2020-12-26 23:36:34 +00:00
|
|
|
# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
|
|
|
|
#
|
|
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
|
|
|
|
{ depot, lib, pkgs, rebuilder, config, ... }:
|
|
|
|
let
|
|
|
|
inherit (depot.ops) secrets;
|
|
|
|
machineSecrets = secrets.machineSpecific.etheroute-lon01;
|
2021-12-07 15:48:50 +00:00
|
|
|
|
|
|
|
makeIPIPInterface = {
|
|
|
|
name,
|
|
|
|
underlayDevice,
|
|
|
|
localIP,
|
|
|
|
remoteIP
|
|
|
|
}: {
|
|
|
|
description = "IPIP interface ${name}";
|
|
|
|
wantedBy = [ "network-setup.service" "sys-subsystem-net-devices-${underlayDevice}.device" ];
|
|
|
|
bindsTo = [ "${underlayDevice}-netdev.service" "sys-subsystem-net-devices-${underlayDevice}.device" ];
|
|
|
|
partOf = [ "network-setup.service" ];
|
|
|
|
after = [ "network-pre.target" "sys-subsystem-net-devices-${underlayDevice}.device" "network-addresses-${underlayDevice}.service" ];
|
|
|
|
before = [ "network-setup.service" ];
|
|
|
|
serviceConfig.Type = "oneshot";
|
|
|
|
serviceConfig.RemainAfterExit = true;
|
|
|
|
path = [ pkgs.iproute2 ];
|
|
|
|
|
|
|
|
script = ''
|
|
|
|
echo "Removing old interface"
|
|
|
|
ip link show "${name}" >/dev/null 2>&1 && ip link del "${name}"
|
|
|
|
|
|
|
|
echo "Adding interface"
|
|
|
|
ip link add name "${name}" type ipip local "${localIP}" remote "${remoteIP}"
|
|
|
|
|
|
|
|
echo "Bringing up interface"
|
|
|
|
ip link set "${name}" up
|
|
|
|
'';
|
|
|
|
preStop = ''
|
|
|
|
echo "Removing interface"
|
|
|
|
ip link set "${name}" down || true
|
|
|
|
ip link del "${name}" || true
|
|
|
|
'';
|
|
|
|
reload = ''
|
|
|
|
ip link set dev "${name}" type ipip local "${localIP}" remote "${remoteIP}"
|
|
|
|
'';
|
|
|
|
reloadIfChanged = true;
|
|
|
|
};
|
2020-12-26 23:36:34 +00:00
|
|
|
in {
|
|
|
|
imports = [
|
|
|
|
../lib/bgp.nix
|
|
|
|
../lib/zfs.nix
|
|
|
|
];
|
|
|
|
|
|
|
|
boot.initrd = {
|
|
|
|
availableKernelModules = [
|
|
|
|
"ehci_pci"
|
|
|
|
"ahci"
|
|
|
|
"usbhid"
|
|
|
|
"usb_storage"
|
|
|
|
"sd_mod"
|
|
|
|
"sr_mod"
|
|
|
|
"bnx2" # ethernet
|
|
|
|
];
|
|
|
|
network = {
|
|
|
|
enable = true;
|
|
|
|
ssh = {
|
|
|
|
enable = true;
|
|
|
|
hostKeys = ["/persist/etc/ssh/ssh_host_ed25519_key"];
|
|
|
|
authorizedKeys = map builtins.readFile config.users.users.lukegb.openssh.authorizedKeys.keyFiles;
|
|
|
|
};
|
|
|
|
postCommands = ''
|
|
|
|
echo "zfs load-key -a; killall zfs" >> /root/.profile
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
boot.kernelParams = [
|
|
|
|
"ip=83.97.19.68::83.97.19.65:255.255.255.224:etheroute-lon01:eno1:none"
|
|
|
|
];
|
|
|
|
boot.kernelModules = [ "kvm-intel" ];
|
2021-12-07 15:48:50 +00:00
|
|
|
boot.kernel.sysctl = {
|
|
|
|
"net.ipv4.conf.all.forwarding" = true;
|
|
|
|
"net.ipv4.conf.default.forwarding" = true;
|
|
|
|
};
