Make cyprianspitz ip static

defaults/meta/network-physical.nix

@@ -43,6 +43,7 @@
       v4 = {
         id = "10.1.1.0";
         prefixLength = 24;
+        # Note: DHCP from .2 to .249, see calanda config
       };
       domain = "plessur-lan.net.qo.is";
 
@@ -50,6 +51,7 @@
         calanda = {
           v4.ip = "10.1.1.1";
         };
+        cyprianspitz.v4.ip = "10.1.1.250";
       };
     };
 

nixos-configurations/calanda/networking.nix

@@ -4,6 +4,7 @@ let
   meta = config.qois.meta;
   plessur-dmz-net = meta.network.physical.plessur-dmz;
   plessur-lan-net = meta.network.physical.plessur-lan;
+  plessur-ext-net = meta.network.physical.plessur-ext;
   getCalandaIp4 = net: net.hosts.calanda.v4.ip;
 in
 {
@@ -66,21 +67,19 @@ in
   # DMZ Portforwarding
   networking.nat.forwardPorts =
     let
-      cyprianspitzPort = (
-        proto: port: {
-          destination = "10.1.1.11:${toString port}";
-          proto = proto;
-          sourcePort = port;
-          loopbackIPs = [ "85.195.200.253" ];
+      cyprianspitzPortDst = (
+        proto: sourcePort: dstPort: {
+          destination = "${plessur-lan-net.hosts.cyprianspitz.v4.ip}:${toString dstPort}";
+          inherit proto;
+          inherit sourcePort;
+          loopbackIPs = [ plessur-ext-net.hosts.calanda.v4.ip ];
         }
       );
+      cyprianspitzPort = proto: port: (cyprianspitzPortDst proto port port);
     in
     [
-      {
-        destination = "10.1.1.11:2222";
-        proto = "tcp";
-        sourcePort = 8223;
-      }
+      (cyprianspitzPortDst "tcp" 8222 22)
+      (cyprianspitzPortDst "tcp" 8223 2222)
     ]
     ++ map (cyprianspitzPort "tcp") [
       80

nixos-configurations/cyprianspitz/networking.nix

@@ -2,26 +2,24 @@
 
 let
   meta = config.qois.meta;
+  getNetV4Ip = net: {
+    address = net.hosts.cyprianspitz.v4.ip;
+    prefixLength = net.v4.prefixLength;
+  };
 in
 {
   networking.hostName = meta.hosts.cyprianspitz.hostName;
 
   networking.useDHCP = false;
-  networking.interfaces.enp0s31f6.useDHCP = true;
+  networking.interfaces.enp0s31f6.ipv4.addresses = [
+    (getNetV4Ip meta.network.physical.plessur-lan)
+  ];
   networking.interfaces.enp2s0.useDHCP = true;
 
   # Virtualization
   networking.interfaces.vms-nat.useDHCP = false;
   networking.interfaces.vms-nat.ipv4.addresses = [
-    (
-      let
-        netConfig = meta.network.virtual.cyprianspitz-vms-nat;
-      in
-      {
-        address = netConfig.hosts.cyprianspitz.v4.ip;
-        prefixLength = netConfig.v4.prefixLength;
-      }
-    )
+    (getNetV4Ip meta.network.virtual.cyprianspitz-vms-nat)
   ];
 
   networking.bridges.vms-nat.interfaces = [ ];
@@ -78,22 +76,5 @@ in
   qois.backplane-net.enable = true;
 
   # Configure this node to be used as an vpn exit node
-  qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    useRoutingFeatures = "server";
-    authKeyFile = config.sops.secrets."tailscale/key".path;
-    extraUpFlags = [
-      "--timeout 60s"
-      "--accept-dns=false"
-      "--login-server=https://vpn.qo.is"
-      "--advertise-exit-node"
-      (
-        with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}"
-      )
-      "--advertise-tags=tag:srv"
-    ];
-  };
-
+  qois.vpn-exit-node.enable = true;
 }

nixos-configurations/cyprianspitz/secrets.nix

@@ -3,8 +3,5 @@
   sops.secrets = {
     "system/hdd" = { };
     "system/initrd-ssh-key" = { };
-    "tailscale/key" = {
-      restartUnits = [ "tailscaled.service" ];
-    };
   };
 }

nixos-configurations/lindberg/networking.nix

@@ -38,7 +38,7 @@ in
     in
     {
       enable = true;
-      resolveLocalQueries = false;
+      resolveLocalQueries = true;
       settings = {
         interface = "vms-nat";
         bind-interfaces = true;
@@ -54,7 +54,14 @@ in
         dhcp-authoritative = true;
       };
     };
-  systemd.services.dnsmasq.bindsTo = [ "network-addresses-vms-nat.service" ];
+  systemd.services.dnsmasq =
+    let
+      vmsNat = [ "network-addresses-vms-nat.service" ];
+    in
+    {
+      bindsTo = vmsNat;
+      after = vmsNat;
+    };
   networking.firewall.interfaces.vms-nat = {
     allowedUDPPorts = [
       53
@@ -74,20 +81,5 @@ in
 
   qois.backplane-net.enable = true;
 
-  # Use this node as vpn exit node
-  qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    useRoutingFeatures = "server";
-    authKeyFile = config.sops.secrets."tailscale/key".path;
-    extraUpFlags = [
-      "--login-server=https://vpn.qo.is"
-      "--advertise-exit-node"
-      (
-        with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}"
-      )
-      "--advertise-tags=tag:srv"
-    ];
-  };
+  qois.vpn-exit-node.enable = true;
 }

nixos-modules/qois/loadbalancer/default.nix

@@ -79,7 +79,7 @@ let
 in
 {
 
-  options.qois.loadbalancer = with lib; {
+  options.qois.loadbalancer = {
     enable = mkEnableOption "Enable services http+s loadbalancing";
 
     domains = mkOption {

nixos-modules/qois/vpn-exit-node/default.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.qois.vpn-exit-node;
+in
+{
+
+  options.qois.vpn-exit-node = {
+    enable = mkEnableOption "vpn exit node";
+    domain = mkOption {
+      description = "Domain for the VPN admin server";
+      type = types.str;
+      default = "vpn.qo.is";
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
+
+    sops.secrets."tailscale/key".restartUnits = [ "tailscaled.service" ];
+
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "server";
+      authKeyFile = config.sops.secrets."tailscale/key".path;
+      extraUpFlags =
+        let
+          backplaneRoute =
+            with config.qois.meta.network.virtual.backplane.v4;
+            "${id}/${builtins.toString prefixLength}";
+        in
+        [
+          "--timeout 60s"
+          "--accept-dns=false"
+          "--accept-routes=false"
+          "--login-server=https://${cfg.domain}"
+          "--advertise-exit-node"
+          "--advertise-routes=${backplaneRoute}"
+          "--advertise-tags=tag:srv"
+        ];
+    };
+  };
+}

nixos-modules/qois/vpn-server/default.nix

@@ -56,6 +56,7 @@ in
       );
 
     networking.firewall.checkReversePath = "loose";
+    networking.firewall.allowedTCPPorts = [ config.services.headscale.port ];
     networking.firewall.allowedUDPPorts = [
       41641
     ];