Genesis buttoned up

Removed lots of overlays that are redundant now
Added copier to home tools
Added static DHCP leases to dnsmasq
Improved router
Added ability to read Jinja2 template files

home/home.nix

@@ -44,10 +44,10 @@
 	home.packages = with pkgs; [
 		bitwarden-cli
 		brew
+		copier
 		diffutils
 		dmidecode
 		findutils
-		gimp
 		git
 		gnupatch
 		gregpy

hosts/default.nix

@@ -16,7 +16,7 @@ let
 		};
 	in channel.lib.nixosSystem {
 		inherit system;
-		specialArgs = { inherit nixpkgs; };
+		specialArgs = { inherit nixpkgs inputs; };
 		modules = [
 			{
 				nixpkgs.overlays = overlays;

hosts/genesis/default.nix

@@ -15,7 +15,7 @@
 	];
 	
 	greg.home = true;
-	greg.gnome.enable = true;
+	greg.gnome.enable = false;
 	
 	# Bootloader.
 	boot.loader = {

hosts/genesis/dnsmasq.nix

@@ -4,17 +4,17 @@ let
 	extraHosts = builtins.concatStringsSep "\n" [
 		# Local hosts
 		"10.42.0.1 switch"
-		"10.42.1.1 router"
+		"10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
-		"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
+		#"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
 		"10.42.1.3 printer"
 		"10.42.1.4 chronicles nas"
 		"10.42.1.12 tv"
 
 		# Tailscale hosts
-		"100.90.74.19 jude.me.ts"
+		"100.90.74.19 jude.shire-zebra.ts.net"
-		"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts"
+		"100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net"
-		"100.119.228.115 chronicles.me.ts nas.me.ts"
+		"100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net"
-		"100.115.57.8 linode.me.ts"
+		"100.115.57.8 linode.shire-zebra.ts.net"
 
 		# Dev hosts
 		"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
@@ -33,13 +33,13 @@ in
 			domain = "thehellings.lan";
 			dhcp-range = [
 		#		"${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static"
-				"${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h"
+				"${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h"
 				"vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h"
 				"vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h"
 			];
 			dhcp-option = [
-				"${lanDevice},option:router,10.42.1.1"
+				"${lanDevice},option:router,10.43.1.1"
-				"${lanDevice},option:dns-server,10.42.1.2,1.1.1.1"
+				"${lanDevice},option:dns-server,10.43.1.2,1.1.1.1"
 				"${lanDevice},option:domain-search,thehellings.lan"
 
 				"vlan66@${lanDevice},option:router,192.168.66.1"
@@ -48,6 +48,33 @@ in
 				"vlan67@${lanDevice},option:router,192.168.67.1"
 				"vlan67@${lanDevice},option:dns-server,192.168.67.2"
 			];
+			dhcp-host = [
+				# Static IPs for things in the IOT range
+				"98:da:c4:77:7f:4d,192.168.66.102"
+				"28:87:ba:0e:ca:da,192.168.66.74"  # KS200M switch
+				"8c:49:62:aa:58:60,192.168.66.108"  # Roku, HiHandsome
+				"28:87:ba:0e:c9:fd,192.168.66.75"
+				"4c:a1:61:05:cd:52,192.168.66.61"
+				"8c:85:80:1c:f9:d1,192.168.66.104"
+				"48:d6:d5:5d:81:21,192.168.66.65"  # Google Home
+				"ac:84:c6:5e:4b:28,192.168.66.100"
+				"d8:0d:17:19:60:62,192.168.66.112"
+				"0c:80:63:41:6c:5d,192.168.66.98"  # HS200 switch
+				"0c:80:63:41:74:73,192.168.66.106"
+				"0c:80:63:41:6e:0f,192.168.66.90"
+				"98:da:c4:20:f3:64,192.168.66.6"
+				"98:da:c4:21:1b:2e,192.168.66.85"
+				"98:da:c4:20:ea:db,192.168.66.107"  # HS220 switch
+				"f0:03:8c:b3:b0:f6,192.168.66.55"  # Roomba
+				"98:da:c4:77:80:18,192.168.66.84"
+				"98:da:c4:77:82:7b,192.168.66.105"
+				"e4:f0:42:61:fa:b5,192.168.66.149"  # Google Home-mini
+				"b4:b0:24:9a:14:0e,192.168.66.131"
+				"6c:29:90:3e:e2:02,192.168.66.66"  # wiz
+				"54:af:97:83:ed:33,192.168.66.80"
+				"54:af:97:c2:0f:a1,192.168.66.76"
+				"b4:b0:24:9a:12:53,192.168.66.130"  # KL125
+			];
 			expand-hosts = true;
 			log-dhcp = true;
 			log-queries = true;
@@ -72,7 +99,6 @@ in
 
