sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

Migrate gateway

Browse Source
This commit is contained in:
soraefir
2026-05-01 17:31:09 +02:00
parent 60bf451310
commit a7ce1dc7ea
12 changed files with 168 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
flake.nix
View File

@@ -44,6 +44,7 @@
avalon = gen.generate { host = "avalon"; };
ci = gen.generate { host = "ci"; };
sandbox = gen.generate { host = "sandbox"; };
gateway = gen.generate { host = "gateway"; };
};
darwinConfigurations = { asgard = gen.generate { host = "asgard"; }; };
homeConfigurations = {

59
modules/home/gui/games/wow.nix
View File

@@ -19,64 +19,5 @@
"wago_addons": null
}
}'';
# curse:master-plan
# curse:raretrackercore-rt
# curse:raretrackerdragonflight-rtd
# curse:raretrackermaw-rtmw
# curse:raretrackermechagon-rtm
# curse:raretrackerthewarwithin-rtww
# curse:raretrackertimelessisle-rtti
# curse:raretrackeruldum-rtu
# curse:raretrackervale-rtv
# curse:raretrackerworldbosses-rtwb
# curse:raretrackerzerethmortis-rtz
# curse:venture-plan
# curse:war-plan
# github:nevcairiel/bartender4
# github:cidan/betterbags
# github:bigwigsmods/bigwigs
# github:bigwigsmods/bigwigs_battleforazeroth
# github:bigwigsmods/bigwigs_burningcrusade
# github:bigwigsmods/bigwigs_cataclysm
# github:bigwigsmods/bigwigs_classic
# github:bigwigsmods/bigwigs_dragonflight
# github:bigwigsmods/bigwigs_legion
# github:bigwigsmods/bigwigs_mistsofpandaria
# github:bigwigsmods/bigwigs_shadowlands
# github:bigwigsmods/bigwigs_warlordsofdraenor
# github:bigwigsmods/bigwigs_wrathofthelichking
# github:nezroy/demodal
# github:curseforge-mirror/details
# github:edusperoni/details_elitism
# github:curseforge-mirror/elitismhelper
# github:michaelnpsp/grid2
# github:jods-gh/groupfinderrio
# github:nevcairiel/handynotes
# github:hekili/hekili
# github:thekrowi/krowi_achievementfilter
# github:bigwigsmods/littlewigs
# github:nnoggie/mythicdungeontools
# github:tullamods/omnicc
# github:tercioo/plater-nameplates
# github:curseforge-mirror/quest_completist
# github:raiderio/raiderio-addon
# github:wowrarity/rarity
# github:nevcairiel/shadowedunitframes
# github:simulationcraft/simc-addon
# github:curseforge-mirror/tomcats
# github:weakauras/weakauras2
# github:kemayo/wow-handynotes-battleforazerothtreasures
# github:kemayo/wow-handynotes-dragonflight
# github:kemayo/wow-handynotes-legiontreasures
# github:kemayo/wow-handynotes-longforgottenhippogryph
# github:kemayo/wow-handynotes-lostandfound
# github:kemayo/wow-handynotes-secretfish
# github:kemayo/wow-handynotes-shadowlandstreasures
# github:kemayo/wow-handynotes-stygia
# github:kemayo/wow-handynotes-treasurehunter
# github:kemayo/wow-handynotes-warwithin
# wowi:7032-tomtom
};
}

10
modules/nixos/system/network/wireguard/default.nix
View File

@@ -1,4 +1,5 @@
{ config, lib, ... }: {
imports = [ ./forwarding.nix ];
config = lib.mkIf (config.syscfg.net.wg.enable) {
networking.wireguard = {
enable = true;
@@ -9,7 +10,14 @@
config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
listenPort = 1515;
mtu = 1340;
peers = [{
peers =
if config.syscfg.net.wg.server.enable then
map(secretName:{
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
publicKey = config.sops.secrets."${secretName}_wg_pub".path;
}) config.syscfg.net.wg.server.peers
else
[{
allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
endpoint = "vpn.helcel.net:1515";
publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";

