diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 1641029..771f86d 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -7,11 +7,9 @@ { imports = [ # Include the results of the hardware scan. - ./dnsmasq.nix ./hardware-configuration.nix ./home-assistant.nix ./networking.nix - ./vhosts.nix ]; greg.home = true; diff --git a/hosts/genesis/dnsmasq.nix b/hosts/genesis/dnsmasq.nix deleted file mode 100644 index 8028d7c..0000000 --- a/hosts/genesis/dnsmasq.nix +++ /dev/null @@ -1,120 +0,0 @@ -{ config, pkgs, ... }: - -let - extraHosts = builtins.concatStringsSep "\n" [ - # Local hosts - "10.42.0.1 switch" - "10.42.1.1 pve1.thehellings.lan" - "10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan" - "10.42.1.3 printer" - "10.42.1.4 chronicles nas" - "10.42.1.5 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" - "10.42.1.12 tv" - - # Tailscale hosts - "100.90.74.19 jude.shire-zebra.ts.net" - "100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net" - "100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net" - "100.115.57.8 linode.shire-zebra.ts.net" - - # Dev hosts - "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" - ]; - - extraConfig = builtins.concatStringsSep "\n" [ - ]; - - lanDevice = "enp0s18"; - - adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); -in -{ - # Enable the service with its own configuration - services.dnsmasq = { - enable = true; - settings = { - domain = "thehellings.lan"; - dhcp-range = [ - # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static" - "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h" - "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h" - "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h" - ]; - dhcp-option = [ - "${lanDevice},option:router,10.42.1.1" - "${lanDevice},option:dns-server,10.42.1.1,1.1.1.1" - "${lanDevice},option:domain-search,thehellings.lan,shire-zebra.ts.net" - - "vlan66@${lanDevice},option:router,192.168.66.1" - "vlan66@${lanDevice},option:dns-server,192.168.66.1" - - "vlan67@${lanDevice},option:router,192.168.67.1" - "vlan67@${lanDevice},option:dns-server,192.168.67.1" - ]; - dhcp-host = [ - # Static IPs for personal work - "00:00:de:ad:be:ef,10.42.2.254" - - # Static IPs for things in the IOT range - "98:da:c4:77:7f:4d,192.168.66.102" - "28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch - "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome - "28:87:ba:0e:c9:fd,192.168.66.75" - "4c:a1:61:05:cd:52,192.168.66.61" - "8c:85:80:1c:f9:d1,192.168.66.104" - "48:d6:d5:5d:81:21,192.168.66.65" # Google Home - "ac:84:c6:5e:4b:28,192.168.66.100" - "d8:0d:17:19:60:62,192.168.66.112" - "0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch - "0c:80:63:41:74:73,192.168.66.106" - "0c:80:63:41:6e:0f,192.168.66.90" - "98:da:c4:20:f3:64,192.168.66.6" - "98:da:c4:21:1b:2e,192.168.66.85" - "98:da:c4:20:ea:db,192.168.66.107" # HS220 switch - "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba - "98:da:c4:77:80:18,192.168.66.84" - "98:da:c4:77:82:7b,192.168.66.105" - "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini - "b4:b0:24:9a:14:0e,192.168.66.131" - "6c:29:90:3e:e2:02,192.168.66.66" # wiz - "54:af:97:83:ed:33,192.168.66.80" - "54:af:97:c2:0f:a1,192.168.66.76" - "b4:b0:24:9a:12:53,192.168.66.130" # KL125 - "92:3e:11:c7:c5:be,192.168.66.109" - "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 - ]; - expand-hosts = true; - log-dhcp = true; - log-queries = true; - addn-hosts = "/etc/adblock_hosts"; - # Public AdGuard DNS servers - server = [ - "9.9.9.9" # Quad 9 - "1.1.1.1" # Cloudflare - "1.0.0.1" # Cloudflare - "149.112.112.112" # Quad 9 - ]; - }; - extraConfig = "${extraConfig}"; - }; - environment.systemPackages = with pkgs; [ - curl - ]; - - # Regularly update DNS block list - services.cron = { - enable = true; - systemCronJobs = [ - "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" - ]; - }; - - # Allow traffic through - networking.firewall = { - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 67 ]; - }; - - # Custom host addition - networking.extraHosts = "${extraHosts}"; -} diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index 17ef737..e58acb2 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -75,17 +75,14 @@ in greg.proxies = { - "smart.thehellings.lan".target = "http://127.0.0.1:8123"; - "genesis.shire-zebra.ts.net" = { - target = "http://127.0.0.1:8123"; - path = "/smart/"; - }; + "smart.home".target = "http://127.0.0.1:8123/"; + "zwave.home".target = "http://127.0.0.1:8091/"; }; # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect # directly for troubleshooting Nginx configuration networking.firewall = { - allowedTCPPorts = [ 80 443 8091 8123 ]; + allowedTCPPorts = [ 80 443 ]; }; greg.backup.jobs.zwave = { diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index a56ebf0..6c22f6d 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -1,7 +1,45 @@ { pkgs, config, ... }: let lan = "ens18"; + lanIP = "10.42.1.5"; iot = "ens19"; + iotIP = "192.168.66.250"; + routerIP = "10.42.1.2"; + extraHosts = builtins.concatStringsSep "\n" [ + # Local hosts + "10.42.0.1 switch" + "10.42.1.1 pve1.thehellings.lan" + "10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan" + "10.42.1.3 printer" + "10.42.1.4 chronicles nas" + "10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.12 tv" + + # Tailscale hosts + "100.90.74.19 jude.shire-zebra.ts.net" + "100.88.91.27 dns.shire-zebra.ts.net" + "100.119.228.115 chronicles.shire-zebra.ts.net" + "100.115.57.8 linode.shire-zebra.ts.net" + "100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home" + "100.78.16.88 mm.shire-zebra.ts.net" + + # Dev hosts + "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" + ]; + + extraConfig = builtins.concatStringsSep "\n" [ + ]; + + adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); + proxyPort = 3128; + dnsPort = 53; + dhcpPort = 67; + dnsServers = [ + "9.9.9.9" # Quad 9 + "1.1.1.1" # Cloudflare + "1.0.0.1" # Cloudflare + "149.112.112.112" # Quad 9 + ]; in { greg.tailscale.enable = true; @@ -15,18 +53,14 @@ in { networking = { enableIPv6 = false; networkmanager.enable = pkgs.lib.mkForce false; - defaultGateway = "10.42.1.1"; - nameservers = [ - "1.1.1.1" - "1.0.0.1" - "127.0.0.1" - ]; + defaultGateway = routerIP; + nameservers = dnsServers; interfaces = { # This is our LAN port "${lan}" = { useDHCP = false; ipv4.addresses = [ { - address = "10.42.1.5"; + address = "${lanIP}"; prefixLength = 16; } ]; }; @@ -34,12 +68,26 @@ in { "${iot}" = { useDHCP = false; ipv4.addresses = [ { - address = "192.168.66.250"; + address = "${iotIP}"; prefixLength = 24; } ]; }; }; - firewall.enable = true; + firewall = { + enable = true; + allowedUDPPorts = [ + dhcpPort + dnsPort + 1900 # Jellyfin auto-discovery + 7359 # Jellyfin auto-discovery + ]; + allowedTCPPorts = [ + dnsPort + proxyPort + ]; + }; + nftables.enable = true; + extraHosts = "${extraHosts}"; }; @@ -49,41 +97,114 @@ in { options = [ "ro" ]; }; - services.jellyfin = { - enable = true; - openFirewall = true; - }; - # Used for service auto-disocvery - networking.firewall.allowedUDPPorts = [ 1900 7359 ]; + services = { + # Video services + jellyfin = { + enable = true; + openFirewall = true; + }; + + ######### + # Blind service proxy behind the walls of the VPN + ######## + _3proxy = { + enable = true; + services = [ { + type = "socks"; + auth = [ "strong" ]; + bindPort = proxyPort; + acl = [ { + rule = "allow"; + users = [ "greg" ]; + } ]; + } ]; + #usersFile = "/run/agenix/3proxy"; + denyPrivate = false; + }; + + ######### + # dnsmasq config + ######## + dnsmasq = { + enable = true; + settings = { + domain = "thehellings.lan"; + dhcp-range = [ + "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h" + "vlan67@${lan},192.168.67.3,192.168.67.150,12h" + ]; + dhcp-option = [ + "${lan},option:router,${routerIP}" + "${lan},option:dns-server,${lanIP},1.1.1.1" + "${lan},option:domain-search,thehellings.lan" + + "${iot},option:router,192.168.66.1" + "${iot},option:dns-server,${iotIP}" + + "vlan67@${lan},option:router,192.168.67.1" + "vlan67@${lan},option:dns-server,192.168.67.1" + ]; + dhcp-host = [ + # Static IPs for personal work + "00:00:de:ad:be:ef,10.42.2.254" + + # Static IPs for things in the IOT range + "98:da:c4:77:7f:4d,192.168.66.102" + "28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch + "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome + "28:87:ba:0e:c9:fd,192.168.66.75" + "4c:a1:61:05:cd:52,192.168.66.61" + "8c:85:80:1c:f9:d1,192.168.66.104" + "48:d6:d5:5d:81:21,192.168.66.65" # Google Home + "ac:84:c6:5e:4b:28,192.168.66.100" + "d8:0d:17:19:60:62,192.168.66.112" + "0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch + "0c:80:63:41:74:73,192.168.66.106" + "0c:80:63:41:6e:0f,192.168.66.90" + "98:da:c4:20:f3:64,192.168.66.6" + "98:da:c4:21:1b:2e,192.168.66.85" + "98:da:c4:20:ea:db,192.168.66.107" # HS220 switch + "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba + "98:da:c4:77:80:18,192.168.66.84" + "98:da:c4:77:82:7b,192.168.66.105" + "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini + "b4:b0:24:9a:14:0e,192.168.66.131" + "6c:29:90:3e:e2:02,192.168.66.66" # wiz + "54:af:97:83:ed:33,192.168.66.80" + "54:af:97:c2:0f:a1,192.168.66.76" + "b4:b0:24:9a:12:53,192.168.66.130" # KL125 + "92:3e:11:c7:c5:be,192.168.66.109" + "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 + ]; + expand-hosts = true; + log-dhcp = true; + log-queries = true; + addn-hosts = "/etc/adblock_hosts"; + server = dnsServers; + }; + extraConfig = "${extraConfig}"; + }; + + # Update adblock list + cron = { + enable = true; + systemCronJobs = [ + "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" + ]; + }; + }; # End of services configuration greg.proxies = { - "jellyfin.thehellings.lan".target = "http://localhost:8096"; - "jellyfin.shire-zebra.ts.net" = { - target = "http://localhost:8096"; - genAliases = false; - }; + "jellyfin.home".target = "http://localhost:8096/"; }; - ######### - # Blind service proxy behind the walls of the VPN - ######## - services._3proxy = { - enable = true; - services = [ { - type = "socks"; - auth = [ "strong" ]; - bindPort = 3128; - acl = [ { - rule = "allow"; - users = [ "greg" ]; - } ]; - } ]; - #usersFile = "/run/agenix/3proxy"; - denyPrivate = false; - }; #age.secrets."3proxy" = { # file = ../../secrets/3proxy.age; # mode = "776"; #}; - networking.firewall.allowedTCPPorts = [ 3128 ]; + + environment.systemPackages = with pkgs; [ + curl # Used by dnsmasq fetching + ]; } diff --git a/hosts/genesis/vhosts.nix b/hosts/genesis/vhosts.nix deleted file mode 100644 index e899089..0000000 --- a/hosts/genesis/vhosts.nix +++ /dev/null @@ -1,10 +0,0 @@ -# Virtual hosts that don't seem to have any better place to live should go in here. -# There are others that are specific to their own purposese scattered about in the -# configuration in places where they more naturally live. This is more of a catchall -# for ones that do not have a better place to live -{ ... }: - -{ - # The module doesn't handle this - services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ]; -}