greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Finalize Genesis virt update

Browse Source
This commit is contained in:
Greg Hellings
2023-09-05 11:06:35 -05:00
parent 3a67a39f6d
commit ededad0fa9
5 changed files with 162 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/genesis/default.nix
-2
View File
@@ -7,11 +7,9 @@
{
imports = [
# Include the results of the hardware scan.
./dnsmasq.nix
./hardware-configuration.nix
./home-assistant.nix
./networking.nix
./vhosts.nix
];
greg.home = true;
hosts/genesis/dnsmasq.nix
-120
View File
@@ -1,120 +0,0 @@
{ config, pkgs, ... }:
let
extraHosts = builtins.concatStringsSep "\n" [
# Local hosts
"10.42.0.1 switch"
"10.42.1.1 pve1.thehellings.lan"
"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
"10.42.1.3 printer"
"10.42.1.4 chronicles nas"
"10.42.1.5 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.12 tv"
# Tailscale hosts
"100.90.74.19 jude.shire-zebra.ts.net"
"100.99.244.92 dns.shire-zebra.ts.net 2maccabees.shire-zebra.ts.net smart.shire-zebra.ts.net jellyfin.shire-zebra.ts.net"
"100.119.228.115 chronicles.shire-zebra.ts.net nas.shire-zebra.ts.net"
"100.115.57.8 linode.shire-zebra.ts.net"
# Dev hosts
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
];
extraConfig = builtins.concatStringsSep "\n" [
];
lanDevice = "enp0s18";
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
in
{
# Enable the service with its own configuration
services.dnsmasq = {
enable = true;
settings = {
domain = "thehellings.lan";
dhcp-range = [
# "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static"
"${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h"
"vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h"
"vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h"
];
dhcp-option = [
"${lanDevice},option:router,10.42.1.1"
"${lanDevice},option:dns-server,10.42.1.1,1.1.1.1"
"${lanDevice},option:domain-search,thehellings.lan,shire-zebra.ts.net"
"vlan66@${lanDevice},option:router,192.168.66.1"
"vlan66@${lanDevice},option:dns-server,192.168.66.1"
"vlan67@${lanDevice},option:router,192.168.67.1"
"vlan67@${lanDevice},option:dns-server,192.168.67.1"
];
dhcp-host = [
# Static IPs for personal work
"00:00:de:ad:be:ef,10.42.2.254"
# Static IPs for things in the IOT range
"98:da:c4:77:7f:4d,192.168.66.102"
"28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
"28:87:ba:0e:c9:fd,192.168.66.75"
"4c:a1:61:05:cd:52,192.168.66.61"
"8c:85:80:1c:f9:d1,192.168.66.104"
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"ac:84:c6:5e:4b:28,192.168.66.100"
"d8:0d:17:19:60:62,192.168.66.112"
"0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch
"0c:80:63:41:74:73,192.168.66.106"
"0c:80:63:41:6e:0f,192.168.66.90"
"98:da:c4:20:f3:64,192.168.66.6"
"98:da:c4:21:1b:2e,192.168.66.85"
"98:da:c4:20:ea:db,192.168.66.107" # HS220 switch
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
"98:da:c4:77:80:18,192.168.66.84"
"98:da:c4:77:82:7b,192.168.66.105"
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
"b4:b0:24:9a:14:0e,192.168.66.131"
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"54:af:97:83:ed:33,192.168.66.80"
"54:af:97:c2:0f:a1,192.168.66.76"
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
"92:3e:11:c7:c5:be,192.168.66.109"
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
addn-hosts = "/etc/adblock_hosts";
# Public AdGuard DNS servers
server = [
"9.9.9.9" # Quad 9
"1.1.1.1" # Cloudflare
"1.0.0.1" # Cloudflare
"149.112.112.112" # Quad 9
];
};
extraConfig = "${extraConfig}";
};
environment.systemPackages = with pkgs; [
curl
];
# Regularly update DNS block list
services.cron = {
enable = true;
systemCronJobs = [
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
];
};
# Allow traffic through
networking.firewall = {
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 67 ];
};
# Custom host addition
networking.extraHosts = "${extraHosts}";
}
hosts/genesis/home-assistant.nix
+3 -6
View File
@@ -75,17 +75,14 @@ in
greg.proxies = {
"smart.thehellings.lan".target = "http://127.0.0.1:8123";
"genesis.shire-zebra.ts.net" = {
target = "http://127.0.0.1:8123";
path = "/smart/";
};
"smart.home".target = "http://127.0.0.1:8123/";
"zwave.home".target = "http://127.0.0.1:8091/";
};
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
# directly for troubleshooting Nginx configuration
networking.firewall = {
allowedTCPPorts = [ 80 443 8091 8123 ];
allowedTCPPorts = [ 80 443 ];
};
greg.backup.jobs.zwave = {
hosts/genesis/networking.nix
+159 -38
View File
@@ -1,7 +1,45 @@
{ pkgs, config, ... }:
let
lan = "ens18";
lanIP = "10.42.1.5";
iot = "ens19";
iotIP = "192.168.66.250";
routerIP = "10.42.1.2";
extraHosts = builtins.concatStringsSep "\n" [
# Local hosts
"10.42.0.1 switch"
"10.42.1.1 pve1.thehellings.lan"
"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
"10.42.1.3 printer"
"10.42.1.4 chronicles nas"
"10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.12 tv"
# Tailscale hosts
"100.90.74.19 jude.shire-zebra.ts.net"
"100.88.91.27 dns.shire-zebra.ts.net"
