diff --git a/home/home.nix b/home/home.nix index 04ccc2d..d8fa832 100644 --- a/home/home.nix +++ b/home/home.nix @@ -44,10 +44,10 @@ home.packages = with pkgs; [ bitwarden-cli brew + copier diffutils dmidecode findutils - gimp git gnupatch gregpy diff --git a/hosts/default.nix b/hosts/default.nix index 00c6e45..143961f 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -16,7 +16,7 @@ let }; in channel.lib.nixosSystem { inherit system; - specialArgs = { inherit nixpkgs; }; + specialArgs = { inherit nixpkgs inputs; }; modules = [ { nixpkgs.overlays = overlays; diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index f00a13d..1f0d378 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -15,7 +15,7 @@ ]; greg.home = true; - greg.gnome.enable = true; + greg.gnome.enable = false; # Bootloader. boot.loader = { diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix index 98769ee..891c0c5 100644 --- a/hosts/genesis/dnsmasq.nix +++ b/hosts/genesis/dnsmasq.nix @@ -4,17 +4,17 @@ let extraHosts = builtins.concatStringsSep "\n" [ # Local hosts "10.42.0.1 switch" - "10.42.1.1 router" - "10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + #"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" "10.42.1.3 printer" "10.42.1.4 chronicles nas" "10.42.1.12 tv" # Tailscale hosts - "100.90.74.19 jude.me.ts" - "100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts" - "100.119.228.115 chronicles.me.ts nas.me.ts" - "100.115.57.8 linode.me.ts" + "100.90.74.19 jude.shire-zebra.ts.net" + "100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net" + "100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net" + "100.115.57.8 linode.shire-zebra.ts.net" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" @@ -33,13 +33,13 @@ in domain = "thehellings.lan"; dhcp-range = [ # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" - "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h" "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" ]; dhcp-option = [ - "${lanDevice},option:router,10.42.1.1" - "${lanDevice},option:dns-server,10.42.1.2,1.1.1.1" + "${lanDevice},option:router,10.43.1.1" + "${lanDevice},option:dns-server,10.43.1.2,1.1.1.1" "${lanDevice},option:domain-search,thehellings.lan" "vlan66@${lanDevice},option:router,192.168.66.1" @@ -48,6 +48,33 @@ in "vlan67@${lanDevice},option:router,192.168.67.1" "vlan67@${lanDevice},option:dns-server,192.168.67.2" ]; + dhcp-host = [ + # Static IPs for things in the IOT range + "98:da:c4:77:7f:4d,192.168.66.102" + "28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch + "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome + "28:87:ba:0e:c9:fd,192.168.66.75" + "4c:a1:61:05:cd:52,192.168.66.61" + "8c:85:80:1c:f9:d1,192.168.66.104" + "48:d6:d5:5d:81:21,192.168.66.65" # Google Home + "ac:84:c6:5e:4b:28,192.168.66.100" + "d8:0d:17:19:60:62,192.168.66.112" + "0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch + "0c:80:63:41:74:73,192.168.66.106" + "0c:80:63:41:6e:0f,192.168.66.90" + "98:da:c4:20:f3:64,192.168.66.6" + "98:da:c4:21:1b:2e,192.168.66.85" + "98:da:c4:20:ea:db,192.168.66.107" # HS220 switch + "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba + "98:da:c4:77:80:18,192.168.66.84" + "98:da:c4:77:82:7b,192.168.66.105" + "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini + "b4:b0:24:9a:14:0e,192.168.66.131" + "6c:29:90:3e:e2:02,192.168.66.66" # wiz + "54:af:97:83:ed:33,192.168.66.80" + "54:af:97:c2:0f:a1,192.168.66.76" + "b4:b0:24:9a:12:53,192.168.66.130" # KL125 + ]; expand-hosts = true; log-dhcp = true; log-queries = true; @@ -72,7 +99,6 @@ in # Allow traffic through networking.firewall = { - enable = true; allowedTCPPorts = [ 53 ]; allowedUDPPorts = [ 53 67 ]; }; diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index bb014d8..1068f2b 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -78,7 +78,6 @@ in # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect # directly for troubleshooting Nginx configuration networking.firewall = { - enable = true; allowedTCPPorts = [ 80 443 8091 8123 ]; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 29d5463..8374c66 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -1,10 +1,22 @@ -{ ... }: - -{ +{ pkgs, config, ... }: +let + lan = "enp1s0"; + wan = "enp2s0"; + iot = "vlan66"; +in { greg.tailscale.enable = true; + # Really, why do I still have to force-disable this crap? + boot.kernel.sysctl = { + "net.ipv6.conf.${lan}.disable_ipv6" = true; + "net.ipv6.conf.${wan}.disable_ipv6" = true; + "net.ipv6.conf.