gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 20:39:18 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

kw.fw reorganising

Browse source
This commit is contained in:
kat witch 2021-08-08 03:46:00 +01:00
parent afa161955d
commit dc6982c5ce
No known key found for this signature in database
GPG key ID: 1B477797DCA5EC72
7 changed files with 44 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

6
config/hosts/athame/nixos.nix
View file

@ -77,8 +77,10 @@ with lib;
# Firewall
kw.fw.public.interfaces = singleton "enp1s0";
kw.fw.private.interfaces = singleton "yggdrasil";
kw.fw = {
public.interfaces = singleton "enp1s0";
private.interfaces = singleton "yggdrasil";
};
# Host-specific DNS Config

8
config/hosts/beltane/nixos.nix
View file

@ -79,10 +79,14 @@ with lib;
interfaces.eno1.useDHCP = true;
};
kw.dns.ipv4 = "192.168.1.223";
# Firewall
kw.fw.private.interfaces = singleton "yggdrasil";
kw.fw.public.interfaces = singleton "eno1";
kw.fw = {
private.interfaces = singleton "yggdrasil";
public.interfaces = singleton "eno1";
};
# Yggdrasil

9
config/hosts/samhain/nixos.nix
View file

@ -119,9 +119,12 @@ in {
# Firewall
kw.fw.private.interfaces = singleton "yggdrasil";
kw.fw.public.interfaces = singleton "br";
kw.fw.private.tcp.ports = [ 10445 ]; # VM Prometheus
kw.fw = {
public.interfaces = singleton "br";
private = {
interfaces = singleton "yggdrasil";
};
};
# Host-specific DNS Config

6
config/hosts/yule/nixos.nix
View file

@ -65,8 +65,10 @@ with lib;
# Firewall
kw.fw.private.interfaces = singleton "yggdrasil";
kw.fw.public.interfaces = [ "enp1s0" "wlp2s0" ];
kw.fw = {
public.interfaces = [ "enp1s0" "wlp2s0" ];
private.interfaces = singleton "yggdrasil";
};
# Yggdrasil

4
config/modules/nixos/dns.nix
View file

@ -40,8 +40,8 @@ with lib;
kw.dns.ygg_prefix = "net";
# This should be set in host config if it needs to be set for a host. Otherwise, they're retrieved from terraform.
kw.dns.ipv4 = mkIf (tf.resources ? config.networking.hostName) (mkOptionDefault (config.deploy.tf.resources."${config.networking.hostName}".refAttr "ipv4_address"));
kw.dns.ipv6 = mkIf (tf.resources ? config.networking.hostName) (mkOptionDefault (config.deploy.tf.resources."${config.networking.hostName}".refAttr "ipv6_address"));
kw.dns.ipv4 = mkDefault (mkIf (tf.resources ? config.networking.hostName) (mkOptionDefault (config.deploy.tf.resources."${config.networking.hostName}".refAttr "ipv4_address")));
kw.dns.ipv6 = mkDefault (mkIf (tf.resources ? config.networking.hostName) (mkOptionDefault (config.deploy.tf.resources."${config.networking.hostName}".refAttr "ipv6_address")));
# This is derived.
kw.dns.domain = builtins.substring 0 ((builtins.stringLength config.kw.dns.tld) - 1) config.kw.dns.tld;

29
config/profiles/base/ssh.nix
View file

@ -1,17 +1,24 @@
{ config, lib, pkgs, ... }:
{
kw.fw.public.udp.ranges = [{
from = 60000;
to = 61000;
}];
kw.fw.private.udp.ranges = [{
from = 60000;
to = 61000;
}];
with lib;
kw.fw.public.tcp.ports = [ 62954 ];
kw.fw.private.tcp.ports = [ 62954 ];
{
kw.fw = {
public = {
tcp.ports = singleton 62954;
udp.ranges = [{
from = 60000;
to = 61000;
}];
};
private = {
tcp.ports = singleton 62954;
udp.ranges = [{
from = 60000;
to = 61000;
}];
};
};
services.openssh = {
enable = true;

6
config/services/nginx/default.nix
View file

@ -12,8 +12,10 @@ with lib;
'';
};
kw.fw.public.tcp.ports = [ 443 80 ];
kw.fw.private.tcp.ports = [ 443 80 ];
kw.fw = {
public.tcp.ports = [ 443 80 ];
private.tcp.ports = [ 443 80 ];
};
services.nginx = {
enable = true;