refactor configuration syntax

This commit is contained in:
Alex 2023-03-24 15:26:39 +01:00
parent e2aea648cf
commit 96566ae523
12 changed files with 144 additions and 185 deletions

View file

@ -1,49 +1,43 @@
{ config, pkgs, ... } @ args: { config, pkgs, ... } @ args:
{ {
deuxfleurs.cluster_name = "staging"; deuxfleurs.clusterName = "staging";
# The IP range to use for the Wireguard overlay of this cluster # The IP range to use for the Wireguard overlay of this cluster
deuxfleurs.cluster_prefix = "10.14.0.0"; deuxfleurs.clusterPrefix = "10.14.0.0/16";
deuxfleurs.cluster_prefix_length = 16;
deuxfleurs.cluster_nodes = [ deuxfleurs.clusterNodes = {
{ "carcajou" = {
hostname = "carcajou"; siteName = "neptune";
site_name = "neptune";
publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk="; publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk=";
IP = "10.14.1.2"; address = "10.14.1.2";
endpoint = "77.207.15.215:33722"; endpoint = "77.207.15.215:33722";
} };
{ "caribou" = {
hostname = "caribou"; siteName = "neptune";
site_name = "neptune";
publicKey = "lABn/axzD1jkFulX8c+K3B3CbKXORlIMDDoe8sQVxhs="; publicKey = "lABn/axzD1jkFulX8c+K3B3CbKXORlIMDDoe8sQVxhs=";
IP = "10.14.1.3"; address = "10.14.1.3";
endpoint = "77.207.15.215:33723"; endpoint = "77.207.15.215:33723";
} };
{ "origan" = {
hostname = "origan"; siteName = "jupiter";
site_name = "jupiter";
publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI="; publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI=";
IP = "10.14.2.33"; address = "10.14.2.33";
endpoint = "82.64.238.84:33733"; endpoint = "82.64.238.84:33733";
} };
{ "piranha" = {
hostname = "piranha"; siteName = "corrin";
site_name = "corrin";
publicKey = "m9rLf+233X1VColmeVrM/xfDGro5W6Gk5N0zqcf32WY="; publicKey = "m9rLf+233X1VColmeVrM/xfDGro5W6Gk5N0zqcf32WY=";
IP = "10.14.3.1"; address = "10.14.3.1";
#endpoint = "82.120.233.78:33721"; #endpoint = "82.120.233.78:33721";
} };
{ "df-pw5" = {
hostname = "df-pw5"; siteName = "bespin";
site_name = "bespin";
publicKey = "XLOYoMXF+PO4jcgfSVAk+thh4VmWx0wzWnb0xs08G1s="; publicKey = "XLOYoMXF+PO4jcgfSVAk+thh4VmWx0wzWnb0xs08G1s=";
IP = "10.14.4.1"; address = "10.14.4.1";
endpoint = "bitfrost.fiber.shirokumo.net:33734"; endpoint = "bitfrost.fiber.shirokumo.net:33734";
} };
]; };
services.wgautomesh.logLevel = "debug"; services.wgautomesh.logLevel = "debug";
# Bootstrap IPs for Consul cluster, # Bootstrap IPs for Consul cluster,
@ -54,7 +48,7 @@
"10.14.1.3" # caribou "10.14.1.3" # caribou
]; ];
deuxfleurs.admin_accounts = { deuxfleurs.adminAccounts = {
lx = [ lx = [
# Keys for accessing nodes from outside # Keys for accessing nodes from outside
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy"
@ -142,16 +136,16 @@
enable = true; enable = true;
port = substituter_port; port = substituter_port;
openFirewall = false; openFirewall = false;
bindAddress = config.deuxfleurs.cluster_ip; bindAddress = "0.0.0.0";
package = pkgs.haskellPackages.nix-serve-ng; package = pkgs.haskellPackages.nix-serve-ng;
}; };
nix.settings.substituters = map nix.settings.substituters = map
({ IP, ... }: "http://${IP}:${builtins.toString substituter_port}") ({ address, ... }: "http://${address}:${builtins.toString substituter_port}")
(builtins.filter (builtins.attrValues (pkgs.lib.filterAttrs
({ site_name, IP, ...}: (hostname: { siteName, ...}:
(IP != config.deuxfleurs.cluster_ip (hostname != config.deuxfleurs.hostName
&& site_name == config.deuxfleurs.site_name)) && siteName == config.deuxfleurs.siteName))
config.deuxfleurs.cluster_nodes); config.deuxfleurs.clusterNodes));
}) })
]; ];
} }

