From 88c28ed0f2ae7808518b10847fd0052c1501be23 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 21 Aug 2023 21:22:26 -0500 Subject: [PATCH] Genesis buttoned up Removed lots of overlays that are redundant now Added copier to home tools Added static DHCP leases to dnsmasq Improved router Added ability to read Jinja2 template files --- home/home.nix | 2 +- hosts/default.nix | 2 +- hosts/genesis/default.nix | 2 +- hosts/genesis/dnsmasq.nix | 46 +++++++++++++++----- hosts/genesis/home-assistant.nix | 1 - hosts/genesis/networking.nix | 67 ++++++++++++++++++++--------- hosts/genesis/nftables.nft | 47 ++++++++++++++++++++ modules-linux/router.nix | 4 ++ overlays/copier.nix | 57 ------------------------ overlays/default.nix | 24 ++++------- overlays/iteration-utilities.nix | 23 ---------- overlays/jinja2-ansible-filters.nix | 34 --------------- overlays/jinja2-cli.nix | 39 +++++++++++++++++ overlays/pyyaml-include.nix | 42 ------------------ overlays/template.nix | 15 +++++++ 15 files changed, 199 insertions(+), 206 deletions(-) create mode 100644 hosts/genesis/nftables.nft delete mode 100644 overlays/copier.nix delete mode 100644 overlays/iteration-utilities.nix delete mode 100644 overlays/jinja2-ansible-filters.nix create mode 100644 overlays/jinja2-cli.nix delete mode 100644 overlays/pyyaml-include.nix create mode 100644 overlays/template.nix diff --git a/home/home.nix b/home/home.nix index 04ccc2d..d8fa832 100644 --- a/home/home.nix +++ b/home/home.nix @@ -44,10 +44,10 @@ home.packages = with pkgs; [ bitwarden-cli brew + copier diffutils dmidecode findutils - gimp git gnupatch gregpy diff --git a/hosts/default.nix b/hosts/default.nix index 00c6e45..143961f 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -16,7 +16,7 @@ let }; in channel.lib.nixosSystem { inherit system; - specialArgs = { inherit nixpkgs; }; + specialArgs = { inherit nixpkgs inputs; }; modules = [ { nixpkgs.overlays = overlays; diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index f00a13d..1f0d378 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -15,7 +15,7 @@ ]; greg.home = true; - greg.gnome.enable = true; + greg.gnome.enable = false; # Bootloader. boot.loader = { diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix index 98769ee..891c0c5 100644 --- a/hosts/genesis/dnsmasq.nix +++ b/hosts/genesis/dnsmasq.nix @@ -4,17 +4,17 @@ let extraHosts = builtins.concatStringsSep "\n" [ # Local hosts "10.42.0.1 switch" - "10.42.1.1 router" - "10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + #"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" "10.42.1.3 printer" "10.42.1.4 chronicles nas" "10.42.1.12 tv" # Tailscale hosts - "100.90.74.19 jude.me.ts" - "100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts" - "100.119.228.115 chronicles.me.ts nas.me.ts" - "100.115.57.8 linode.me.ts" + "100.90.74.19 jude.shire-zebra.ts.net" + "100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net" + "100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net" + "100.115.57.8 linode.shire-zebra.ts.net" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" @@ -33,13 +33,13 @@ in domain = "thehellings.lan"; dhcp-range = [ # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" - "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h" "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" ]; dhcp-option = [ - "${lanDevice},option:router,10.42.1.1" - "${lanDevice},option:dns-server,10.42.1.2,1.1.1.1" + "${lanDevice},option:router,10.43.1.1" + "${lanDevice},option:dns-server,10.43.1.2,1.1.1.1" "${lanDevice},option:domain-search,thehellings.lan" "vlan66@${lanDevice},option:router,192.168.66.1" @@ -48,6 +48,33 @@ in "vlan67@${lanDevice},option:router,192.168.67.1" "vlan67@${lanDevice},option:dns-server,192.168.67.2" ]; + dhcp-host = [ + # Static IPs for things in the IOT