greg/nixos
1
0
Fork 2
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: no default routes

Browse Source
This commit is contained in:
Greg Hellings
2026-04-02 08:11:32 -05:00
parent a1bef073cf
commit 88d9234332
1 changed files with 29 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nixos/nebula.nix
+29 -34
View File
@@ -52,7 +52,8 @@ in
let let
hostData = metadata.hosts.${config.networking.hostName} or { }; hostData = metadata.hosts.${config.networking.hostName} or { };
in in
hostData.nebulaIp or (throw "greg.nebula.nebulaIp must be set for host ${config.networking.hostName}"); hostData.nebulaIp
or (throw "greg.nebula.nebulaIp must be set for host ${config.networking.hostName}");
}; };
lighthouseAddr = lib.mkOption { lighthouseAddr = lib.mkOption {
@@ -96,12 +97,7 @@ in
); );
# Default: route the home LAN through genesis (the home router node). # Default: route the home LAN through genesis (the home router node).
# Hosts that ARE genesis (or any other routing node) should override this to []. # Hosts that ARE genesis (or any other routing node) should override this to [].
default = [ default = [ ];
{
route = "10.42.0.0/16";
via = "10.157.0.2"; # genesis's Nebula IP
}
];
description = '' description = ''
List of unsafe_routes to configure on this host (for reaching non-Nebula subnets). List of unsafe_routes to configure on this host (for reaching non-Nebula subnets).
Defaults to routing the home LAN (10.42.0.0/16) through genesis (10.157.0.2). Defaults to routing the home LAN (10.42.0.0/16) through genesis (10.157.0.2).
@@ -126,7 +122,7 @@ in
# agenix: decrypt this host's Nebula private key at boot # agenix: decrypt this host's Nebula private key at boot
age.secrets."nebula-${config.networking.hostName}-key" = { age.secrets."nebula-${config.networking.hostName}-key" = {
file = ../../secrets/nebula/${config.networking.hostName}.key.age; file = ../../secrets/nebula/${config.networking.hostName}.key.age;
# nebula service runs as root, key owned by root is fine owner = config.systemd.services."nebula@${nebulaDomain}".serviceConfig.User;
mode = "0400"; mode = "0400";
}; };
@@ -165,7 +161,7 @@ in
device = "nebula0"; device = "nebula0";
}; };
settings.tun.unsafe_routes = map (r: { route = r.route; via = r.via; }) cfg.unsafeRoutes; settings.tun.unsafe_routes = cfg.unsafeRoutes;
# Firewall: permissive defaults — tighten per-host as desired # Firewall: permissive defaults — tighten per-host as desired
firewall = { firewall = {
@@ -176,31 +172,30 @@ in
host = "any"; host = "any";
} }
]; ];
inbound = inbound = [
[ # Allow ICMP (ping) from any Nebula peer
# Allow ICMP (ping) from any Nebula peer {
{ port = "any";
port = "any"; proto = "icmp";
proto = "icmp"; host = "any";
host = "any"; }
} # Allow all traffic from within the Nebula overlay
# Allow all traffic from within the Nebula overlay {
{ port = "any";
port = "any"; proto = "any";
proto = "any"; host = "any";
host = "any"; }
} ]
] # When routing an unsafe subnet, allow inbound traffic destined
# When routing an unsafe subnet, allow inbound traffic destined # for that subnet from any Nebula peer (local_cidr scopes it)
# for that subnet from any Nebula peer (local_cidr scopes it) ++ lib.optionals (cfg.routesSubnet != null) [
++ lib.optionals (cfg.routesSubnet != null) [ {
{ port = "any";
port = "any"; proto = "any";
proto = "any"; host = "any";
host = "any"; local_cidr = cfg.routesSubnet;
local_cidr = cfg.routesSubnet; }
} ];
];
}; };
}; };