|
2020-12-26 23:36:34 +00:00
|
|
|
|
|
|
|
# Use the systemd-boot EFI boot loader.
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
|
|
|
|
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
|
|
|
services.zfs.rollbackOnBoot = {
|
|
|
|
enable = true;
|
|
|
|
snapshot = "tank/local/root@blank";
|
|
|
|
};
|
|
|
|
|
|
|
|
fileSystems = let
|
|
|
|
zfs = device: {
|
|
|
|
device = device;
|
|
|
|
fsType = "zfs";
|
|
|
|
};
|
|
|
|
in {
|
|
|
|
"/" = zfs "tank/local/root";
|
|
|
|
"/nix" = zfs "tank/local/nix";
|
|
|
|
"/tmp" = zfs "tank/local/tmp";
|
|
|
|
|
|
|
|
"/persist" = zfs "tank/safe/persist";
|
|
|
|
"/home" = zfs "tank/safe/home";
|
|
|
|
|
|
|
|
"/boot" = {
|
|
|
|
device = "/dev/disk/by-partlabel/ESP";
|
|
|
|
fsType = "vfat";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
nix.maxJobs = lib.mkDefault 8;
|
|
|
|
|
|
|
|
# Networking!
|
|
|
|
networking = {
|
|
|
|
hostName = "etheroute-lon01";
|
|
|
|
domain = "as205479.net";
|
|
|
|
hostId = "420bee1b";
|
|
|
|
|
|
|
|
nameservers = [
|
|
|
|
"2001:4860:4860::8888"
|
|
|
|
"2001:4860:4860::8844"
|
|
|
|
"8.8.8.8"
|
|
|
|
"8.8.4.4"
|
|
|
|
];
|
|
|
|
useDHCP = false;
|
|
|
|
defaultGateway = {
|
|
|
|
address = "83.97.19.65";
|
|
|
|
interface = "eno1";
|
|
|
|
};
|
|
|
|
defaultGateway6 = {
|
|
|
|
address = "2a07:242:800:64::1";
|
|
|
|
interface = "eno1";
|
|
|
|
};
|
|
|
|
interfaces.eno1 = {
|
|
|
|
ipv4.addresses = [{ address = "83.97.19.68"; prefixLength = 27; }];
|
|
|
|
ipv6.addresses = [{ address = "2a07:242:800:64::68"; prefixLength = 64; }];
|
|
|
|
};
|
2021-12-07 15:48:50 +00:00
|
|
|
interfaces.quadv1-4 = {
|
|
|
|
ipv4.addresses = [{ address = "92.118.31.254"; prefixLength = 24; }];
|
|
|
|
virtual = true;
|
|
|
|
};
|
2020-12-28 15:27:18 +00:00
|
|
|
firewall.allowedTCPPorts = [ 80 443 ];
|
2020-12-26 23:36:34 +00:00
|
|
|
};
|
|
|
|
my.ip.tailscale = "100.111.191.21";
|
|
|
|
|
2021-12-07 16:13:32 +00:00
|
|
|
systemd.services.quadv1-4-netdev = lib.mkForce (makeIPIPInterface {
|
2021-12-07 15:48:50 +00:00
|
|
|
name = "quadv1-4";
|
|
|
|
underlayDevice = "eno1";
|
|
|
|
localIP = "83.97.19.68";
|
|
|
|
remoteIP = "92.118.30.254"; # Dummy for now
|
2021-12-07 16:13:32 +00:00
|
|
|
});
|
2021-12-07 15:48:50 +00:00
|
|
|
|
2020-12-26 23:36:34 +00:00
|
|
|
services.openssh.hostKeys = [
|
|
|
|
{
|
|
|
|
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
|
|
|
type = "ed25519";
|
|
|
|
}
|
|
|
|
{
|
|
|
|
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
|
|
|
type = "rsa";
|
|
|
|
bits = 4096;
|
|
|
|
}
|
|
|
|
];
|
|
|
|
|
|
|
|
users.users = {
|
|
|
|
lukegb.extraGroups = [ "bird2" ];
|
|
|
|
};
|
|
|
|
|
|
|
|
services.lukegbgp = let local = {
|
|
|
|
asn = 205479;
|
|
|
|
}; in {
|
|
|
|
enable = true;
|
|
|
|
config = {
|
|
|
|
local = {
|
|
|
|
routerID = "83.97.19.68";
|
|
|
|
};
|
2021-12-07 15:48:50 +00:00
|
|
|
export.v4 = [ "92.118.31.0/24" ];
|
2020-12-26 23:36:34 +00:00
|
|
|
peering = {
|
|
|
|
etheroute = {
|
|
|
|
local = local // {
|
|
|
|
v4 = "83.97.19.68";
|
|
|
|
v6 = "2a07:242:800:64::68";
|
|
|
|
};
|
|
|
|
remote = {
|
2021-06-11 12:28:30 +00:00
|
|
|
asn = 3170;
|
2020-12-26 23:36:34 +00:00
|
|
|
export_community = 4000;
|
|
|
|
routers = [{
|
|
|
|
v4 = "83.97.19.65";
|
|
|
|
v6 = "2a07:242:800:64::1";
|
|
|
|
}];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
systemd.mounts = let
|
|
|
|
bindMount' = dir: {
|
|
|
|
unitConfig.RequiresMountsFor = dir;
|
|
|
|
options = "bind";
|
|
|
|
what = "/persist${dir}";
|
|
|
|
where = dir;
|
|
|
|
};
|
|
|
|
bindMountSvc = dir: svc: (bindMount' dir) // {
|
|
|
|
bindsTo = [svc];
|
|
|
|
partOf = [svc];
|
|
|
|
};
|
|
|
|
bindMountSvcDynamic = dir: svc: (bindMount' "/var/lib/private/${dir}") // {
|
|
|
|
requiredBy = [svc];
|
|
|
|
before = [svc];
|
|
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
