greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Genesis buttoned up

Browse Source 
Removed lots of overlays that are redundant now
Added copier to home tools
Added static DHCP leases to dnsmasq
Improved router
Added ability to read Jinja2 template files
This commit is contained in:
Greg Hellings
2023-08-21 21:22:26 -05:00
parent 70b76382ec
commit 88c28ed0f2
15 changed files with 199 additions and 206 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/home.nix
+1 -1
View File
@@ -44,10 +44,10 @@
home.packages = with pkgs; [
bitwarden-cli
brew
copier
diffutils
dmidecode
findutils
gimp
git
gnupatch
gregpy
hosts/default.nix
+1 -1
View File
@@ -16,7 +16,7 @@ let
};
in channel.lib.nixosSystem {
inherit system;
specialArgs = { inherit nixpkgs; };
specialArgs = { inherit nixpkgs inputs; };
modules = [
{
nixpkgs.overlays = overlays;
hosts/genesis/default.nix
+1 -1
View File
@@ -15,7 +15,7 @@
];
greg.home = true;
greg.gnome.enable = true;
greg.gnome.enable = false;
# Bootloader.
boot.loader = {
hosts/genesis/dnsmasq.nix
+36 -10
View File
@@ -4,17 +4,17 @@ let
extraHosts = builtins.concatStringsSep "\n" [
# Local hosts
"10.42.0.1 switch"
"10.42.1.1 router"
"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
#"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.3 printer"
"10.42.1.4 chronicles nas"
"10.42.1.12 tv"
# Tailscale hosts
"100.90.74.19 jude.me.ts"
"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts"
"100.119.228.115 chronicles.me.ts nas.me.ts"
"100.115.57.8 linode.me.ts"
"100.90.74.19 jude.shire-zebra.ts.net"
"100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net"
"100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net"
"100.115.57.8 linode.shire-zebra.ts.net"
# Dev hosts
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
@@ -33,13 +33,13 @@ in
domain = "thehellings.lan";
dhcp-range = [
# "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static"
"${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h"
"${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h"
"vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h"
"vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h"
];
dhcp-option = [
"${lanDevice},option:router,10.42.1.1"
"${lanDevice},option:dns-server,10.42.1.2,1.1.1.1"
"${lanDevice},option:router,10.43.1.1"
"${lanDevice},option:dns-server,10.43.1.2,1.1.1.1"
"${lanDevice},option:domain-search,thehellings.lan"
"vlan66@${lanDevice},option:router,192.168.66.1"
@@ -48,6 +48,33 @@ in
"vlan67@${lanDevice},option:router,192.168.67.1"
"vlan67@${lanDevice},option:dns-server,192.168.67.2"
];
dhcp-host = [
# Static IPs for things in the IOT range
"98:da:c4:77:7f:4d,192.168.66.102"
"28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
"28:87:ba:0e:c9:fd,192.168.66.75"
"4c:a1:61:05:cd:52,192.168.66.61"
"8c:85:80:1c:f9:d1,192.168.66.104"
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"ac:84:c6:5e:4b:28,192.168.66.100"
"d8:0d:17:19:60:62,192.168.66.112"
"0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch
"0c:80:63:41:74:73,192.168.66.106"
"0c:80:63:41:6e:0f,192.168.66.90"
"98:da:c4:20:f3:64,192.168.66.6"
"98:da:c4:21:1b:2e,192.168.66.85"
"98:da:c4:20:ea:db,192.168.66.107" # HS220 switch
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
"98:da:c4:77:80:18,192.168.66.84"
"98:da:c4:77:82:7b,192.168.66.105"
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
"b4:b0:24:9a:14:0e,192.168.66.131"
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"54:af:97:83:ed:33,192.168.66.80"
"54:af:97:c2:0f:a1,192.168.66.76"
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
@@ -72,7 +99,6 @@ in
# Allow traffic through
networking.firewall = {
enable = true;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 67 ];
};
hosts/genesis/home-assistant.nix
-1
View File
@@ -78,7 +78,6 @@ in
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
# directly for troubleshooting Nginx configuration
networking.firewall = {
enable = true;
allowedTCPPorts = [ 80 443 8091 8123 ];
};
hosts/genesis/networking.nix
+47 -20
View File
@@ -1,10 +1,22 @@
{ ... }:
{
{ pkgs, config, ... }:
let
lan = "enp1s0";
wan = "enp2s0";
iot = "vlan66";
in {
greg.tailscale.enable = true;