 	# Allow traffic through
 	networking.firewall = {
-		enable = true;
 		allowedTCPPorts = [ 53 ];
 		allowedUDPPorts = [ 53 67 ];
 	};

hosts/genesis/home-assistant.nix

@@ -78,7 +78,6 @@ in
 	# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
 	# directly for troubleshooting Nginx configuration
 	networking.firewall = {
-		enable = true;
 		allowedTCPPorts = [ 80 443 8091 8123 ];
 	};
 

hosts/genesis/networking.nix

@@ -1,10 +1,22 @@
-{ ... }:
+{ pkgs, config, ... }:
-
+let
-{
+	lan = "enp1s0";
+	wan = "enp2s0";
+	iot = "vlan66";
+in {
 	greg.tailscale.enable = true;
 
+	# Really, why do I still have to force-disable this crap?
+	boot.kernel.sysctl = {
+		"net.ipv6.conf.${lan}.disable_ipv6" = true;
+		"net.ipv6.conf.${wan}.disable_ipv6" = true;
+		"net.ipv6.conf.${iot}.disable_ipv6" = true;
+		"net.ipv6.conf.lo.disable_ipv6" = true;
+	};
+
 	networking = {
 		enableIPv6 = false;
+		networkmanager.enable = pkgs.lib.mkForce false;
 		#defaultGateway = "10.42.1.1";
 		# 100.100.100.100 is the tailscale DNS
 		nameservers = [
@@ -14,37 +26,52 @@
 		];
 		interfaces = {
 			# This is our WAN port
-			enp2s0 = {
+			"${wan}" = {
 				useDHCP = true;
-				name = "wan";
 			};
 
 			# This is our LAN port
-			enp1s0.ipv4.addresses = [ {
+			"${lan}" = {
-				address = "10.43.1.1";
+				ipv4.addresses = [ {
-				prefixLength = 16;
+					address = "10.42.1.1";
-			} ];
+					prefixLength = 16;
+				} ];
+				useDHCP = false;
+			};
 			wlan0.useDHCP = false;
 
-			vlan66.ipv4.addresses = [ {
+			"${iot}" = {
-				address = "192.168.66.2";
+				useDHCP = false;
-				prefixLength = 24;
+				ipv4.addresses = [ {
-			} ];
+					address = "192.168.66.2";
+					prefixLength = 24;
+				} ];
+			};
 		};
 
 		vlans = {
-			vlan66 = {
+			"${iot}" = {
 				id = 66;
-				interface = "enp2s0";
+				interface = lan;
 			};
 		};
+
+		firewall.enable = false;
+		# Router portion here
+		nftables = let
+			myvars = {
+				lanInterfaces = [ lan ];
+				wanInterface = wan;
+				limitedLan = [ iot ];
+				tcpPorts = config.networking.firewall.allowedTCPPorts;
+				udpPorts = config.networking.firewall.allowedUDPPorts;
+			};
+		in {
+			enable = true;
+			rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft;
+		};
 	};
 
