summaryrefslogtreecommitdiffstats
path: root/makefu
diff options
context:
space:
mode:
Diffstat (limited to 'makefu')
-rw-r--r--makefu/1systems/gum/config.nix5
-rw-r--r--makefu/1systems/gum/hetznercloud/network.nix15
-rw-r--r--makefu/2configs/home-manager/zsh.nix25
-rw-r--r--makefu/2configs/wireguard/wiregrill.nix45
4 files changed, 68 insertions, 22 deletions
diff --git a/makefu/1systems/gum/config.nix b/makefu/1systems/gum/config.nix
index 26bfd0731..e61af7a7b 100644
--- a/makefu/1systems/gum/config.nix
+++ b/makefu/1systems/gum/config.nix
@@ -103,6 +103,7 @@ in {
# <stockholm/makefu/2configs/sabnzbd.nix>
# <stockholm/makefu/2configs/mail/mail.euer.nix>
{ krebs.exim.enable = mkDefault true; }
+ <stockholm/makefu/2configs/nix-community/mediawiki-matrix-bot.nix>
# sharing
<stockholm/makefu/2configs/share/gum.nix> # samba sahre
@@ -125,7 +126,7 @@ in {
<stockholm/makefu/2configs/backup/server.nix>
<stockholm/makefu/2configs/backup/state.nix>
<stockholm/makefu/2configs/wireguard/server.nix>
- # <stockholm/makefu/2configs/wireguard/wiregrill.nix>
+ <stockholm/makefu/2configs/wireguard/wiregrill.nix>
{ # recent changes mediawiki bot
networking.firewall.allowedUDPPorts = [ 5005 5006 ];
@@ -173,7 +174,7 @@ in {
# <stockholm/makefu/2configs/nginx/iso.euer.nix>
# <stockholm/makefu/2configs/deployment/photostore.krebsco.de.nix>
- <stockholm/makefu/2configs/deployment/graphs.nix>
+ # <stockholm/makefu/2configs/deployment/graphs.nix>
#<stockholm/makefu/2configs/deployment/owncloud.nix>
# <stockholm/makefu/2configs/deployment/board.euer.krebsco.de.nix>
#<stockholm/makefu/2configs/deployment/feed.euer.krebsco.de>
diff --git a/makefu/1systems/gum/hetznercloud/network.nix b/makefu/1systems/gum/hetznercloud/network.nix
index 24fe3842f..5159cf570 100644
--- a/makefu/1systems/gum/hetznercloud/network.nix
+++ b/makefu/1systems/gum/hetznercloud/network.nix
@@ -3,7 +3,7 @@ let
external-mac = "96:00:01:24:33:f4";
external-gw = "172.31.1.1";
external-ip = "142.132.189.140";
- external-ip6 = "2a01:4f8:1c17:5cdf::2/64";
+ external-ip6 = "2a01:4f8:1c17:5cdf::2";
external-gw6 = "fe80::1";
external-netmask = 32;
external-netmask6 = 64;
@@ -16,19 +16,20 @@ in
SUBSYSTEM=="net", ATTR{address}=="${external-mac}", NAME="${ext-if}"
'';
networking = {
+ enableIPv6 = true;
+ nat.enableIPv6 = true;
interfaces."${ext-if}" = {
useDHCP = true;
+ ipv6.addresses = [{
+ address = external-ip6;
+ prefixLength = external-netmask6;
+ }];
};
#ipv4.addresses = [{
# address = external-ip;
# prefixLength = external-netmask;
#}];
- #ipv6.addresses = [{
- # address = external-ip6;
- # prefixLength = external-netmask6;
- # }];
- #};
- #defaultGateway6 = { address = external-gw6; interface = ext-if; };
+ defaultGateway6 = { address = external-gw6; interface = ext-if; };
#defaultGateway = external-gw;
nameservers = [ "1.1.1.1" ];
};
diff --git a/makefu/2configs/home-manager/zsh.nix b/makefu/2configs/home-manager/zsh.nix
index 13755de27..c875d52c8 100644
--- a/makefu/2configs/home-manager/zsh.nix
+++ b/makefu/2configs/home-manager/zsh.nix
