This repository has no description
3.0 kB
108 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7let
8 domains = [
9 "hackerfleet.eu"
10 "hackerfleet.de"
11 ];
12in
13{
14 containers.riot = {
15 config = {
16 environment.systemPackages = [
17 pkgs.git
18 pkgs.jq
19 ];
20 services.openssh.enable = true;
21 users.users.root.openssh.authorizedKeys.keys = [
22 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
23 ];
24 networking.defaultGateway = "10.233.1.1";
25 systemd.services.autoswitch = {
26 environment = {
27 NIX_REMOTE = "daemon";
28 };
29 wantedBy = [ "multi-user.target" ];
30 serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
31 set -efu
32 if test -e /etc/nixos/configuration.nix; then
33 /run/current-system/sw/bin/nixos-rebuild switch \
34 -I nixpkgs=channel:$(cat /etc/nixos/channel) \
35 -I nixos-config=/etc/nixos/configuration.nix \
36 || :
37 fi
38 '';
39 unitConfig.X-StopOnRemoval = false;
40 };
41 system.stateVersion = config.system.nixos.release;
42 };
43 autoStart = true;
44 enableTun = true;
45 privateNetwork = true;
46 hostAddress = "10.233.1.1";
47 localAddress = "10.233.1.2";
48 };
49 systemd.services."container@riot".restartIfChanged = lib.mkForce false;
50
51 systemd.network.networks."50-ve-riot" = {
52 matchConfig.Name = "ve-riot";
53
54 networkConfig = {
55 # weirdly we have to use POSTROUTING MASQUERADE here
56 # and set ip_forward manually
57 # IPForward = "yes";
58 # IPMasquerade = "both";
59 LinkLocalAddressing = "no";
60 KeepConfiguration = "static";
61 };
62 };
63
64 boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
65
66 krebs.iptables.tables.nat.POSTROUTING.rules = [
67 {
68 v6 = false;
69 predicate = "-s ${config.containers.riot.localAddress}";
70 target = "MASQUERADE";
71 }
72 ];
73
74 # networking.nat can be used instead of this
75 krebs.iptables.tables.nat.PREROUTING.rules = [
76 {
77 predicate = "-p tcp --dport 45622";
78 target = "DNAT --to-destination ${config.containers.riot.localAddress}:22";
79 v6 = false;
80 }
81 ];
82 krebs.iptables.tables.filter.FORWARD.rules = [
83 {
84 predicate = "-i ve-riot";
85 target = "ACCEPT";
86 }
87 {
88 predicate = "-o ve-riot";
89 target = "ACCEPT";
90 }
91 ];
92
93 # non container stuff
94
95 services.nginx.virtualHosts.riot = {
96 serverName = null;
97 serverAliases = domains;
98 };
99
100 krebs.exim-smarthost.extraRouters = ''
101 forward_riot:
102 driver = manualroute
103 domains = ${lib.concatStringsSep ":" domains}
104 transport = remote_smtp
105 route_list = * riot
106 no_more
107 '';
108}