};
|
|
|
|
bindMount = dir: (bindMount' dir) // {
|
|
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
};
|
|
|
|
in [
|
|
|
|
(bindMountSvc "/var/lib/tailscale" "tailscaled.service")
|
|
|
|
];
|
|
|
|
|
2020-12-28 19:09:55 +00:00
|
|
|
services.redis = {
|
|
|
|
enable = true;
|
|
|
|
bind = "127.0.0.1";
|
|
|
|
};
|
2020-12-28 14:08:24 +00:00
|
|
|
services.pomerium = {
|
|
|
|
enable = true;
|
|
|
|
secretsFile = machineSecrets.pomeriumSecrets;
|
2021-04-07 00:46:15 +00:00
|
|
|
useACMEHost = "int.lukegb.com";
|
2020-12-28 18:54:00 +00:00
|
|
|
|
2021-04-07 00:46:15 +00:00
|
|
|
settings = {
|
2020-12-28 18:54:00 +00:00
|
|
|
address = ":443";
|
|
|
|
http_redirect_addr = ":80";
|
|
|
|
|
|
|
|
idp_provider = "google";
|
|
|
|
idp_client_id = "136257844546-qsa6hi1oqqoq2bnt93deo4e70ggbn1p8.apps.googleusercontent.com";
|
2020-12-28 19:26:39 +00:00
|
|
|
idp_request_params = {
|
|
|
|
hd = "lukegb.com";
|
|
|
|
login_hint = "lukegb@lukegb.com";
|
|
|
|
};
|
2020-12-28 18:54:00 +00:00
|
|
|
|
2020-12-29 20:00:52 +00:00
|
|
|
jwt_claims_headers = [
|
|
|
|
"email"
|
|
|
|
"user"
|
|
|
|
];
|
|
|
|
|
2021-03-14 13:00:37 +00:00
|
|
|
timeout_read = "0"; # We have some long-lived connections...
|
|
|
|
timeout_write = "0";
|
|
|
|
timeout_idle = "0";
|
|
|
|
|
2020-12-28 19:09:55 +00:00
|
|
|
databroker_storage_type = "redis";
|
2020-12-28 19:11:25 +00:00
|
|
|
databroker_storage_connection_string = "redis://127.0.0.1:6379/15";
|
2020-12-28 19:09:55 +00:00
|
|
|
|
2020-12-28 18:54:00 +00:00
|
|
|
forward_auth_url = "https://fwdauth.int.lukegb.com";
|
|
|
|
authenticate_service_url = "https://auth.int.lukegb.com";
|
2020-12-30 00:57:53 +00:00
|
|
|
signout_redirect_url = "https://logged-out.int.lukegb.com";
|
2020-12-28 18:54:00 +00:00
|
|
|
|
|
|
|
policy = let
|
|
|
|
baseConfig = {
|
|
|
|
allowed_domains = [ "lukegb.com" ];
|
2020-12-29 20:00:52 +00:00
|
|
|
pass_identity_headers = true;
|
2021-03-18 23:50:54 +00:00
|
|
|
timeout = "30s";
|
2020-12-28 18:54:00 +00:00
|
|
|
};
|
2020-12-29 20:11:41 +00:00
|
|
|
service = server: hostName: extraConfig: baseConfig // {
|
2020-12-28 18:54:00 +00:00
|
|
|
from = "https://${hostName}";
|
|
|
|
to = "http://${server}";
|
|
|
|
preserve_host_header = true;
|
2020-12-29 20:11:41 +00:00
|
|
|
} // extraConfig;
|
|
|
|
secureService = server: hostName: extraConfig: service server hostName ({
|
|
|
|
to = "https://${server}";
|
|
|
|
tls_server_name = hostName;
|
|
|
|
} // extraConfig);
|
2020-12-30 00:57:53 +00:00
|
|
|
public = extraConfig: {
|
|
|
|
allow_public_unauthenticated_access = true;
|
|
|
|
allowed_domains = null;
|
|
|
|
} // extraConfig;
|
2020-12-29 20:11:41 +00:00
|
|
|
in [
|
|
|
|
(service "clouvider-fra01" "int.lukegb.com" {})
|
2020-12-30 00:57:53 +00:00
|
|
|
(service "clouvider-fra01" "logged-out.int.lukegb.com" (public {}))
|
2020-12-29 20:11:41 +00:00
|
|
|
(service "clouvider-fra01" "sonarr.int.lukegb.com" {})
|
|
|
|
(service "clouvider-fra01" "radarr.int.lukegb.com" {})
|
|
|
|
(service "clouvider-fra01" "deluge.int.lukegb.com" {})
|
2021-10-19 06:06:37 +00:00
|
|
|
(service "clouvider-fra01" "content.int.lukegb.com" {})
|
2020-12-29 20:11:41 +00:00
|
|
|
(service "totoro:9090" "prometheus.int.lukegb.com" {})
|
|
|
|
(service "totoro:9093" "alertmanager.int.lukegb.com" {})
|
|
|
|
(service "totoro:3000" "grafana.int.lukegb.com" {})
|
2021-01-03 15:32:00 +00:00
|
|
|
(secureService "swann:8443" "unifi.int.lukegb.com" {
|
|
|
|
tls_skip_verify = true;
|
2021-01-04 21:15:43 +00:00
|
|
|
allow_websockets = true;
|
2021-03-18 23:50:54 +00:00
|
|
|
timeout = "0";
|
2021-01-03 15:32:00 +00:00
|
|
|
})
|
2021-03-14 13:00:37 +00:00
|
|
|
(service "blade-tuvok:7480" "objdump.zxcvbnm.ninja" (public {
|
2021-03-18 23:50:54 +00:00
|
|
|
timeout = "30m"; # Uploads can take a while; bump the timeout.