@@ -61,6 +61,8 @@ direnv allow
size = 900001;
save = 900001;
ignoreDups = true;
+ ignoreSpace = true;
+
extended = true;
share = true;
};
@@ -77,31 +79,32 @@ direnv allow
xo = "mimeopen";
nmap = "nmap -oN $HOME/loot/scan-`date +\%s`.nmap -oX $HOME/loot/scan-`date +%s`.xml";
};
- # navi package does not come with the navi.plugin.zsh anymore so we use .src
+ #zplug = {
+ # enable = true;
+ # plugins = [
+ # { name = "denisidoro/navi" ; }
+ # { name = "zsh-users/zsh-autosuggestions" ; }
+ # ];
+ #};
initExtra = ''
bindkey -e
+ zle -N edit-command-line
+ # ctrl-x ctrl-e
+ bindkey '^xe' edit-command-line
+ bindkey '^x^e' edit-command-line
# shift-tab
bindkey '^[[Z' reverse-menu-complete
bindkey "\e[3~" delete-char
zstyle ':completion:*' menu select
setopt HIST_IGNORE_ALL_DUPS
- setopt HIST_IGNORE_SPACE
setopt HIST_FIND_NO_DUPS
compdef _pass brain
zstyle ':completion::complete:brain::' prefix "$HOME/brain"
+
compdef _pass secrets
zstyle ':completion::complete:secrets::' prefix "$HOME/.secrets-pass/"
-
- # navi
- . ${pkgs.navi.src}/shell/navi.plugin.zsh
- # ctrl-x ctrl-e
- autoload -U compinit && compinit
- autoload -U edit-command-line
- zle -N edit-command-line
- bindkey '^xe' edit-command-line
- bindkey '^x^e' edit-command-line
'';
};
};
diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix
index 082090755..070f01e10 100644
--- a/makefu/2configs/wireguard/wiregrill.nix
+++ b/makefu/2configs/wireguard/wiregrill.nix
@@ -13,16 +13,57 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
+ "net.ipv4.conf.all.forwarding" = 1;
+ };
+ networking.nat = mkIf isRouter {
+ enable = true;
+ enableIPv6 = true;
+ externalInterface = ext-if;
+ internalInterfaces = [ "wiregrill" ];
};
networking.firewall = {
allowedUDPPorts = [ self.wireguard.port ];
- extraCommands = ''
- iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT
+ interfaces.wiregrill = mkIf isRouter {
+ allowedUDPPorts = [ 53 ];
+ allowedTCPPorts = [ 53 ];
+ };
+ };
+
+ services.dnsmasq = mkIf isRouter {
+ enable = true;
+ resolveLocalQueries = false;
+ extraConfig = /* dnsmasq */ ''
+ bind-interfaces
+ interface=retiolum,wiregrill
'';
+ servers = [ "1.1.1.1" ];
};
networking.wireguard.interfaces.wiregrill = {
+ postSetup = optionalString isRouter ''
+ ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i retiolum -o wiregrill -j ACCEPT
+
+ ${pkgs.iptables}/bin/ip6tables -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE
+ ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -A FORWARD -i retiolum -o wiregrill -j ACCEPT
+ '';
+
+ # This undoes the above command
+ postShutdown = optionalString isRouter ''
+ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE
+ ${pkgs.iptables}/bin/iptables -D FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -D FORWARD -i retiolum -o wiregrill -j ACCEPT
+
+ ${pkgs.iptables}/bin/ip6tables -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE
+ ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -D FORWARD -i retiolum -o wiregrill -j ACCEPT
+ '' ;
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 06:04:15 +0000