# Really, why do I still have to force-disable this crap?
boot.kernel.sysctl = {
"net.ipv6.conf.${lan}.disable_ipv6" = true;
"net.ipv6.conf.${wan}.disable_ipv6" = true;
"net.ipv6.conf.${iot}.disable_ipv6" = true;
"net.ipv6.conf.lo.disable_ipv6" = true;
};
networking = {
enableIPv6 = false;
networkmanager.enable = pkgs.lib.mkForce false;
#defaultGateway = "10.42.1.1";
# 100.100.100.100 is the tailscale DNS
nameservers = [
@@ -14,37 +26,52 @@
];
interfaces = {
# This is our WAN port
enp2s0 = {
"${wan}" = {
useDHCP = true;
name = "wan";
};
# This is our LAN port
enp1s0.ipv4.addresses = [ {
address = "10.43.1.1";
prefixLength = 16;
} ];
"${lan}" = {
ipv4.addresses = [ {
address = "10.42.1.1";
prefixLength = 16;
} ];
useDHCP = false;
};
wlan0.useDHCP = false;
vlan66.ipv4.addresses = [ {
address = "192.168.66.2";
prefixLength = 24;
} ];
"${iot}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "192.168.66.2";
prefixLength = 24;
} ];
};
};
vlans = {
vlan66 = {
"${iot}" = {
id = 66;
interface = "enp2s0";
interface = lan;
};
};
firewall.enable = false;
# Router portion here
nftables = let
myvars = {
lanInterfaces = [ lan ];
wanInterface = wan;
limitedLan = [ iot ];
tcpPorts = config.networking.firewall.allowedTCPPorts;
udpPorts = config.networking.firewall.allowedUDPPorts;
};
in {
enable = true;
rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft;
};
};
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
fileSystems."/media" = {
device = "10.42.1.4:/volume1/video/";
hosts/genesis/nftables.nft
+47
View File
@@ -0,0 +1,47 @@
#!/usr/bin/env nft -f
table ip filter {
chain output {
type filter hook output priority 100; policy accept;
}
chain input {
type filter hook input priority 0; policy drop;
iifname lo accept
# Open the specific ports that we allow
{% for port in tcpPorts %}
iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept
{% endfor %}
{% for port in udpPorts %}
iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept
{% endfor %}
iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing"
iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections"
iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much"
}
chain forward {
type filter hook forward priority 0; policy drop;
iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN"
iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic"
}
}
table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname { {{ wanInterface }} } masquerade
}
}
table ip6 filter {
chain input {
type filter hook input priority 0; policy drop;
}
chain forward {
type filter hook forward priority 0; policy drop;
}
}
modules-linux/router.nix
+4
View File
@@ -17,6 +17,10 @@ let
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
in lib.strings.concatStringsSep "\n" [
"table ip filter {"
" chain output {"
" type filter hook output priority 100; policy accept;"
" }"
" chain input {"
" type filter hook input priority 0; policy drop;"
overlays/copier.nix
-57
View File
@@ -1,57 +0,0 @@
{ lib, buildPythonPackage, fetchPypi, pkgs,
colorama,
dunamai,
iteration-utilities,
jinja2,
jinja2-ansible-filters,
packaging,
pathspec,
plumbum,
pydantic,
pygments,
pyyaml,
pyyaml-include,
questionary,
setuptools,
wheel}:
let
pydeps = [
colorama
dunamai
iteration-utilities
jinja2
jinja2-ansible-filters
packaging
pathspec
plumbum
pydantic
pygments
pyyaml
pyyaml-include
questionary
setuptools
wheel
];
in buildPythonPackage rec {
pname = "copier";
version = "6.2.0";
src = fetchPypi {
inherit pname version;
sha256 = "sha256-eSxm7Rpu3dhWkLoSA1/b8IemWxjIsHwlJ+NYEpbilkk=";
};
meta = with lib; {
description = "A library and CLI app for rendering templates";
homepage = "https://github.com/copier-org/copier";
license = licenses.mit;
maintainers = [];
};
doCheck = false;
propagatedBuildInputs = pydeps;
buildInputs = [];
}
overlays/default.nix
+8 -16
View File
@@ -3,7 +3,6 @@ final: prev:
let
myPackages = pypackages: with pypackages; [
black
copier
dateutil
flake8
ipython
@@ -42,28 +41,21 @@ in rec {
xonsh-apipenv = cp ./xonsh-apipenv.nix {};
