Get Genesis buttoned up

Stop building Gnome stuff for it
Fix up DHCP responses to the new topology
Make Home Assistant Work Again
Complete changeover

home/home.nix

@@ -36,6 +36,7 @@
 	home.stateVersion = "23.05";
 	home.packages = with pkgs; [
 		bitwarden-cli
+		busybox
 		copier
 		diffutils
 		findutils

home/hosts/genesis/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+
+}

hosts/default.nix

@@ -41,11 +41,7 @@ in {
 		system = "aarch64-linux";
 		name = "2maccabees";
 	};
-	genesis = unstable {
+	genesis = unstable { name = "genesis"; };
-		name = "genesis";
-		gnome = true;
-		gui = true;
-	};
 	jude = unstable {
 		name = "jude";
 		gnome = true;

hosts/genesis/dnsmasq.nix

@@ -33,20 +33,20 @@ in
 			domain = "thehellings.lan";
 			dhcp-range = [
 		#		"${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static"
-				"${lanDevice},10.43.2.1,10.43.2.255,255.255.0.0,12h"
+				"${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h"
 				"vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h"
 				"vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h"
 			];
 			dhcp-option = [
-				"${lanDevice},option:router,10.43.1.1"
+				"${lanDevice},option:router,10.42.1.1"
-				"${lanDevice},option:dns-server,10.43.1.2,1.1.1.1"
+				"${lanDevice},option:dns-server,10.42.1.1,1.1.1.1"
-				"${lanDevice},option:domain-search,thehellings.lan"
+				"${lanDevice},option:domain-search,thehellings.lan,shire-zebra.ts.net"
 
 				"vlan66@${lanDevice},option:router,192.168.66.1"
-				"vlan66@${lanDevice},option:dns-server,192.168.66.2"
+				"vlan66@${lanDevice},option:dns-server,192.168.66.1"
 
 				"vlan67@${lanDevice},option:router,192.168.67.1"
-				"vlan67@${lanDevice},option:dns-server,192.168.67.2"
+				"vlan67@${lanDevice},option:dns-server,192.168.67.1"
 			];
 			dhcp-host = [
 				# Static IPs for things in the IOT range

hosts/genesis/home-assistant.nix

@@ -29,8 +29,6 @@ in
 
 		config = {
 			default_config = {};
-			esphome = {};  # Get these things loaded, even if not configured
-			met = {};
 			tts = [ { platform = "google_translate"; } ];
 			http = {
 				use_x_forwarded_for = true;
@@ -38,9 +36,9 @@ in
 				server_host = "127.0.0.1";
 			};
 			#"automation manual" = *nix config here* and so on
-			"automation ui" = "!include automations.yaml";
+			"automation ui" = "";
-			"script ui" = "!include scripts.yaml";
+			"script ui" = "";
-			"scene ui" = "!include scenes.yaml";
+			"scene ui" = "";
 		};
 	};
 
@@ -73,7 +71,13 @@ in
 	};
 
 
-	greg.proxies."smart.thehellings.lan".target = "http://127.0.0.1:8123";
+	greg.proxies = {
+		"smart.thehellings.lan".target = "http://127.0.0.1:8123";
+		"genesis.shire-zebra.ts.net" = {
+			target = "http://127.0.0.1:8123";
+			path = "/smart/";
+		};
+	};
 
 	# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
 	# directly for troubleshooting Nginx configuration

hosts/genesis/networking.nix

@@ -43,7 +43,7 @@ in {
 			"${iot}" = {
 				useDHCP = false;
 				ipv4.addresses = [ {
-					address = "192.168.66.2";
+					address = "192.168.66.1";
 					prefixLength = 24;
 				} ];
 			};
@@ -86,7 +86,10 @@ in {
 
 	greg.proxies = {
 		"jellyfin.thehellings.lan".target = "http://localhost:8096";
-		"jellyfin.me.ts".target = "http://localhost:8096";
+		"jellyfin.shire-zebra.ts.net" = {
+			target = "http://localhost:8096";
+			genAliases = false;
+		};
 	};
 
 	#########

hosts/genesis/nftables.nft

@@ -1,6 +1,15 @@
 #!/usr/bin/env nft -f
 
 table ip filter {
+	define FRIENDS = { {{ '\"' + ( lanInterfaces | join('\", \"') ) + '\"' }} , "tailscale0" }
+	define SUS = { {{ limitedLan | join(", ") }} }
+	define LAN = { $FRIENDS, $SUS }
+
+	counter tcp_dns {}
+	counter udp_dns {}
+	counter catchall {}
+	counter sus {}
+
 	chain output {
 		type filter hook output priority 100; policy accept;
 	}
@@ -9,24 +18,28 @@ table ip filter {
 		type filter hook input priority 0; policy drop;
 
 		iifname lo accept
+		iifname $SUS counter name sus
 
+		# Router needs to yield up DNS and DHCP for itself, in my case
+		iifname $LAN tcp dport { 53, 67 } counter name tcp_dns accept
+		iifname $LAN udp dport { 53, 67 } counter name udp_dns accept
 		# Open the specific ports that we allow
 		{% for port in tcpPorts %}
-		iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept
+		iifname $FRIENDS tcp dport {{ port }} accept
 		{% endfor %}
 		{% for port in udpPorts %}
-		iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept
+		iifname $FRIENDS udp dport {{ port }} accept
 		{% endfor %}
 
-		iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing"
+		iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing"
-		iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections"
+		iifname {{ wanInterface }} ct state { established, related } accept comment "Allows existing connections"
-		iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
+		iifname {{ wanInterface }} icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
-		iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much"
+		iifname {{ wanInterface }} counter drop comment "Drop other incoming traffic, and count how much"
 	}
 	chain forward {
 		type filter hook forward priority 0; policy drop;
-		iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN"
+		iifname $LAN oifname {{ wanInterface }} accept comment "Forward LAN to WAN"
-		iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic"
+		iifname {{ wanInterface }} oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
 	}
 }