137 lines
5.0 KiB
Nix
137 lines
5.0 KiB
Nix
{ config, lib, stable_pkgs, unstable_pkgs, ... }:
|
|
|
|
let
|
|
pkgs = stable_pkgs.x86_64;
|
|
unstable = unstable_pkgs.x86_64;
|
|
vpsip4 = "100.100.1.10";
|
|
homelabipv4 = "10.10.0.10";
|
|
in
|
|
{
|
|
imports =
|
|
[
|
|
./hardware-configuration.nix
|
|
../../nixos
|
|
../../../users/blake
|
|
../../../modules/system
|
|
../../../modules/homelab
|
|
#../../../modules/holocron
|
|
];
|
|
|
|
home-manager.users.blake.imports = [
|
|
../../../users/blake/hosts/vaniville.nix
|
|
];
|
|
|
|
system = {
|
|
tailscale.enable = false;
|
|
};
|
|
homelab = {
|
|
base_domain = "vaniville.lan";
|
|
host_ip = "10.10.0.11";
|
|
ddns.enable = true;
|
|
|
|
uptime-kuma = {
|
|
enable = true;
|
|
url = "up.blakedheld.xyz";
|
|
};
|
|
caddy = {
|
|
enable = false;
|
|
};
|
|
};
|
|
|
|
boot = {
|
|
loader = {
|
|
efi.canTouchEfiVariables = true;
|
|
grub = {
|
|
enable = true;
|
|
forceInstall = true;
|
|
};
|
|
};
|
|
kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
};
|
|
};
|
|
|
|
# define shell
|
|
programs.zsh.enable = true;
|
|
users.defaultUserShell = pkgs.zsh;
|
|
|
|
# packages reccomended by linode
|
|
environment.systemPackages = with pkgs; [
|
|
inetutils
|
|
mtr
|
|
sysstat
|
|
];
|
|
|
|
# setup the network forwarding this host is designed for
|
|
# general networking config
|
|
networking = {
|
|
hostName = "vaniville"; # Define your hostname.
|
|
usePredictableInterfaceNames = false;
|
|
useDHCP = false;
|
|
interfaces.eth0.useDHCP = true; # public ipv4 interface
|
|
|
|
# the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = "eth0"; # your PUBLIC_IF
|
|
internalInterfaces = [ "tailscale0" ];
|
|
# maybe one day i will figure out the forward ports proper
|
|
forwardPorts = [
|
|
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
|
|
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
|
|
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
|
|
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
|
|
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
|
|
|
|
# Rustdesk ports
|
|
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
|
|
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
|
|
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
|
|
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
|
|
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
|
|
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
|
|
];
|
|
};
|
|
|
|
# what actually does the forwarding
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
|
|
# tailscale will also need its UDP port open:
|
|
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
extraCommands = ''
|
|
# Clear any previous rules if you are iterating
|
|
iptables -t nat -F
|
|
|
|
# DNAT: internet -> homelab over tailscale
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
|
|
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
|
|
|
|
# SNAT: ensure replies go back through VPS tailscale IP
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # cbblemon mc
|
|
'';
|
|
};
|
|
};
|
|
|
|
# enable tailscale for to forward over!
|
|
services.tailscale = {
|
|
enable = true;
|
|
useRoutingFeatures = "server";
|
|
};
|
|
|
|
|
|
system.stateVersion = "25.05"; # Did you read the comment?
|
|
|
|
}
|
|
|