From 08ac2fb6dc3aaaa56feb20223375f6dc4af289d0 Mon Sep 17 00:00:00 2001 From: Tyler Starr Date: Sat, 23 Sep 2023 10:39:48 -0700 Subject: [PATCH 1/4] add wireguard server for torus --- provision/nixos/hosts/torus/configuration.nix | 1 + provision/nixos/modules/services/default.nix | 2 +- .../modules/services/wireguard-server.nix | 54 +++++++++++++++++++ 3 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 provision/nixos/modules/services/wireguard-server.nix diff --git a/provision/nixos/hosts/torus/configuration.nix b/provision/nixos/hosts/torus/configuration.nix index 385ca5e7..2ce3bd55 100644 --- a/provision/nixos/hosts/torus/configuration.nix +++ b/provision/nixos/hosts/torus/configuration.nix @@ -126,6 +126,7 @@ samba-server.enable = true; jellyfin.enable = true; syncthing.enable = true; + wireguard-server.enable = true; }; system = { terminal.enable = true; diff --git a/provision/nixos/modules/services/default.nix b/provision/nixos/modules/services/default.nix index ecbd0763..aeee625d 100644 --- a/provision/nixos/modules/services/default.nix +++ b/provision/nixos/modules/services/default.nix @@ -1,4 +1,4 @@ { ... }: { - imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ]; + imports = [ ./wireguard-server.nix ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ]; } diff --git a/provision/nixos/modules/services/wireguard-server.nix b/provision/nixos/modules/services/wireguard-server.nix new file mode 100644 index 00000000..11ab2da9 --- /dev/null +++ b/provision/nixos/modules/services/wireguard-server.nix @@ -0,0 +1,54 @@ +{ config, lib, pkgs, ... }: + +let cfg = config.modules.services.wireguard-server; +in { + options.modules.services.wireguard-server.enable = lib.mkEnableOption "wireguard-server"; + config = lib.mkIf cfg.enable { + # enable NAT + networking.nat.enable = true; + networking.nat.externalInterface = "enp4s0"; + networking.nat.internalInterfaces = [ "wg0" ]; + networking.firewall = { + allowedUDPPorts = [ 51820 ]; + }; + + networking.wireguard.interfaces = { + # "wg0" is the network interface name. You can name the interface arbitrarily. + wg0 = { + # Determines the IP address and subnet of the server's end of the tunnel interface. + ips = [ "10.100.0.1/24" ]; + + # The port that WireGuard listens to. Must be accessible by the client. + listenPort = 51820; + + # This allows the wireguard server to route your traffic to the internet and hence be like a VPN + # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients + postSetup = '' + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE + ''; + + # This undoes the above command + postShutdown = '' + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE + ''; + + # Path to the private key file. + # + # Note: The private key can also be included inline via the privateKey option, + # but this makes the private key world-readable; thus, using privateKeyFile is + # recommended. + privateKeyFile = "/engi/apps/wireguard/torus-adjudicator"; + + peers = [ + # List of allowed peers. + { # Feel free to give a meaning full name + # Public key of the peer (not a file path). + publicKey = "boy07PYDJT8TuG6Zkwg1KqhKeoakc7GH7UxAw9NuSjE"; + # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing. + allowedIPs = [ "10.100.0.2/32" ]; + } + ]; + }; + }; + }; +} From 30b85b90c5b079b78e103aaf8899327d3c62f5fc Mon Sep 17 00:00:00 2001 From: Tyler Starr Date: Sat, 7 Oct 2023 02:00:29 -0700 Subject: [PATCH 2/4] Fix wireguard on Torus --- provision/nixos/hosts/torus/configuration.nix | 13 ++-- .../modules/services/wireguard-server.nix | 63 ++++++++++--------- 2 files changed, 40 insertions(+), 36 deletions(-) diff --git a/provision/nixos/hosts/torus/configuration.nix b/provision/nixos/hosts/torus/configuration.nix index 2ce3bd55..1bc75d62 100644 --- a/provision/nixos/hosts/torus/configuration.nix +++ b/provision/nixos/hosts/torus/configuration.nix @@ -28,8 +28,14 @@ # Set networking options networking.hostName = "torus"; - networking.networkmanager.enable = true; + # Needed for wireguard-server + boot.kernel.sysctl = { + "net.ipv4.conf.all.forwarding" = true; + }; + networking.firewall.enable = true; networking.firewall.checkReversePath = "loose"; + networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.allowedUDPPorts = [ 80 443 ]; # Set your time zone. time.timeZone = "America/Los_Angeles"; @@ -78,8 +84,6 @@ defaults.email = "starrtyler88@gmail.com"; }; - networking.firewall.allowedTCPPorts = [ 80 443 ]; - networking.firewall.allowedUDPPorts = [ 80 443 ]; security.pam.services.nginx.setEnvironment = false; systemd.services.nginx.serviceConfig = { @@ -103,9 +107,6 @@ "media.tstarr.us" = (SSL // { locations."