43
modules/nixos/system/network/wireguard/forwarding.nix Normal file
View File

@@ -0,0 +1,43 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.syscfg.net.wg;
in
{
config = lib.mkIf (config.syscfg.net.wg.server.enable) {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
networking.nftables.enable = true;
networking.nftables.ruleset = ''
table inet nat {
chain prerouting {
type nat hook prerouting priority 0; policy accept;
${concatMapStringsSep "\n" (ports:
let
src = builtins.elemAt ports 0;
dst = builtins.elemAt ports 1;
in ''
iifname "${cfg.inInterface}" tcp dport ${toString src} counter dnat to ${cfg.toAddr}:${toString dst}
iifname "${cfg.inInterface}" udp dport ${toString src} counter dnat to ${cfg.toAddr}:${toString dst}
''
) cfg.forwarding.ports}
}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname { "wg0", "ens3" } masquerade
}
}
'';
};
}

10
modules/shared/sops/common.yaml
View File

@@ -1,3 +1,7 @@
gateway_wg_priv: ENC[AES256_GCM,data:3XZxNN3qDNPNlvWeErPujvm0XJR3GUTNodEBL7G8Z+6uhyNTdLDOB34m16k=,iv:QRxE7qLtDOckWhL3GGopTnADlwuRSkT/GLpHkrGOAOA=,tag:xT/UlJg/oQYbJBfQeNak3w==,type:str]
gateway_wg_pub: ENC[AES256_GCM,data:yS7PFe/ShzB7FG3gXinPl7VLNfdxA6hxIyuIHUDT2GfP/NWc08Z7ztKVu48=,iv:B45FKQNhg9YTykNHRC2p4ZWHB9+VwfEBh2gW+npE7EA=,tag:j2hU0RLv8gknAmSGp7iMrw==,type:str]
gateway_ssh_priv: null
gateway_ssh_pub: null
valinor_ssh_priv: ENC[AES256_GCM,data:+eeVw/05eU5VW29KhT9+eGXcf+Ola2n0ISbj5Lzyj/bB/8OWDGXkqxWjgZv3cbL9v265AbyqcHfYX94BynTtMITfM6Cwz3D0EcUmIyP3rgjrJZdnksLu41a30dUjLnfVqiPwZaxxccZb6/JNAgXrg4hjkTsrCiZeSGpPl2VqECVt0tfJ3nmJwX+7C95QMvzxCw5S6CbN53AZBPmqBqzmxperc0LegMR+2lXviuqTEL2ZH3mzo0YeJQS/yCVVQL6TWx/wyM4fKD4kavg07sCAoj7E4V9RL4DY75uIbEz2+hvw9yE4nCtg2UgLu2hmragbH5ZseD/BWu+d2JGQeAnSLJBr6lZj/LGsiCe5vdnNqh2igZ9EI8Bhjv2ed