.173.245.194" - "99.105.215.234" # public tl - "65.108.204.30" # unknown - "65.109.31.111" # @fediverse@mastodont.cat - "54.37.233.246" # fba.ryona.agency domain block scraper - "185.244.192.119" # mooneyed.de / drow.be / bka.li blocklist scraper - "23.24.204.110" # ryona tool fed.dembased.xyz / annihilation.social blocklist scraper - "187.190.192.31" # ryona tool unfediblockthefedi.now - "70.106.192.146" # blocklist scraper - # https://openai.com/gptbot-ranges.txt - "20.15.240.64/28" - "20.15.240.80/28" - "20.15.240.96/28" - "20.15.240.176/28" - "20.15.241.0/28" - "20.15.242.128/28" - "20.15.242.144/28" - "20.15.242.192/28" - "40.83.2.64/28" - ]; - blockedV6 = [ - "2003:cb:ff2c:2700::1/64" # fedi_stats - "2600:3c02::/64" # scottherr stats - "2600:3c03::/64" # unknown, tries public tl access - "2605:6400:10:1fe::1/64" # ryona.agency - "2a01:4f9:5a:1cc4::2" # @fediverse@mastodont.cat - "2604:a880:400:d1::1/64" # fedidb.org - "2a01:4f8:162:6027::1/64" # blocklist scraper - ]; - in + peers = [ { - checkReversePath = "loose"; - trustedInterfaces = [ "tailscale0" "floating1" "wg0" ]; - enable = true; - allowPing = true; - logRefusedConnections = false; - allowedTCPPorts = [ - 22 # ssh - 5060 # SIP - 8088 - 80 - 443 - 51820 - ]; - allowedUDPPorts = [ - 5060 # SIP - config.services.tailscale.port + publicKey = "M+OpQ/umgERHB+K6JJkszVChrRPqqYvMstbr28HRrSE="; + allowedIPs = [ + "0.0.0.0/0" + "::/0" ]; + endpoint = "95.217.202.35:51820"; + } + ]; + }; - allowedUDPPortRanges = [ - { from = 10000; to = 20000; } - ]; + }; - extraCommands = - builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4) + "\n" - + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6); + firewall = + let + blockedV4 = [ + "158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670 + "207.231.106.226" # fediverse.network / fedi.ninja + "45.81.20.80" # instances.social + "198.58.122.231" # fedimapper.tedivm.com + "142.93.3.121" # fedidb.org + "45.158.40.164" # fedi.buzz + "170.39.215.216" # fediverse.observer + "87.157.136.163" # fedi_stats + "94.31.103.67" # python/federation + "45.56.100.29" # scottherr? same as :5a13 + "173.230.137.240" # scottherr@mastodon.social + "138.37.89.34" + "104.21.80.126" # gangstalking.services + "172.67.181.16" # gangstalking.services + "198.98.54.220" # ryona.agency + "35.173.245.194" + "99.105.215.234" # public tl + "65.108.204.30" # unknown + "65.109.31.111" # @fediverse@mastodont.cat + "54.37.233.246" # fba.ryona.agency domain block scraper + "185.244.192.119" # mooneyed.de / drow.be / bka.li blocklist scraper + "23.24.204.110" # ryona tool fed.dembased.xyz / annihilation.social blocklist scraper + "187.190.192.31" # ryona tool unfediblockthefedi.now + "70.106.192.146" # blocklist scraper + # https://openai.com/gptbot-ranges.txt + "20.15.240.64/28" + "20.15.240.80/28" + "20.15.240.96/28" + "20.15.240.176/28" + "20.15.241.0/28" + "20.15.242.128/28" + "20.15.242.144/28" + "20.15.242.192/28" + "40.83.2.64/28" + ]; + blockedV6 = [ + "2003:cb:ff2c:2700::1/64" # fedi_stats + "2600:3c02::/64" # scottherr stats + "2600:3c03::/64" # unknown, tries public tl access + "2605:6400:10:1fe::1/64" # ryona.agency + "2a01:4f9:5a:1cc4::2" # @fediverse@mastodont.cat + "2604:a880:400:d1::1/64" # fedidb.org + "2a01:4f8:162:6027::1/64" # blocklist scraper + ]; + in + { + checkReversePath = "loose"; + trustedInterfaces = [ "tailscale0" "floating1" "wg0" ]; + enable = true; + allowPing = true; + logRefusedConnections = false; + allowedTCPPorts = [ + 22 # ssh + 5060 # SIP + 8088 + 80 + 443 + 51820 + ]; + allowedUDPPorts = [ + 5060 # SIP + config.services.tailscale.port + ]; - extraStopCommands = - builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4) + "\n" - + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6); - }; - }; + allowedUDPPortRanges = [ + { from = 10000; to = 20000; } + ]; - # packages that are not flakes - environment.systemPackages = with pkgs; [ - unstable.forgejo-actions-runner - config.services.headscale.package - ]; + extraCommands = + builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4) + "\n" + + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6); - # Configure