${iot}.disable_ipv6" = true; + "net.ipv6.conf.lo.disable_ipv6" = true; + }; + networking = { enableIPv6 = false; + networkmanager.enable = pkgs.lib.mkForce false; #defaultGateway = "10.42.1.1"; # 100.100.100.100 is the tailscale DNS nameservers = [ @@ -14,37 +26,52 @@ ]; interfaces = { # This is our WAN port - enp2s0 = { + "${wan}" = { useDHCP = true; - name = "wan"; }; # This is our LAN port - enp1s0.ipv4.addresses = [ { - address = "10.43.1.1"; - prefixLength = 16; - } ]; + "${lan}" = { + ipv4.addresses = [ { + address = "10.42.1.1"; + prefixLength = 16; + } ]; + useDHCP = false; + }; wlan0.useDHCP = false; - vlan66.ipv4.addresses = [ { - address = "192.168.66.2"; - prefixLength = 24; - } ]; + "${iot}" = { + useDHCP = false; + ipv4.addresses = [ { + address = "192.168.66.2"; + prefixLength = 24; + } ]; + }; }; vlans = { - vlan66 = { + "${iot}" = { id = 66; - interface = "enp2s0"; + interface = lan; }; }; + + firewall.enable = false; + # Router portion here + nftables = let + myvars = { + lanInterfaces = [ lan ]; + wanInterface = wan; + limitedLan = [ iot ]; + tcpPorts = config.networking.firewall.allowedTCPPorts; + udpPorts = config.networking.firewall.allowedUDPPorts; + }; + in { + enable = true; + rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft; + }; }; - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; fileSystems."/media" = { device = "10.42.1.4:/volume1/video/"; diff --git a/hosts/genesis/nftables.nft b/hosts/genesis/nftables.nft new file mode 100644 index 0000000..19fe0be --- /dev/null +++ b/hosts/genesis/nftables.nft @@ -0,0 +1,47 @@ +#!/usr/bin/env nft -f + +table ip filter { + chain output { + type filter hook output priority 100; policy accept; + } + + chain input { + type filter hook input priority 0; policy drop; + + iifname lo accept + + # Open the specific ports that we allow + {% for port in tcpPorts %} + iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept + {% endfor %} + {% for port in udpPorts %} + iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept + {% endfor %} + + iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing" + iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections" + iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic" + iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much" + } + chain forward { + type filter hook forward priority 0; policy drop; + iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN" + iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic" + } +} + +table ip nat { + chain postrouting { + type nat hook postrouting priority 100; policy accept; + oifname { {{ wanInterface }} } masquerade + } +} + +table ip6 filter { + chain input { + type filter hook input priority 0; policy drop; + } + chain forward { + type filter hook forward priority 0; policy drop; + } +} diff --git a/modules-linux/router.nix b/modules-linux/router.nix index 0a7f561..b483587 100644 --- a/modules-linux/router.nix +++ b/modules-linux/router.nix @@ -17,6 +17,10 @@ let udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; in lib.strings.concatStringsSep "\n" [ "table ip filter {" + " chain output {" + " type filter hook output priority 100; policy accept;" + " }" + " chain input {" " type filter hook input priority 0; policy drop;" diff --git a/overlays/copier.nix b/overlays/copier.nix deleted file mode 100644 index 82fa817..0000000 --- a/overlays/copier.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs, -colorama, -dunamai, -iteration-utilities, -jinja2, -jinja2-ansible-filters, -packaging, -pathspec, -plumbum, -pydantic, -pygments, -pyyaml, -pyyaml-include, -questionary, -setuptools, -wheel}: - -let - pydeps = [ - colorama - dunamai - iteration-utilities - jinja2 - jinja2-ansible-filters - packaging - pathspec - plumbum - pydantic - pygments - pyyaml - pyyaml-include - questionary - setuptools - wheel - ]; -in buildPythonPackage rec { - pname = "copier"; - version = "6.2.0"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-eSxm7Rpu3dhWkLoSA1/b8IemWxjIsHwlJ+NYEpbilkk="; - }; - - meta = with lib; { - description = "A library and CLI app for rendering templates"; - homepage = "https://github.com/copier-org/copier"; - license = licenses.mit; - maintainers = []; - }; - - doCheck = false; - - propagatedBuildInputs = pydeps; - - buildInputs = []; -} diff --git a/overlays/default.nix b/overlays/default.nix index e1c9ca1..6ee8c09 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -3,7 +3,6 @@ final: prev: let myPackages = pypackages: with pypackages; [ black - copier dateutil flake8 ipython @@ -42,28 +41,21 @@ in rec { xonsh-apipenv = cp ./xonsh-apipenv.nix {}; xonsh-direnv = cp ./xonsh-direnv.nix {}; xontrib-vox = cp ./xonsh-vox.nix {}; - copier = cp ./copier.nix { - inherit (python-final) - iteration-utilities - jinja2-ansible-filters - pyyaml-include; - }; - iteration-utilities = cp ./iteration-utilities.nix {}; - jinja2-ansible-filters = cp ./jinja2-ansible-filters.nix {}; - pyyaml-include = cp ./pyyaml-include.nix {}; }) ]; brew = prev.callPackage ./homebrew.nix {}; - - enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; - hms = prev.callPackage ./hms.nix { - pkgs = final.pkgs; - }; - inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; setup-ssh = prev.callPackage ./setup-ssh.nix { pkgs = final.pkgs; }; + hms = prev.callPackage ./hms.nix { + pkgs = final.pkgs; + }; + jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {}; + template = prev.callPackage ./template.nix { }; + + enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; + inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; diff --git a/overlays/iteration-utilities.nix b/overlays/iteration-utilities.nix deleted file mode 100644 index cb272ca..0000000 --- a/overlays/iteration-utilities.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs}: - -buildPythonPackage rec { - pname = "iteration-utilities"; - version = "0.11.0"; - - src = fetchPypi { - inherit version; - pname = "iteration_utilities"; - sha256 = "sha256-+R9BolSemn5A/1Rg/fkDO27lswXZvneUO2OlVFNMKnc="; - }; - - meta = with lib; { - description = "Utilities based on Pythons iterators and generators."; - homepage = "https://github.com/MSeifert04/iteration_utilities"; - license = licenses.afl20; - maintainers = []; - }; - - propagatedBuildInputs = []; - - doCheck = false; -} diff --git a/overlays/jinja2-ansible-filters.nix b/overlays/jinja2-ansible-filters.nix deleted file mode 100644 index c6eacad..0000000 --- a/overlays/jinja2-ansible-filters.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs}: - -let - pydeps = pypkgs: with pypkgs; [ - ansible-core - setuptools - wheel - ]; -in buildPythonPackage rec { - pname = "jinja2-ansible-filters"; - version = "1.3.2"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs="; - }; - - meta = with lib; { - description = "A port of the Jinja2 filters from Ansible"; - homepage = "https://gitlab.com/dreamer-labs/libraries/jinja2-ansible-filters"; - license = licenses.gpl3; - maintainers = []; - }; - - doCheck = false; - - buildInputs = with pkgs; [ - (python3.withPackages pydeps) - ]; - - nativeBuildInputs = with pkgs; [ - (python3.withPackages pydeps) - ]; -} diff --git a/overlays/jinja2-cli.nix b/overlays/jinja2-cli.nix new file mode 100644 index 0000000..4cca67b --- /dev/null +++ b/overlays/jinja2-cli.nix @@ -0,0 +1,39 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + + flake8, + jinja2, + pytestCheckHook, + setuptools, +}: + +buildPythonPackage { + pname = "jinja2-cli"; + version = "0.8.2"; + + src = fetchFromGitHub { + owner = "mattrobenolt"; + repo = "jinja2-cli"; + rev = "0.8.2"; + hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0="; + }; + + propagatedBuildInputs = [ + jinja2 + setuptools + ]; + + checkInputs = [ + flake8 + pytestCheckHook + ]; + + meta = with lib; { + description = "A CLI interface for Jinja2 templates"; + homepage = "https://github.com/mattrobenolt/jinja2-cli"; + license = licenses.bsd2; + maintainers = [ lib.maintainers.greg ]; + }; +} diff --git a/overlays/pyyaml-include.nix b/overlays/pyyaml-include.nix deleted file mode 100644 index 4a6213f..0000000 --- a/overlays/pyyaml-include.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs, -pyyaml, -setuptools, -setuptools-scm, -setuptools-scm-git-archive, -wheel -}: - -let - pydeps = [ - pyyaml - ]; -in buildPythonPackage rec { - pname = "pyyaml-include"; - version = "1.3"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E="; - }; - - meta = with lib; { - description = "A PyYAML extension to allow includes."; - homepage = "https://github.com/tanbro/pyyaml-include"; - license = licenses.gpl3; - maintainers = []; - }; - - doCheck = false; - - propagatedBuildInputs = pydeps; - - buildInputs = [ - setuptools - setuptools-scm - setuptools-scm-git-archive - wheel - ]; - - nativeBuildInputs = with pkgs; [ - ]; -} diff --git a/overlays/template.nix b/overlays/template.nix new file mode 100644 index 0000000..e4bfcde --- /dev/null +++ b/overlays/template.nix @@ -0,0 +1,15 @@ +{ stdenv, jinja2-cli }: + +name: vars: template: +(stdenv.mkDerivation { + inherit name; + + passAsFile = [ "varsData" ]; + varsData = builtins.toJSON vars; + + nativeBuildInputs = [ jinja2-cli ]; + phases = [ "buildPhase" "installPhase" ]; + + buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result''; + installPhase = "cp result $out"; +})