2ajAxPYxJ1cAT9noxx6E+KU6sjWaSeKhLsnO/X3Ht1ADiUP4i/j39aE/4U7Gmk8Gs+3LBF0FXS88M06HV1cCKkd8RLkD0v6uKpOd6deOkKZRRGT8XzrF6JGY6fMXksF7GCqYqKhHEvU3nd3MQ/XjZuSycIr6NKdo31iezwjFCELUf2XQCIEtLe77vxfZQQ9lhddLhM7FJVDwlIuVLjN0lzrUoCywOZOG/ipenkCLDD5JmPqbkgyqFEIKpLW3weqlIFPTQblwaW724kKB80E+0lvW+0mG8oiyeqBuFufhtaUEwmg93aCzPW7wJuP7rzBm2i0FPl4Mg0f1d7iJtrHaIcnncw7vzeo+LOq1zvlcCVO3lt/JTRhTbxMEDzzQvvuRnFVExQbNCd9BKErpZAIia/l+5/PYClqapQYuBsx+Y4jUC/ct6PicSz/YtdXgTQc3jqmsLJ46R7Y3qkeaYJvsFDbTtjG1GlQdisNPZEhtkWgvyIcxl62/SSqLJr+ZxWh2ldToVpnX4g9JKcHbHyvsD/JJRsSD8fHlGBlnpXpL4onkQNbtZQ9HUBpaz6rQvp7klM5iI1trpdnv8nf3H0G54mz5c4FY81VIXcy+2nEgadhWNdKlI0rjruvXyJKUvCPmh3ZyPZPL+7rkLI+ywj+0Gz7QGKcDsOy2L1UsHSpCJGRe0ZJO8vuq1relbMF2pz5eQHa+9S3NNG/v5WNWVw4BcCaX8tfuac467mZ+sr2CKAKn+ojhBAkSVWHWg95bURX1NUpjw6d2dPSJbLjen7FDZ1NiZsvW+eNIPnuaOAIoNKW9H2XXmXagJASOnwd+BwNWWB7APlQz/YfQycDG4TjAWCg22aoTagmXoPtiqNqo0gq7NljSbq5EY2hn1RUV7umMR/cqY4XmdBsVqSwnjBtuHGQArn2QRbAYJcHkrxpAzMfJSWNx176ARBFhQDITpI8Y2ROyF+tZaOcNOYuXfAjktV7Elgt5dNypxdo4a/qFt0IkjxRF8WGGTKU3eRnC0EvaVc3xifLIcjrihqiVnB3jb58pT7lSeTH8pnuTS2+jOVphvok+8ddKd+Q5Po2yw8e0PswzPK7dYdMjNNKhbg/W41Bxf5ZKWxGZjxMbwNndzPext/+QWZqTJDw+Cf3rCMpaAU3nRSW7b5TD9fYrmajSbkzHBy9ggt1y+IofLEWlsMkiisxqnggsbVyDlxMb2q5iOFYMWtG/VPE6e5yDUVlwsd1l+Mv+vASCJW0J2i5BJzpYVTnazcQabbVeK/t3t8oA7/aO7omZxbPYDcfBAfc8+ibx3iBW4tIrwe0EvsqkdhTt4C5jpxynfBnvUL4+O5IYFSyz29EKNPZ+2RQti6tMCZYi4/IDBg93WQHGMrUd0pyANwP0vYVH8QGtD3X94nwOjoJO3GXqD3qcGsCrmBmmJtHTYBZ39KZpxxujsYDeccUuRbV9Ivq9vydkjO4fkIKCtlSFWRtkgU6cl4IxoO7alRDvJzadWrBdW5k3ubZG3qV05+iV9KSdh520YrRzxGb0yd8Ii0pgJU38oEywWyLUL9+/Ov5UZALtflS90cLANodWfzNtAxcZP6C+XR3aRyI8dZp5ZcOwwbj9aieSImLDwnC0l1cdtxSu8Iwm29/yeh4v4JXl6t1bBsTkyCoirQnkyBC3lHLCbwE3vfB34BTcChR+qWhiM92rnr6be8M89AtnEfNsdpZAWD96craURM8wfmMh9tM66gjjHyYuJbi1186x4LAtST4VZMHnw6NoG3XK5sMoVZq8jFWfUqrpS6ZMRu1UV0qL1jNbcZifwOlDgmoFXhFMZ6CGax0Up+cFPI2BJ7wGQwsTszifSXah/XgFhrOWgu9Hs5YJYbTxs26yEhG2K9j1J/4dtNdowmPI05iMynybTzrQkB8T/lVE5w9o1wumNhftyXie10+Nc8U1Ok3JugGG1CoM35eLAPTA8vHZzj6819apBCtw2vGeHio9k27164gHhsZUdAhyfC8hxmR/V857ipCchBNGg6aQOh2hVs9+4mNaap1UXGlAOJZMp/O7BNknYi6LVuGOtiS01W86pgPtCrbb8/24RHcybSLXhS4spTDf/LfBHaEWiklQHyq7YU6hsTOcmTkMNLCFuNVbPXPFze30KWtPhyZyQNYPqEwo8dZ8InN3RNBaYCMgYel7kNcmCO/0HlL1Kqjc4i2mguFiw23Tz0YRmUpwDjEe9gfOjlm9EZQs0GQQyB2gNfaoH1oyiM5yvQ9MrY9OADGpos0334ZqW9mykUpjkhrCWKLmVLAzWejbqMw1ZDq7FRa+l6Uyt+2XFPar7dta/TsWYKv6kTqoz1JHMwf5EoGEgCszcwnqkcqd5T9NHoVNwwpkEN/7axF0OqT25NSpXkAcacSHo70998jL3zbdKFVamUmpF/hN6ioniJyKAelESPym7KpjZKBEsHGTzU30t1GgsGlYUwtR07O5FnRVViDiMyQHYAq1PXa1EbCS0b7bbdMYGcExJzHvlT8VmeKnJ1RoOvKWyil2habXd+TbxEWtfAOuWtJzLYwXWKPppsq/EwKxUGNla01hVrfAbm3QNP45gDGFZ0+piA8PLNq6PNFoSlINc/6/Z3WaENpGhxL0mKS2IS/d76AzHjUV+Hw6ylFUdYEjAPp2lR5woslQnxpO5n3oKpFl3jevzJmcNJKuZZEYzGU1leyddx30hzmVMfTliybA5I1GVTIigbdKwuRWL8uYQA1mHUeO5pEPGMv1X4GcoT5BDrdcFAaU6vjhXbjVhCNcPBbjxKHisfOBUr6nx1M/n3AHndhilimrPP5adOGpG2CFqKQtINb0UmpqPQJRB488tuVE3fTPgqNi+PEES1tIumBVdt5m95p+BNHPyVwLloMeGkCVqsTid2251NSpFd/n0BVAOR0zZP1hGRRzgU2tNPK4VAVuvuPQdPw7ZUbVSe/VvphOLXAG72M27W9IbLrsnnmaNeh5ur/9fl5yI52py53z0Zrp6WNociqyeC03xzPAwmYF9BFMG+j9Kto2OfbxOCUdWxhlCGDuUqODcAsvfKNQddq4Fha0HSLjvGOtfEuWmJNTzmfIeO3vg==,iv:pTQbb6nLHJ8BXTIYdiSe4vc5+1hpNuHhQhDkIAsZ9HI=,tag:jyO99VXSsCQlQD+Hh+gtvg==,type:str]
valinor_ssh_pub: ENC[AES256_GCM,data:c9s+tEjn+aZAjsxU7+dWmKLVc3dFdtna3ilDJrEb4k9TToyYY5VYEW6exxpbBl6MMAe98/KXgLPI5kTmq3gCqQe2dBnOB3C4f212DOmVyoYGj4AiqzU+Oo0pfg6DRw5BCjYGY7B+zJopqQgDvlIRTdJzAhQe3ZRuJFXKupVpJ+pEx56bo/memAf+BBZgIXChFrYadqze90rMmlw0D5V3L3lmTnqjoniXTXj5QoHh2f873qFAQ72+fSNlJCkasNavSiXKWVPcS3xMmgfiaffkqdO6pte1m/IgevKkKfciIOBbKskgsTZdy9iPGdELLH1wMzO45+vX3h2ATy/v5Hqq/yWlrDbvFFUKoaCb6n7/5O3MhaLwa78Uk09Dvbno2Wb8C5BBZlXBZ/BSooosDFUG/2IG8nKM+FrHJvtwgugCGa3ZQYKQr6iJ9g6tN83YRTEgKTCsZPnSNg+vXSBAib5ABHl8z7oHVB2hJFBnEn7Im99b/GRsCRD+/y9Y+4wF8nzznJgSrqInM59//EJHmwOWrHzSIpyV+cY67cCUXlkYB/ufx510XtEjijr2SOJXKmdAmme0EICkP/LY80Yrsoz2ee/A6w6ZP3HDHuxUVNeGNJvdoFhIyt9pEiRBwl7K2XKYCh/lRiE6E19EM6SmwplEM0+uAWTY+NUKZba2JSqFZLMlBFfWSLHgOHFLPatkZRUTkoNa4BOhtUlAYfuN/uHHimnL7H4O814OnjU5exqHca63VkDDhA==,iv:YT0ZN/Rt6CbMSFU1wZDbrenlwXCh7e4C06YbVL5J/VU=,tag:BqVtzOC1ViEkHHTXbgDJHw==,type:str]
valinor_wg_priv: ENC[AES256_GCM,data:1izZF+6G2Uc2MRBH56A07lexZEkyOiiFI4zltyoZco0+Y9EPhH1nJ4sWzs0=,iv:OIBIQvMsrq93/o0r8V6eSzfU63xtCzgQFf8NKXsjRk0=,tag:wdcQOfdaoxe7Vw0QWmngwA==,type:str]
@@ -64,8 +68,8 @@ sops:
STRtTVpVTCtVZ1FUNENqWFFVNTNuaVUKN6HRiZjTdENeif8dJ29urBxPXDaosjjY
InN4Ko6YUaGfvB1DTrKIzrxOpsHS+XjisoGfT71tJwwEOoREklEO/A==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-09-06T13:14:21Z"
mac: ENC[AES256_GCM,data:nsr9KS5VNuxltR3cMDfCXtpK/lFi4M2OwwcOCj+MmJ+AtyCn7reqjd/VlIb7vLhZfuqoPbbzObvzBzX8jrMuX3Idy/PrCKht0ilYC1dZW4I/TlFM2mkJdTuFbhiXwQUhUJ89yHqIFFHJbO4ld5WfOEzGdazM2YC1OwkyOPu25+4=,iv:y6Knr38jVd+nyOBEdn861AULzkwpa9NpRKobIIlyJFg=,tag:HrGm4dENtWFXAm6d0ydn/g==,type:str]
lastmodified: "2026-05-01T15:14:46Z"
mac: ENC[AES256_GCM,data:epSFr7V8a1SRbLqiW0hmxFczzedodtoq69zVy3+kYmoIoQCGh2lHyDr2UPQHpdKZQbaOaForXO8Nlc+hllEcX/uPp/O7Yw/KEsS66wPZW8XW9GubzKVn47K1+tNTzeiLAi0iOMEcl2spXGL+6qlieuqNNrWlMEJak61rPEKSXcA=,iv:ifi1u2LTxGPHhMYRHkwSobpLBouCnOMSv6/f1G3LI+s=,tag:46tMthiGwxITsGbIMYykUg==,type:str]
pgp:
- created_at: "2023-04-20T10:20:17Z"
enc: |-
@@ -88,4 +92,4 @@ sops:
-----END PGP MESSAGE-----
fp: 4E241635F8EDD2919D2FB44CA362EA0491E2EEA0
unencrypted_suffix: _unencrypted
version: 3.10.2
version: 3.12.1

