sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

Better Server cfg

Browse Source
This commit is contained in:
soraefir
2026-05-03 02:20:41 +02:00
parent d3a3941591
commit 9377d1ce45
8 changed files with 99 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
modules/nixos/system/network/wireguard/default.nix
View File

@@ -7,7 +7,6 @@
activePeers = builtins.filter isValidPeer config.syscfg.peers;
in
{
imports = [ ./forwarding.nix ];
config = lib.mkIf (config.syscfg.net.wg.enable) {
networking.wireguard = {
enable = true;
@@ -19,7 +18,7 @@ in
listenPort = 1515;
mtu = 1340;
peers =
if config.syscfg.net.wg.server.enable then
if config.syscfg.server ? wireguard then
map (p: {
name = p.syscfg.hostname;
publicKey = p.syscfg.net.wg.pubkey;

13
modules/server/arion/default.nix Normal file
View File

@@ -0,0 +1,13 @@
{ config, pkgs, lib, ... }:{
config = lib.mkIf (config.syscfg.server ? arion) {
environment.systemPackages = with pkgs; [ arion ];
virtualisation.arion = {
backend = "podman-socket";
projects = {
cloud.settings = import ./docker/cloud.nix { inherit config pkgs lib; };
authentik.settings =
import ./docker/authentik.nix { inherit config pkgs lib; };
};
};
};
}

16
modules/server/default.nix
View File

@@ -1,15 +1,3 @@
{ config, pkgs, lib, ... }:
let
in {
imports = [ ./sops ];
environment.systemPackages = with pkgs; [ arion ];
virtualisation.arion = {
backend = "podman-socket";
projects = {
cloud.settings = import ./docker/cloud.nix { inherit config pkgs lib; };
authentik.settings =
import ./docker/authentik.nix { inherit config pkgs lib; };
};
};
{ config, pkgs, lib, ... }:{
imports = [ ./sops ./nftables ./openssh ./arion ];
}

9
modules/nixos/system/network/wireguard/forwarding.nix → modules/server/nftables/default.nix
View File

@@ -1,8 +1,7 @@
{ config, lib, pkgs, ... }:
{
config = lib.mkIf (config.syscfg.net.wg.server.enable) {
{ config, lib, ... }:{
config = lib.mkIf (config.syscfg.server.nftables.enable) {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
@@ -28,12 +27,12 @@
iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
''
) config.syscfg.net.wg.server.forward}
) config.syscfg.server.nftables.ports}
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname { "wg0", "ens3" } masquerade
oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
}
}
'';

27
modules/server/openssh/default.nix Normal file
View File

@@ -0,0 +1,27 @@
{ config, lib, ... }:
let
allUsers = lib.concatMap (peer: if peer.syscfg ? users then peer.syscfg.users else []) config.syscfg.peers;
groupedUsers = lib.groupBy (u: u.username) allUsers;
allowedUsernames = map (u: u.username) config.syscfg.users;
activeUsers = lib.filterAttrs (name: _: lib.elem name allowedUsernames) groupedUsers;
in {
config = lib.mkIf (config.syscfg.server.nftables.enable) {
services.openssh = {
enable = true;
ports = [ 422 ];
banner = "";
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
ClientAliveInterval = 60;
ClientAliveCountMax = 3;
TCPKeepAlive = true;
};
};
users.users = lib.mapAttrs (name: userList: {
openssh.authorizedKeys.keys = lib.unique (
lib.concatMap (u: if u ? pubssh then [ u.pubssh ] else []) userList
);
}) activeUsers;
};
}

53
modules/shared/syscfg/default.nix
View File

@@ -52,26 +52,6 @@ let
type = types.str;
default = "";
};
server = {
enable = mkOption {
type = types.bool;
default = false;
};
peers = mkOption {
type = types.listOf types.str;
default = [];
};
forward = mkOption {
type = types.listOf (types.listOf (types.oneOf [ types.str types.int ]));
default = [];
description = "Forwarding rules: [ [srcInterface dstAddr srcPort dstPort] ... ]";
example = [
[ "ens3" "10.10.1.2" "IPV6" 22 2222 ]
[ "ens3" "10.10.1.2" "IPV6" 80 80 ]
[ "ens3" "10.10.1.2" "IPV6" 443 443 ]
];
};
};
};
};
makeOpt = with lib; {
@@ -114,7 +94,6 @@ let
type = types.str;
default = "3306";
};
configPath = mkOption {
type = types.str;
default = "/media/config";
@@ -123,6 +102,38 @@ let
type = types.str;
default = "/media/data";
};
arion = mkOption {
type = type.bool;
default = false;
};
openssh = mkOption {
type = type.bool;
default = false;
};
wireguard = mkOption {
type = type.bool;
default = false;
};
nftables = {
enable = mkOption {
type = type.bool;
default = false;
};
ifs = mkOption {
type = types.listOf types.str;
default = [ ];
};
ports = mkOption {
type = types.listOf (types.listOf (types.oneOf [ types.str types.int ]));
default = [];
description = "Forwarding rules: [ [srcInterface dstAddr srcPort dstPort] ... ]";
example = [
[ "ens3" "10.10.1.2" "IPV6" 22 2222 ]
[ "ens3" "10.10.1.2" "IPV6" 80 80 ]
[ "ens3" "10.10.1.2" "IPV6" 443 443 ]
];
};
};
};
in with lib; {

9
systems/gateway/cfg.nix
View File

@@ -24,9 +24,15 @@
ip4 = "10.10.1.1/32";
ip6 = "fd10:10:10::1/128";
pubkey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
};
};
server = {
openssh = true;
wireguard = true;
nftables = {
enable = true;
forward = [
ifs = ["ens3" "wg0" ];
ports = [
[ "ens3" "10.10.1.2" "fd10:10:10::2" 22 2222 ] # SSH/GIT
[ "ens3" "10.10.1.2" "fd10:10:10::2" 80 80 ] # HTTP
[ "ens3" "10.10.1.2" "fd10:10:10::2" 443 443 ] # HTTPS
@@ -35,5 +41,4 @@
};
};
};
};
}

33
systems/gateway/default.nix
View File

@@ -1,27 +1,14 @@
{ config, lib, inputs, ... }:
let
allUsers = lib.concatMap (peer: if peer.syscfg ? users then peer.syscfg.users else []) config.syscfg.peers;
groupedUsers = lib.groupBy (u: u.username) allUsers;
allowedUsernames = map (u: u.username) config.syscfg.users;
activeUsers = lib.filterAttrs (name: _: lib.elem name allowedUsernames) groupedUsers;
in {
imports = [ ./hardware.nix ];
{ config, lib, inputs, ... }: {
imports = [ ./hardware.nix ../../modules/server ];
services.openssh = {
system.autoUpgrade = {
enable = true;
ports = [ 422 ];
banner = "";
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
ClientAliveInterval = 60;
ClientAliveCountMax = 3;
TCPKeepAlive = true;
flake = "git+https://git.helcel.net/sora/nixconfig";
flags = [
"--no-write-lock-file"
];
dates = "04:00";
randomizedDelaySec = "30min";
allowReboot = false;
};
};
users.users = lib.mapAttrs (name: userList: {
openssh.authorizedKeys.keys = lib.unique (
lib.concatMap (u: if u ? pubssh then [ u.pubssh ] else []) userList
);
}) activeUsers;
}