/".proxyPass = "http://localhost:8096/"; }); - "joplin.tstarr.us" = (SSL // { - locations."/".proxyPass = "http://localhost:22300/"; - }); "wiki.tstarr.us" = (SSL // { locations."/".proxyPass = "http://localhost:4567/"; extraConfig = '' diff --git a/provision/nixos/modules/services/wireguard-server.nix b/provision/nixos/modules/services/wireguard-server.nix index 11ab2da9..e6cd3389 100644 --- a/provision/nixos/modules/services/wireguard-server.nix +++ b/provision/nixos/modules/services/wireguard-server.nix @@ -4,49 +4,52 @@ let cfg = config.modules.services.wireguard-server; in { options.modules.services.wireguard-server.enable = lib.mkEnableOption "wireguard-server"; config = lib.mkIf cfg.enable { - # enable NAT - networking.nat.enable = true; - networking.nat.externalInterface = "enp4s0"; - networking.nat.internalInterfaces = [ "wg0" ]; - networking.firewall = { - allowedUDPPorts = [ 51820 ]; + # Enable NAT + networking.nat = { + enable = true; + enableIPv6 = true; + externalInterface = "enp4s0"; + internalInterfaces = [ "wg0" ]; }; - networking.wireguard.interfaces = { + # Open ports in the firewall + networking.firewall = { + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 51820 ]; + }; + + networking.wg-quick.interfaces = { # "wg0" is the network interface name. You can name the interface arbitrarily. wg0 = { - # Determines the IP address and subnet of the server's end of the tunnel interface. - ips = [ "10.100.0.1/24" ]; - - # The port that WireGuard listens to. Must be accessible by the client. + # Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface + address = [ "192.168.2.1/24" ]; + # The port that WireGuard listens to - recommended that this be changed from default listenPort = 51820; + # Path to the server's private key + privateKeyFile = "/engi/apps/wireguard/private"; # This allows the wireguard server to route your traffic to the internet and hence be like a VPN - # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients - postSetup = '' - ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE + postUp = '' + ${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE + ''; - # This undoes the above command - postShutdown = '' - ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE + # Undo the above + preDown = '' + ${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE ''; - # Path to the private key file. - # - # Note: The private key can also be included inline via the privateKey option, - # but this makes the private key world-readable; thus, using privateKeyFile is - # recommended. - privateKeyFile = "/engi/apps/wireguard/torus-adjudicator"; - peers = [ - # List of allowed peers. - { # Feel free to give a meaning full name - # Public key of the peer (not a file path). - publicKey = "boy07PYDJT8TuG6Zkwg1KqhKeoakc7GH7UxAw9NuSjE"; - # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing. - allowedIPs = [ "10.100.0.2/32" ]; + { + # Adjudicator + publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM="; + allowedIPs = [ "192.168.2.2/32" ]; } + # More peers can be added here. ]; }; }; From 5a58d747995fb06ae303e852598ab530a0094980 Mon Sep 17 00:00:00 2001 From: Tyler Starr Date: Sat, 7 Oct 2023 02:04:31 -0700 Subject: [PATCH 3/4] Move wireguard server outside of modules --- provision/nixos/hosts/torus/configuration.nix | 7 ++- .../nixos/hosts/torus/wireguard-server.nix | 52 +++++++++++++++++ provision/nixos/modules/services/default.nix | 2 +- .../modules/services/wireguard-server.nix | 57 ------------------- 4 files changed, 58 insertions(+), 60 deletions(-) create mode 100644 provision/nixos/hosts/torus/wireguard-server.nix delete mode 100644 provision/nixos/modules/services/wireguard-server.nix diff --git a/provision/nixos/hosts/torus/configuration.nix