greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Added basic Home Assistant and routing config for mm

Browse Source
This commit is contained in:
Greg Hellings
2023-06-28 19:14:08 -05:00
parent e75799dbde
commit 413b04990e
4 changed files with 75 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+3 -3
View File
@@ -177,11 +177,11 @@
},
"nixunstable": {
"locked": {
"lastModified": 1683408522,
"narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=",
"lastModified": 1686020360,
"narHash": "sha256-Wee7lIlZ6DIZHHLiNxU5KdYZQl0iprENXa/czzI6Cj4=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7",
"rev": "4729ffac6fd12e26e5a8de002781ffc49b0e94b7",
"type": "github"
},
"original": {
hosts/2maccabees/home-assistant.nix
+1
View File
@@ -37,6 +37,7 @@ in
trusted_proxies = [ "127.0.0.1" "::1" ];
server_host = "127.0.0.1";
};
#"automation manual" = *nix config here* and so on
"automation ui" = "!include automations.yaml";
"script ui" = "!include scripts.yaml";
"scene ui" = "!include scenes.yaml";
hosts/mm/default.nix
+61 -6
View File
@@ -38,18 +38,27 @@ in
};
};
firewall = { # Might not strictly be necessary?
allowedTCPPorts = [ 53 ];
allowedTCPPorts = [ 53 80 443 8123 ]; # 8091 8123
allowedUDPPorts = [ 53 67 ];
};
extraHosts = (builtins.concatStringsSep "\n" [
"${lanIpAddress} store.mindmazeroom.com"
]);
};
# Serves as the router, DHCP, and DNS for the site
greg.router = {
enable = true;
wan = [ wanInterface "tailscale0" ];
lan = [ lanInterface ];
greg = {
router = {
enable = true;
wan = [ wanInterface "tailscale0" ];
lan = [ lanInterface ];
};
tailscale.enable = true;
proxies = {
"mm.shire-zebra.ts.net".target = "http://127.0.0.1:8123";
"store.mindmazeroom.com".target = "http://127.0.0.1:8123";
};
};
greg.tailscale.enable = true;
services = {
dnsmasq = {
enable = true;
@@ -71,6 +80,39 @@ in
PASSPHRASE = "MindMaze2023";
};
};
home-assistant = {
enable = true;
configDir = "/var/lib/hass";
package = (pkgs.home-assistant.override {
extraComponents = [
"accuweather"
"calendar"
"cast"
"lovelace"
];
}).overrideAttrs (oldAttrs: {
doInstallCheck = false;
});
config = {
logger.default = "info";
default_config = {};
esphome = {}; # Get these things loaded, even if not configured
met = {};
my = {};
tts = [ { platform = "google_translate"; } ];
http = {
use_x_forwarded_for = true;
trusted_proxies = [ "127.0.0.1" "::1" ];
server_host = "127.0.0.1";
};
"automation manual" = [];
"automation ui" = "!include automations.yaml";
"script manual" = [];
"script ui" = "!include scripts.yaml";
"scene manual" = [];
"scene ui" = "!include scenes.yaml";
};
};
kea.dhcp4 = {
enable = true;
settings = {
@@ -97,6 +139,19 @@ in
pools = [{
pool = "10.177.1.10-10.177.1.250";
}];
reservations = [{
hw-address = "9c:8e:cd:3f:3f:8c";
hostname = "madscientist";
ip-address = "10.177.1.249";
} {
hw-address = "9c:8e:cd:3f:40:a4";
hostname = "saloon";
ip-address = "10.177.1.248";
} {
hw-address = "9c:8e:cd:3f:40:d3";
hostname = "jail";
ip-address = "10.177.1.247";
}];
}];
};
};
modules-linux/router.nix
+10 -3
View File
@@ -7,12 +7,14 @@ let
wan,
lan,
limitedLan ? [],
openPorts ? [ "ssh" "67" "53" ] # ssh, dhcpd, dns
openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
}: let
lanList = names lan;
allLan = names (lan ++ limitedLan);
wanName = names wan;
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${x} accept") openPorts;
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
in lib.strings.concatStringsSep "\n" [
"table ip filter {"
" chain input {"
@@ -20,6 +22,7 @@ let
" iifname lo accept"
portsString
udpPortsString
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
@@ -71,7 +74,11 @@ in with lib; {
config = mkIf cfg.enable {
networking.nftables = {
enable = true;
ruleset = (nftConfig { lan = cfg.lan; wan = cfg.wan; });
ruleset = (nftConfig {
inherit (cfg) lan wan;
openPorts = config.networking.firewall.allowedTCPPorts;
openUDPPorts = config.networking.firewall.allowedUDPPorts;
});
};
environment.systemPackages = [