range + "98:da:c4:77:7f:4d,192.168.66.102" + "28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch + "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome + "28:87:ba:0e:c9:fd,192.168.66.75" + "4c:a1:61:05:cd:52,192.168.66.61" + "8c:85:80:1c:f9:d1,192.168.66.104" + "48:d6:d5:5d:81:21,192.168.66.65" # Google Home + "ac:84:c6:5e:4b:28,192.168.66.100" + "d8:0d:17:19:60:62,192.168.66.112" + "0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch + "0c:80:63:41:74:73,192.168.66.106" + "0c:80:63:41:6e:0f,192.168.66.90" + "98:da:c4:20:f3:64,192.168.66.6" + "98:da:c4:21:1b:2e,192.168.66.85" + "98:da:c4:20:ea:db,192.168.66.107" # HS220 switch + "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba + "98:da:c4:77:80:18,192.168.66.84" + "98:da:c4:77:82:7b,192.168.66.105" + "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini + "b4:b0:24:9a:14:0e,192.168.66.131" + "6c:29:90:3e:e2:02,192.168.66.66" # wiz + "54:af:97:83:ed:33,192.168.66.80" + "54:af:97:c2:0f:a1,192.168.66.76" + "b4:b0:24:9a:12:53,192.168.66.130" # KL125 + ]; expand-hosts = true; log-dhcp = true; log-queries = true; @@ -72,7 +99,6 @@ in # Allow traffic through networking.firewall = { - enable = true; allowedTCPPorts = [ 53 ]; allowedUDPPorts = [ 53 67 ]; }; diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index bb014d8..1068f2b 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -78,7 +78,6 @@ in # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect # directly for troubleshooting Nginx configuration networking.firewall = { - enable = true; allowedTCPPorts = [ 80 443 8091 8123 ]; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 29d5463..8374c66 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -1,10 +1,22 @@ -{ ... }: - -{ +{ pkgs, config, ... }: +let + lan = "enp1s0"; + wan = "enp2s0"; + iot = "vlan66"; +in { greg.tailscale.enable = true; + # Really, why do I still have to force-disable this crap? + boot.kernel.sysctl = { + "net.ipv6.conf.${lan}.disable_ipv6" = true; + "net.ipv6.conf.${wan}.disable_ipv6" = true; + "net.ipv6.conf.${iot}.disable_ipv6" = true; + "net.ipv6.conf.lo.disable_ipv6" = true; + }; + networking = { enableIPv6 = false; + networkmanager.enable = pkgs.lib.mkForce false; #defaultGateway = "10.42.1.1"; # 100.100.100.100 is the tailscale DNS nameservers = [ @@ -14,37 +26,52 @@ ]; interfaces = { # This is our WAN port - enp2s0 = { + "${wan}" = { useDHCP = true; - name = "wan"; }; # This is our LAN port - enp1s0.ipv4.addresses = [ { - address = "10.43.1.1"; - prefixLength = 16; - } ]; + "${lan}" = { + ipv4.addresses = [ { + address = "10.42.1.1"; + prefixLength = 16; + } ]; + useDHCP = false; + }; wlan0.useDHCP = false; - vlan66.ipv4.addresses = [ { - address = "192.168.66.2"; - prefixLength = 24; - } ]; + "${iot}" = { + useDHCP = false; + ipv4.addresses = [ { + address = "192.168.66.2"; + prefixLength = 24; + } ]; + }; }; vlans = { - vlan66 = { + "${iot}" = { id = 66; - interface = "enp2s0"; + interface = lan; }; }; + + firewall.enable = false; + # Router portion here + nftables = let + myvars = { + lanInterfaces = [ lan ]; + wanInterface = wan; + limitedLan = [ iot ]; + tcpPorts = config.networking.firewall.allowedTCPPorts; + udpPorts = config.networking.firewall.allowedUDPPorts; + }; + in { + enable = true; + rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft; + }; }; - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; fileSystems."/media" = { device = "10.42.1.4:/volume1/video/"; diff --git a/hosts/genesis/nftables.nft b/hosts/genesis/nftables.nft new file mode 100644 index 0000000..19fe0be --- /dev/null +++ b/hosts/genesis/nftables.nft @@ -0,0 +1,47 @@ +#!