|
2021-03-14 13:00:37 +00:00
|
|
|
}))
|
2020-12-30 00:57:53 +00:00
|
|
|
(secureService "totoro" "invoices.lukegb.com" (public {
|
2020-12-29 20:11:41 +00:00
|
|
|
regex = "^/((third_party|ajax|client_area|pdf)/.*|[a-zA-Z0-9]{8})$";
|
2020-12-30 00:57:53 +00:00
|
|
|
}))
|
2020-12-29 20:11:41 +00:00
|
|
|
(secureService "totoro" "invoices.lukegb.com" {})
|
2020-12-28 18:54:00 +00:00
|
|
|
(baseConfig // {
|
|
|
|
from = "https://httpbin.int.lukegb.com";
|
|
|
|
to = "https://verify.pomerium.com";
|
|
|
|
})
|
2021-03-31 22:37:01 +00:00
|
|
|
(service "bvm-twitterchiver:8080" "twitterchiver.int.lukegb.com" {})
|
|
|
|
(service "bvm-twitterchiver:8080" "twitterchiver.lukegb.com" {})
|
2021-04-10 19:22:54 +00:00
|
|
|
(service "bvm-nixosmgmt:4440" "rundeck.int.lukegb.com" {
|
|
|
|
set_request_headers = {
|
|
|
|
"X-Forwarded-Roles" = "pomerium";
|
|
|
|
};
|
|
|
|
})
|
2021-04-18 16:24:59 +00:00
|
|
|
(service "bvm-ipfs:5001" "ipfs.int.lukegb.com" {})
|
|
|
|
(service "bvm-ipfs:8080" "ipfs-gw.int.lukegb.com" {})
|
2021-08-16 02:09:47 +00:00
|
|
|
(service "bvm-netbox:80" "netbox.int.lukegb.com" {})
|
2020-12-28 18:54:00 +00:00
|
|
|
];
|
|
|
|
};
|
2020-12-28 14:08:24 +00:00
|
|
|
};
|
2021-04-07 00:46:15 +00:00
|
|
|
systemd.services.pomerium = {
|
|
|
|
wants = lib.mkAfter [ "redis.service" ];
|
|
|
|
after = lib.mkAfter [ "redis.service" ];
|
2020-12-28 14:08:24 +00:00
|
|
|
};
|
|
|
|
security.acme = {
|
|
|
|
acceptTerms = true;
|
|
|
|
email = "letsencrypt@lukegb.com";
|
|
|
|
certs."int.lukegb.com" = {
|
|
|
|
domain = "*.int.lukegb.com";
|
|
|
|
dnsProvider = "cloudflare";
|
|
|
|
credentialsFile = secrets.cloudflareCredentials;
|
2020-12-29 20:37:33 +00:00
|
|
|
extraDomainNames = [
|
|
|
|
# "int.lukegb.com" # redundant with *.lukegb.com
|
|
|
|
"lukegb.com"
|
|
|
|
"*.lukegb.com"
|
2021-03-14 11:46:05 +00:00
|
|
|
"objdump.zxcvbnm.ninja"
|
2020-12-29 20:37:33 +00:00
|
|
|
];
|
2020-12-28 14:08:24 +00:00
|
|
|
postRun = ''
|
|
|
|
systemctl restart pomerium
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2020-12-26 23:36:34 +00:00
|
|
|
system.stateVersion = "20.09";
|
|
|
|
}
|