b/provision/nixos/hosts/torus/configuration.nix index 1bc75d62..e176bcf7 100644 --- a/provision/nixos/hosts/torus/configuration.nix +++ b/provision/nixos/hosts/torus/configuration.nix @@ -1,5 +1,10 @@ { config, pkgs, user, lib, ... }: { + imports = [ + ./wireguard-server.nix + ../../modules + ]; + nix = { package = pkgs.nixFlakes; extraOptions = "experimental-features = nix-command flakes"; @@ -118,7 +123,6 @@ }; # Enable modules - imports = [ ../../modules ]; modules = { devel = { tooling.enable = true; @@ -127,7 +131,6 @@ samba-server.enable = true; jellyfin.enable = true; syncthing.enable = true; - wireguard-server.enable = true; }; system = { terminal.enable = true; diff --git a/provision/nixos/hosts/torus/wireguard-server.nix b/provision/nixos/hosts/torus/wireguard-server.nix new file mode 100644 index 00000000..f039a55d --- /dev/null +++ b/provision/nixos/hosts/torus/wireguard-server.nix @@ -0,0 +1,52 @@ +{ config, lib, pkgs, ... }: +{ + # Enable NAT + networking.nat = { + enable = true; + enableIPv6 = true; + externalInterface = "enp4s0"; + internalInterfaces = [ "wg0" ]; + }; + + # Open ports in the firewall + networking.firewall = { + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 51820 ]; + }; + + networking.wg-quick.interfaces = { + # "wg0" is the network interface name. You can name the interface arbitrarily. + wg0 = { + # Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface + address = [ "192.168.2.1/24" ]; + # The port that WireGuard listens to - recommended that this be changed from default + listenPort = 51820; + # Path to the server's private key + privateKeyFile = "/engi/apps/wireguard/private"; + + # This allows the wireguard server to route your traffic to the internet and hence be like a VPN + postUp = '' + ${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE + + ''; + + # Undo the above + preDown = '' + ${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE + ''; + + peers = [ + { + # Adjudicator + publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM="; + allowedIPs = [ "192.168.2.2/32" ]; + } + # More peers can be added here. + ]; + }; + }; +} diff --git a/provision/nixos/modules/services/default.nix b/provision/nixos/modules/services/default.nix index aeee625d..ecbd0763 100644 --- a/provision/nixos/modules/services/default.nix +++ b/provision/nixos/modules/services/default.nix @@ -1,4 +1,4 @@ { ... }: { - imports = [ ./wireguard-server.nix ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ]; + imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ]; } diff --git a/provision/nixos/modules/services/wireguard-server.nix b/provision/nixos/modules/services/wireguard-server.nix deleted file mode 100644 index e6cd3389..00000000 --- a/provision/nixos/modules/services/wireguard-server.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ config, lib, pkgs, ... }: - -let cfg = config.modules.services.wireguard-server; -in { - options.modules.services.wireguard-server.enable = lib.mkEnableOption "wireguard-server"; - config = lib.mkIf cfg.enable { - # Enable NAT - networking.nat = { - enable = true; - enableIPv6 = true; - externalInterface = "enp4s0"; - internalInterfaces = [ "wg0" ]; - }; - - # Open ports in the firewall - networking.firewall = { - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 51820 ]; - }; - - networking.wg-quick.interfaces = { - # "wg0" is the network interface name. You can name the interface arbitrarily. - wg0 = { - # Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface - address = [ "192.168.2.1/24" ]; - # The port that WireGuard listens to - recommended that this be changed from default - listenPort = 51820; - # Path to the server's private key - privateKeyFile = "/engi/apps/wireguard/private"; - - # This allows the wireguard server to route your traffic to the internet and hence be like a VPN - postUp = '' - ${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT - ${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT - ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE - - ''; - - # Undo the above - preDown = '' - ${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT - ${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT - ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE - ''; - - peers = [ - { - # Adjudicator - publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM="; - allowedIPs = [ "192.168.2.2/32" ]; - } - # More peers can be added here. - ]; - }; - }; - }; -} From b226a0c55d97e2ed330b3573fabb28ae0371463f Mon Sep 17 00:00:00 2001 From: Tyler Starr Date: Sat, 7 Oct 2023 02:11:46 -0700 Subject: [PATCH 4/4] Move samba server outside of modules --- provision/nixos/hosts/torus/configuration.nix | 2 +- provision/nixos/hosts/torus/samba-server.nix | 41 +++++++++++++++++ provision/nixos/modules/services/default.nix | 2 +- .../nixos/modules/services/samba-server.nix | 46 ------------------- 4 files changed, 43 insertions(+), 48 deletions(-) create mode 100644 provision/nixos/hosts/torus/samba-server.nix delete mode 100644 provision/nixos/modules/services/samba-server.nix diff --git a/provision/nixos/hosts/torus/configuration.nix b/provision/nixos/hosts/torus/configuration.nix index e176bcf7..4f441c6a 100644 --- a/provision/nixos/hosts/torus/configuration.nix +++ b/provision/nixos/hosts/torus/configuration.nix @@ -2,6 +2,7 @@ { imports = [ ./wireguard-server.nix + ./samba-server.nix ../../modules ]; @@ -128,7 +129,6 @@ tooling.enable = true; }; services = { - samba-server.enable = true; jellyfin.enable = true; syncthing.enable = true; }; diff --git a/provision/nixos/hosts/torus/samba-server.nix b/provision/nixos/hosts/torus/samba-server.nix new file mode 100644 index 00000000..015086ba --- /dev/null +++ b/provision/nixos/hosts/torus/samba-server.nix @@ -0,0 +1,41 @@ +{ config, lib, pkgs, ... }: +{ + services.samba = { + enable = true; + extraConfig = '' + workgroup = WORKGROUP + server string = smbnix + netbios name = smbnix + security = user + hosts allow = 192.168.1. 127.0.0.1 localhost + hosts deny = 0.0.0.0/0 + guest account = nobody + map to guest = bad user + ''; + + shares = { + private = { + "path" = "/engi"; + browseable = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "force user" = "tstarr"; + "force group" = "users"; + }; + public = { + "path" = "/engi"; + browseable = "yes"; + "read only" = "yes"; + "guest ok" = "yes"; + }; + }; + }; + + # Curiously, `services.samba` does not automatically open + # the needed ports in the firewall. + networking.firewall.allowedTCPPorts = [ 445 139 ]; + networking.firewall.allowedUDPPorts = [ 137 138 ]; + + # To make SMB mounting easier on the command line + environment.systemPackages = with pkgs; [ cifs-utils ]; +} diff --git a/provision/nixos/modules/services/default.nix b/provision/nixos/modules/services/default.nix index ecbd0763..2cd18a94 100644 --- a/provision/nixos/modules/services/default.nix +++ b/provision/nixos/modules/services/default.nix @@ -1,4 +1,4 @@ { ... }: { - imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ]; + imports = [ ./syncthing.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ]; } diff --git a/provision/nixos/modules/services/samba-server.nix b/provision/nixos/modules/services/samba-server.nix deleted file mode 100644 index b328c842..00000000 --- a/provision/nixos/modules/services/samba-server.nix +++ /dev/null @@ -1,46 +0,0 @@ -{ config, lib, pkgs, ... }: - -let cfg = config.modules.services.samba-server; -in { - options.modules.services.samba-server.enable = lib.mkEnableOption "samba-server"; - config = lib.mkIf cfg.enable { - services.samba = { - enable = true; - extraConfig = '' - workgroup = WORKGROUP - server string = smbnix - netbios name = smbnix - security = user - hosts allow = 192.168.1. 127.0.0.1 localhost - hosts deny = 0.0.0.0/0 - guest account = nobody - map to guest = bad user - ''; - - shares = { - private = { - "path" = "/engi"; - browseable = "yes"; - "read only" = "no"; - "guest ok" = "no"; - "force user" = "tstarr"; - "force group" = "users"; - }; - public = { - "path" = "/engi"; - browseable = "yes"; - "read only" = "yes"; - "guest ok" = "yes"; - }; - }; - }; - - # Curiously, `services.samba` does not automatically open - # the needed ports in the firewall. - networking.firewall.allowedTCPPorts = [ 445 139 ]; - networking.firewall.allowedUDPPorts = [ 137 138 ]; - - # To make SMB mounting easier on the command line - environment.systemPackages = with pkgs; [ cifs-utils ]; - }; -}