xonsh-direnv = cp ./xonsh-direnv.nix {};
xontrib-vox = cp ./xonsh-vox.nix {};
copier = cp ./copier.nix {
inherit (python-final)
iteration-utilities
jinja2-ansible-filters
pyyaml-include;
};
iteration-utilities = cp ./iteration-utilities.nix {};
jinja2-ansible-filters = cp ./jinja2-ansible-filters.nix {};
pyyaml-include = cp ./pyyaml-include.nix {};
})
];
brew = prev.callPackage ./homebrew.nix {};
enwiki-dump = prev.callPackage ./enwiki-dump.nix {};
hms = prev.callPackage ./hms.nix {
pkgs = final.pkgs;
};
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
setup-ssh = prev.callPackage ./setup-ssh.nix {
pkgs = final.pkgs;
};
hms = prev.callPackage ./hms.nix {
pkgs = final.pkgs;
};
jinja2-cli = prev.python3.pkgs.callPackage ./jinja2-cli.nix {};
template = prev.callPackage ./template.nix { };
enwiki-dump = prev.callPackage ./enwiki-dump.nix {};
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
xonsh = prev.xonsh.overridePythonAttrs (old: rec{
python3 = final.gregpy;
overlays/iteration-utilities.nix
-23
View File
@@ -1,23 +0,0 @@
{ lib, buildPythonPackage, fetchPypi, pkgs}:
buildPythonPackage rec {
pname = "iteration-utilities";
version = "0.11.0";
src = fetchPypi {
inherit version;
pname = "iteration_utilities";
sha256 = "sha256-+R9BolSemn5A/1Rg/fkDO27lswXZvneUO2OlVFNMKnc=";
};
meta = with lib; {
description = "Utilities based on Pythons iterators and generators.";
homepage = "https://github.com/MSeifert04/iteration_utilities";
license = licenses.afl20;
maintainers = [];
};
propagatedBuildInputs = [];
doCheck = false;
}
overlays/jinja2-ansible-filters.nix
-34
View File
@@ -1,34 +0,0 @@
{ lib, buildPythonPackage, fetchPypi, pkgs}:
let
pydeps = pypkgs: with pypkgs; [
ansible-core
setuptools
wheel
];
in buildPythonPackage rec {
pname = "jinja2-ansible-filters";
version = "1.3.2";
src = fetchPypi {
inherit pname version;
sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs=";
};
meta = with lib; {
description = "A port of the Jinja2 filters from Ansible";
homepage = "https://gitlab.com/dreamer-labs/libraries/jinja2-ansible-filters";
license = licenses.gpl3;
maintainers = [];
};
doCheck = false;
buildInputs = with pkgs; [
(python3.withPackages pydeps)
];
nativeBuildInputs = with pkgs; [
(python3.withPackages pydeps)
];
}
overlays/jinja2-cli.nix
+39
View File
@@ -0,0 +1,39 @@
{
lib,
buildPythonPackage,
fetchFromGitHub,
flake8,
jinja2,
pytestCheckHook,
setuptools,
}:
buildPythonPackage {
pname = "jinja2-cli";
version = "0.8.2";
src = fetchFromGitHub {
owner = "mattrobenolt";
repo = "jinja2-cli";
rev = "0.8.2";
hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0=";
};
propagatedBuildInputs = [
jinja2
setuptools
];
checkInputs = [
flake8
pytestCheckHook
];
meta = with lib; {
description = "A CLI interface for Jinja2 templates";
homepage = "https://github.com/mattrobenolt/jinja2-cli";
license = licenses.bsd2;
maintainers = [ lib.maintainers.greg ];
};
}
overlays/pyyaml-include.nix
-42
View File
@@ -1,42 +0,0 @@
{ lib, buildPythonPackage, fetchPypi, pkgs,
pyyaml,
setuptools,
setuptools-scm,
setuptools-scm-git-archive,
wheel
}:
let
pydeps = [
pyyaml
];
in buildPythonPackage rec {
pname = "pyyaml-include";
version = "1.3";
src = fetchPypi {
inherit pname version;
sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E=";
};
meta = with lib; {
description = "A PyYAML extension to allow includes.";
homepage = "https://github.com/tanbro/pyyaml-include";
license = licenses.gpl3;
maintainers = [];
};
doCheck = false;
propagatedBuildInputs = pydeps;
buildInputs = [
setuptools
setuptools-scm
setuptools-scm-git-archive
wheel
];
nativeBuildInputs = with pkgs; [
];
}
overlays/template.nix
+15
View File
@@ -0,0 +1,15 @@
{ stdenv, jinja2-cli }:
name: vars: template:
(stdenv.mkDerivation {
inherit name;
passAsFile = [ "varsData" ];
varsData = builtins.toJSON vars;
nativeBuildInputs = [ jinja2-cli ];
phases = [ "buildPhase" "installPhase" ];
buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result'';
installPhase = "cp result $out";
})