Compare commits
8
Commits
105550e5f1
...
bd8c18b76b
| Author | SHA1 | Date | |
|---|---|---|---|
 blake
|
bd8c18b76b | ||
|
blake
|
c02b5a997a | ||
|
blake
|
4ef203bcc4 | ||
|
blake
|
c908cb3d00 | ||
|
blake
|
d7362dee01 | ||
|
blake
|
028c06cad3 | ||
|
blake
|
c1dce7bab1 | ||
|
blake
|
e225cde934 |
@@ -42,9 +42,31 @@
|
||||
|
||||
homelab = {
|
||||
enable = true;
|
||||
base_domain = "lumiose.lan";
|
||||
base_domain = "lumiose.blakedheld.xyz";
|
||||
host_ip = "10.10.0.11";
|
||||
gitea.enable = true;
|
||||
glance.enable = true;
|
||||
immich.enable = true;
|
||||
vaultwarden.enable = true;
|
||||
#searx.enable = true;
|
||||
# home assistant
|
||||
home.enable = true;
|
||||
# network
|
||||
tailscale.enable = true;
|
||||
caddy.enable = true;
|
||||
dnsmasq.enable = false;
|
||||
# mediastack
|
||||
mediastack.enable = true;
|
||||
qbittorrent.vpn_inf = "enp34s0.69";
|
||||
# system
|
||||
backups.enable = true;
|
||||
motd.enable = true;
|
||||
postfix.enable = false;
|
||||
uptime-kuma.enable = true;
|
||||
# ai
|
||||
ollama.enable = false;
|
||||
open-webui.enable = false;
|
||||
wyoming.enable = false;
|
||||
};
|
||||
|
||||
holocron = {
|
||||
@@ -78,16 +100,16 @@
|
||||
enable = true; # the goat
|
||||
dns = "systemd-resolved"; # the backup dancer!
|
||||
ensureProfiles.profiles = {
|
||||
# vpn = {
|
||||
# ethernet.mac-address = "7a:e4:07:8d:22:76";
|
||||
# connection.type = "vlan";
|
||||
# connection.id = "vpn";
|
||||
# connection.interface-name = "enp89s0.69"; # or just "vpn-vlan"
|
||||
# vlan.interface-name = "enp89s0.69"; # or just "vpn-vlan"
|
||||
# vlan.parent = "enp89s0";
|
||||
# vlan.id = 69;
|
||||
# #ipv4.dns = "9.9.9.9";
|
||||
# };
|
||||
vpn = {
|
||||
#ethernet.mac-address = "7a:e4:07:8d:22:76";
|
||||
connection.type = "vlan";
|
||||
connection.id = "vpn";
|
||||
connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
|
||||
vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
|
||||
vlan.parent = "enp34s0";
|
||||
vlan.id = 69;
|
||||
#ipv4.dns = "9.9.9.9";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/crypted";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@root" ];
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."crypted".device = "/dev/disk/by-uuid/4c5bef93-c0b8-4f03-8325-6ab1b9b9199a";
|
||||
|
||||
fileSystems."/.swapvol" =
|
||||
{ device = "/dev/mapper/crypted";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@swap" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/3E0D-91EE";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/mapper/crypted";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@home" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/mapper/crypted";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -8,7 +8,9 @@
|
||||
...
|
||||
}: let
|
||||
vpsip4 = "100.100.1.10";
|
||||
homelabipv4 = "10.10.0.10";
|
||||
snowbelle_ip = "10.10.0.10";
|
||||
lumiose_ip = "10.10.0.11";
|
||||
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
imports = [
|
||||
@@ -29,7 +31,7 @@ in {
|
||||
};
|
||||
homelab = {
|
||||
base_domain = "vaniville.lan";
|
||||
host_ip = "10.10.0.11";
|
||||
host_ip = "10.10.0.12";
|
||||
ddns.enable = true;
|
||||
uptime-kuma = {
|
||||
enable = true;
|
||||
@@ -105,27 +107,27 @@ in {
|
||||
allowedUDPPorts = [config.services.tailscale.port 25777 21116];
|
||||
trustedInterfaces = ["tailscale0"];
|
||||
/*
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80 # http
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443 # https
|
||||
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # http
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # https
|
||||
*/
|
||||
extraCommands = ''
|
||||
# Clear any previous rules if you are iterating
|
||||
iptables -t nat -F
|
||||
|
||||
# DNAT: internet -> homelab over tailscale
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
|
||||
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567 # gitea ssh
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${snowbelle_ip}:25777 # recpro mc
|
||||
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${snowbelle_ip}:25777 # recpro mc
|
||||
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${snowbelle_ip}:25778 # cbblemon mc
|
||||
|
||||
# SNAT: ensure replies go back through VPS tailscale IP
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # cbblemon mc
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
||||
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # cbblemon mc
|
||||
'';
|
||||
};
|
||||
};
|
||||
@@ -153,19 +155,19 @@ in {
|
||||
# this is instead of forwarding all 80 & 443 traffic to have more explicit
|
||||
# publishing things to the open web
|
||||
"media.${homelab.public_domain}".extraConfig = ''
|
||||
reverse_proxy 10.10.0.10:7100
|
||||
reverse_proxy ${lumiose_ip}:7100
|
||||
'';
|
||||
"pass.${homelab.public_domain}".extraConfig = ''
|
||||
reverse_proxy 10.10.0.10:7701
|
||||
reverse_proxy ${lumiose_ip}:7701
|
||||
'';
|
||||
"photos.${homelab.public_domain}".extraConfig = ''
|
||||
reverse_proxy 10.10.0.10:7702
|
||||
reverse_proxy ${lumiose_ip}:7702
|
||||
'';
|
||||
"git.${homelab.public_domain}".extraConfig = ''
|
||||
reverse_proxy 10.10.0.10:7703
|
||||
reverse_proxy ${lumiose_ip}:7703
|
||||
'';
|
||||
"hass.${homelab.public_domain}".extraConfig = ''
|
||||
reverse_proxy 10.10.0.10:7704 {
|
||||
reverse_proxy ${lumiose_ip}:7704 {
|
||||
header_up Host {host}
|
||||
header_up X-Real-IP {remote_host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
|
||||
@@ -32,7 +32,7 @@ in {
|
||||
identityFile = "${home_dir}/.ssh/id_snowbelle";
|
||||
port = 7567;
|
||||
};
|
||||
"git.snowbelle.blakedheld.xyz" = {
|
||||
"git.lumiose.blakedheld.xyz" = {
|
||||
user = "gitea";
|
||||
identityFile = "${home_dir}/.ssh/id_snowbelle";
|
||||
port = 7567;
|
||||
|
||||
@@ -32,7 +32,7 @@ in {
|
||||
identityFile = "${home_dir}/.ssh/id_snowbelle";
|
||||
port = 7567;
|
||||
};
|
||||
"git.snowbelle.blakedheld.xyz" = {
|
||||
"git.lumiose.blakedheld.xyz" = {
|
||||
user = "gitea";
|
||||
identityFile = "${home_dir}/.ssh/id_snowbelle";
|
||||
port = 7567;
|
||||
|
||||
@@ -32,7 +32,7 @@ in {
|
||||
identityFile = "${home_dir}/.ssh/id_vaniville";
|
||||
port = 7567;
|
||||
};
|
||||
"git.snowbelle.blakedheld.xyz" = {
|
||||
"git.lumiose.blakedheld.xyz" = {
|
||||
user = "gitea";
|
||||
identityFile = "${home_dir}/.ssh/id_vaniville";
|
||||
port = 7567;
|
||||
|
||||
Reference in New Issue
Block a user