From 90440c5d95fdcdebc7edc0d6caebe618eba15134 Mon Sep 17 00:00:00 2001 From: Fabian Hauser Date: Wed, 11 Dec 2024 15:25:47 +0200 Subject: [PATCH] Make cyprianspitz ip static --- defaults/meta/network-virtual.nix | 2 +- nixos-configurations/calanda/networking.nix | 29 ++++++++------ nixos-configurations/cyprianspitz/README.md | 9 ++++- .../cyprianspitz/networking.nix | 39 +++++++++++-------- nixos-configurations/lindberg/networking.nix | 9 ++++- nixos-modules/qois/vpn-server/default.nix | 4 +- 6 files changed, 60 insertions(+), 32 deletions(-) diff --git a/defaults/meta/network-virtual.nix b/defaults/meta/network-virtual.nix index 4cf70d1..d69be2b 100644 --- a/defaults/meta/network-virtual.nix +++ b/defaults/meta/network-virtual.nix @@ -93,7 +93,7 @@ cyprianspitz-vms-nat = { v4 = { - id = "10.247.0.0"; + id = "10.248.0.0"; prefixLength = 24; }; domain = "cyprianspitz-vms-nat.net.qo.is"; diff --git a/nixos-configurations/calanda/networking.nix b/nixos-configurations/calanda/networking.nix index 0f713b9..a96757d 100644 --- a/nixos-configurations/calanda/networking.nix +++ b/nixos-configurations/calanda/networking.nix @@ -4,6 +4,7 @@ let meta = config.qois.meta; plessur-dmz-net = meta.network.physical.plessur-dmz; plessur-lan-net = meta.network.physical.plessur-lan; + plessur-ext-net = meta.network.physical.plessur-ext; getCalandaIp4 = net: net.hosts.calanda.v4.ip; in { @@ -53,6 +54,14 @@ in }; }; + # Assign the static address to cyprianspitz (required for ssh luks unlock at this time) + services.dnsmasq.settings.dhcp-host = + let + cyprianspitzEnp0s31f6Mac = "9c:6b:00:58:6e:90"; + inherit (plessur-lan-net.hosts.cyprianspitz.v4) ip; + in + "${cyprianspitzEnp0s31f6Mac},${ip}"; + # DMZ services.unbound.settings.server = { interface = [ plessur-dmz-net.hosts.calanda.v4.ip ]; @@ -66,21 +75,19 @@ in # DMZ Portforwarding networking.nat.forwardPorts = let - cyprianspitzPort = ( - proto: port: { - destination = "10.1.1.11:${toString port}"; - proto = proto; - sourcePort = port; - loopbackIPs = [ "85.195.200.253" ]; + cyprianspitzPortDst = ( + proto: sourcePort: dstPort: { + destination = "${plessur-lan-net.hosts.cyprianspitz.v4.ip}:${toString dstPort}"; + inherit proto; + inherit sourcePort; + loopbackIPs = [ plessur-ext-net.hosts.calanda.v4.ip ]; } ); + cyprianspitzPort = proto: port: (cyprianspitzPortDst proto port port); in [ - { - destination = "10.1.1.11:2222"; - proto = "tcp"; - sourcePort = 8223; - } + (cyprianspitzPortDst "tcp" 8222 22) + (cyprianspitzPortDst "tcp" 8223 2222) ] ++ map (cyprianspitzPort "tcp") [ 80 diff --git a/nixos-configurations/cyprianspitz/README.md b/nixos-configurations/cyprianspitz/README.md index e957926..d6369f9 100644 --- a/nixos-configurations/cyprianspitz/README.md +++ b/nixos-configurations/cyprianspitz/README.md @@ -11,6 +11,13 @@ sops decrypt --extract '["system"]["hdd"]' private/nixos-configurations/cyprians ssh -p 8223 root@calanda.plessur-ext.net.qo.is ``` + +Direct remote ssh access: + +``` +ssh -p 8222 root@calanda.plessur-ext.net.qo.is +``` + ## Hardware TODO @@ -29,4 +36,4 @@ TODO ### HDD Bay -Note that slot 5 (the leftmost) SATA bay is not connected due to the mainboard only having 