From c5d9d01f84ba5ca27066d63d24b6cbed123cbce5 Mon Sep 17 00:00:00 2001 From: Fabian Hauser Date: Wed, 11 Dec 2024 13:11:42 +0200 Subject: [PATCH 1/3] Extract vpn exit node config to module --- .../cyprianspitz/networking.nix | 19 +------ nixos-configurations/cyprianspitz/secrets.nix | 3 -- nixos-configurations/lindberg/networking.nix | 19 +------ nixos-modules/qois/vpn-exit-node/default.nix | 49 +++++++++++++++++++ 4 files changed, 52 insertions(+), 38 deletions(-) create mode 100644 nixos-modules/qois/vpn-exit-node/default.nix diff --git a/nixos-configurations/cyprianspitz/networking.nix b/nixos-configurations/cyprianspitz/networking.nix index de8132d..3649afb 100644 --- a/nixos-configurations/cyprianspitz/networking.nix +++ b/nixos-configurations/cyprianspitz/networking.nix @@ -78,22 +78,5 @@ in qois.backplane-net.enable = true; # Configure this node to be used as an vpn exit node - qois.backup-client.includePaths = [ "/var/lib/tailscale" ]; - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "server"; - authKeyFile = config.sops.secrets."tailscale/key".path; - extraUpFlags = [ - "--timeout 60s" - "--accept-dns=false" - "--login-server=https://vpn.qo.is" - "--advertise-exit-node" - ( - with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}" - ) - "--advertise-tags=tag:srv" - ]; - }; - + qois.vpn-exit-node.enable = true; } diff --git a/nixos-configurations/cyprianspitz/secrets.nix b/nixos-configurations/cyprianspitz/secrets.nix index 0e9f62c..d61753f 100644 --- a/nixos-configurations/cyprianspitz/secrets.nix +++ b/nixos-configurations/cyprianspitz/secrets.nix @@ -3,8 +3,5 @@ sops.secrets = { "system/hdd" = { }; "system/initrd-ssh-key" = { }; - "tailscale/key" = { - restartUnits = [ "tailscaled.service" ]; - }; }; } diff --git a/nixos-configurations/lindberg/networking.nix b/nixos-configurations/lindberg/networking.nix index 50c631c..35218f7 100644 --- a/nixos-configurations/lindberg/networking.nix +++ b/nixos-configurations/lindberg/networking.nix @@ -38,7 +38,7 @@ in in { enable = true; - resolveLocalQueries = false; + resolveLocalQueries = true; settings = { interface = "vms-nat"; bind-interfaces = true; @@ -74,20 +74,5 @@ in qois.backplane-net.enable = true; - # Use this node as vpn exit node - qois.backup-client.includePaths = [ "/var/lib/tailscale" ]; - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "server"; - authKeyFile = config.sops.secrets."tailscale/key".path; - extraUpFlags = [ - "--login-server=https://vpn.qo.is" - "--advertise-exit-node" - ( - with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}" - ) - "--advertise-tags=tag:srv" - ]; - }; + qois.vpn-exit-node.enable = true; } diff --git a/nixos-modules/qois/vpn-exit-node/default.nix b/nixos-modules/qois/vpn-exit-node/default.nix new file mode 100644 index 0000000..cc5dc82 --- /dev/null +++ b/nixos-modules/qois/vpn-exit-node/default.nix @@ -0,0 +1,49 @@ +{ + config, + pkgs, + lib, + ... +}: +with lib; +let + cfg = config.qois.vpn-exit-node; +in +{ + + options.qois.vpn-exit-node = { + enable = mkEnableOption "vpn exit node"; + domain = mkOption { + description = "Domain for the VPN admin server"; + type = types.str; + default = "vpn.qo.is"; + }; + }; + + config = mkIf cfg.enable { + + qois.backup-client.includePaths = [ "/var/lib/tailscale" ]; + + sops.secrets."tailscale/key".restartUnits = [ "tailscaled.service" ]; + + services.tailscale = { + enable = true; + openFirewall = true; + useRoutingFeatures = "server"; + authKeyFile = config.sops.secrets."tailscale/key".path; + extraUpFlags = + let + backplaneRoute = + with config.qois.meta.network.virtual.backplane.v4; + "${id}/${builtins.toString prefixLength}"; + in + [ + "--timeout 60s" + "--accept-dns=false" + "--login-server=https://${cfg.domain}" + "--advertise-exit-node" + "--advertise-routes=${backplaneRoute}" + "--advertise-tags=tag:srv" + ]; + }; + }; +} From 3f2d427c656ab1bf1855e7a09c35b9a58daf9ff0 Mon Sep 17 00:00:00 2001 From: Fabian Hauser Date: Wed, 11 Dec 2024 13:11:42 +0200 Subject: [PATCH 2/3] Extract vpn exit node config to module --- defaults/meta/network-physical.nix | 2 + .../cyprianspitz/networking.nix | 19 +------ nixos-configurations/cyprianspitz/secrets.nix | 3 -- nixos-configurations/lindberg/networking.nix | 19 +------ nixos-modules/qois/loadbalancer/default.nix | 2 +- nixos-modules/qois/vpn-exit-node/default.nix | 50 +++++++++++++++++++ nixos-modules/qois/vpn-server/default.nix | 1 + 7 files changed, 57 insertions(+), 39 deletions(-) create mode 100644 nixos-modules/qois/vpn-exit-node/default.nix diff --git a/defaults/meta/network-physical.nix b/defaults/meta/network-physical.nix index 69a4057..972476d 100644 --- a/defaults/meta/network-physical.nix +++ b/defaults/meta/network-physical.nix @@ -43,6 +43,7 @@ v4 = { id = "10.1.1.0"; prefixLength = 24; + # Note: DHCP from .2 to .249, see calanda config }; domain = "plessur-lan.net.qo.is"; @@ -50,6 +51,7 @@ calanda = { v4.ip = "10.1.1.1"; }; + cyprianspitz.v4.ip = "10.1.1.250"; }; }; diff --git a/nixos-configurations/cyprianspitz/networking.nix b/nixos-configurations/cyprianspitz/networking.nix index de8132d..3649afb 100644 --- a/nixos-configurations/cyprianspitz/networking.nix +++ b/nixos-configurations/cyprianspitz/networking.nix @@ -78,22 +78,5 @@ in qois.backplane-net.enable = true; # Configure this node to be used as an vpn exit node - qois.backup-client.includePaths = [ "/var/lib/tailscale" ]; - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "server"; - authKeyFile = config.sops.secrets."tailscale/key".path; - extraUpFlags = [ - "--timeout 60s" - "--accept-dns=false" - "--login-server=https://vpn.qo.is" - "--advertise-exit-node" - ( - with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}" - ) - "--advertise-tags=tag:srv" - ]; - }; - + qois.vpn-exit-node.enable = true; } diff --git a/nixos-configurations/cyprianspitz/secrets.nix b/nixos-configurations/cyprianspitz/secrets.nix index 0e9f62c..d61753f 100644 --- a/nixos-configurations/cyprianspitz/secrets.nix +++ b/nixos-configurations/cyprianspitz/secrets.nix @@ -3,8 +3,5 @@ sops.secrets = { "system/hdd" = { }; "system/initrd-ssh-key" = { }; - "tailscale/key" = { - restartUnits = [ "tailscaled.service" ]; - }; }; } diff --git a/nixos-configurations/lindberg/networking.nix b/nixos-configurations/lindberg/networking.nix index 50c631c..35218f7 100644 --- a/nixos-configurations/lindberg/networking.nix +++ b/nixos-configurations/lindberg/networking.nix @@ -38,7 +38,7 @@ in in { enable = true; - resolveLocalQueries = false; + resolveLocalQueries = true; settings = { interface = "vms-nat"; bind-interfaces = true; @@ -74,20 +74,5 @@ in qois.backplane-net.enable = true; - # Use this node as vpn exit node - qois.backup-client.includePaths = [ "/var/lib/tailscale" ]; - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "server"; - authKeyFile = config.sops.secrets."tailscale/key".path; - extraUpFlags = [ - "--login-server=https://vpn.qo.is" - "--advertise-exit-node" - ( - with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}" - ) - "--advertise-tags=tag:srv" - ]; - }; + qois.vpn-exit-node.enable = true; } diff --git a/nixos-modules/qois/loadbalancer/default.nix b/nixos-modules/qois/loadbalancer/default.nix index 56c7208..fe5477c 100644 --- a/nixos-modules/qois/loadbalancer/default.nix +++ b/nixos-modules/qois/loadbalancer/default.nix @@ -79,7 +79,7 @@ let in { - options.qois.loadbalancer = with lib; { + options.qois.loadbalancer = { enable = mkEnableOption "Enable services http+s loadbalancing"; domains = mkOption { diff --git a/nixos-modules/qois/vpn-exit-node/default.nix b/nixos-modules/qois/vpn-exit-node/default.nix new file mode 100644 index 0000000..aff1a84 --- /dev/null +++ b/nixos-modules/qois/vpn-exit-node/default.nix @@ -0,0 +1,50 @@ +{ + config, + pkgs, + lib, + ... +}: +with lib; +let + cfg = config.qois.vpn-exit-node; +in +{ + + options.qois.vpn-exit-node = { + enable = mkEnableOption "vpn exit node"; + domain = mkOption { + description = "Domain for the VPN admin server"; + type = types.str; + default = "vpn.qo.is"; + }; + }; + + config = mkIf cfg.enable { + + qois.backup-client.includePaths = [ "/var/lib/tailscale" ]; + + sops.secrets."tailscale/key".restartUnits = [ "tailscaled.service" ]; + + services.tailscale = { + enable = true; + openFirewall = true; + useRoutingFeatures = "server"; + authKeyFile = config.sops.secrets."tailscale/key".path; + extraUpFlags = + let + backplaneRoute = + with config.qois.meta.network.virtual.backplane.v4; + "${id}/${builtins.toString prefixLength}"; + in + [ + "--timeout 60s" + "--accept-dns=false" + "--accept-routes=false" + "--login-server=https://${cfg.domain}" + "--advertise-exit-node" + "--advertise-routes=${backplaneRoute}" + "--advertise-tags=tag:srv" + ]; + }; + }; +} diff --git a/nixos-modules/qois/vpn-server/default.nix b/nixos-modules/qois/vpn-server/default.nix index 0b23fdf..25ef0a0 100644 --- a/nixos-modules/qois/vpn-server/default.nix +++ b/nixos-modules/qois/vpn-server/default.nix @@ -56,6 +56,7 @@ in ); networking.firewall.checkReversePath = "loose"; + networking.firewall.allowedTCPPorts = [ config.services.headscale.port ]; networking.firewall.allowedUDPPorts = [ 41641 ]; From 0ec9c630586b7e667388ee9307a9410144d327c2 Mon Sep 17 00:00:00 2001 From: Fabian Hauser Date: Wed, 11 Dec 2024 15:25:47 +0200 Subject: [PATCH 3/3] Make cyprianspitz ip static --- nixos-configurations/calanda/networking.nix | 21 +++++++++---------- .../cyprianspitz/networking.nix | 18 +++++++--------- nixos-configurations/lindberg/networking.nix | 9 +++++++- 3 files changed, 26 insertions(+), 22 deletions(-) diff --git a/nixos-configurations/calanda/networking.nix b/nixos-configurations/calanda/networking.nix index 0f713b9..5d3ba48 100644 --- a/nixos-configurations/calanda/networking.nix +++ b/nixos-configurations/calanda/networking.nix @@ -4,6 +4,7 @@ let meta = config.qois.meta; plessur-dmz-net = meta.network.physical.plessur-dmz; plessur-lan-net = meta.network.physical.plessur-lan; + plessur-ext-net = meta.network.physical.plessur-ext; getCalandaIp4 = net: net.hosts.calanda.v4.ip; in { @@ -66,21 +67,19 @@ in # DMZ Portforwarding networking.nat.forwardPorts = let - cyprianspitzPort = ( - proto: port: { - destination = "10.1.1.11:${toString port}"; - proto = proto; - sourcePort = port; - loopbackIPs = [ "85.195.200.253" ]; + cyprianspitzPortDst = ( + proto: sourcePort: dstPort: { + destination = "${plessur-lan-net.hosts.cyprianspitz.v4.ip}:${toString dstPort}"; + inherit proto; + inherit sourcePort; + loopbackIPs = [ plessur-ext-net.hosts.calanda.v4.ip ]; } ); + cyprianspitzPort = proto: port: (cyprianspitzPortDst proto port port); in [ - { - destination = "10.1.1.11:2222"; - proto = "tcp"; - sourcePort = 8223; - } + (cyprianspitzPortDst "tcp" 8222 22) + (cyprianspitzPortDst "tcp" 8223 2222) ] ++ map (cyprianspitzPort "tcp") [ 80 diff --git a/nixos-configurations/cyprianspitz/networking.nix b/nixos-configurations/cyprianspitz/networking.nix index 3649afb..b3b570e 100644 --- a/nixos-configurations/cyprianspitz/networking.nix +++ b/nixos-configurations/cyprianspitz/networking.nix @@ -2,26 +2,24 @@ let meta = config.qois.meta; + getNetV4Ip = net: { + address = net.hosts.cyprianspitz.v4.ip; + prefixLength = net.v4.prefixLength; + }; in { networking.hostName = meta.hosts.cyprianspitz.hostName; networking.useDHCP = false; - networking.interfaces.enp0s31f6.useDHCP = true; + networking.interfaces.enp0s31f6.ipv4.addresses = [ + (getNetV4Ip meta.network.physical.plessur-lan) + ]; networking.interfaces.enp2s0.useDHCP = true; # Virtualization networking.interfaces.vms-nat.useDHCP = false; networking.interfaces.vms-nat.ipv4.addresses = [ - ( - let - netConfig = meta.network.virtual.cyprianspitz-vms-nat; - in - { - address = netConfig.hosts.cyprianspitz.v4.ip; - prefixLength = netConfig.v4.prefixLength; - } - ) + (getNetV4Ip meta.network.virtual.cyprianspitz-vms-nat) ]; networking.bridges.vms-nat.interfaces = [ ]; diff --git a/nixos-configurations/lindberg/networking.nix b/nixos-configurations/lindberg/networking.nix index 35218f7..67f2b0b 100644 --- a/nixos-configurations/lindberg/networking.nix +++ b/nixos-configurations/lindberg/networking.nix @@ -54,7 +54,14 @@ in dhcp-authoritative = true; }; }; - systemd.services.dnsmasq.bindsTo = [ "network-addresses-vms-nat.service" ]; + systemd.services.dnsmasq = + let + vmsNat = [ "network-addresses-vms-nat.service" ]; + in + { + bindsTo = vmsNat; + after = vmsNat; + }; networking.firewall.interfaces.vms-nat = { allowedUDPPorts = [ 53