-	# Open ports in the firewall.
-	# networking.firewall.allowedTCPPorts = [ ... ];
-	# networking.firewall.allowedUDPPorts = [ ... ];
-	# Or disable the firewall altogether.
-	# networking.firewall.enable = false;
 
 	fileSystems."/media" = {
 		device = "10.42.1.4:/volume1/video/";

hosts/genesis/nftables.nft

@@ -0,0 +1,47 @@
+#!/usr/bin/env nft -f
+
+table ip filter {
+	chain output {
+		type filter hook output priority 100; policy accept;
+	}
+
+	chain input {
+		type filter hook input priority 0; policy drop;
+
+		iifname lo accept
+
+		# Open the specific ports that we allow
+		{% for port in tcpPorts %}
+		iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept
+		{% endfor %}
+		{% for port in udpPorts %}
+		iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept
+		{% endfor %}
+
+		iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing"
+		iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections"
+		iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
+		iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much"
+	}
+	chain forward {
+		type filter hook forward priority 0; policy drop;
+		iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN"
+		iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic"
+	}
+}
+
+table ip nat {
+	chain postrouting {
+		type nat hook postrouting priority 100; policy accept;
+		oifname { {{ wanInterface }} } masquerade
+	}
+}
+
+table ip6 filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+	}
+	chain forward {
+		type filter hook forward priority 0; policy drop;
+	}
+}

modules-linux/router.nix

@@ -17,6 +17,10 @@ let
 			udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
 	in lib.strings.concatStringsSep "\n" [
 		"table ip filter {"
+		"	chain output {"
+		"		type filter hook output priority 100; policy accept;"
+		"	}"
+
 		"	chain input {"
 		"		type filter hook input priority 0; policy drop;"
 

overlays/copier.nix

@@ -1,57 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, pkgs,
-colorama,
-dunamai,
-iteration-utilities,
-jinja2,
-jinja2-ansible-filters,
-packaging,
-pathspec,
-plumbum,
-pydantic,
-pygments,
-pyyaml,
-pyyaml-include,
-questionary,
-setuptools,
-wheel}:
-
-let
-	pydeps = [
-		colorama
-		dunamai
-		iteration-utilities
-		jinja2
-		jinja2-ansible-filters
-		packaging
-		pathspec
-		plumbum
-		pydantic
-		pygments
-		pyyaml
-		pyyaml-include
-		questionary
-		setuptools
-		wheel
-	];
-in buildPythonPackage rec {
-	pname = "copier";
-	version = "6.2.0";
-
-	src = fetchPypi {
-		inherit pname version;
-		sha256 = "sha256-eSxm7Rpu3dhWkLoSA1/b8IemWxjIsHwlJ+NYEpbilkk=";
-	};
-
-	meta = with lib; {
-		description = "A library and CLI app for rendering templates";
-		homepage = "https://github.com/copier-org/copier";
-		license = licenses.mit;
-		maintainers = [];
-	};
-
-	doCheck = false;
-
-	propagatedBuildInputs = pydeps;
-
-	buildInputs = [];
-}

overlays/default.nix

@@ -3,7 +3,6 @@ final: prev:
 let
 	myPackages = pypackages: with pypackages; [
 		black
-		copier
 		dateutil
 		flake8
 		ipython
@@ -42,28 +41,21 @@ in rec {
 			xonsh-apipenv = cp ./xonsh-apipenv.nix {};
 			xonsh-direnv = cp ./xonsh-direnv.nix {};
 			xontrib-vox = cp ./xonsh-vox.nix {};
-			copier =  cp ./copier.nix {
-				inherit (python-final)
-				    iteration-utilities
-				    jinja2-ansible-filters
-				    pyyaml-include;
-			};
-			iteration-utilities = cp ./iteration-utilities.nix {};
-			jinja2-ansible-filters = cp ./jinja2-ansible-filters.nix {};
-			pyyaml-include = cp ./pyyaml-include.nix {};
 		})
 	];
 
 	brew = prev.callPackage ./homebrew.nix {};
-
-	enwiki-dump = prev.callPackage ./enwiki-dump.nix {};
-	hms = prev.callPackage ./hms.nix {
-		pkgs = final.pkgs;
-	};
-	inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
 	setup-ssh = prev.callPackage ./setup-ssh.nix {
 		pkgs = final.pkgs;
 	};
+	hms = prev.callPackage ./hms.nix {
+		pkgs = final.pkgs;
+	};
+	jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {};
+	template = prev.callPackage ./template.nix { };
+
+	enwiki-dump = prev.callPackage ./enwiki-dump.nix {};
+	inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
 
 	xonsh = prev.xonsh.overridePythonAttrs (old: rec{
 		python3 = final.gregpy;