/usr/bin/env nft -f + +table ip filter { + chain output { + type filter hook output priority 100; policy accept; + } + + chain input { + type filter hook input priority 0; policy drop; + + iifname lo accept + + # Open the specific ports that we allow + {% for port in tcpPorts %} + iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept + {% endfor %} + {% for port in udpPorts %} + iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept + {% endfor %} + + iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing" + iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections" + iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic" + iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much" + } + chain forward { + type filter hook forward priority 0; policy drop; + iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN" + iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic" + } +} + +table ip nat { + chain postrouting { + type nat hook postrouting priority 100; policy accept; + oifname { {{ wanInterface }} } masquerade + } +} + +table ip6 filter { + chain input { + type filter hook input priority 0; policy drop; + } + chain forward { + type filter hook forward priority 0; policy drop; + } +} diff --git a/modules-linux/router.nix b/modules-linux/router.nix index 0a7f561..b483587 100644 --- a/modules-linux/router.nix +++ b/modules-linux/router.nix @@ -17,6 +17,10 @@ let udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; in lib.strings.concatStringsSep "\n" [ "table ip filter {" + " chain output {" + " type filter hook output priority 100; policy accept;" + " }" + " chain input {" " type filter hook input priority 0; policy drop;" diff --git a/overlays/copier.nix b/overlays/copier.nix deleted file mode 100644 index 82fa817..0000000 --- a/overlays/copier.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs, -colorama, -dunamai, -iteration-utilities, -jinja2, -jinja2-ansible-filters, -packaging, -pathspec, -plumbum, -pydantic, -pygments, -pyyaml, -pyyaml-include, -questionary, -setuptools, -wheel}: - -let - pydeps = [ - colorama - dunamai - iteration-utilities - jinja2 - jinja2-ansible-filters - packaging - pathspec - plumbum - pydantic - pygments - pyyaml - pyyaml-include - questionary - setuptools - wheel - ]; -in buildPythonPackage rec { - pname = "copier"; - version = "6.2.0"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-eSxm7Rpu3dhWkLoSA1/b8IemWxjIsHwlJ+NYEpbilkk="; - }; - - meta = with lib; { - description = "A library and CLI app for rendering templates"; - homepage = "https://github.com/copier-org/copier"; - license = licenses.mit; - maintainers = []; - }; - - doCheck = false; - - propagatedBuildInputs = pydeps; - - buildInputs = []; -} diff --git a/overlays/default.nix b/overlays/default.nix index e1c9ca1..6ee8c09 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -3,7 +3,6 @@ final: prev: let myPackages = pypackages: with pypackages; [ black - copier dateutil flake8 ipython @@ -42,28 +41,21 @@ in rec { xonsh-apipenv = cp ./xonsh-apipenv.nix {}; xonsh-direnv = cp ./xonsh-direnv.nix {}; xontrib-vox = cp ./xonsh-vox.nix {}; - copier = cp ./copier.nix { - inherit (python-final) - iteration-utilities - jinja2-ansible-filters - pyyaml-include; - }; - iteration-utilities = cp ./iteration-utilities.nix {}; - jinja2-ansible-filters = cp ./jinja2-ansible-filters.nix {}; - pyyaml-include = cp ./pyyaml-include.nix {}; }) ]; brew = prev.callPackage ./homebrew.nix {}; - - enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; - hms = prev.callPackage ./hms.nix { - pkgs = final.pkgs; - }; - inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; setup-ssh = prev.callPackage ./setup-ssh.nix { pkgs = final.pkgs; }; + hms = prev.callPackage ./hms.nix { + pkgs = final.pkgs; + }; + jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {}; + template = prev.callPackage ./template.nix { }; + + enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; + inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ python3 = final.gregpy; diff --git a/overlays/iteration-utilities.nix b/overlays/iteration-utilities.nix deleted file mode 100644 index cb272ca..0000000 --- a/overlays/iteration-utilities.