blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove all grammars and fix pkgs with new setup

Browse Source
This commit is contained in:
blake
2026-05-03 10:44:55 -05:00
parent 3c5f6cedeb
commit 4d552be249
1 changed files with 47 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixos/vaniville/configuration.nix
+47 -46
View File
@@ -1,23 +1,27 @@
{ config, lib, pkgs, stable_pkgs, unstable_pkgs, ... }:
let
{
config,
lib,
pkgs,
inputs,
stable_pkgs,
unstable_pkgs,
...
}: let
vpsip4 = "100.100.1.10";
homelabipv4 = "10.10.0.10";
homelab = config.homelab;
in
{
imports =
[
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/homelab
#../../../modules/holocron
];
in {
imports = [
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/homelab
#../../../modules/holocron
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/vaniville.nix
../../../users/blake/hosts/vaniville.nix
];
system = {
@@ -37,7 +41,7 @@ in
};
};
boot = {
boot = {
loader = {
efi.canTouchEfiVariables = true;
grub = {
@@ -72,50 +76,50 @@ in
# the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
nat = {
enable = true;
externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = [ "tailscale0" ];
externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = ["tailscale0"];
# maybe one day i will figure out the forward ports proper
forwardPorts = [
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
];
};
# what actually does the forwarding
firewall = {
enable = true;
allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
allowedTCPPorts = [22 80 443 25777 7567 21115 21116 21117 21118 21119];
# tailscale will also need its UDP port open:
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
trustedInterfaces = [ "tailscale0" ];
/*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
allowedUDPPorts = [config.services.tailscale.port 25777 21116];
trustedInterfaces = ["tailscale0"];
/*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
*/
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
*/
extraCommands = ''
# Clear any previous rules if you are iterating
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
@@ -142,7 +146,7 @@ in
reverse_proxy 127.0.0.1:7901
'';
# below is basically just manually reverse proxying everything in the homelab
# this is instead of forwarding all 80 & 443 traffic to have more explicit
# this is instead of forwarding all 80 & 443 traffic to have more explicit
# publishing things to the open web
"media.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7100
@@ -163,7 +167,4 @@ in
};
system.stateVersion = "25.05"; # Did you read the comment?
}