This repository has no description
3.1 kB
112 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 domains = [
10 "hackerfleet.eu"
11 "hackerfleet.de"
12 ];
13in
14{
15 imports = [
16 self.inputs.stockholm.nixosModules.exim-smarthost
17 ];
18 containers.riot = {
19 config = {
20 environment.systemPackages = [
21 pkgs.git
22 pkgs.jq
23 ];
24 services.openssh.enable = true;
25 users.users.root.openssh.authorizedKeys.keys = [
26 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
27 ];
28 networking.defaultGateway = "10.233.1.1";
29 systemd.services.autoswitch = {
30 environment = {
31 NIX_REMOTE = "daemon";
32 };
33 wantedBy = [ "multi-user.target" ];
34 serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
35 set -efu
36 if test -e /etc/nixos/configuration.nix; then
37 /run/current-system/sw/bin/nixos-rebuild switch \
38 -I nixpkgs=channel:$(cat /etc/nixos/channel) \
39 -I nixos-config=/etc/nixos/configuration.nix \
40 || :
41 fi
42 '';
43 unitConfig.X-StopOnRemoval = false;
44 };
45 system.stateVersion = config.system.nixos.release;
46 };
47 autoStart = true;
48 enableTun = true;
49 privateNetwork = true;
50 hostAddress = "10.233.1.1";
51 localAddress = "10.233.1.2";
52 };
53 systemd.services."container@riot".restartIfChanged = lib.mkForce false;
54
55 systemd.network.networks."50-ve-riot" = {
56 matchConfig.Name = "ve-riot";
57
58 networkConfig = {
59 # weirdly we have to use POSTROUTING MASQUERADE here
60 # and set ip_forward manually
61 # IPForward = "yes";
62 # IPMasquerade = "both";
63 LinkLocalAddressing = "no";
64 KeepConfiguration = "static";
65 };
66 };
67
68 boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
69
70 krebs.iptables.tables.nat.POSTROUTING.rules = [
71 {
72 v6 = false;
73 predicate = "-s ${config.containers.riot.localAddress}";
74 target = "MASQUERADE";
75 }
76 ];
77
78 # networking.nat can be used instead of this
79 krebs.iptables.tables.nat.PREROUTING.rules = [
80 {
81 predicate = "-p tcp --dport 45622";
82 target = "DNAT --to-destination ${config.containers.riot.localAddress}:22";
83 v6 = false;
84 }
85 ];
86 krebs.iptables.tables.filter.FORWARD.rules = [
87 {
88 predicate = "-i ve-riot";
89 target = "ACCEPT";
90 }
91 {
92 predicate = "-o ve-riot";
93 target = "ACCEPT";
94 }
95 ];
96
97 # non container stuff
98
99 services.nginx.virtualHosts.riot = {
100 serverName = null;
101 serverAliases = domains;
102 };
103
104 krebs.exim-smarthost.extraRouters = ''
105 forward_riot:
106 driver = manualroute
107 domains = ${lib.concatStringsSep ":" domains}
108 transport = remote_smtp
109 route_list = * riot
110 no_more
111 '';
112}