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs}: - -buildPythonPackage rec { - pname = "iteration-utilities"; - version = "0.11.0"; - - src = fetchPypi { - inherit version; - pname = "iteration_utilities"; - sha256 = "sha256-+R9BolSemn5A/1Rg/fkDO27lswXZvneUO2OlVFNMKnc="; - }; - - meta = with lib; { - description = "Utilities based on Pythons iterators and generators."; - homepage = "https://github.com/MSeifert04/iteration_utilities"; - license = licenses.afl20; - maintainers = []; - }; - - propagatedBuildInputs = []; - - doCheck = false; -} diff --git a/overlays/jinja2-ansible-filters.nix b/overlays/jinja2-ansible-filters.nix deleted file mode 100644 index c6eacad..0000000 --- a/overlays/jinja2-ansible-filters.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs}: - -let - pydeps = pypkgs: with pypkgs; [ - ansible-core - setuptools - wheel - ]; -in buildPythonPackage rec { - pname = "jinja2-ansible-filters"; - version = "1.3.2"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs="; - }; - - meta = with lib; { - description = "A port of the Jinja2 filters from Ansible"; - homepage = "https://gitlab.com/dreamer-labs/libraries/jinja2-ansible-filters"; - license = licenses.gpl3; - maintainers = []; - }; - - doCheck = false; - - buildInputs = with pkgs; [ - (python3.withPackages pydeps) - ]; - - nativeBuildInputs = with pkgs; [ - (python3.withPackages pydeps) - ]; -} diff --git a/overlays/jinja2-cli.nix b/overlays/jinja2-cli.nix new file mode 100644 index 0000000..4cca67b --- /dev/null +++ b/overlays/jinja2-cli.nix @@ -0,0 +1,39 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + + flake8, + jinja2, + pytestCheckHook, + setuptools, +}: + +buildPythonPackage { + pname = "jinja2-cli"; + version = "0.8.2"; + + src = fetchFromGitHub { + owner = "mattrobenolt"; + repo = "jinja2-cli"; + rev = "0.8.2"; + hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0="; + }; + + propagatedBuildInputs = [ + jinja2 + setuptools + ]; + + checkInputs = [ + flake8 + pytestCheckHook + ]; + + meta = with lib; { + description = "A CLI interface for Jinja2 templates"; + homepage = "https://github.com/mattrobenolt/jinja2-cli"; + license = licenses.bsd2; + maintainers = [ lib.maintainers.greg ]; + }; +} diff --git a/overlays/pyyaml-include.nix b/overlays/pyyaml-include.nix deleted file mode 100644 index 4a6213f..0000000 --- a/overlays/pyyaml-include.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ lib, buildPythonPackage, fetchPypi, pkgs, -pyyaml, -setuptools, -setuptools-scm, -setuptools-scm-git-archive, -wheel -}: - -let - pydeps = [ - pyyaml - ]; -in buildPythonPackage rec { - pname = "pyyaml-include"; - version = "1.3"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E="; - }; - - meta = with lib; { - description = "A PyYAML extension to allow includes."; - homepage = "https://github.com/tanbro/pyyaml-include"; - license = licenses.gpl3; - maintainers = []; - }; - - doCheck = false; - - propagatedBuildInputs = pydeps; - - buildInputs = [ - setuptools - setuptools-scm - setuptools-scm-git-archive - wheel - ]; - - nativeBuildInputs = with pkgs; [ - ]; -} diff --git a/overlays/template.nix b/overlays/template.nix new file mode 100644 index 0000000..e4bfcde --- /dev/null +++ b/overlays/template.nix @@ -0,0 +1,15 @@ +{ stdenv, jinja2-cli }: + +name: vars: template: +(stdenv.mkDerivation { + inherit name; + + passAsFile = [ "varsData" ]; + varsData = builtins.toJSON vars; + + nativeBuildInputs = [ jinja2-cli ]; + phases = [ "buildPhase" "installPhase" ]; + + buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result''; + installPhase = "cp result $out"; +})