nixos-config/machines/dolomite/default.nix

211 lines
5.4 KiB
Nix
Raw Normal View History

{ config, lib, ... }:
2024-04-16 08:48:56 +00:00
let
2024-08-25 09:45:58 +00:00
awsHosts = [ "tok-00" ];
2024-04-16 08:48:56 +00:00
bwgHosts = [ "la-00" ];
in
2023-10-06 14:05:19 +00:00
{
2023-11-28 13:38:50 +00:00
imports = [
../sops.nix
./bandwagon.nix
./lightsail.nix
2023-11-28 13:38:50 +00:00
];
2023-12-06 14:54:22 +00:00
config = {
2024-04-16 08:48:56 +00:00
isBandwagon = builtins.elem config.networking.hostName bwgHosts;
isLightsail = builtins.elem config.networking.hostName awsHosts;
sops = {
secrets = {
wg_private_key = {
owner = "root";
sopsFile = ./secrets + "/${config.networking.hostName}.yaml";
};
wg_ipv6_local_addr = {
owner = "root";
sopsFile = ./secrets + "/${config.networking.hostName}.yaml";
};
};
};
2023-12-06 14:54:22 +00:00
boot.kernel.sysctl = {
"net.core.default_qdisc" = "fq";
"net.ipv4.tcp_congestion_control" = "bbr";
};
2023-11-28 13:38:50 +00:00
2023-12-06 14:54:22 +00:00
networking.firewall.trustedInterfaces = [ "tun0" ];
2023-11-28 13:38:50 +00:00
2023-12-06 14:54:22 +00:00
security.acme = {
acceptTerms = true;
certs.${config.deployment.targetHost} = {
2023-12-06 14:54:22 +00:00
email = "me@namely.icu";
# Avoid port conflict
listenHTTP = if config.services.caddy.enable then ":30310" else ":80";
2023-12-06 14:54:22 +00:00
};
2023-11-28 13:38:50 +00:00
};
services.caddy.virtualHosts."http://${config.deployment.targetHost}:80".extraConfig = ''
reverse_proxy 127.0.0.1:30310
'';
2024-08-25 09:45:58 +00:00
networking.firewall.allowedTCPPorts = [
80
8080
];
2023-12-06 14:54:22 +00:00
networking.firewall.allowedUDPPorts = [ ] ++ (lib.range 6311 6314);
2023-10-06 14:05:19 +00:00
2023-12-20 03:13:20 +00:00
custom.prometheus = {
2024-08-01 09:01:53 +00:00
enable = true;
exporters.blackbox.enable = true;
2023-12-20 03:13:20 +00:00
};
2024-01-09 04:27:51 +00:00
custom.kanidm-client = {
enable = true;
uri = "https://auth.xinyang.life/";
asSSHAuth = {
enable = true;
allowedGroups = [ "linux_users" ];
};
sudoers = [ "xin@auth.xinyang.life" ];
};
services.openssh = {
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = lib.mkForce "no";
GSSAPIAuthentication = "no";
KerberosAuthentication = "no";
};
};
services.fail2ban.enable = true;
2024-01-13 02:47:37 +00:00
programs.mosh.enable = true;
2024-01-09 04:27:51 +00:00
security.sudo = {
execWheelOnly = true;
wheelNeedsPassword = false;
};
2024-08-25 09:45:58 +00:00
services.sing-box =
let
singTls = {
enabled = true;
server_name = config.deployment.targetHost;
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
certificate_path =
config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
};
password = {
_secret = config.sops.secrets.singbox_password.path;
};
uuid = {
_secret = config.sops.secrets.singbox_uuid.path;
};
2024-08-25 09:45:58 +00:00
in
{
enable = true;
settings = {
dns = {
servers = [
{
tag = "warp";
address = "1.1.1.1";
detour = "wg-out";
2023-12-06 14:54:22 +00:00
}
2024-08-25 09:45:58 +00:00
{
tag = "directdns";
address = "h3://8.8.8.8/dns-query";
2023-12-06 14:54:22 +00:00
}
];
2024-08-25 09:45:58 +00:00
rules = [
{
outbound = "wg-out";
server = "warp";
}
{
outbound = "direct";
server = "directdns";
}
];
2024-08-25 09:45:58 +00:00
};
inbounds =
[
{
tag = "sg0";
type = "trojan";
listen = "::";
listen_port = 8080;
users = [
{
name = "proxy";
password = password;
}
];
tls = singTls;
}
]
++ lib.forEach (lib.range 6311 6314) (port: {
tag = "sg" + toString (port - 6310);
type = "tuic";
listen = "::";
listen_port = port;
congestion_control = "bbr";
users = [
{
name = "proxy";
uuid = uuid;
password = password;
}
];
tls = singTls;
});
outbounds = [
{
2024-08-25 09:45:58 +00:00
type = "wireguard";
tag = "wg-out";
private_key = {
_secret = config.sops.secrets.wg_private_key.path;
};
local_address = [
"172.16.0.2/32"
{ _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
];
peers = [
{
public_key = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
allowed_ips = [
"0.0.0.0/0"
"::/0"
];
server = "162.159.192.1";
server_port = 500;
}
];
}
2024-08-01 09:01:53 +00:00
{
2024-08-25 09:45:58 +00:00
type = "direct";
tag = "direct";
2024-08-01 09:01:53 +00:00
}
{
2024-08-25 09:45:58 +00:00
type = "dns";
tag = "dns-out";
}
];
2024-08-25 09:45:58 +00:00
route = {
rules = [
{
outbound = "dns-out";
protocol = "dns";
}
{
inbound = "sg0";
outbound = "direct";
}
{
inbound = "sg4";
outbound = "direct";
}
];
};
};
2023-12-06 14:54:22 +00:00
};
2023-10-06 14:05:19 +00:00
};
2023-12-06 14:54:22 +00:00
2023-10-06 14:05:19 +00:00
}