Deuxfleurs/nixcfg
17
6
Fork 2
Code Issues 15 Pull requests 2 Projects Releases Wiki Activity

Simplify network configuration #11

Merged
lx merged 25 commits from simplify-network-config into main 2023-05-16 13:19:33 +00:00
Conversation 0 Commits 25 Files changed 43 +10 -32
5 changed files with 10 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit a0db30ca26 - Show all commits

1
cluster/staging/site/bespin.nix
View file

@ -6,7 +6,6 @@
deuxfleurs.ipv6_default_gateway = "2a02:a03f:6510:5102::1"; deuxfleurs.ipv6_default_gateway = "2a02:a03f:6510:5102::1";
deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.lan_ip_prefix_length = 24;
deuxfleurs.ipv6_prefix_length = 64; deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.5.254" ];
deuxfleurs.cname_target = "bespin.site.staging.deuxfleurs.org."; deuxfleurs.cname_target = "bespin.site.staging.deuxfleurs.org.";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];

1
cluster/staging/site/corrin.nix
View file

@ -6,7 +6,6 @@
deuxfleurs.ipv6_default_gateway = "fe80::7ec1:77ff:fe3e:bb90"; deuxfleurs.ipv6_default_gateway = "fe80::7ec1:77ff:fe3e:bb90";
deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.lan_ip_prefix_length = 24;
deuxfleurs.ipv6_prefix_length = 64; deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.1.1" ];
deuxfleurs.cname_target = "corrin.site.staging.deuxfleurs.org."; deuxfleurs.cname_target = "corrin.site.staging.deuxfleurs.org.";
deuxfleurs.public_ipv4 = "82.120.233.78"; deuxfleurs.public_ipv4 = "82.120.233.78";

1
cluster/staging/site/jupiter.nix
View file

@ -6,7 +6,6 @@
deuxfleurs.ipv6_default_gateway = "fe80::9038:202a:73a0:e73b"; deuxfleurs.ipv6_default_gateway = "fe80::9038:202a:73a0:e73b";
deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.lan_ip_prefix_length = 24;
deuxfleurs.ipv6_prefix_length = 64; deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.1.1" ];
deuxfleurs.cname_target = "jupiter.site.staging.deuxfleurs.org."; deuxfleurs.cname_target = "jupiter.site.staging.deuxfleurs.org.";
# no public ipv4 is used for the staging cluster on Jupiter # no public ipv4 is used for the staging cluster on Jupiter

1
cluster/staging/site/neptune.nix
View file

@ -6,7 +6,6 @@
deuxfleurs.ipv6_default_gateway = "2001:910:1204:1::1"; deuxfleurs.ipv6_default_gateway = "2001:910:1204:1::1";
deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.lan_ip_prefix_length = 24;
deuxfleurs.ipv6_prefix_length = 64; deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.1.1" ];
deuxfleurs.cname_target = "neptune.site.staging.deuxfleurs.org."; deuxfleurs.cname_target = "neptune.site.staging.deuxfleurs.org.";
# no public ipv4 is used for the staging cluster on Neptune, # no public ipv4 is used for the staging cluster on Neptune,

38
nix/deuxfleurs.nix
View file

@ -96,10 +96,6 @@ in
type = types.nullOr types.str; type = types.nullOr types.str;
default = null; default = null;
}; };
nameservers = mkOption {
description = "External DNS servers to use";
type = types.listOf types.str;
};
# Parameters common to all nodes # Parameters common to all nodes
cluster_name = mkOption { cluster_name = mkOption {
@ -190,47 +186,36 @@ in
}; };
}; };
# Configure Unbound DNS to redirect to Consul queries under .consul # Configure Unbound as a central DNS server for everything
# and to pass directly to public DNS resolver all others # - is its own recursor (applies DNSSec) for everything,
# no need to declare an outside nameserver
# - redirects to Consul queries under .consul
services.unbound = { services.unbound = {
enable = true; enable = true;
enableRootTrustAnchor = false; # disable DNSSEC as it causes issues
settings = { settings = {
server = { server = {
interface = [ "127.0.0.1" "${cfg.lan_ip}" "172.17.0.1" ]; interface = [ "127.0.0.1" "172.17.0.1" ];
domain-insecure = [ "consul." ]; domain-insecure = [ "consul." ];
local-zone = [ "consul. nodefault" ]; local-zone = [ "consul. nodefault" ];
log-servfail = true; log-servfail = true;
access-control = [ access-control = [
"127.0.0.0/8 allow" "127.0.0.0/8 allow"
"${cfg.lan_ip}/${toString cfg.lan_ip_prefix_length} allow"
"172.17.0.0/16 allow" "172.17.0.0/16 allow"
]; ];
}; };
forward-zone = [ stub-zone = [
# Forward .consul queries to Consul daemon # Forward .consul queries to Consul daemon
{ {
name = "consul."; name = "consul.";
forward-addr = "${cfg.lan_ip}@8600"; stub-addr = "${cfg.cluster_ip}@8600";
forward-no-cache = true; stub-no-cache = true;
forward-tcp-upstream = false; stub-tcp-upstream = false;
forward-tls-upstream = false; stub-tls-upstream = false;
}
# Forward all queries to our ISP's nameserver
{
name = ".";
forward-addr = cfg.nameservers;
forward-first = true;
} }
]; ];
}; };
resolveLocalQueries = true; resolveLocalQueries = true;
}; };
# Reach Unbound through the IP of our LAN interface,
# instead of 127.0.0.1 (this will also work in Docker containers)
networking.nameservers = [ # TODO remove this ?
cfg.lan_ip
];
services.resolved.enable = false; services.resolved.enable = false;
# Configure Wireguard VPN between all nodes # Configure Wireguard VPN between all nodes
@ -321,9 +306,6 @@ in
verify_outgoing = true; verify_outgoing = true;
verify_server_hostname = true; verify_server_hostname = true;
}; };
systemd.services.consul.serviceConfig = { # TODO remove this ?
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
};
services.nomad.enable = true; services.nomad.enable = true;
systemd.services.nomad.after = [ "wg-quick-wg0.service" ]; systemd.services.nomad.after = [ "wg-quick-wg0.service" ];