From 3756094c6be1c6688b5a7c58f61dc76ada96c77d Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 13 Nov 2024 23:38:00 -0600 Subject: [PATCH] Convert from dnsmasq to kea and NOPASSWD sudo User greg no longer needs password for sudo dnsmasq is relegated to only DNS and no longer serving DHCP. That is moved over to kea.dhcp4 --- hosts/genesis/net/hosts | 3 +- hosts/genesis/networking.nix | 64 ++--------- hosts/genesis/networking/dhcp.nix | 183 ++++++++++++++++++++++++++++++ modules/nixos/default.nix | 12 ++ 4 files changed, 209 insertions(+), 53 deletions(-) create mode 100644 hosts/genesis/networking/dhcp.nix diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index 3a9fe1b..15e9913 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -8,10 +8,11 @@ 10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan 10.42.1.3 printer.thehellings.lan 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan -10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan +10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan 10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan 10.42.1.7 hosea hosea.thehellings.lan 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan +10.42.1.9 ivr ivr.thehellings.lan 10.42.1.12 tv 10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 1913ec1..34ed93d 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -111,6 +111,18 @@ in denyPrivate = false; }; + kea.dhcp4 = ( + import ./networking/dhcp.nix { + inherit + iot + iotIP + lan + lanIP + routerIP + ; + } + ); + ######### # dnsmasq config ######## @@ -118,59 +130,7 @@ in enable = true; settings = { domain = "thehellings.lan"; - dhcp-range = [ - "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h" - "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h" - "vlan67@${lan},192.168.67.3,192.168.67.150,12h" - ]; - dhcp-option = [ - "${lan},option:router,${routerIP}" - "${lan},option:dns-server,${lanIP},1.1.1.1" - "${lan},option:domain-search,thehellings.lan" - - "${iot},option:router,192.168.66.1" - "${iot},option:dns-server,${iotIP}" - - "vlan67@${lan},option:router,192.168.67.1" - "vlan67@${lan},option:dns-server,192.168.67.1" - ]; - dhcp-host = [ - # Static IPs for personal work - "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch - "00:00:de:ad:be:ef,10.42.2.254" - "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah - - # Static IPs for things in the IOT range - "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 - "98:da:c4:20:f3:64,192.168.66.6" # Dining room light - "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch - "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba - "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird - "48:d6:d5:5d:81:21,192.168.66.65" # Google Home - "6c:29:90:3e:e2:02,192.168.66.66" # wiz - "28:87:ba:0e:ca:da,192.168.66.74" - "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet - "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet - "54:af:97:83:ed:33,192.168.66.80" - "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights - "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights - "0c:80:63:41:6e:0f,192.168.66.90" # Front porch - "0c:80:63:41:6c:5d,192.168.66.98" # House number - "ac:84:c6:5e:4b:28,192.168.66.100" - "98:da:c4:77:7f:4d,192.168.66.102" # Office lights - "8c:85:80:1c:f9:d1,192.168.66.104" - "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp - "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch - "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch - "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome - "92:3e:11:c7:c5:be,192.168.66.109" - "d8:0d:17:19:60:62,192.168.66.112" - "b4:b0:24:9a:12:53,192.168.66.130" # KL125 - "b4:b0:24:9a:14:0e,192.168.66.131" - "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini - ]; expand-hosts = true; - log-dhcp = true; log-queries = true; no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 addn-hosts = "/etc/adblock_hosts"; diff --git a/hosts/genesis/networking/dhcp.nix