Added basic Home Assistant and routing config for mm

flake.lock

@@ -177,11 +177,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1683408522,
+        "lastModified": 1686020360,
-        "narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=",
+        "narHash": "sha256-Wee7lIlZ6DIZHHLiNxU5KdYZQl0iprENXa/czzI6Cj4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7",
+        "rev": "4729ffac6fd12e26e5a8de002781ffc49b0e94b7",
         "type": "github"
       },
       "original": {

hosts/2maccabees/home-assistant.nix

@@ -37,6 +37,7 @@ in
 				trusted_proxies = [ "127.0.0.1" "::1" ];
 				server_host = "127.0.0.1";
 			};
+			#"automation manual" = *nix config here* and so on
 			"automation ui" = "!include automations.yaml";
 			"script ui" = "!include scripts.yaml";
 			"scene ui" = "!include scenes.yaml";

hosts/mm/default.nix

@@ -38,18 +38,27 @@ in
 			};
 		};
 		firewall = {  # Might not strictly be necessary?
-			allowedTCPPorts = [ 53 ];
+			allowedTCPPorts = [ 53 80 443 8123 ]; # 8091 8123
 			allowedUDPPorts = [ 53 67 ];
 		};
+		extraHosts = (builtins.concatStringsSep "\n" [
+			"${lanIpAddress} store.mindmazeroom.com"
+		]);
 	};
 
 	# Serves as the router, DHCP, and DNS for the site
-	greg.router = {
+	greg = {
-		enable = true;
+		router = {
-		wan = [ wanInterface "tailscale0" ];
+			enable = true;
-		lan = [ lanInterface ];
+			wan = [ wanInterface "tailscale0" ];
+			lan = [ lanInterface ];
+		};
+		tailscale.enable = true;
+		proxies = {
+			"mm.shire-zebra.ts.net".target = "http://127.0.0.1:8123";
+			"store.mindmazeroom.com".target = "http://127.0.0.1:8123";
+		};
 	};
-	greg.tailscale.enable = true;
 	services = {
 		dnsmasq = {
 			enable = true;
@@ -71,6 +80,39 @@ in
 				PASSPHRASE = "MindMaze2023";
 			};
 		};
+		home-assistant = {
+			enable = true;
+			configDir = "/var/lib/hass";
+			package = (pkgs.home-assistant.override {
+				extraComponents = [
+					"accuweather"
+					"calendar"
+					"cast"
+					"lovelace"
+				];
+			}).overrideAttrs (oldAttrs: {
+				doInstallCheck = false;
+			});
+			config = {
+				logger.default = "info";
+				default_config = {};
+				esphome = {};  # Get these things loaded, even if not configured
+				met = {};
+				my = {};
+				tts = [ { platform = "google_translate"; } ];
+				http = {
+					use_x_forwarded_for = true;
+					trusted_proxies = [ "127.0.0.1" "::1" ];
+					server_host = "127.0.0.1";
+				};
+				"automation manual" = [];
+				"automation ui" = "!include automations.yaml";
+				"script manual" = [];
+				"script ui" = "!include scripts.yaml";
+				"scene manual" = [];
+				"scene ui" = "!include scenes.yaml";
+			};
+		};
 		kea.dhcp4 = {
 			enable = true;
 			settings = {
@@ -97,6 +139,19 @@ in
 					pools = [{
 						pool = "10.177.1.10-10.177.1.250";
 					}];
+					reservations = [{
+						hw-address = "9c:8e:cd:3f:3f:8c";
+						hostname = "madscientist";
+						ip-address = "10.177.1.249";
+					} {
+						hw-address = "9c:8e:cd:3f:40:a4";
+						hostname = "saloon";
+						ip-address = "10.177.1.248";
+					} {
+						hw-address = "9c:8e:cd:3f:40:d3";
+						hostname = "jail";
+						ip-address = "10.177.1.247";
+					}];
 				}];
 			};
 		};

modules-linux/router.nix

@@ -7,12 +7,14 @@ let
 		wan,
 		lan,
 		limitedLan ? [],
-		openPorts ? [ "ssh" "67" "53" ]  # ssh, dhcpd, dns
+		openPorts ? [ "ssh" "67" "53" ],  # ssh, dhcpd, dns
+		openUDPPorts ? [ "67" "53" ] # dhcpd, dns
 	}: let
 			lanList = names lan;
 			allLan = names (lan ++ limitedLan);
 			wanName = names wan;
-			portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${x} accept") openPorts;
+			portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
+			udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
 	in lib.strings.concatStringsSep "\n" [
 		"table ip filter {"
 		"	chain input {"
@@ -20,6 +22,7 @@ let
 
 		"		iifname lo accept"
 		portsString
+		udpPortsString
 		"		iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
 		"		iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
 		"		iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
@@ -71,7 +74,11 @@ in with lib; {
 	config = mkIf cfg.enable {
 		networking.nftables = {
 			enable = true;
-			ruleset = (nftConfig { lan = cfg.lan; wan = cfg.wan; });
+			ruleset = (nftConfig {
+				inherit (cfg) lan wan;
+				openPorts = config.networking.firewall.allowedTCPPorts;
+				openUDPPorts = config.networking.firewall.allowedUDPPorts;
+			});
 		};
 
 		environment.systemPackages = [