your system-wide user settings (groups, etc), add more users as needed. - users = { - #mutableUsers = false; - users = { - marcel = { - isNormalUser = true; - passwordFile = config.sops.secrets.marcel_initial_password.path; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev" - ]; - extraGroups = [ "wheel" ]; - shell = pkgs.zsh; - }; + extraStopCommands = + builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4) + "\n" + + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6); + }; + }; - "root".passwordFile = config.sops.secrets.root_initial_password.path; - }; + # packages that are not flakes + environment.systemPackages = with pkgs; [ + unstable.forgejo-actions-runner + config.services.headscale.package + ]; + + # Configure your system-wide user settings (groups, etc), add more users as needed. + users = { + #mutableUsers = false; + users = { + marcel = { + isNormalUser = true; + passwordFile = config.sops.secrets.marcel_initial_password.path; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev" + ]; + extraGroups = [ "wheel" ]; + shell = pkgs.zsh; }; - services.gitea-actions-runner = { - instances = { - nordgedanken = { - enable = false; - url = "https://git.nordgedanken.dev"; - tokenFile = config.sops.secrets.forgejo_runner_token.path; - labels = [ ]; - name = "worker-1"; - }; - }; + "root".passwordFile = config.sops.secrets.root_initial_password.path; + }; + }; + + services.gitea-actions-runner = { + instances = { + nordgedanken = { + enable = false; + url = "https://git.nordgedanken.dev"; + tokenFile = config.sops.secrets.forgejo_runner_token.path; + labels = [ ]; + name = "worker-1"; }; + }; + }; - systemd.services.gitea-runner-nordgedanken = { - serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ]; + systemd.services.gitea-runner-nordgedanken = { + serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ]; + }; + + + # Restic Backup + services.restic.backups = { + storagebox = { + passwordFile = config.sops.secrets.backup_password.path; + paths = [ + "/persist" + ]; + repository = "sftp://u362507@u362507.your-storagebox.de:22//backups/worker-1"; + timerConfig = { + OnCalendar = "00:05"; + RandomizedDelaySec = "5h"; }; + pruneOpts = [ + "--keep-daily 7" + "--keep-weekly 5" + "--keep-monthly 12" + ]; + initialize = true; + }; + }; + security.acme.acceptTerms = true; + security.acme.defaults.email = "support@nordgedanken.dev"; - # Restic Backup - services.restic.backups = { - storagebox = { - passwordFile = config.sops.secrets.backup_password.path; - paths = [ - "/persist" - ]; - repository = "sftp://u362507@u362507.your-storagebox.de:22//backups/worker-1"; - timerConfig = { - OnCalendar = "00:05"; - RandomizedDelaySec = "5h"; + services = { + nginx = { + enable = true; + upstreams = { + "asterisk_webrtc_ws" = { + servers = { + "127.0.0.1:8088" = { }; }; - pruneOpts = [ - "--keep-daily 7" - "--keep-weekly 5" - "--keep-monthly 12" - ]; - initialize = true; }; }; - - security.acme.acceptTerms = true; - security.acme.defaults.email = "support@nordgedanken.dev"; - - services = { - nginx = { - enable = true; - upstreams = { - "asterisk_webrtc_ws" = { - servers = { - "127.0.0.1:8088" = { }; - }; - }; + virtualHosts = { + "pbx.midnightthoughts.space" = { + forceSSL = true; + enableACME = true; + + locations."/ws" = { + proxyPass = "http://asterisk_webrtc_ws/ws"; + proxyWebsockets = true; }; - virtualHosts = { - "pbx.midnightthoughts.space" = { - forceSSL = true; - enableACME = true; - - locations."/ws" = { - proxyPass = "http://asterisk_webrtc_ws/ws"; - proxyWebsockets = true; - }; - locations."/metrics" = { - proxyPass = "http://asterisk_webrtc_ws/metrics"; - }; - }; - "headscale.midnightthoughts.space" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = - "http://localhost:${toString config.services.headscale.port}"; - proxyWebsockets = true; - }; - }; - "lg.midnightthoughts.space" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = - "http://localhost:5001"; - }; - }; + locations."