View file

@ -19,11 +19,8 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "carcajou"; deuxfleurs.hostName = "carcajou";
deuxfleurs.ipv6Address = "2001:910:1204:1::22";
deuxfleurs.ipv6 = "2001:910:1204:1::22";
deuxfleurs.cluster_ip = "10.14.1.2";
system.stateVersion = "21.05"; system.stateVersion = "21.05";
} }

View file

@ -8,12 +8,9 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "caribou"; deuxfleurs.hostName = "caribou";
deuxfleurs.ipv6Address = "2001:910:1204:1::23";
deuxfleurs.ipv6 = "2001:910:1204:1::23"; deuxfleurs.isRaftServer = true;
deuxfleurs.cluster_ip = "10.14.1.3";
deuxfleurs.is_raft_server = true;
system.stateVersion = "21.05"; system.stateVersion = "21.05";
} }

View file

@ -9,13 +9,9 @@
boot.loader.efi.efiSysMountPoint = "/boot"; boot.loader.efi.efiSysMountPoint = "/boot";
boot.loader.timeout = 20; boot.loader.timeout = 20;
networking.hostName = "df-pw5"; deuxfleurs.hostName = "df-pw5";
deuxfleurs.staticIPv4.address = "192.168.5.130/24"; deuxfleurs.staticIPv4.address = "192.168.5.130/24";
deuxfleurs.ipv6 = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; deuxfleurs.ipv6Address = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7";
deuxfleurs.cluster_ip = "10.14.4.1";
deuxfleurs.is_raft_server = false;
system.stateVersion = "22.11"; system.stateVersion = "22.11";
} }

View file

@ -8,13 +8,10 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "origan"; deuxfleurs.hostName = "origan";
deuxfleurs.staticIPv4.address = "192.168.1.33/24"; deuxfleurs.staticIPv4.address = "192.168.1.33/24";
deuxfleurs.ipv6 = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; deuxfleurs.ipv6Address = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec";
deuxfleurs.isRaftServer = true;
deuxfleurs.cluster_ip = "10.14.2.33";
deuxfleurs.is_raft_server = true;
system.stateVersion = "22.11"; system.stateVersion = "22.11";
} }

View file

@ -8,13 +8,10 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "piranha"; deuxfleurs.hostName = "piranha";
deuxfleurs.staticIPv4.address = "192.168.1.25/24"; deuxfleurs.staticIPv4.address = "192.168.1.25/24";
deuxfleurs.ipv6 = "2a01:cb05:8984:9900:223:24ff:feb0:ea82"; deuxfleurs.ipv6Address = "2a01:cb05:8984:9900:223:24ff:feb0:ea82";
deuxfleurs.isRaftServer = true;
deuxfleurs.cluster_ip = "10.14.3.1";
deuxfleurs.is_raft_server = true;
system.stateVersion = "22.11"; system.stateVersion = "22.11";
} }

View file

@ -1,9 +1,9 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "bespin"; deuxfleurs.siteName = "bespin";
deuxfleurs.staticIPv4.defaultGateway = "192.168.5.254"; deuxfleurs.staticIPv4.defaultGateway = "192.168.5.254";
deuxfleurs.cname_target = "bespin.site.staging.deuxfleurs.org."; deuxfleurs.cnameTarget = "bespin.site.staging.deuxfleurs.org.";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

