greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Pass traffic through genesis

Browse Source 
* keepalived does not work with Nebula VPN
* update Genesis firewall to allow passing through local traffic
* target all traffic directly to the LAN IP using genesis's routing
This commit is contained in:
Greg Hellings
2026-08-05 22:57:58 -05:00
parent d779d275f2
commit 029b71d0d4
11 changed files with 58 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.nix
+1 -1
View File
@@ -101,7 +101,7 @@
{ {
deployment = { deployment = {
inherit (v) tags; inherit (v) tags;
targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts; targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
targetUser = "greg"; targetUser = "greg";
}; };
} }
hosts/unstable/genesis/networking.nix
+2 -2
View File
@@ -77,7 +77,7 @@ in
}; };
}; };
firewall = { firewall = {
enable = false; enable = true;
allowedUDPPorts = [ allowedUDPPorts = [
dhcpPort dhcpPort
dnsPort dnsPort
@@ -88,7 +88,7 @@ in
80 80
]; ];
}; };
nftables.enable = false; nftables.enable = true;
}; };
environment.etc."hosts.d/local".text = extraHosts; environment.etc."hosts.d/local".text = extraHosts;
hosts/unstable/isaiah/default.nix
+4
View File
@@ -47,6 +47,10 @@
enable = true; enable = true;
extraLabels = [ "bare-metal:host" ]; extraLabels = [ "bare-metal:host" ];
}; };
vmdev = {
enable = true;
host = "libvirt";
};
}; };
networking = { networking = {
hosts/unstable/linode/default.nix
+21 -14
View File
@@ -1,8 +1,9 @@
{ {
config,
lib,
metadata,
pkgs, pkgs,
pkgs', pkgs',
lib,
config,
... ...
}: }:
@@ -70,6 +71,12 @@ in
nebula = { nebula = {
enable = true; enable = true;
isLighthouse = true; isLighthouse = true;
unsafeRoutes = [
{
route = "10.42.0.0/16";
via = metadata.hosts.genesis.nebulaIp;
}
];
}; };
tailscale.enable = true; tailscale.enable = true;
}; };
@@ -126,7 +133,7 @@ in
COOKIE_DOMAIN = "thehellings.com"; COOKIE_DOMAIN = "thehellings.com";
SERVE_ROBOTS_TXT = true; SERVE_ROBOTS_TXT = true;
SLOG_LEVEL = "DEBUG"; SLOG_LEVEL = "DEBUG";
TARGET = "http://git.k3s.nebula.thehellings.com"; TARGET = "http://git.k3s.thehellings.lan";
}; };
}; };
}; };
@@ -149,9 +156,9 @@ in
bind *:${toString sshPort} bind *:${toString sshPort}
timeout client 1h timeout client 1h
mode tcp mode tcp
server git-isaiah isaiah.nebula.thehellings.com:32222 server git-isaiah isaiah.thehellings.lan:32222
server git-jeremiah jeremiah.nebula.thehellings.com:32222 server git-jeremiah jeremiah.thehellings.lan:32222
server git-zeke zeke.nebula.thehellings.com:32222 server git-zeke zeke.thehellings.lan:32222
frontend https frontend https
bind *:80 bind *:80
@@ -184,10 +191,10 @@ in
option accept-unsafe-violations-in-http-response option accept-unsafe-violations-in-http-response
retries 3 retries 3
option forwardfor option forwardfor
http-request set-header Host git.k3s.nebula.thehellings.com http-request set-header Host git.k3s.thehellings.lan
server git-isaiah isaiah.nebula.thehellings.com:80 server git-isaiah isaiah.thehellings.lan:80
server git-jeremiah jeremiah.nebula.thehellings.com:80 server git-jeremiah jeremiah.thehellings.lan:80
server git-zeke zeke.nebula.thehellings.com:80 server git-zeke zeke.thehellings.lan:80
backend matrix backend matrix
mode http mode http
@@ -195,10 +202,10 @@ in
option accept-unsafe-violations-in-http-response option accept-unsafe-violations-in-http-response
retries 3 retries 3
option forwardfor option forwardfor
http-request set-header Host matrix.k3s.nebula.thehellings.com http-request set-header Host matrix.k3s.thehellings.lan
server git-isaiah isaiah.nebula.thehellings.com:80 server git-isaiah isaiah.thehellings.lan:80
server git-jeremiah jeremiah.nebula.thehellings.com:80 server git-jeremiah jeremiah.thehellings.lan:80
server git-zeke zeke.nebula.thehellings.com:80 server git-zeke zeke.thehellings.lan:80
backend web backend web
mode http mode http
hosts/unstable/zeke/default.nix
+4 -6
View File
@@ -32,6 +32,10 @@
enable = true; enable = true;
tags = [ "home" ]; tags = [ "home" ];
}; };
vmdev = {
enable = true;
host = "vbox";
};
}; };
hardware = { hardware = {
@@ -71,10 +75,4 @@
users.users.greg.extraGroups = [ users.users.greg.extraGroups = [
"podman" "podman"
]; ];
# virtualisation.virtualbox.host = {
# enableExtensionPack = true;
# headless = true;
# enableWebService = true;
# };
} }
modules/nixos/kubernetes.nix
-26
View File
@@ -15,8 +15,6 @@ let
sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ="; sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
}; };
keepaliveIp = "10.42.5.1"; keepaliveIp = "10.42.5.1";
nebulaName = "k3s.nebula.thehellings.com";
nebulaIp = "10.157.100.1";
in in
{ {
options.greg = { options.greg = {
@@ -46,13 +44,6 @@ in
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.greg.nebula.enable;
message = "Configure Nebula for this host, first";
}
];
age.secrets = { age.secrets = {
bw_secret.file = ../../secrets/kubernetes/bw_secret.age; bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
dendrite_key.file = ../../secrets/dendrite_key.age; dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -106,8 +97,6 @@ in
"--tls-san ${config.networking.hostName}.thehellings.lan" "--tls-san ${config.networking.hostName}.thehellings.lan"
"--tls-san ${config.networking.hostName}.shire-zebra.ts.net" "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
"--tls-san ${keepaliveIp}" "--tls-san ${keepaliveIp}"
"--tls-san ${nebulaName}"
"--tls-san ${nebulaIp}"
]; ];
manifests = { manifests = {
cert-manager.source = cert-manager; cert-manager.source = cert-manager;
@@ -139,21 +128,6 @@ in
advert_int 1 advert_int 1
''; '';
}; };
k3s-nebula = {
interface = "nebula0";
priority = 1;
state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
virtualIps = [
{
addr = "${nebulaIp}/16";
dev = "nebula0";
}
];
virtualRouterId = 78;
extraConfig = ''
advert_int 1
'';
};
}; };
}; };
openiscsi = { openiscsi = {
modules/nixos/vmdev.nix
+13 -2
View File
@@ -23,6 +23,13 @@ with lib;
type = types.str; type = types.str;
description = "Kernel module type to install - amd, intel, etc"; description = "Kernel module type to install - amd, intel, etc";
}; };
host = mkOption {
type = types.enum [
"libvirt"
"vbox"
];
description = "Which VM hosting type to configure";
};
}; };
}; };
@@ -35,7 +42,6 @@ with lib;
nixos-generators nixos-generators
packer packer
swtpm swtpm
virt-manager
virtio-win virtio-win
xorriso xorriso
]; ];
@@ -44,7 +50,7 @@ with lib;
# Enable the virtualisation services # Enable the virtualisation services
virtualisation = { virtualisation = {
libvirtd = { libvirtd = mkIf (cfg.host == "libvirt") {
enable = true; enable = true;
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
qemu = { qemu = {
@@ -54,6 +60,11 @@ with lib;
}; };
}; };
}; };
virtualbox.host = mkIf (cfg.host == "vbox") {
enable = true;
enableExtensionPack = true;
headless = true;
};
}; };
boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
network.json
+1
View File
@@ -86,6 +86,7 @@
"system": "aarch64-darwin" "system": "aarch64-darwin"
}, },
"linode": { "linode": {
"connectAddr": "thehellings.com",
"ip": null, "ip": null,
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q", "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
"ts": "100.109.86.8", "ts": "100.109.86.8",
secrets/nebula/isaiah.crt
+4 -4
View File
@@ -1,6 +1,6 @@
-----BEGIN NEBULA CERTIFICATE V2----- -----BEGIN NEBULA CERTIFICATE V2-----
MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO 1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ== pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
-----END NEBULA CERTIFICATE V2----- -----END NEBULA CERTIFICATE V2-----
secrets/nebula/jeremiah.crt
+4 -4
View File
@@ -1,6 +1,6 @@
-----BEGIN NEBULA CERTIFICATE V2----- -----BEGIN NEBULA CERTIFICATE V2-----
MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi 7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
-----END NEBULA CERTIFICATE V2----- -----END NEBULA CERTIFICATE V2-----
secrets/nebula/zeke.crt
+4 -4
View File
@@ -1,6 +1,6 @@
-----BEGIN NEBULA CERTIFICATE V2----- -----BEGIN NEBULA CERTIFICATE V2-----
MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58 x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8= /2YdsUCODDzoGjdEtrQVftiz8RxRBg==
-----END NEBULA CERTIFICATE V2----- -----END NEBULA CERTIFICATE V2-----