This repository has no description
2.6 kB
83 lines
1{ pkgs, ... }:
2{
3 users.users.riot = {
4 uid = genid "riot";
5 isNormalUser = true;
6 extraGroups = [ "libvirtd" ];
7 openssh.authorizedKeys.keys = [
8 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMkyCwdwBrsbs3qrNQcy/SqQpex4aaQoAMuT+NDefFc8KVHOMfmkDccEyAggDTgQhUrEVIvo/fFUmGBd9sm1vN1IthO2Qh5nX+qiK/A2R7sxci0Ry6piU03R27JfpZqi6g8TSPNi1C9rC8eBqOfO3OB8oQOkFmM48Q9cmS8AV3ERLR0LaHoEqUbs86JELbtHrMdKk4Hzo8zTM/isP3GO8iDHRt4dBS/03Ve7+WVxgNwWU2HW3a3jJd3tWHrqGmS/ZfCEC/47eIj4WSW+JiH9Q0BarNEbkkMV1Mvm32MX52stGPd5FaIIUtFqD4745iVSiw8esUGFUxJ1RjWgUHr99h riot@vortex"
9 ];
10 };
11
12 networking.interfaces."eth0:0".ip4 = [
13 {
14 address = "213.239.205.246";
15 prefixLength = 24;
16 }
17 ];
18
19 krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
20 {
21 v6 = false;
22 predicate = "-d 213.239.205.246 -p tcp --dport 22";
23 target = "DNAT --to-destination 192.168.122.208:22";
24 }
25 {
26 v6 = false;
27 predicate = "-d 213.239.205.246 -p tcp --dport 25";
28 target = "DNAT --to-destination 192.168.122.208:25";
29 }
30 {
31 v6 = false;
32 predicate = "-d 213.239.205.246 -p tcp --dport 80";
33 target = "DNAT --to-destination 192.168.122.208:1080";
34 }
35 {
36 v6 = false;
37 predicate = "-d 213.239.205.246 -p tcp --dport 443";
38 target = "DNAT --to-destination 192.168.122.208:1443";
39 }
40 ];
41
42 krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
43 {
44 v6 = false;
45 predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED";
46 target = "ACCEPT";
47 }
48 {
49 v6 = false;
50 predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED";
51 target = "ACCEPT";
52 }
53 {
54 v6 = false;
55 predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED";
56 target = "ACCEPT";
57 }
58 {
59 v6 = false;
60 predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED";
61 target = "ACCEPT";
62 }
63 ];
64
65 krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [
66 {
67 v6 = false;
68 predicate = "-d 213.239.205.246 -p tcp --dport 443";
69 target = "DNAT --to-destination 192.168.122.208:1443";
70 }
71 ];
72
73 # TODO use bridge interfaces instead of this crap
74 systemd.services.libvirtd.serviceConfig.ExecStartPost =
75 let
76 restart-iptables = pkgs.writeDash "restart-iptables" ''
77 #soo hacky
78 ${pkgs.coreutils}/bin/sleep 5s
79 ${pkgs.systemd}/bin/systemctl restart krebs-iptables.service
80 '';
81 in
82 restart-iptables;
83}