root
df2f9d69fe
buildbot/nix-eval Build done. (1 warning)
- Replace unpoller-credentials plain Secret with ExternalSecret pulling from Bitwarden item 15bfc957-5de5-49b2-ab6c-b41800e71564 via bitwarden-login ClusterSecretStore (username + password) - Pull UP_UNIFI_DEFAULT_USER from secret as well (was hardcoded) - Add OpenWRT access point (10.42.0.3) to genesis DNS hosts file as ap.thehellings.lan (discovered during network scan) - Add blackbox exporter to genesis (port 9115, ICMP module) for probing non-NixOS infrastructure that has no node_exporter: OpenWRT AP, Joel, pve1, chronicles, nas1, odoo, mattermost, homeassistant, USW-Pro-HD-24 UniFi switch - Add infra_ping scrape job to Prometheus using blackbox prober targeting all non-NixOS LAN hosts via genesis blackbox exporter
136 lines
2.7 KiB
Nix
136 lines
2.7 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
metadata,
|
|
...
|
|
}:
|
|
let
|
|
lan = "enp1s0";
|
|
lanIP = metadata.hosts.${config.networking.hostName}.ip;
|
|
iot = "enp2s0";
|
|
iotIP = "192.168.66.250";
|
|
routerIP = metadata.infra.gw;
|
|
extraHosts = builtins.readFile ./net/hosts;
|
|
|
|
proxyPort = 3128;
|
|
dnsPort = 53;
|
|
dhcpPort = 67;
|
|
dnsServers = [
|
|
#"9.9.9.9" # Quad 9
|
|
#"1.1.1.1" # Cloudflare
|
|
#"1.0.0.1" # Cloudflare
|
|
#"149.112.112.112" # Quad 9
|
|
metadata.infra.gw # Currently using our UniFi router for DNS as well
|
|
];
|
|
in
|
|
{
|
|
greg.tailscale = {
|
|
enable = true;
|
|
tags = [ "home" ];
|
|
};
|
|
|
|
# Really, why do I still have to force-disable this crap?
|
|
boot.kernel.sysctl = {
|
|
"net.ipv6.conf.${lan}.disable_ipv6" = true;
|
|
"net.ipv6.conf.${iot}.disable_ipv6" = true;
|
|
"net.ipv6.conf.lo.disable_ipv6" = true;
|
|
};
|
|
|
|
networking = {
|
|
defaultGateway = metadata.infra.gw;
|
|
enableIPv6 = false;
|
|
networkmanager.enable = pkgs.lib.mkForce false;
|
|
nameservers = dnsServers;
|
|
interfaces = {
|
|
# This is our LAN port
|
|
"${lan}" = {
|
|
useDHCP = false;
|
|
ipv4.addresses = [
|
|
{
|
|
address = "${lanIP}";
|
|
prefixLength = 16;
|
|
}
|
|
];
|
|
};
|
|
|
|
"${iot}" = {
|
|
useDHCP = false;
|
|
ipv4.addresses = [
|
|
{
|
|
address = "${iotIP}";
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
firewall = {
|
|
enable = false;
|
|
allowedUDPPorts = [
|
|
dhcpPort
|
|
dnsPort
|
|
];
|
|
allowedTCPPorts = [
|
|
dnsPort
|
|
proxyPort
|
|
80
|
|
];
|
|
};
|
|
nftables.enable = false;
|
|
};
|
|
|
|
environment.etc."hosts.d/local".text = extraHosts;
|
|
|
|
services = {
|
|
kea = {
|
|
dhcp4 = (
|
|
import ./networking/dhcp.nix {
|
|
inherit
|
|
iot
|
|
lan
|
|
lanIP
|
|
routerIP
|
|
;
|
|
}
|
|
);
|
|
};
|
|
|
|
#########
|
|
# dnsmasq config
|
|
########
|
|
dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
domain = "thehellings.lan";
|
|
expand-hosts = true;
|
|
log-queries = true;
|
|
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
|
addn-hosts = "/etc/adblock_hosts";
|
|
hostsdir = "/etc/hosts.d/";
|
|
server = dnsServers;
|
|
};
|
|
};
|
|
|
|
prometheus.exporters = {
|
|
dnsmasq.enable = true;
|
|
blackbox = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
configFile = pkgs.writeText "blackbox.yml" ''
|
|
modules:
|
|
icmp:
|
|
prober: icmp
|
|
timeout: 5s
|
|
icmp:
|
|
preferred_ip_protocol: ip4
|
|
'';
|
|
};
|
|
};
|
|
}; # End of services configuration
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
bind
|
|
curl # Used by dnsmasq fetching
|
|
sqlite
|
|
];
|
|
}
|