211 lines
7.8 KiB
Nix
211 lines
7.8 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
inputs,
|
|
stable_pkgs,
|
|
unstable_pkgs,
|
|
...
|
|
}: let
|
|
vpsip4 = "100.100.1.10";
|
|
snowbelle_ip = "10.10.0.10";
|
|
lumiose_ip = "10.10.0.11";
|
|
|
|
homelab = config.homelab;
|
|
in {
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
../../nixos
|
|
../../../users/blake
|
|
../../../modules/system
|
|
../../../modules/homelab
|
|
#../../../modules/holocron
|
|
];
|
|
|
|
home-manager.users.blake.imports = [
|
|
../../../users/blake/hosts/vaniville.nix
|
|
];
|
|
|
|
system = {
|
|
tailscale.enable = false;
|
|
};
|
|
homelab = {
|
|
enable = true;
|
|
base_domain = "vaniville.holocron.blue";
|
|
host_ip = "100.100.1.10";
|
|
ddns.enable = true;
|
|
uptime-kuma = {
|
|
enable = true;
|
|
url = "up.holocron.blue";
|
|
};
|
|
caddy = {
|
|
enable = true;
|
|
keys = true;
|
|
};
|
|
backups = {
|
|
enable = true;
|
|
databases = false;
|
|
homelab = true;
|
|
backup_repo = "/var/lib/backups/homelab";
|
|
offsite_dir = "lifeboat/vaniville/homelab";
|
|
};
|
|
gitea.enable = true;
|
|
vaultwarden.enable = true;
|
|
home.enable = false;
|
|
};
|
|
|
|
boot = {
|
|
loader = {
|
|
efi.canTouchEfiVariables = true;
|
|
grub = {
|
|
enable = true;
|
|
forceInstall = true;
|
|
};
|
|
};
|
|
kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
};
|
|
};
|
|
|
|
# define shell
|
|
programs.zsh.enable = true;
|
|
users.defaultUserShell = pkgs.zsh;
|
|
|
|
# packages reccomended by linode
|
|
environment.systemPackages = with pkgs; [
|
|
inetutils
|
|
mtr
|
|
sysstat
|
|
];
|
|
|
|
# services.resolved = {
|
|
# enable = true;
|
|
# settings = {
|
|
# Resolve = {
|
|
# FallbackDNS = ["1.1.1.1" "9.9.9.9"];
|
|
# DNSOverTLS = "opportunistic";
|
|
# };
|
|
# };
|
|
# };
|
|
|
|
# setup the network forwarding this host is designed for
|
|
# general networking config
|
|
networking = {
|
|
hostName = "vaniville"; # Define your hostname.
|
|
usePredictableInterfaceNames = false;
|
|
useDHCP = false;
|
|
interfaces.eth0.useDHCP = true; # public ipv4 interface
|
|
|
|
# the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = "eth0"; # your PUBLIC_IF
|
|
internalInterfaces = ["tailscale0"];
|
|
# maybe one day i will figure out the forward ports proper
|
|
forwardPorts = [
|
|
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
|
|
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
|
|
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
|
|
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
|
|
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
|
|
|
|
# Rustdesk ports
|
|
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
|
|
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
|
|
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
|
|
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
|
|
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
|
|
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
|
|
];
|
|
};
|
|
|
|
# what actually does the forwarding
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
|
|
# tailscale will also need its UDP port open:
|
|
allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580];
|
|
trustedInterfaces = ["tailscale0"];
|
|
/*
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80 # http
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443 # https
|
|
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # http
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # https
|
|
*/
|
|
|
|
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567 # gitea ssh
|
|
# iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
|
|
|
|
extraCommands = ''
|
|
# Clear any previous rules if you are iterating
|
|
iptables -t nat -F
|
|
|
|
# DNAT: internet -> homelab over tailscale
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777 # recpro mc
|
|
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777 # recpro mc
|
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579 # craftoria mc
|
|
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580 # craftoria mc voice chat
|
|
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456 # valheim server
|
|
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457 # valheim server
|
|
|
|
# SNAT: ensure replies go back through VPS tailscale IP
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # craftoria mc
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # craftoria mc voicechat
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # valheim server
|
|
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # valheim server
|
|
'';
|
|
};
|
|
};
|
|
|
|
# enable tailscale for to forward over!
|
|
services.tailscale = {
|
|
enable = true;
|
|
useRoutingFeatures = "server";
|
|
extraSetFlags = [
|
|
"--advertise-exit-node"
|
|
];
|
|
};
|
|
|
|
# forwarding for caddy
|
|
services.caddy = {
|
|
globalConfig = ''
|
|
auto_https ignore_loaded_certs
|
|
'';
|
|
virtualHosts = {
|
|
# for central uptime monitoring
|
|
"up.${homelab.public_domain}".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:7901
|
|
'';
|
|
# below is basically just manually reverse proxying everything in the homelab
|
|
# this is instead of forwarding all 80 & 443 traffic to have more explicit
|
|
# publishing things to the open web
|
|
"media.${homelab.public_domain}".extraConfig = ''
|
|
reverse_proxy ${lumiose_ip}:7100
|
|
'';
|
|
"photos.${homelab.public_domain}".extraConfig = ''
|
|
reverse_proxy ${lumiose_ip}:7702
|
|
'';
|
|
"hass.${homelab.public_domain}".extraConfig = ''
|
|
reverse_proxy ${lumiose_ip}:7704 {
|
|
header_up Host {host}
|
|
header_up X-Real-IP {remote_host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto https
|
|
}
|
|
'';
|
|
# now hosted on vaniville!
|
|
# "pass.${homelab.public_domain}".extraConfig = ''
|
|
# reverse_proxy 127.0.0.1:7701
|
|
# '';
|
|
# "git.${homelab.public_domain}".extraConfig = ''
|
|
# reverse_proxy localhost:7703
|
|
# '';
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "25.05"; # Did you read the comment?
|
|
}
|