mirror of
https://github.com/gensokyo-zone/infrastructure.git
synced 2026-02-09 12:29:19 -08:00
Moving to modules. Structural changes.
This commit is contained in:
kat witch
parent
3903bc1766
commit
060d4c6d1e
258 changed files with 621 additions and 407 deletions
|
|
@ -1,16 +0,0 @@
|
|||
{ sources, lib, ... }:
|
||||
|
||||
{
|
||||
imports = with (import (sources.nixexprs + "/modules")).nixos; [ base16 base16-shared ] ++ [
|
||||
./nftables
|
||||
./fw-abstraction
|
||||
./deploy-tf
|
||||
(sources.tf-nix + "/modules/nixos/secrets.nix")
|
||||
(sources.tf-nix + "/modules/nixos/secrets-users.nix")
|
||||
(sources.hexchen + "/modules/hexnet")
|
||||
];
|
||||
|
||||
# stubs for hexchens modules, until more generalized
|
||||
options.hexchen.dns = lib.mkOption { };
|
||||
options.hexchen.deploy = lib.mkOption { };
|
||||
}
|
||||
|
|
@ -1,69 +0,0 @@
|
|||
{ tf, target, config, lib, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.deploy.tf;
|
||||
unmergedValues = types.mkOptionType {
|
||||
name = "unmergedValues";
|
||||
merge = loc: defs: map (def: def.value) defs;
|
||||
};
|
||||
in
|
||||
{
|
||||
options.deploy.target = mkOption {
|
||||
type = with types; str;
|
||||
default = "";
|
||||
};
|
||||
|
||||
options.deploy.tf = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = types.attrsOf unmergedValues;
|
||||
|
||||
options = {
|
||||
attrs = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
};
|
||||
out.set = mkOption { type = types.unspecified; };
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
deploy.tf = mkMerge (singleton
|
||||
{
|
||||
attrs = [ "out" "attrs" ];
|
||||
out.set = removeAttrs cfg cfg.attrs;
|
||||
deploy.systems.${config.networking.hostName} =
|
||||
with tf.resources; {
|
||||
isRemote =
|
||||
(config.networking.hostName != builtins.getEnv "HOME_HOSTNAME");
|
||||
nixosConfig = config;
|
||||
connection = tf.resources.${config.networking.hostName}.connection.set;
|
||||
triggers.copy.${config.networking.hostName} =
|
||||
tf.resources.${config.networking.hostName}.refAttr "id";
|
||||
triggers.secrets.${config.networking.hostName} =
|
||||
tf.resources.${config.networking.hostName}.refAttr "id";
|
||||
};
|
||||
|
||||
dns.records."kittywitch_net_${config.networking.hostName}" =
|
||||
mkIf (config.hexchen.network.enable) {
|
||||
tld = "kittywit.ch.";
|
||||
domain = "${config.networking.hostName}.net";
|
||||
aaaa.address = config.hexchen.network.address;
|
||||
};
|
||||
|
||||
} ++ mapAttrsToList
|
||||
(_: user:
|
||||
mapAttrs (_: mkMerge) user.deploy.tf.out.set)
|
||||
config.home-manager.users);
|
||||
|
||||
security.acme.certs."${config.networking.hostName}.net.kittywit.ch" =
|
||||
mkIf (config.services.nginx.enable && config.hexchen.network.enable) {
|
||||
domain = "${config.networking.hostName}.net.kittywit.ch";
|
||||
dnsProvider = "rfc2136";
|
||||
credentialsFile = config.secrets.files.dns_creds.path;
|
||||
group = "nginx";
|
||||
};
|
||||
|
||||
_module.args.tf = target.${config.deploy.target};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,80 +0,0 @@
|
|||
{ config, hosts, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let cfg = config.kw.fw;
|
||||
in
|
||||
{
|
||||
options.kw.fw = {
|
||||
public.tcp.ports = mkOption {
|
||||
type = types.listOf types.port;
|
||||
default = [ ];
|
||||
};
|
||||
public.udp.ports = mkOption {
|
||||
type = types.listOf types.port;
|
||||
default = [ ];
|
||||
};
|
||||
private.tcp.ports = mkOption {
|
||||
type = types.listOf types.port;
|
||||
default = [ ];
|
||||
};
|
||||
private.udp.ports = mkOption {
|
||||
type = types.listOf types.port;
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
public.tcp.ranges = mkOption {
|
||||
type = types.listOf (types.attrsOf types.port);
|
||||
default = [ ];
|
||||
};
|
||||
public.udp.ranges = mkOption {
|
||||
type = types.listOf (types.attrsOf types.port);
|
||||
default = [ ];
|
||||
};
|
||||
private.tcp.ranges = mkOption {
|
||||
type = types.listOf (types.attrsOf types.port);
|
||||
default = [ ];
|
||||
};
|
||||
private.udp.ranges = mkOption {
|
||||
type = types.listOf (types.attrsOf types.port);
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
public.interfaces = mkOption {
|
||||
type = types.listOf types.str;
|
||||
description = "Public firewall interfaces";
|
||||
default = [ ];
|
||||
};
|
||||
private.interfaces = mkOption {