b/hosts/genesis/networking/dhcp.nix new file mode 100644 index 0000000..ca8d265 --- /dev/null +++ b/hosts/genesis/networking/dhcp.nix @@ -0,0 +1,183 @@ +{ + lan, + iot, + lanIP, + iotIP, + routerIP, +}: +{ + enable = true; + settings = { + valid-lifetime = 43200; # 12 hours, in seconds + renew-timer = 1000; + rebind-timer = 2000; + interfaces-config.interfaces = [ + lan + iot + ]; + lease-database = { + type = "memfile"; + persist = true; + name = "/var/lib/kea/dhcp4.leases"; + }; + subnet4 = [ + { + subnet = "10.42.0.0/16"; + pools = [ { pool = "10.42.2.0 - 10.42.3.255"; } ]; + interface = lan; + # https://kea.readthedocs.io/en/kea-2.6.1/arm/dhcp4-srv.html#dhcp4-std-options-list + option-data = [ + { + name = "domain-name-servers"; + data = "${lanIP},1.1.1.1"; + } + { + name = "routers"; + data = routerIP; + } + { + name = "domain-search"; + data = "home,thehellings.lan"; + } + { + name = "lpr-servers"; + data = "10.42.1.3"; + } + { + name = "domain-name"; + data = "thehellings.lan"; + } + ]; + } + { + subnet = "192.168.66.0/24"; + pools = [ { pool = "192.168.66.2 - 192.168.66.254"; } ]; + interface = iot; + option-data = [ + { + name = "domain-name-servers"; + data = iotIP; + } + { + name = "routers"; + data = "192.168.67.1"; + } + ]; + } + ]; + + reservations = [ + # Static IPs for personal work + { + hw-address = "00:23:24:72:64:32"; # Joel + ip-address = "10.42.0.4"; + } + { + hw-address = "2a:5d:23:10:4e:22"; # SAN Switch + ip-address = "10.42.0.5"; + } + { + hw-address = "00:00:de:ad:be:ef"; # deadbeef + ip-address = "10.42.2.254"; + } + { + hw-address = "01:a8:a1:59:c7:8a:12"; # BMC management interface for isaiah + ip-address = "10.42.2.253"; + } + { + hw-address = "7c:83:34:b9:ee:ec"; # PVE1 + ip-address = "10.42.1.1"; + } + { + hw-address = "74:ee:2a:66:b3:51"; # printer + ip-address = "10.42.1.3"; + } + { + hw-address = "00:11:32:c6:7c:81"; # chronicles + ip-address = "10.42.1.4"; + } + { + hw-address = "6a:86:56:45:0b:b1"; # Genesis + ip-address = "10.42.1.5"; + } + { + hw-address = "a8:a1:59:c7:20:44"; # isaiah + ip-address = "10.42.1.6"; + } + #{ + # hw-address = ""; # hosea + # ip-address = "10.42.1.7"; + #} + #{ + # hw-address = ""; # jeremiah + # ip-address = "10.42.1.8"; + #} + { + hw-address = "c8:5e:a9:54:9e:c6"; # IVR laptop Wi-Fi + ip-address = "10.42.1.9"; + } + + ######################################## + # IOT devices # + ######################################## + + # Static IPs for things in the IOT range + { + hw-address = "b4:b0:24:9a:02:4a"; + ip-address = "192.168.66.5"; + } # LD125 + { + hw-address = "f0:03:8c:b3:b0:f6"; + ip-address = "192.168.66.55"; + } # Roomba + { + hw-address = "4c:a1:61:05:cd:52"; + ip-address = "192.168.66.61"; + } # Rainbird + { + hw-address = "48:d6:d5:5d:81:21"; + ip-address = "192.168.66.65"; + } # Google Home + { + hw-address = "28:87:ba:0e:ca:da"; + ip-address = "192.168.66.74"; + } + { + hw-address = "54:af:97:83:ed:33"; + ip-address = "192.168.66.80"; + } + { + hw-address = "ac:84:c6:5e:4b:28"; + ip-address = "192.168.66.100"; + } + { + hw-address = "8c:85:80:1c:f9:d1"; + ip-address = "192.168.66.104"; + } + { + hw-address = "8c:49:62:aa:58:60"; + ip-address = "192.168.66.108"; + } # Roku, HiHandsome + { + hw-address = "92:3e:11:c7:c5:be"; + ip-address = "192.168.66.109"; + } + { + hw-address = "d8:0d:17:19:60:62"; + ip-address = "192.168.66.112"; + } + { + hw-address = "b4:b0:24:9a:12:53"; + ip-address = "192.168.66.130"; + } # KL125 + { + hw-address = "b4:b0:24:9a:14:0e"; + ip-address = "192.168.66.131"; + } + { + hw-address = "e4:f0:42:61:fa:b5"; + ip-address = "192.168.66.149"; + } # Google Home-mini + ]; + }; +} diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 1447610..82e9157 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -98,6 +98,18 @@ in ); }; + security.sudo.extraRules = [ + { + users = [ "greg" ]; + commands = [ + { + command = "ALL"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + i18n.defaultLocale = "en_US.UTF-8"; console = {