View file

@ -1,10 +1,10 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "corrin"; deuxfleurs.siteName = "corrin";
deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
deuxfleurs.cname_target = "corrin.site.staging.deuxfleurs.org."; deuxfleurs.cnameTarget = "corrin.site.staging.deuxfleurs.org.";
deuxfleurs.public_ipv4 = "82.120.233.78"; deuxfleurs.publicIPv4 = "82.120.233.78";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

View file

@ -1,12 +1,9 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "jupiter"; deuxfleurs.siteName = "jupiter";
deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
deuxfleurs.cname_target = "jupiter.site.staging.deuxfleurs.org."; deuxfleurs.cnameTarget = "jupiter.site.staging.deuxfleurs.org.";
# no public ipv4 is used for the staging cluster on Jupiter
# deuxfleurs.public_ipv4 = "???";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

View file

@ -1,12 +1,8 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "neptune"; deuxfleurs.siteName = "neptune";
deuxfleurs.cname_target = "neptune.site.staging.deuxfleurs.org."; deuxfleurs.cnameTarget = "neptune.site.staging.deuxfleurs.org.";
# no public ipv4 is used for the staging cluster on Neptune,
# because the Internet connection is already used for the prod cluster
# deuxfleurs.public_ipv4 = "77.207.15.215";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