overlays/iteration-utilities.nix

@@ -1,23 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, pkgs}:
-
-buildPythonPackage rec {
-	pname = "iteration-utilities";
-	version = "0.11.0";
-
-	src = fetchPypi {
-		inherit version;
-		pname = "iteration_utilities";
-		sha256 = "sha256-+R9BolSemn5A/1Rg/fkDO27lswXZvneUO2OlVFNMKnc=";
-	};
-
-	meta = with lib; {
-		description = "Utilities based on Pythons iterators and generators.";
-		homepage = "https://github.com/MSeifert04/iteration_utilities";
-		license = licenses.afl20;
-		maintainers = [];
-	};
-
-	propagatedBuildInputs = [];
-
-	doCheck = false;
-}

overlays/jinja2-ansible-filters.nix

@@ -1,34 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, pkgs}:
-
-let
-        pydeps = pypkgs: with pypkgs; [
-                ansible-core
-                setuptools
-                wheel
-        ];
-in buildPythonPackage rec {
-        pname = "jinja2-ansible-filters";
-        version = "1.3.2";
-
-        src = fetchPypi {
-                inherit pname version;
-                sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs=";
-        };
-
-        meta = with lib; {
-                description = "A port of the Jinja2 filters from Ansible";
-                homepage = "https://gitlab.com/dreamer-labs/libraries/jinja2-ansible-filters";
-                license = licenses.gpl3;
-                maintainers = [];
-        };
-
-        doCheck = false;
-
-        buildInputs = with pkgs; [
-                (python3.withPackages pydeps)
-        ];
-
-        nativeBuildInputs = with pkgs; [
-                (python3.withPackages pydeps)
-        ];
-}

overlays/jinja2-cli.nix

@@ -0,0 +1,39 @@
+{
+	lib,
+	buildPythonPackage,
+	fetchFromGitHub,
+
+	flake8,
+	jinja2,
+	pytestCheckHook,
+	setuptools,
+}:
+
+buildPythonPackage {
+    pname = "jinja2-cli";
+    version = "0.8.2";
+
+    src = fetchFromGitHub {
+        owner = "mattrobenolt";
+        repo = "jinja2-cli";
+        rev = "0.8.2";
+        hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0=";
+    };
+
+    propagatedBuildInputs = [
+        jinja2
+        setuptools
+    ];
+
+    checkInputs = [
+        flake8
+        pytestCheckHook
+    ];
+
+    meta = with lib; {
+        description = "A CLI interface for Jinja2 templates";
+        homepage = "https://github.com/mattrobenolt/jinja2-cli";
+        license = licenses.bsd2;
+        maintainers = [ lib.maintainers.greg ];
+    };
+}

overlays/pyyaml-include.nix

@@ -1,42 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, pkgs,
-pyyaml,
-setuptools,
-setuptools-scm,
-setuptools-scm-git-archive,
-wheel
-}:
-
-let
-	pydeps = [
-		pyyaml
-	];
-in buildPythonPackage rec {
-	pname = "pyyaml-include";
-	version = "1.3";
-
-	src = fetchPypi {
-		inherit pname version;
-		sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E=";
-	};
-
-	meta = with lib; {
-		description = "A PyYAML extension to allow includes.";
-		homepage = "https://github.com/tanbro/pyyaml-include";
-		license = licenses.gpl3;
-		maintainers = [];
-	};
-
-	doCheck = false;
-
-	propagatedBuildInputs = pydeps;
-
-	buildInputs = [
-		setuptools
-		setuptools-scm
-		setuptools-scm-git-archive
-		wheel
-	];
-
-	nativeBuildInputs = with pkgs; [
-	];
-}

overlays/template.nix

@@ -0,0 +1,15 @@
+{ stdenv, jinja2-cli }:
+
+name: vars: template:
+(stdenv.mkDerivation {
+	inherit name;
+
+	passAsFile = [ "varsData" ];
+	varsData = builtins.toJSON vars;
+
+	nativeBuildInputs = [ jinja2-cli ];
+	phases = [ "buildPhase" "installPhase" ];
+
+	buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result'';
+	installPhase = "cp result $out";
+})