This repository has no description
3.0 kB
91 lines
1{ self, config, lib, pkgs, ... }: let
2 domains = [
3 "hackerfleet.eu"
4 "hackerfleet.de"
5 ];
6in {
7 imports = [
8 self.inputs.stockholm.nixosModules.exim-smarthost
9 ];
10 containers.riot = {
11 config = {
12 environment.systemPackages = [
13 pkgs.git
14 pkgs.jq
15 ];
16 services.openssh.enable = true;
17 users.users.root.openssh.authorizedKeys.keys = [
18 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
19 ];
20 networking.defaultGateway = "10.233.1.1";
21 systemd.services.autoswitch = {
22 environment = {
23 NIX_REMOTE = "daemon";
24 };
25 wantedBy = [ "multi-user.target" ];
26 serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
27 set -efu
28 if test -e /etc/nixos/configuration.nix; then
29 /run/current-system/sw/bin/nixos-rebuild switch \
30 -I nixpkgs=channel:$(cat /etc/nixos/channel) \
31 -I nixos-config=/etc/nixos/configuration.nix \
32 || :
33 fi
34 '';
35 unitConfig.X-StopOnRemoval = false;
36 };
37 system.stateVersion = config.system.nixos.release;
38 };
39 autoStart = true;
40 enableTun = true;
41 privateNetwork = true;
42 hostAddress = "10.233.1.1";
43 localAddress = "10.233.1.2";
44 };
45 systemd.services."container@riot".restartIfChanged = lib.mkForce false;
46
47 systemd.network.networks."50-ve-riot" = {
48 matchConfig.Name = "ve-riot";
49
50 networkConfig = {
51 # weirdly we have to use POSTROUTING MASQUERADE here
52 # and set ip_forward manually
53 # IPForward = "yes";
54 # IPMasquerade = "both";
55 LinkLocalAddressing = "no";
56 KeepConfiguration = "static";
57 };
58 };
59
60 boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
61
62 krebs.iptables.tables.nat.POSTROUTING.rules = [
63 { v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; }
64 ];
65
66 # networking.nat can be used instead of this
67 krebs.iptables.tables.nat.PREROUTING.rules = [
68 { predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; }
69 ];
70 krebs.iptables.tables.filter.FORWARD.rules = [
71 { predicate = "-i ve-riot"; target = "ACCEPT"; }
72 { predicate = "-o ve-riot"; target = "ACCEPT"; }
73 ];
74
75
76 # non container stuff
77
78 services.nginx.virtualHosts.riot = {
79 serverName = null;
80 serverAliases = domains;
81 };
82
83 krebs.exim-smarthost.extraRouters = ''
84 forward_riot:
85 driver = manualroute
86 domains = ${lib.concatStringsSep ":" domains}
87 transport = remote_smtp
88 route_list = * riot
89 no_more
90 '';
91}