From 70b76382ec5860113df1cba1ba387ec2b3a952e9 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 18 Aug 2023 20:46:37 -0500 Subject: [PATCH] Basic network server setup --- hosts/genesis/default.nix | 76 +++++++++++++----------- hosts/genesis/dnsmasq.nix | 26 ++++---- hosts/genesis/hardware-configuration.nix | 73 ++++++++++++----------- hosts/genesis/networking.nix | 42 ++++++++----- hosts/genesis/vhosts.nix | 5 -- 5 files changed, 120 insertions(+), 102 deletions(-) diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 955543c..f00a13d 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -5,39 +5,45 @@ { config, pkgs, ... }: { - imports = - [ # Include the results of the hardware scan. - ./dnsmasq.nix - ./hardware-configuration.nix - ./home-assistant.nix - ./networking.nix - ./vhosts.nix - ]; - - greg.home = true; - greg.gnome.enable = true; - - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - boot.loader.efi.efiSysMountPoint = "/boot/efi"; - - networking.hostName = "genesis"; # Define your hostname. - - # Enable sound with pipewire. - sound.enable = true; - hardware.pulseaudio.enable = false; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - # If you want to use JACK applications, uncomment this - #jack.enable = true; - - # use the example session manager (no others are packaged yet so this is enabled by default, - # no need to redefine it in your config for now) - #media-session.enable = true; - }; + imports = [ + # Include the results of the hardware scan. + ./dnsmasq.nix + ./hardware-configuration.nix + ./home-assistant.nix + ./networking.nix + ./vhosts.nix + ]; + + greg.home = true; + greg.gnome.enable = true; + + # Bootloader. + boot.loader = { + systemd-boot.enable = true; + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot/efi"; + }; + }; + + networking.hostName = "genesis"; # Define your hostname. + + # Enable sound with pipewire. + sound.enable = true; + hardware.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa = { + enable = true; + support32Bit = true; + }; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; } diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix index 578cab0..98769ee 100644 --- a/hosts/genesis/dnsmasq.nix +++ b/hosts/genesis/dnsmasq.nix @@ -22,35 +22,37 @@ let extraConfig = builtins.concatStringsSep "\n" [ ]; + + lanDevice = "enp1s0"; in { # Enable the service with its own configuration services.dnsmasq = { enable = true; - # Public AdGuard DNS servers settings = { domain = "thehellings.lan"; dhcp-range = [ - # "eth0,10.42.0.1,10.42.1.255,255.255.0.0,static" - "eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h" - "vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h" - "vlan67@eth0,192.168.67.3,192.168.67.150,12h" + # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" + "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" + "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" ]; dhcp-option = [ - "eth0,option:router,10.42.1.1" - "eth0,option:dns-server,10.42.1.2,1.1.1.1" - "eth0,option:domain-search,thehellings.lan" + "${lanDevice},option:router,10.42.1.1" + "${lanDevice},option:dns-server,10.42.1.2,1.1.1.1" + "${lanDevice},option:domain-search,thehellings.lan" - "vlan66@eth0,option:router,192.168.66.1" - "vlan66@eth0,option:dns-server,192.168.66.2" + "vlan66@${lanDevice},option:router,192.168.66.1" + "vlan66@${lanDevice},option:dns-server,192.168.66.2" - "vlan67@eth0,option:router,192.168.67.1" - "vlan67@eth0,option:dns-server,192.168.67.2" + "vlan67@${lanDevice},option:router,192.168.67.1" + "vlan67@${lanDevice},option:dns-server,192.168.67.2" ]; expand-hosts = true; log-dhcp = true; log-queries = true; addn-hosts = "/etc/adblock_hosts"; + # Public AdGuard DNS servers server = [ "94.140.14.14" "94.140.15.15" diff --git a/hosts/genesis/hardware-configuration.nix b/hosts/genesis/hardware-configuration.nix index e8f467d..8c1e016 100644 --- a/hosts/genesis/hardware-configuration.nix +++ b/hosts/genesis/hardware-configuration.nix @@ -4,39 +4,42 @@ { config, lib, pkgs, modulesPath, ... }: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9"; - fsType = "btrfs"; - options = [ "subvol=@" ]; - }; - - fileSystems."/boot/efi" = - { device = "/dev/disk/by-uuid/5AC6-50D7"; - fsType = "vfat"; - }; - - swapDevices = - [ { device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; } - ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; - # networking.interfaces.eth2.useDHCP = lib.mkDefault true; - - powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot = { + initrd = { + availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; + kernelModules = [ ]; + }; + kernelModules = [ "kvm-intel" ]; + extraModulePackages = [ ]; + }; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; + + fileSystems."/boot/efi" = { + device = "/dev/disk/by-uuid/5AC6-50D7"; + fsType = "vfat"; + }; + + swapDevices = [ { + device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; + } ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; + # networking.interfaces.eth2.useDHCP = lib.mkDefault true; + + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index c2234f2..29d5463 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -4,17 +4,27 @@ greg.tailscale.enable = true; networking = { - # This value is deprecated, you now set it per interface - useDHCP = false; - defaultGateway = "10.42.1.1"; + enableIPv6 = false; + #defaultGateway = "10.42.1.1"; # 100.100.100.100 is the tailscale DNS - nameservers = [ "100.100.100.100" "127.0.0.1" ]; + nameservers = [ + "1.1.1.1" + #"100.100.100.100" + "127.0.0.1" + ]; interfaces = { - eth0.ipv4.addresses = [ { - address = "10.42.1.2"; + # This is our WAN port + enp2s0 = { + useDHCP = true; + name = "wan"; + }; + + # This is our LAN port + enp1s0.ipv4.addresses = [ { + address = "10.43.1.1"; prefixLength = 16; } ]; - wlan0.useDHCP = true; + wlan0.useDHCP = false; vlan66.ipv4.addresses = [ { address = "192.168.66.2"; @@ -25,7 +35,7 @@ vlans = { vlan66 = { id = 66; - interface = "eth0"; + interface = "enp2s0"; }; }; }; @@ -47,8 +57,10 @@ openFirewall = true; }; - greg.proxies."jellyfin.thehellings.lan".target = "http://localhost:8096"; - greg.proxies."jellyfin.me.ts".target = "http://localhost:8096"; + greg.proxies = { + "jellyfin.thehellings.lan".target = "http://localhost:8096"; + "jellyfin.me.ts".target = "http://localhost:8096"; + }; ######### # Blind service proxy behind the walls of the VPN @@ -64,12 +76,12 @@ users = [ "greg" ]; } ]; } ]; - usersFile = "/run/agenix/3proxy"; + #usersFile = "/run/agenix/3proxy"; denyPrivate = false; }; - age.secrets."3proxy" = { - file = ../../secrets/3proxy.age; - mode = "777"; - }; + #age.secrets."3proxy" = { + # file = ../../secrets/3proxy.age; + # mode = "776"; + #}; networking.firewall.allowedTCPPorts = [ 3128 ]; } diff --git a/hosts/genesis/vhosts.nix b/hosts/genesis/vhosts.nix index 1a2fd22..e899089 100644 --- a/hosts/genesis/vhosts.nix +++ b/hosts/genesis/vhosts.nix @@ -5,11 +5,6 @@ { ... }: { - greg.proxies."dns.thehellings.lan" = { - target = "http://127.0.0.1:8384/"; - path = "/sync/"; - }; - # The module doesn't handle this services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ]; }