View file

@ -6,19 +6,69 @@ in
with builtins; with builtins;
with pkgs.lib; with pkgs.lib;
{ {
options.deuxfleurs = options.deuxfleurs = with types; {
let wg_node = with types; submodule { # Parameters for individual nodes
options = { hostName = mkOption {
hostname = mkOption { description = "Node name";
type = str; type = str;
description = "Host name";
}; };
site_name = mkOption { ipv6Address = mkOption {
description = "Static public IPv6 address of this node";
type = str;
};
staticIPv4.address = mkOption {
description = "IP address (with prefix length) of this node on the local network interface";
type = nullOr str;
default = null;
};
isRaftServer = mkOption {
description = "Make this node a RAFT server for the Nomad and Consul deployments";
type = bool;
default = false;
};
# Parameters that generally vary between sites
siteName = mkOption {
description = "Site (availability zone) on which this node is deployed";
type = str;
};
staticIPv4.defaultGateway = mkOption {
description = "IPv4 address of the default route on the local network interface";
type = nullOr str;
default = null;
};
publicIPv4 = mkOption {
description = "Public IPv4 through which this node is accessible (possibly after port opening using DiploNAT), for domain names that are updated by D53";
type = nullOr str;
default = null;
};
cnameTarget = mkOption {
description = "DNS CNAME target to use for services hosted in this site, for domain names that are updated by D53";
type = nullOr str;
default = null;
};
# Parameters common to all nodes
clusterName = mkOption {
description = "Name of this Deuxfleurs deployment";
type = str;
};
clusterPrefix = mkOption {
description = "IP address prefix (and length) for the Wireguard overlay network";
type = str;
};
clusterNodes = mkOption {
description = "Nodes that are part of the cluster";
type = attrsOf (submodule {
options = {
siteName = mkOption {
type = nullOr str; type = nullOr str;
description = "Site where the node is located"; description = "Site where the node is located";
default = null; default = null;
}; };
IP = mkOption { address = mkOption {
type = str; type = str;
description = "IP Address in the Wireguard network"; description = "IP Address in the Wireguard network";
}; };
@ -32,84 +82,22 @@ in
description = "Wireguard endpoint on the public Internet"; description = "Wireguard endpoint on the public Internet";
}; };
}; };
});
}; };
in adminAccounts = mkOption {
{
# Parameters for individual nodes
ipv6 = mkOption {
description = "Static public IPv6 address of this node";
type = types.str;
};
staticIPv4.address = mkOption {
description = "IP address (with prefix length) of this node on the local network interface";
type = types.nullOr types.str;
default = null;
};
cluster_ip = mkOption {
description = "IP address of this node on the Wesher mesh network";
type = types.str;
};
is_raft_server = mkOption {
description = "Make this node a RAFT server for the Nomad and Consul deployments";
type = types.bool;
default = false;
};
# Parameters that generally vary between sites
site_name = mkOption {
description = "Site (availability zone) on which this node is deployed";
type = types.str;
};
staticIPv4.defaultGateway = mkOption {
description = "IPv4 address of the default route on the local network interface";
type = types.nullOr types.str;
default = null;
};
public_ipv4 = mkOption {
description = "Public IPv4 through which this node is accessible (possibly after port opening using DiploNAT), for domain names that are updated by D53";
type = types.nullOr types.str;
default = null;
};
cname_target = mkOption {
description = "DNS CNAME target to use for services hosted in this site, for domain names that are updated by D53";
type = types.nullOr types.str;
default = null;
};
# Parameters common to all nodes
cluster_name = mkOption {
description = "Name of this Deuxfleurs deployment";
type = types.str;
};
cluster_prefix = mkOption {
description = "IP address prefix for the Wireguard overlay network";
type = types.str;
};
cluster_prefix_length = mkOption {
description = "IP address prefix length for the Wireguard overlay network";
type = types.int;
default = 16;
};
cluster_nodes = mkOption {
description = "Nodes that are part of the cluster";
type = types.listOf wg_node;
};
admin_accounts = mkOption {
description = "List of users having an admin account on cluster nodes, maps user names to a list of authorized SSH keys"; description = "List of users having an admin account on cluster nodes, maps user names to a list of authorized SSH keys";
