defaults/meta/network-virtual.nix

@@ -93,7 +93,7 @@
 
       cyprianspitz-vms-nat = {
         v4 = {
-          id = "10.247.0.0";
+          id = "10.248.0.0";
           prefixLength = 24;
         };
         domain = "cyprianspitz-vms-nat.net.qo.is";

nixos-configurations/calanda/networking.nix

@@ -4,6 +4,7 @@ let
   meta = config.qois.meta;
   plessur-dmz-net = meta.network.physical.plessur-dmz;
   plessur-lan-net = meta.network.physical.plessur-lan;
+  plessur-ext-net = meta.network.physical.plessur-ext;
   getCalandaIp4 = net: net.hosts.calanda.v4.ip;
 in
 {
@@ -53,6 +54,14 @@ in
     };
   };
 
+  # Assign the static address to cyprianspitz (required for ssh luks unlock at this time)
+  services.dnsmasq.settings.dhcp-host =
+    let
+      cyprianspitzEnp0s31f6Mac = "9c:6b:00:58:6e:90";
+      inherit (plessur-lan-net.hosts.cyprianspitz.v4) ip;
+    in
+    "${cyprianspitzEnp0s31f6Mac},${ip}";
+
   # DMZ
   services.unbound.settings.server = {
     interface = [ plessur-dmz-net.hosts.calanda.v4.ip ];
@@ -66,21 +75,19 @@ in
   # DMZ Portforwarding
   networking.nat.forwardPorts =
     let
-      cyprianspitzPort = (
+      cyprianspitzPortDst = (
-        proto: port: {
+        proto: sourcePort: dstPort: {
-          destination = "10.1.1.11:${toString port}";
+          destination = "${plessur-lan-net.hosts.cyprianspitz.v4.ip}:${toString dstPort}";
-          proto = proto;
+          inherit proto;
-          sourcePort = port;
+          inherit sourcePort;
-          loopbackIPs = [ "85.195.200.253" ];
+          loopbackIPs = [ plessur-ext-net.hosts.calanda.v4.ip ];
         }
       );
+      cyprianspitzPort = proto: port: (cyprianspitzPortDst proto port port);
     in
     [
-      {
+      (cyprianspitzPortDst "tcp" 8222 22)
-        destination = "10.1.1.11:2222";
+      (cyprianspitzPortDst "tcp" 8223 2222)
-        proto = "tcp";
-        sourcePort = 8223;
-      }
     ]
     ++ map (cyprianspitzPort "tcp") [
       80

nixos-configurations/cyprianspitz/README.md

@@ -11,6 +11,13 @@ sops decrypt --extract '["system"]["hdd"]' private/nixos-configurations/cyprians
 ssh -p 8223 root@calanda.plessur-ext.net.qo.is
 ```
 
+
+Direct remote ssh access:
+
+```
+ssh -p 8222 root@calanda.plessur-ext.net.qo.is
+```
+
 ## Hardware
 
 TODO
@@ -29,4 +36,4 @@ TODO
 
 ### HDD Bay
 
-Note that slot 5 (the leftmost) SATA bay is not connected due to the mainboard only having 4 SATA plugs.
+Note that the slot in the middle of the SATA bay is not connected due to the mainboard only having 4 SATA plugs.

nixos-configurations/cyprianspitz/networking.nix

@@ -2,27 +2,34 @@
 
 let
   meta = config.qois.meta;
+  getNetV4Ip = net: {
+    address = net.hosts.cyprianspitz.v4.ip;
+    prefixLength = net.v4.prefixLength;
+  };
+  calandaIp = meta.network.physical.plessur-lan.hosts.calanda.v4.ip;
 in
 {
+  networking.enableIPv6 = false;
   networking.hostName = meta.hosts.cyprianspitz.hostName;
 
+  networking.nameservers = [ calandaIp ];
   networking.useDHCP = false;
-  networking.interfaces.enp0s31f6.useDHCP = true;
+  networking.interfaces.enp0s31f6.ipv4.addresses = [
-  networking.interfaces.enp2s0.useDHCP = true;
+    (getNetV4Ip meta.network.physical.plessur-lan)
+  ];
+
+  networking.defaultGateway = {
+    address = calandaIp;
+    interface = "enp0s31f6";
+  };
 
   # Virtualization
-  networking.interfaces.vms-nat.useDHCP = false;
+  networking.interfaces.vms-nat = {
-  networking.interfaces.vms-nat.ipv4.addresses = [
+    useDHCP = false;
-    (
+    ipv4.addresses = [
-      let
+      (getNetV4Ip meta.network.virtual.cyprianspitz-vms-nat)
-        netConfig = meta.network.virtual.cyprianspitz-vms-nat;
+    ];
-      in
+  };
-      {
-        address = netConfig.hosts.cyprianspitz.v4.ip;
-        prefixLength = netConfig.v4.prefixLength;
-      }
-    )
-  ];
 
   networking.bridges.vms-nat.interfaces = [ ];
   networking.nat = {
@@ -41,6 +48,7 @@ in
       enable = true;
       resolveLocalQueries = true;
       settings = {
+        server = [ calandaIp ];
         interface = "vms-nat";
         bind-interfaces = true;
 
@@ -65,11 +73,10 @@ in
   };
 
   # Boot
-  boot.initrd.network.udhcpc.enable = true;
-
   services.qois.luks-ssh = {
     enable = true;
     interface = "eth0";
+
     sshPort = 2222;
     sshHostKey = "/secrets/system/initrd-ssh-key";
     # TODO Solve sops dependency porblem: config.sops.secrets."system/initrd-ssh-key".path;

nixos-configurations/lindberg/networking.nix

@@ -54,7 +54,14 @@ in
         dhcp-authoritative = true;
       };
     };
-  systemd.services.dnsmasq.bindsTo = [ "network-addresses-vms-nat.service" ];
+  systemd.services.dnsmasq =
+    let
+      vmsNat = [ "network-addresses-vms-nat.service" ];
+    in
+    {
+      bindsTo = vmsNat;
+      after = vmsNat;
+    };
   networking.firewall.interfaces.vms-nat = {
     allowedUDPPorts = [
       53

nixos-modules/qois/vpn-server/default.nix

@@ -80,9 +80,9 @@ in
           dns = {
             base_domain = vpnNet.domain;
             magic_dns = true;
-            nameservers.global = [ vnet.backplane.hosts.calanda.v4.ip ];
+            nameservers.global = [ "127.0.0.1" ];
             search_domains = [
-              # vpnNet.domain # First by default with magic_dns
+              # First is base_domain by default with magic_dns
               vnet.backplane.domain
             ];
             extra_records = pipe cfg.dnsRecords [