/metrics" = { + proxyPass = "http://asterisk_webrtc_ws/metrics"; }; }; - - discourse = { - enable = true; - database = { - host = "postgres.internal.midnightthoughts.space"; - passwordFile = config.sops.secrets."discourse/db_password".path; - }; - backendSettings = { - db_port = 5000; - }; - secretKeyBaseFile = config.sops.secrets."discourse/secret_key_base".path; - mail = { - outgoing = { - port = 465; - serverAddress = "mail.nordgedanken.dev"; - username = "support@miki.community"; - passwordFile = config.sops.secrets."discourse/mail_password".path; - authentication = "login"; - forceTLS = true; - }; - incoming.enable = false; - contactEmailAddress = "support@miki.community"; - }; - redis = { - host = "localhost"; + "headscale.midnightthoughts.space" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = + "http://localhost:${toString config.services.headscale.port}"; + proxyWebsockets = true; }; - hostname = "forum.miki.community"; - plugins = with config.services.discourse.package.plugins; [ - discourse-github - discourse-solved - discourse-docs - ]; - siteSettings = { - required = { - title = "Matrix Projects Forum"; - contact_email = "support@miki.community"; - notification_email = "noreply@forum.miki.community"; - }; - login = { - login_required = false; - must_approve_users = false; - enable_local_logins = true; - enable_local_logins_via_email = true; - allow_new_registrations = true; - }; - spam = { - notify_mods_when_user_silenced = true; - }; - legal = { - tos_url = "https://docs.draupnir.midnightthoughts.space/docs/code_of_conduct/"; - }; - plugins = { - chat_enabled = false; - }; - }; - admin = { - username = "MTRNord"; - fullName = "Marcel"; - email = "mtrnord@nordgedanken.dev"; - passwordFile = config.sops.secrets."discourse/admin_password".path; - }; - }; - tailscale = { - enable = true; - useRoutingFeatures = "both"; }; - headscale = { - enable = true; - address = "0.0.0.0"; - port = 8080; - - settings = { - logtail.enabled = false; - server_url = "https://headscale.midnightthoughts.space"; - ip_prefixes = [ "fd7a:115c:a1e0::/48" "100.64.0.0/10" ]; - - dns_config = { - base_domain = "headscale.midnightthoughts.space"; - magic_dns = true; - nameservers = [ - "8.8.8.8" - ]; - }; + "lg.midnightthoughts.space" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = + "http://localhost:5001"; }; }; + }; + }; - bird2 = { - enable = true; - config = '' - router id 100.64.0.1; - debug protocols all; - - protocol device { - } - - protocol direct { - ipv4; - ipv6; - interface "floating1"; - } - - protocol kernel { - ipv4 { - import all; - export all; - }; - } + discourse = { + enable = true; + database = { + host = "postgres.internal.midnightthoughts.space"; + passwordFile = config.sops.secrets."discourse/db_password".path; + }; + backendSettings = { + db_port = 5000; + }; + secretKeyBaseFile = config.sops.secrets."discourse/secret_key_base".path; + mail = { + outgoing = { + port = 465; + serverAddress = "mail.nordgedanken.dev"; + username = "support@miki.community"; + passwordFile = config.sops.secrets."discourse/mail_password".path; + authentication = "login"; + forceTLS = true; + }; + incoming.enable = false; + contactEmailAddress = "support@miki.community"; + }; + redis = { + host = "localhost"; + }; + hostname = "forum.miki.community"; + plugins = with config.services.discourse.package.plugins; [ + discourse-github + discourse-solved + discourse-docs + ]; + siteSettings = { + required = { + title = "Matrix Projects Forum"; + contact_email = "support@miki.community"; + notification_email = "noreply@forum.miki.community"; + }; + login = { + login_required = false; + must_approve_users = false; + enable_local_logins = true; + enable_local_logins_via_email = true; + allow_new_registrations = true; + }; + spam = { + notify_mods_when_user_silenced = true; + }; + legal = { + tos_url = "https://docs.draupnir.midnightthoughts.space/docs/code_of_conduct/"; + }; + plugins = { + chat_enabled = false; + }; + }; + admin = { + username = "MTRNord"; + fullName = "Marcel"; + email = "mtrnord@nordgedanken.dev"; + passwordFile = config.sops.secrets."discourse/admin_password".path; + }; + }; + tailscale = { + enable = true; + useRoutingFeatures = "both"; + }; + headscale = { + enable = true; + address = "0.0.0.0"; + port = 8080; + + settings = { + logtail.enabled = false; + server_url = "https://headscale.midnightthoughts.space"; + ip_prefixes = [ "fd7a:115c:a1e0::/48" "100.64.0.0/10" ]; + + dns_config = { + base_domain = "headscale.midnightthoughts.space"; + magic_dns = true; + nameservers = [ + "8.8.8.8" + ]; + }; + }; + }; - protocol kernel { - ipv6 { - import all; - export all; - }; - } + bird2 = { + enable = true; + config = '' + router id 100.64.0.1; + debug protocols all; + + protocol device { + } + + protocol direct { + ipv4; + ipv6; + interface "floating1"; + } + + protocol kernel { + ipv4 { + import all; + export all; + }; + } - protocol ospf v2 v4 { - ipv4 { - import all; - export all; - }; - graceful restart 1; - area 0 { - interface "wg0"; - }; - } + protocol kernel { + ipv6 { + import all; + export all; + }; + } - protocol ospf v3 v6 { - ipv6 { - import all; - export all; - }; - graceful restart 1; - area 0 { - interface "wg0"; - }; - } - ''; - }; + protocol ospf v2 v4 { + ipv4 { + import all; + export all; + }; + graceful restart 1; + area 0 { + interface "wg0"; + }; + } - bird-lg = { - proxy = { - enable = true; - allowedIPs = [ "100.64.0.1" ]; - listenAddress = "100.64.0.1:8000"; + protocol ospf v3 v6 { + ipv6 { + import all; + export all; }; - frontend = { - enable = true; - titleBrand = "Midnightthoughts infra"; - navbar.brand = "Midnightthoughts infra"; - listenAddress = "127.0.0.1:5001"; - domain = "lg.midnightthoughts.space"; - servers = [ - "worker-1" - "nordgedanken" - ]; + graceful restart 1; + area 0 { + interface "wg0"; }; - }; + } + ''; + }; - keepalived = { - enable = true; - extraGlobalDefs = '' - lvs_id LVS_BACK + bird-lg = { + proxy = { + enable = true; + allowedIPs = [ "100.64.0.1" ]; + listenAddress = "100.64.0.1:8000"; + }; + frontend = { + enable = true; + titleBrand = "Midnightthoughts infra"; + navbar.brand = "Midnightthoughts infra"; + listenAddress = "127.0.0.1:5001"; + domain = "lg.midnightthoughts.space"; + servers = [ + "worker-1" + "nordgedanken" + ]; + }; + }; + + keepalived = { + enable = true; + extraGlobalDefs = '' + lvs_id LVS_BACK + ''; + # extraConfig = '' + # # Virtual Servers definitions + # virtual_server 10.100.12.1 5000 { + # delay_loop 10 + + # lb_algo wrr + # lb_kind DS + + # persistence_timeout 10 + # protocol TCP + # real_server 100.64.0.3 5432 { + # weight 1 + # HTTP_GET { + # url { + # path / + # } + + # connect_port 8008 + # connect_timeout 3 + # retry 3 + # delay_before_retry 2 + # } + # } + # real_server 100.64.0.1 5432 { + # weight 1 + # HTTP_GET { + # url { + # path / + # } + + # connect_port 8008 + # connect_timeout 3 + # retry 3 + # delay_before_retry 2 + # } + # } + # } + # ''; + vrrpInstances = { + VI_1 = { + state = "BACKUP"; + interface = "wg0"; + virtualRouterId = 230; + priority = 101; + extraConfig = '' + advert_int 1 ''; - # extraConfig = '' - # # Virtual Servers definitions - # virtual_server 10.100.12.1 5000 { - # delay_loop 10 - - # lb_algo wrr - # lb_kind DS - - # persistence_timeout 10 - # protocol TCP - # real_server 100.64.0.3 5432 { - # weight 1 - # HTTP_GET { - # url { - # path / - # } - - # connect_port 8008 - # connect_timeout 3 - # retry 3 - # delay_before_retry 2 - # } - # } - # real_server 100.64.0.1 5432 { - # weight 1 - # HTTP_GET { - # url { - # path / - # } - - # connect_port 8008 - # connect_timeout 3 - # retry 3 - # delay_before_retry 2 - # } - # } - # } - # ''; - vrrpInstances = { - VI_1 = { - state = "BACKUP"; - interface = "wg0"; - virtualRouterId = 230; - priority = 101; - extraConfig = '' - advert_int 1 - ''; - unicastSrcIp = "10.100.0.1"; - unicastPeers = [ "10.100.0.2" ]; - virtualIps = [ - { - addr = "10.100.12.1/24"; - dev = "floating1"; - } - ]; - }; - }; + unicastSrcIp = "10.100.0.1"; + unicastPeers = [ "10.100.0.2" ]; + virtualIps = [ + { + addr = "10.100.12.1/24"; + dev = "floating1"; + } + ]; }; }; + }; + }; - # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion - system.stateVersion = "23.05"; - } + # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion + system.stateVersion = "23.05"; +}