"100.119.228.115 chronicles.shire-zebra.ts.net"
"100.115.57.8 linode.shire-zebra.ts.net"
"100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home"
"100.78.16.88 mm.shire-zebra.ts.net"
# Dev hosts
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
];
extraConfig = builtins.concatStringsSep "\n" [
];
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
proxyPort = 3128;
dnsPort = 53;
dhcpPort = 67;
dnsServers = [
"9.9.9.9" # Quad 9
"1.1.1.1" # Cloudflare
"1.0.0.1" # Cloudflare
"149.112.112.112" # Quad 9
];
in {
greg.tailscale.enable = true;
@@ -15,18 +53,14 @@ in {
networking = {
enableIPv6 = false;
networkmanager.enable = pkgs.lib.mkForce false;
defaultGateway = "10.42.1.1";
nameservers = [
"1.1.1.1"
"1.0.0.1"
"127.0.0.1"
];
defaultGateway = routerIP;
nameservers = dnsServers;
interfaces = {
# This is our LAN port
"${lan}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "10.42.1.5";
address = "${lanIP}";
prefixLength = 16;
} ];
};
@@ -34,12 +68,26 @@ in {
"${iot}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "192.168.66.250";
address = "${iotIP}";
prefixLength = 24;
} ];
};
};
firewall.enable = true;
firewall = {
enable = true;
allowedUDPPorts = [
dhcpPort
dnsPort
1900 # Jellyfin auto-discovery
7359 # Jellyfin auto-discovery
];
allowedTCPPorts = [
dnsPort
proxyPort
];
};
nftables.enable = true;
extraHosts = "${extraHosts}";
};
@@ -49,41 +97,114 @@ in {
options = [ "ro" ];
};
services.jellyfin = {
enable = true;
openFirewall = true;
};
# Used for service auto-disocvery
networking.firewall.allowedUDPPorts = [ 1900 7359 ];
services = {
# Video services
jellyfin = {
enable = true;
openFirewall = true;
};
#########
# Blind service proxy behind the walls of the VPN
########
_3proxy = {
enable = true;
services = [ {
type = "socks";
auth = [ "strong" ];
bindPort = proxyPort;
acl = [ {
rule = "allow";
users = [ "greg" ];
} ];
} ];
#usersFile = "/run/agenix/3proxy";
denyPrivate = false;
};
#########
# dnsmasq config
########
dnsmasq = {
enable = true;
settings = {
domain = "thehellings.lan";
dhcp-range = [
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
];
dhcp-option = [
"${lan},option:router,${routerIP}"
"${lan},option:dns-server,${lanIP},1.1.1.1"
"${lan},option:domain-search,thehellings.lan"
"${iot},option:router,192.168.66.1"
"${iot},option:dns-server,${iotIP}"
"vlan67@${lan},option:router,192.168.67.1"
"vlan67@${lan},option:dns-server,192.168.67.1"
];
dhcp-host = [
# Static IPs for personal work
"00:00:de:ad:be:ef,10.42.2.254"
# Static IPs for things in the IOT range
"98:da:c4:77:7f:4d,192.168.66.102"
"28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
"28:87:ba:0e:c9:fd,192.168.66.75"
"4c:a1:61:05:cd:52,192.168.66.61"
"8c:85:80:1c:f9:d1,192.168.66.104"
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"ac:84:c6:5e:4b:28,192.168.66.100"
"d8:0d:17:19:60:62,192.168.66.112"
"0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch
"0c:80:63:41:74:73,192.168.66.106"
"0c:80:63:41:6e:0f,192.168.66.90"
"98:da:c4:20:f3:64,192.168.66.6"
"98:da:c4:21:1b:2e,192.168.66.85"
"98:da:c4:20:ea:db,192.168.66.107" # HS220 switch
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
"98:da:c4:77:80:18,192.168.66.84"
"98:da:c4:77:82:7b,192.168.66.105"
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
"b4:b0:24:9a:14:0e,192.168.66.131"
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"54:af:97:83:ed:33,192.168.66.80"
"54:af:97:c2:0f:a1,192.168.66.76"
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
"92:3e:11:c7:c5:be,192.168.66.109"
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
addn-hosts = "/etc/adblock_hosts";
server = dnsServers;
};
extraConfig = "${extraConfig}";
};
# Update adblock list
cron = {
enable = true;
systemCronJobs = [
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
];
};
}; # End of services configuration
greg.proxies = {
"jellyfin.thehellings.lan".target = "http://localhost:8096";
"jellyfin.shire-zebra.ts.net" = {
target = "http://localhost:8096";
genAliases = false;
};
"jellyfin.home".target = "http://localhost:8096/";
};
#########
# Blind service proxy behind the walls of the VPN
########
services._3proxy = {
enable = true;
services = [ {
type = "socks";
auth = [ "strong" ];
bindPort = 3128;
acl = [ {
rule = "allow";
users = [ "greg" ];
} ];
} ];
#usersFile = "/run/agenix/3proxy";
denyPrivate = false;
};
#age.secrets."3proxy" = {
# file = ../../secrets/3proxy.age;
# mode = "776";
#};
networking.firewall.allowedTCPPorts = [ 3128 ];
environment.systemPackages = with pkgs; [
curl # Used by dnsmasq fetching
];
}
hosts/genesis/vhosts.nix
-10
View File
@@ -1,10 +0,0 @@
# Virtual hosts that don't seem to have any better place to live should go in here.
# There are others that are specific to their own purposese scattered about in the
# configuration in places where they more naturally live. This is more of a catchall
# for ones that do not have a better place to live
{ ... }:
{
# The module doesn't handle this
services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ];
}