blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove all grammars and fix pkgs with new setup

Browse Source
This commit is contained in:
blake
2026-05-03 10:44:55 -05:00
parent 3c5f6cedeb
commit 4d552be249
1 changed files with 47 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixos/vaniville/configuration.nix
+47 -46
View File
@@ -1,23 +1,27 @@
{ config, lib, pkgs, stable_pkgs, unstable_pkgs, ... }: {
config,
let lib,
pkgs,
inputs,
stable_pkgs,
unstable_pkgs,
...
}: let
vpsip4 = "100.100.1.10"; vpsip4 = "100.100.1.10";
homelabipv4 = "10.10.0.10"; homelabipv4 = "10.10.0.10";
homelab = config.homelab; homelab = config.homelab;
in in {
{ imports = [
imports = ./hardware-configuration.nix
[ ../../nixos
./hardware-configuration.nix ../../../users/blake
../../nixos ../../../modules/system
../../../users/blake ../../../modules/homelab
../../../modules/system #../../../modules/holocron
../../../modules/homelab ];
#../../../modules/holocron
];
home-manager.users.blake.imports = [ home-manager.users.blake.imports = [
../../../users/blake/hosts/vaniville.nix ../../../users/blake/hosts/vaniville.nix
]; ];
system = { system = {
@@ -37,7 +41,7 @@ in
}; };
}; };
boot = { boot = {
loader = { loader = {
efi.canTouchEfiVariables = true; efi.canTouchEfiVariables = true;
grub = { grub = {
@@ -72,50 +76,50 @@ in
# the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps # the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
nat = { nat = {
enable = true; enable = true;
externalInterface = "eth0"; # your PUBLIC_IF externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = [ "tailscale0" ]; internalInterfaces = ["tailscale0"];
# maybe one day i will figure out the forward ports proper # maybe one day i will figure out the forward ports proper
forwardPorts = [ forwardPorts = [
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http # { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https # { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft # { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft # { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git # { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports # Rustdesk ports
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; } # { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; } # { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; } # { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; } # { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; } # { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; } # { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
]; ];
}; };
# what actually does the forwarding # what actually does the forwarding
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ]; allowedTCPPorts = [22 80 443 25777 7567 21115 21116 21117 21118 21119];
# tailscale will also need its UDP port open: # tailscale will also need its UDP port open:
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ]; allowedUDPPorts = [config.services.tailscale.port 25777 21116];
trustedInterfaces = [ "tailscale0" ]; trustedInterfaces = ["tailscale0"];
/* /*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
*/ */
extraCommands = '' extraCommands = ''
# Clear any previous rules if you are iterating # Clear any previous rules if you are iterating
iptables -t nat -F iptables -t nat -F
# DNAT: internet -> homelab over tailscale # DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
# SNAT: ensure replies go back through VPS tailscale IP # SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
@@ -142,7 +146,7 @@ in
reverse_proxy 127.0.0.1:7901 reverse_proxy 127.0.0.1:7901
''; '';
# below is basically just manually reverse proxying everything in the homelab # below is basically just manually reverse proxying everything in the homelab
# this is instead of forwarding all 80 & 443 traffic to have more explicit # this is instead of forwarding all 80 & 443 traffic to have more explicit
# publishing things to the open web # publishing things to the open web
"media.${homelab.public_domain}".extraConfig = '' "media.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7100 reverse_proxy 10.10.0.10:7100
@@ -163,7 +167,4 @@ in
}; };
system.stateVersion = "25.05"; # Did you read the comment? system.stateVersion = "25.05"; # Did you read the comment?
} }