type = types.attrsOf (types.listOf types.str); type = attrsOf (listOf str);
}; };
bootstrap = mkOption { bootstrap = mkOption {
description = "Whether to enable bootstrapping for Nomad and Consul"; description = "Whether to enable bootstrapping for Nomad and Consul";
type = types.bool; type = bool;
default = false; default = false;
}; };
# Options that generally stay to their default value # Options that generally stay to their default value
wireguardPort = mkOption { wireguardPort = mkOption {
description = "Port for incoming Wireguard VPN connections"; description = "Port for incoming Wireguard VPN connections";
type = types.port; type = port;
default = 33799; default = 33799;
}; };
}; };
@ -119,25 +107,29 @@ in
]; ];
config = config =
let node_meta = { let
"site" = cfg.site_name; clusterNodeCfg = getAttr cfg.hostName cfg.clusterNodes;
"public_ipv6" = cfg.ipv6; clusterAddress = clusterNodeCfg.address;
node_meta = {
"site" = cfg.siteName;
"public_ipv6" = cfg.ipv6Address;
} // } //
(if cfg.public_ipv4 != null (if cfg.publicIPv4 != null
then { "public_ipv4" = cfg.public_ipv4; } then { "public_ipv4" = cfg.publicIPv4; }
else {}) // else {}) //
(if cfg.cname_target != null (if cfg.cnameTarget != null
then { "cname_target" = cfg.cname_target; } then { "cname_target" = cfg.cnameTarget; }
else {}); else {});
in in
{ {
networking.hostName = cfg.hostName;
# Configure admin accounts on all nodes # Configure admin accounts on all nodes
users.users = builtins.mapAttrs (name: publicKeys: { users.users = mapAttrs (name: publicKeys: {
isNormalUser = true; isNormalUser = true;
extraGroups = [ "wheel" ]; extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = publicKeys; openssh.authorizedKeys.keys = publicKeys;
}) cfg.admin_accounts; }) cfg.adminAccounts;
# Configure network interfaces # Configure network interfaces
networking.useDHCP = false; networking.useDHCP = false;
@ -148,7 +140,7 @@ in
Name = "en* eth*"; Name = "en* eth*";
}; };
ipv6AcceptRAConfig = { ipv6AcceptRAConfig = {
Token = "static:${cfg.ipv6}"; Token = "static:${cfg.ipv6Address}";
UseDNS = false; UseDNS = false;
}; };
} // (if cfg.staticIPv4.address == null || cfg.staticIPv4.defaultGateway == null then { } // (if cfg.staticIPv4.address == null || cfg.staticIPv4.defaultGateway == null then {
@ -195,7 +187,7 @@ in
# Forward .consul queries to Consul daemon # Forward .consul queries to Consul daemon
{ {
name = "consul."; name = "consul.";
stub-addr = "${cfg.cluster_ip}@8600"; stub-addr = "${clusterAddress}@8600";
stub-no-cache = true; stub-no-cache = true;
stub-tcp-upstream = false; stub-tcp-upstream = false;
stub-tls-upstream = false; stub-tls-upstream = false;
@ -208,7 +200,7 @@ in
# Configure Wireguard VPN between all nodes # Configure Wireguard VPN between all nodes
networking.wireguard.interfaces.wg0 = { networking.wireguard.interfaces.wg0 = {
ips = [ "${cfg.cluster_ip}/16" ]; ips = [ "${clusterAddress}/16" ];
listenPort = cfg.wireguardPort; listenPort = cfg.wireguardPort;
privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private"; privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
mtu = 1420; mtu = 1420;
@ -220,28 +212,24 @@ in
gossipSecretFile = "/var/lib/wgautomesh/gossip_secret"; gossipSecretFile = "/var/lib/wgautomesh/gossip_secret";
persistFile = "/var/lib/wgautomesh/state"; persistFile = "/var/lib/wgautomesh/state";
upnpForwardPublicPort = upnpForwardPublicPort =
let if clusterNodeCfg.endpoint != null then
us = filter ({ hostname, ...}: hostname == config.networking.hostName) cfg.cluster_nodes; strings.toInt (lists.last (split ":" clusterNodeCfg.endpoint))
in
if length us > 0 && (head us).endpoint != null then
strings.toInt (lists.last (split ":" (head us).endpoint))
else null; else null;
peers = map ({ publicKey, endpoint, IP, ... }: { peers = attrValues (mapAttrs (hostname: { publicKey, endpoint, address, ... }: {
address = IP; inherit address endpoint;
pubkey = publicKey; pubkey = publicKey;
endpoint = endpoint; }) cfg.clusterNodes);
}) cfg.cluster_nodes;
}; };
# Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work # Old code for wg-quick, we can use this as a fallback if we fail to make wgautomesh work
# systemd.services."wg-quick-wg0".after = [ "unbound.service" ]; # systemd.services."wg-quick-wg0".after = [ "unbound.service" ];
# networking.wg-quick.interfaces.wg0 = { # networking.wg-quick.interfaces.wg0 = {
# address = [ "${cfg.cluster_ip}/16" ]; # address = [ "${clusterAddress}/16" ];
# listenPort = cfg.wireguardPort; # listenPort = cfg.wireguardPort;
# privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private"; # privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
# mtu = 1420; # mtu = 1420;
# peers = map ({ publicKey, endpoint, IP, ... }: { # peers = map ({ publicKey, endpoint, address, ... }: {
# inherit publicKey endpoint; # inherit publicKey endpoint;
# allowedIPs = [ "${IP}/32" ]; # allowedIPs = [ "${address}/32" ];
# persistentKeepalive = 25; # persistentKeepalive = 25;
# }; # };
@ -255,25 +243,25 @@ in
''; '';
# Configure /etc/hosts to link all hostnames to their Wireguard IP # Configure /etc/hosts to link all hostnames to their Wireguard IP
networking.extraHosts = builtins.concatStringsSep "\n" (map networking.extraHosts = concatStringsSep "\n" (attrValues (mapAttrs
({ hostname, IP, ...}: "${IP} ${hostname}") (hostname: { address, ...}: "${address} ${hostname}")
cfg.cluster_nodes); cfg.clusterNodes));
# Enable Hashicorp Consul & Nomad # Enable Hashicorp Consul & Nomad
services.consul.enable = true; services.consul.enable = true;
systemd.services.consul.after = [ "wg-quick-wg0.service" ]; systemd.services.consul.after = [ "wg-quick-wg0.service" ];
services.consul.extraConfig = services.consul.extraConfig =
(if cfg.is_raft_server (if cfg.isRaftServer
then { server = true; } then { server = true; }
// (if cfg.bootstrap then { bootstrap_expect = 3; } else {}) // (if cfg.bootstrap then { bootstrap_expect = 3; } else {})
else {}) // else {}) //
{ {
inherit node_meta; inherit node_meta;
datacenter = cfg.cluster_name; datacenter = cfg.clusterName;
ui_config = { ui_config = {
enabled = true; enabled = true;
}; };
bind_addr = "${cfg.cluster_ip}"; bind_addr = "${clusterAddress}";
addresses = { addresses = {
https = "0.0.0.0"; https = "0.0.0.0";
@ -303,18 +291,18 @@ in
pkgs.zstd pkgs.zstd
]; ];
services.nomad.settings = services.nomad.settings =
(if cfg.is_raft_server (if cfg.isRaftServer
then { then {
server = { enabled = true; } server = { enabled = true; }
// (if cfg.bootstrap then { bootstrap_expect = 3; } else {}); // (if cfg.bootstrap then { bootstrap_expect = 3; } else {});
} else {}) // } else {}) //
{ {
region = cfg.cluster_name; region = cfg.clusterName;
datacenter = cfg.site_name; datacenter = cfg.siteName;
advertise = { advertise = {
rpc = "${cfg.cluster_ip}"; rpc = "${clusterAddress}";
http = "${cfg.cluster_ip}"; http = "${clusterAddress}";
serf = "${cfg.cluster_ip}"; serf = "${clusterAddress}";
}; };
consul = { consul = {
address = "localhost:8501"; address = "localhost:8501";
@ -367,7 +355,7 @@ in
allowedTCPPorts = [ allowedTCPPorts = [
# Allow anyone to connect on SSH port # Allow anyone to connect on SSH port
(builtins.head ({ openssh.ports = [22]; } // config.services).openssh.ports) (head ({ openssh.ports = [22]; } // config.services).openssh.ports)
]; ];
allowedUDPPorts = [ allowedUDPPorts = [
@ -385,14 +373,14 @@ in
iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT
# Allow other nodes on VPN to access all ports # Allow other nodes on VPN to access all ports
iptables -A INPUT -s ${cfg.cluster_prefix}/${toString cfg.cluster_prefix_length} -j ACCEPT iptables -A INPUT -s ${cfg.clusterPrefix} -j ACCEPT
''; '';
# When stopping firewall, delete all rules that were configured manually above # When stopping firewall, delete all rules that were configured manually above
extraStopCommands = '' extraStopCommands = ''
iptables -D INPUT -s 192.168.0.0/16 -p udp --sport 1900 -j ACCEPT iptables -D INPUT -s 192.168.0.0/16 -p udp --sport 1900 -j ACCEPT
iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT
iptables -D INPUT -s ${cfg.cluster_prefix}/${toString cfg.cluster_prefix_length} -j ACCEPT iptables -D INPUT -s ${cfg.clusterPrefix} -j ACCEPT
''; '';
}; };
}; };

View file

@ -28,7 +28,7 @@ in
boot.initrd.network.ssh = { boot.initrd.network.ssh = {
enable = true; enable = true;
port = 222; port = 222;
authorizedKeys = concatLists (mapAttrsToList (name: user: user) config.deuxfleurs.admin_accounts); authorizedKeys = concatLists (mapAttrsToList (name: user: user) config.deuxfleurs.adminAccounts);
hostKeys = [ "/var/lib/deuxfleurs/remote-unlock/ssh_host_ed25519_key" ]; hostKeys = [ "/var/lib/deuxfleurs/remote-unlock/ssh_host_ed25519_key" ];
}; };
boot.initrd.network.postCommands = '' boot.initrd.network.postCommands = ''