32
modules/shared/syscfg/default.nix
View File

@@ -42,6 +42,36 @@ let
type = types.str;
default = "";
};
server = {
enable = mkOption {
type = types.bool;
default = false;
};
peers = mkOption {
type = types.listOf types.str;
default = [];
};
forward = {
inInterface = mkOption {
type = types.str;
default = "ens3";
description = "Incoming interface for forwarding";
};
toAddr = mkOption {
type = types.str;
description = "Destination address (IPv4 or IPv6)";
example = "10.10.1.2";
};
ports = mkOption {
type = types.listOf (types.listOf types.port);
default = [];
description = "Port mappings: [ [srcPort dstPort] ... ]";
example = [ [ 22 22 ] [ 80 80 ] [ 443 443 ] ];
};
}
};
};
};
makeOpt = with lib; {
@@ -55,7 +85,7 @@ let
};
virt = mkOption {
type = types.bool;
default = true;
default = false;
};
power = mkOption {
type = types.bool;

8
systems/avalon/cfg.nix
View File

@@ -23,16 +23,8 @@
}
];
make = {
gui = false;
cli = true;
virt = true;
power = false;
game = false;
develop = false;
};
wlp = {
enable = false;
nif = "";
};
wg = {
enable = true;

14
systems/avalon/server/docker/secrets.txt Normal file
View File

@@ -0,0 +1,14 @@
AUTHENTIK_DB_PASSWORD=NTQRO0rhPCd4L3HLNK4AT09Npz+ks1jyRC6AOyo5u+k=
AUTHENTIK_SECRET_KEY=9Zw8Sy8257iJmRdBhUKGiq3d7uYAkhC9smuDUClE8aR1iPdpHHds+K2D1Zy3lwj2Hjnasu5jnopkhwnABWDu8A==
AUTHENTIK_EMAIL_PASSWORD=w+g:cPU+e.<q,f<mj3DFPxXxo4h2SVS9.;,T<!Sra>y!mNcAsiAp4jPCLTmjte2d
ETHERPAD_DB_PASSWORD=d43352c3906516bf4c34d63316509cb4b1621167af84c81b60689779a62b2348
ETHERPAD_ADMIN_PASSWORD=Hackme55#
COLLABORA_USER=...
COLLABORA_PASSWORD=...

32
systems/gateway/cfg.nix Normal file
View File

@@ -0,0 +1,32 @@
{
syscfg = {
hostname = "gateway";
type = "nixos";
system = "x86_64-linux";
defaultUser = "sora";
users = [{
username = "sora";
wm = "-";
git = {
email = "soraefir+git@helcel";
username = "soraefir";
key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
};
}];
make = {
cli = true;
};
net = {
wlp = { enable = false; };
wg = {
enable = true;
ip4 = "10.10.1.1/32";
ip6 = "fd10:10:10::1/128";
server = {
enable = true;
peers = ["avalon" "asguard" "iriy" "valinor" ];
};
};
};
};
}

13
systems/gateway/default.nix Normal file
View File

@@ -0,0 +1,13 @@
{ config, inputs, ... }: {
imports = [ ./hardware.nix ];
services.openssh.enable = true;
services.openssh.authorizedKeysFiles = [
config.sops.secrets."iriy_ssh_pub".path
config.sops.secrets."valinor_ssh_pub".path
];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0GpKd62XMlO410/iYkNG8MHdGGaeMG3Gmsf3Pv3u2BllUzR9Dpym1ZOz2lwo3iK0FimcQpOiJqSIahO59HJl8jQ9BoQrJMXH7l2kuq1T09cMNWGjlzowg0LWKWOzoBzOwcheyW68OJGgkSfvk9BdshkUYTLVBXjiI9jo/8Qkcv1WLJJvJmDBDwnbYDQpODXCEDQ/t3YVubb+ocLmh40sDUffJLWZQXN6OFW9N5XxnvY7K5x9ci9GU4Reei40K8yDw2Hgi0njzijRdzie3MJlKPPawJ2TATu9LsGuxfx8bJXVx+mNxP0lhO8dOOhP7p0ozTxlJJY9ZWaKgOz3SzYNCgJ1gH7NtTBtSruXd6pfmErUmuJEAeMD6+QF3yJ5tnVFNPoSHqjP+oL3CgSRpmuvn7ChSSI3J3UVhLux165VtwIL7UhosO2mCqmn0Yk2mSBkB/L4ZiWFmO3vYdagYNQX7xZHzCJ5my8vomiT+DUGb2h/o1NetKwIZJiFAuHxKt3k= sora@valinor"
];
}

13
systems/gateway/hardware.nix Normal file
View File

@@ -0,0 +1,13 @@
{ config, lib, pkgs, modulesPath, ... }: {
boot.kernelPackages = pkgs.linuxPackages_latest;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
boot.loader.grub.device = "/dev/sda";
boot.initrd.availableKernelModules =
[ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = {
device = "/dev/sda3";
fsType = "btrfs";
};
}

1
systems/iriy/cfg.nix
View File

@@ -17,7 +17,6 @@
gui = true;
cli = true;
virt = true;
power = false;
game = true;
develop = true;
};