4 SATA plugs. +Note that the slot in the middle of the SATA bay is not connected due to the mainboard only having 4 SATA plugs. diff --git a/nixos-configurations/cyprianspitz/networking.nix b/nixos-configurations/cyprianspitz/networking.nix index 3649afb..469c598 100644 --- a/nixos-configurations/cyprianspitz/networking.nix +++ b/nixos-configurations/cyprianspitz/networking.nix @@ -2,27 +2,34 @@ let meta = config.qois.meta; + getNetV4Ip = net: { + address = net.hosts.cyprianspitz.v4.ip; + prefixLength = net.v4.prefixLength; + }; + calandaIp = meta.network.physical.plessur-lan.hosts.calanda.v4.ip; in { + networking.enableIPv6 = false; networking.hostName = meta.hosts.cyprianspitz.hostName; + networking.nameservers = [ calandaIp ]; networking.useDHCP = false; - networking.interfaces.enp0s31f6.useDHCP = true; - networking.interfaces.enp2s0.useDHCP = true; + networking.interfaces.enp0s31f6.ipv4.addresses = [ + (getNetV4Ip meta.network.physical.plessur-lan) + ]; + + networking.defaultGateway = { + address = calandaIp; + interface = "enp0s31f6"; + }; # Virtualization - networking.interfaces.vms-nat.useDHCP = false; - networking.interfaces.vms-nat.ipv4.addresses = [ - ( - let - netConfig = meta.network.virtual.cyprianspitz-vms-nat; - in - { - address = netConfig.hosts.cyprianspitz.v4.ip; - prefixLength = netConfig.v4.prefixLength; - } - ) - ]; + networking.interfaces.vms-nat = { + useDHCP = false; + ipv4.addresses = [ + (getNetV4Ip meta.network.virtual.cyprianspitz-vms-nat) + ]; + }; networking.bridges.vms-nat.interfaces = [ ]; networking.nat = { @@ -41,6 +48,7 @@ in enable = true; resolveLocalQueries = true; settings = { + server = [ calandaIp ]; interface = "vms-nat"; bind-interfaces = true; @@ -65,11 +73,10 @@ in }; # Boot - boot.initrd.network.udhcpc.enable = true; - services.qois.luks-ssh = { enable = true; interface = "eth0"; + sshPort = 2222; sshHostKey = "/secrets/system/initrd-ssh-key"; # TODO Solve sops dependency porblem: config.sops.secrets."system/initrd-ssh-key".path; diff --git a/nixos-configurations/lindberg/networking.nix b/nixos-configurations/lindberg/networking.nix index 35218f7..67f2b0b 100644 --- a/nixos-configurations/lindberg/networking.nix +++ b/nixos-configurations/lindberg/networking.nix @@ -54,7 +54,14 @@ in dhcp-authoritative = true; }; }; - systemd.services.dnsmasq.bindsTo = [ "network-addresses-vms-nat.service" ]; + systemd.services.dnsmasq = + let + vmsNat = [ "network-addresses-vms-nat.service" ]; + in + { + bindsTo = vmsNat; + after = vmsNat; + }; networking.firewall.interfaces.vms-nat = { allowedUDPPorts = [ 53 diff --git a/nixos-modules/qois/vpn-server/default.nix b/nixos-modules/qois/vpn-server/default.nix index 25ef0a0..d813532 100644 --- a/nixos-modules/qois/vpn-server/default.nix +++ b/nixos-modules/qois/vpn-server/default.nix @@ -80,9 +80,9 @@ in dns = { base_domain = vpnNet.domain; magic_dns = true; - nameservers.global = [ vnet.backplane.hosts.calanda.v4.ip ]; + nameservers.global = [ "127.0.0.1" ]; search_domains = [ - # vpnNet.domain # First by default with magic_dns + # First is base_domain by default with magic_dns vnet.backplane.domain ]; extra_records = pipe cfg.dnsRecords [