From 413b04990e76826a485ba0ab3ef5eb6f8340bc6e Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 28 Jun 2023 19:14:08 -0500 Subject: [PATCH] Added basic Home Assistant and routing config for mm --- flake.lock | 6 +-- hosts/2maccabees/home-assistant.nix | 1 + hosts/mm/default.nix | 67 ++++++++++++++++++++++++++--- modules-linux/router.nix | 13 ++++-- 4 files changed, 75 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index 31e9866..765d787 100644 --- a/flake.lock +++ b/flake.lock @@ -177,11 +177,11 @@ }, "nixunstable": { "locked": { - "lastModified": 1683408522, - "narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=", + "lastModified": 1686020360, + "narHash": "sha256-Wee7lIlZ6DIZHHLiNxU5KdYZQl0iprENXa/czzI6Cj4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7", + "rev": "4729ffac6fd12e26e5a8de002781ffc49b0e94b7", "type": "github" }, "original": { diff --git a/hosts/2maccabees/home-assistant.nix b/hosts/2maccabees/home-assistant.nix index 50d4af0..bb014d8 100755 --- a/hosts/2maccabees/home-assistant.nix +++ b/hosts/2maccabees/home-assistant.nix @@ -37,6 +37,7 @@ in trusted_proxies = [ "127.0.0.1" "::1" ]; server_host = "127.0.0.1"; }; + #"automation manual" = *nix config here* and so on "automation ui" = "!include automations.yaml"; "script ui" = "!include scripts.yaml"; "scene ui" = "!include scenes.yaml"; diff --git a/hosts/mm/default.nix b/hosts/mm/default.nix index 7849548..ee31d7b 100644 --- a/hosts/mm/default.nix +++ b/hosts/mm/default.nix @@ -38,18 +38,27 @@ in }; }; firewall = { # Might not strictly be necessary? - allowedTCPPorts = [ 53 ]; + allowedTCPPorts = [ 53 80 443 8123 ]; # 8091 8123 allowedUDPPorts = [ 53 67 ]; }; + extraHosts = (builtins.concatStringsSep "\n" [ + "${lanIpAddress} store.mindmazeroom.com" + ]); }; # Serves as the router, DHCP, and DNS for the site - greg.router = { - enable = true; - wan = [ wanInterface "tailscale0" ]; - lan = [ lanInterface ]; + greg = { + router = { + enable = true; + wan = [ wanInterface "tailscale0" ]; + lan = [ lanInterface ]; + }; + tailscale.enable = true; + proxies = { + "mm.shire-zebra.ts.net".target = "http://127.0.0.1:8123"; + "store.mindmazeroom.com".target = "http://127.0.0.1:8123"; + }; }; - greg.tailscale.enable = true; services = { dnsmasq = { enable = true; @@ -71,6 +80,39 @@ in PASSPHRASE = "MindMaze2023"; }; }; + home-assistant = { + enable = true; + configDir = "/var/lib/hass"; + package = (pkgs.home-assistant.override { + extraComponents = [ + "accuweather" + "calendar" + "cast" + "lovelace" + ]; + }).overrideAttrs (oldAttrs: { + doInstallCheck = false; + }); + config = { + logger.default = "info"; + default_config = {}; + esphome = {}; # Get these things loaded, even if not configured + met = {}; + my = {}; + tts = [ { platform = "google_translate"; } ]; + http = { + use_x_forwarded_for = true; + trusted_proxies = [ "127.0.0.1" "::1" ]; + server_host = "127.0.0.1"; + }; + "automation manual" = []; + "automation ui" = "!include automations.yaml"; + "script manual" = []; + "script ui" = "!include scripts.yaml"; + "scene manual" = []; + "scene ui" = "!include scenes.yaml"; + }; + }; kea.dhcp4 = { enable = true; settings = { @@ -97,6 +139,19 @@ in pools = [{ pool = "10.177.1.10-10.177.1.250"; }]; + reservations = [{ + hw-address = "9c:8e:cd:3f:3f:8c"; + hostname = "madscientist"; + ip-address = "10.177.1.249"; + } { + hw-address = "9c:8e:cd:3f:40:a4"; + hostname = "saloon"; + ip-address = "10.177.1.248"; + } { + hw-address = "9c:8e:cd:3f:40:d3"; + hostname = "jail"; + ip-address = "10.177.1.247"; + }]; }]; }; }; diff --git a/modules-linux/router.nix b/modules-linux/router.nix index c148224..0a7f561 100644 --- a/modules-linux/router.nix +++ b/modules-linux/router.nix @@ -7,12 +7,14 @@ let wan, lan, limitedLan ? [], - openPorts ? [ "ssh" "67" "53" ] # ssh, dhcpd, dns + openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns + openUDPPorts ? [ "67" "53" ] # dhcpd, dns }: let lanList = names lan; allLan = names (lan ++ limitedLan); wanName = names wan; - portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${x} accept") openPorts; + portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts; + udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; in lib.strings.concatStringsSep "\n" [ "table ip filter {" " chain input {" @@ -20,6 +22,7 @@ let " iifname lo accept" portsString + udpPortsString " iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\"" " iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\"" " iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\"" @@ -71,7 +74,11 @@ in with lib; { config = mkIf cfg.enable { networking.nftables = { enable = true; - ruleset = (nftConfig { lan = cfg.lan; wan = cfg.wan; }); + ruleset = (nftConfig { + inherit (cfg) lan wan; + openPorts = config.networking.firewall.allowedTCPPorts; + openUDPPorts = config.networking.firewall.allowedUDPPorts; + }); }; environment.systemPackages = [