|
||||
type = types.listOf types.str;
|
||||
description = "Private firewall interfaces";
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking.firewall.interfaces =
|
||||
let
|
||||
fwTypes = {
|
||||
ports = "Ports";
|
||||
ranges = "PortRanges";
|
||||
};
|
||||
|
||||
interfaceDef = visibility:
|
||||
listToAttrs (flatten (mapAttrsToList
|
||||
(type: typeString:
|
||||
map
|
||||
(proto: {
|
||||
name = "allowed${toUpper proto}${typeString}";
|
||||
value = cfg.${visibility}.${proto}.${type};
|
||||
}) [ "tcp" "udp" ])
|
||||
fwTypes));
|
||||
|
||||
interfaces = visibility:
|
||||
listToAttrs
|
||||
(map (interface: nameValuePair interface (interfaceDef visibility))
|
||||
cfg.${visibility}.interfaces);
|
||||
in
|
||||
mkMerge (map (visibility: interfaces visibility) [ "public" "private" ]);
|
||||
};
|
||||
}
|
||||
|
|
@ -1,134 +0,0 @@
|
|||
{ pkgs, lib, config, modulesPath, ... }:
|
||||
|
||||
let
|
||||
fwcfg = config.networking.firewall;
|
||||
cfg = config.kw.nftables;
|
||||
|
||||
doDocker = config.virtualisation.docker.enable && cfg.generateDockerRules;
|
||||
|
||||
mkPorts = cond: ports: ranges: action: let
|
||||
portStrings = (map (range: "${toString range.from}-${toString range.to}") ranges)
|
||||
++ (map toString ports);
|
||||
in lib.optionalString (portStrings != []) ''
|
||||
${cond} dport { ${lib.concatStringsSep ", " portStrings} } ${action}
|
||||
'';
|
||||
|
||||
ruleset = ''
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority filter
|
||||
policy ${cfg.inputPolicy}
|
||||
|
||||
icmpv6 type { echo-request, echo-reply, mld-listener-query, mld-listener-report, mld-listener-done, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, packet-too-big } accept
|
||||
icmp type echo-request accept
|
||||
|
||||
ct state invalid drop
|
||||
ct state established,related accept
|
||||
|
||||
iifname { ${
|
||||
lib.concatStringsSep "," (["lo"] ++ fwcfg.trustedInterfaces)
|
||||
} } accept
|
||||
|
||||
${mkPorts "tcp" fwcfg.allowedTCPPorts fwcfg.allowedTCPPortRanges "accept"}
|
||||
${mkPorts "udp" fwcfg.allowedUDPPorts fwcfg.allowedUDPPortRanges "accept"}
|
||||
|
||||
${
|
||||
lib.concatStringsSep "\n" (lib.mapAttrsToList (name: ifcfg:
|
||||
mkPorts "iifname ${name} tcp" ifcfg.allowedTCPPorts ifcfg.allowedTCPPortRanges "accept"
|
||||
+ mkPorts "iifname ${name} udp" ifcfg.allowedUDPPorts ifcfg.allowedUDPPortRanges "accept"
|
||||
) fwcfg.interfaces)
|
||||
}
|
||||
|
||||
# DHCPv6
|
||||
ip6 daddr fe80::/64 udp dport 546 accept
|
||||
|
||||
${cfg.extraInput}
|
||||
|
||||
counter
|
||||
}
|
||||
chain output {
|
||||
type filter hook output priority filter
|
||||
policy ${cfg.outputPolicy}
|
||||
|
||||
${cfg.extraOutput}
|
||||
|
||||
counter
|
||||
}
|
||||
chain forward {
|
||||
type filter hook forward priority filter
|
||||
policy ${cfg.forwardPolicy}
|
||||
|
||||
${lib.optionalString doDocker ''
|
||||
oifname docker0 ct state invalid drop
|
||||
oifname docker0 ct state established,related accept
|
||||
iifname docker0 accept
|
||||
''}
|
||||
|
||||
${cfg.extraForward}
|
||||
|
||||
counter
|
||||
}
|
||||
}
|
||||
${lib.optionalString doDocker ''
|
||||
table ip nat {
|
||||
chain docker-postrouting {
|
||||
type nat hook postrouting priority 10
|
||||
iifname docker0 masquerade
|
||||
}
|
||||
}
|
||||
''}
|
||||
${cfg.extraConfig}
|
||||
'';
|
||||
|
||||
in {
|
||||
options = with lib; {
|
||||
kw.nftables = {
|
||||
enable = mkEnableOption "nftables firewall";
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
};
|
||||
extraInput = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
};
|
||||
extraOutput = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
};
|
||||
extraForward = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
};
|
||||
inputPolicy = mkOption {
|
||||
type = types.str;
|
||||
default = "drop";
|
||||
};
|
||||
outputPolicy = mkOption {
|
||||
type = types.str;
|
||||
default = "accept";
|
||||
};
|
||||
forwardPolicy = mkOption {
|
||||
type = types.str;
|
||||
default = "accept";
|
||||
};
|
||||
generateDockerRules = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall.enable = false;
|
||||
networking.nftables = {
|
||||
enable = true;
|
||||
inherit ruleset;
|
||||
};
|
||||
|
||||
virtualisation.docker = lib.mkIf doDocker {
|
||||
extraOptions = "--iptables=false";
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue