greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Pass traffic through genesis

Browse Source 
* keepalived does not work with Nebula VPN
* update Genesis firewall to allow passing through local traffic
* target all traffic directly to the LAN IP using genesis's routing
This commit is contained in:
Greg Hellings
2026-08-05 22:57:58 -05:00
parent d779d275f2
commit 029b71d0d4
11 changed files with 58 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.nix
+1 -1
View File
@@ -101,7 +101,7 @@
{
deployment = {
inherit (v) tags;
targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
targetUser = "greg";
};
}
hosts/unstable/genesis/networking.nix
+2 -2
View File
@@ -77,7 +77,7 @@ in
};
};
firewall = {
enable = false;
enable = true;
allowedUDPPorts = [
dhcpPort
dnsPort
@@ -88,7 +88,7 @@ in
80
];
};
nftables.enable = false;
nftables.enable = true;
};
environment.etc."hosts.d/local".text = extraHosts;
hosts/unstable/isaiah/default.nix
+4
View File
@@ -47,6 +47,10 @@
enable = true;
extraLabels = [ "bare-metal:host" ];
};
vmdev = {
enable = true;
host = "libvirt";
};
};
networking = {
hosts/unstable/linode/default.nix
+21 -14
View File
@@ -1,8 +1,9 @@
{
config,
lib,
metadata,
pkgs,
pkgs',
lib,
config,
...
}:
@@ -70,6 +71,12 @@ in
nebula = {
enable = true;
isLighthouse = true;
unsafeRoutes = [
{
route = "10.42.0.0/16";
via = metadata.hosts.genesis.nebulaIp;
}
];
};
tailscale.enable = true;
};
@@ -126,7 +133,7 @@ in
COOKIE_DOMAIN = "thehellings.com";
SERVE_ROBOTS_TXT = true;
SLOG_LEVEL = "DEBUG";
TARGET = "http://git.k3s.nebula.thehellings.com";
TARGET = "http://git.k3s.thehellings.lan";
};
};
};
@@ -149,9 +156,9 @@ in
bind *:${toString sshPort}
timeout client 1h
mode tcp
server git-isaiah isaiah.nebula.thehellings.com:32222
server git-jeremiah jeremiah.nebula.thehellings.com:32222
server git-zeke zeke.nebula.thehellings.com:32222
server git-isaiah isaiah.thehellings.lan:32222
server git-jeremiah jeremiah.thehellings.lan:32222
server git-zeke zeke.thehellings.lan:32222
frontend https
bind *:80
@@ -184,10 +191,10 @@ in
option accept-unsafe-violations-in-http-response
retries 3
option forwardfor
http-request set-header Host git.k3s.nebula.thehellings.com
server git-isaiah isaiah.nebula.thehellings.com:80
server git-jeremiah jeremiah.nebula.thehellings.com:80
server git-zeke zeke.nebula.thehellings.com:80
http-request set-header Host git.k3s.thehellings.lan
server git-isaiah isaiah.thehellings.lan:80
server git-jeremiah jeremiah.thehellings.lan:80
server git-zeke zeke.thehellings.lan:80
backend matrix
mode http
@@ -195,10 +202,10 @@ in
option accept-unsafe-violations-in-http-response
retries 3
option forwardfor
http-request set-header Host matrix.k3s.nebula.thehellings.com
server git-isaiah isaiah.nebula.thehellings.com:80
server git-jeremiah jeremiah.nebula.thehellings.com:80
server git-zeke zeke.nebula.thehellings.com:80
http-request set-header Host matrix.k3s.thehellings.lan
server git-isaiah isaiah.thehellings.lan:80
server git-jeremiah jeremiah.thehellings.lan:80
server git-zeke zeke.thehellings.lan:80
backend web
mode http
hosts/unstable/zeke/default.nix
+4 -6
View File
@@ -32,6 +32,10 @@
enable = true;
tags = [ "home" ];
};
vmdev = {
enable = true;
host = "vbox";
};
};
hardware = {
@@ -71,10 +75,4 @@
users.users.greg.extraGroups = [
"podman"
];
# virtualisation.virtualbox.host = {
# enableExtensionPack = true;
# headless = true;
# enableWebService = true;
# };
}
modules/nixos/kubernetes.nix
-26
View File
@@ -15,8 +15,6 @@ let
sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
};
keepaliveIp = "10.42.5.1";
nebulaName = "k3s.nebula.thehellings.com";
nebulaIp = "10.157.100.1";
in
{
options.greg = {
@@ -46,13 +44,6 @@ in
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.greg.nebula.enable;
message = "Configure Nebula for this host, first";
}
];
age.secrets = {
bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -106,8 +97,6 @@ in
"--tls-san ${config.networking.hostName}.thehellings.lan"
"--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
"--tls-san ${keepaliveIp}"
"--tls-san ${nebulaName}"
"--tls-san ${nebulaIp}"
];
manifests = {
cert-manager.source = cert-manager;
@@ -139,21 +128,6 @@ in
advert_int 1
'';
};
k3s-nebula = {
interface = "nebula0";
priority = 1;
state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
virtualIps = [
{
addr = "${nebulaIp}/16";
dev = "nebula0";
}
];
virtualRouterId = 78;
extraConfig = ''
advert_int 1
'';
};
};
};
openiscsi = {
modules/nixos/vmdev.nix
+13 -2
View File
@@ -23,6 +23,13 @@ with lib;
type = types.str;
description = "Kernel module type to install - amd, intel, etc";
};
host = mkOption {
type = types.enum [
"libvirt"
"vbox"
];
description = "Which VM hosting type to configure";
};
};
};
@@ -35,7 +42,6 @@ with lib;
nixos-generators
packer
swtpm
virt-manager
virtio-win
xorriso
];
@@ -44,7 +50,7 @@ with lib;
# Enable the virtualisation services
virtualisation = {
libvirtd = {
libvirtd = mkIf (cfg.host == "libvirt") {
enable = true;
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
qemu = {
@@ -54,6 +60,11 @@ with lib;
};
};
};
virtualbox.host = mkIf (cfg.host == "vbox") {
enable = true;
enableExtensionPack = true;
headless = true;
};
};
boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
network.json
+1
View File
@@ -86,6 +86,7 @@
"system": "aarch64-darwin"
},
"linode": {
"connectAddr": "thehellings.com",
"ip": null,
"pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
"ts": "100.109.86.8",
secrets/nebula/isaiah.crt
+4 -4
View File
@@ -1,6 +1,6 @@
-----BEGIN NEBULA CERTIFICATE V2-----
MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
-----END NEBULA CERTIFICATE V2-----
secrets/nebula/jeremiah.crt
+4 -4
View File
@@ -1,6 +1,6 @@
-----BEGIN NEBULA CERTIFICATE V2-----
MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
-----END NEBULA CERTIFICATE V2-----
secrets/nebula/zeke.crt
+4 -4
View File
@@ -1,6 +1,6 @@
-----BEGIN NEBULA CERTIFICATE V2-----
MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
/2YdsUCODDzoGjdEtrQVftiz8RxRBg==
-----END NEBULA CERTIFICATE V2-----