This repository has no description
2.4 kB
48 lines
1{ config, lib, pkgs, ... }: let
2
3 vmip = "192.168.122.208";
4
5in {
6 users.users.riot = {
7 uid = genid "riot";
8 isNormalUser = true;
9 extraGroups = [ "libvirtd" ];
10 openssh.authorizedKeys.keys = [
11 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMkyCwdwBrsbs3qrNQcy/SqQpex4aaQoAMuT+NDefFc8KVHOMfmkDccEyAggDTgQhUrEVIvo/fFUmGBd9sm1vN1IthO2Qh5nX+qiK/A2R7sxci0Ry6piU03R27JfpZqi6g8TSPNi1C9rC8eBqOfO3OB8oQOkFmM48Q9cmS8AV3ERLR0LaHoEqUbs86JELbtHrMdKk4Hzo8zTM/isP3GO8iDHRt4dBS/03Ve7+WVxgNwWU2HW3a3jJd3tWHrqGmS/ZfCEC/47eIj4WSW+JiH9Q0BarNEbkkMV1Mvm32MX52stGPd5FaIIUtFqD4745iVSiw8esUGFUxJ1RjWgUHr99h riot@vortex"
12 ];
13 };
14
15 networking.interfaces."eth0:0".ip4 = [
16 {
17 address = "213.239.205.246";
18 prefixLength = 24;
19 }
20 ];
21
22 krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
23 { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; }
24 { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; }
25 { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; }
26 { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
27 ];
28
29 krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
30 { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
31 { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
32 { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
33 { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
34 ];
35
36 krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [
37 { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
38 ];
39
40 # TODO use bridge interfaces instead of this crap
41 systemd.services.libvirtd.serviceConfig.ExecStartPost = let
42 restart-iptables = pkgs.writeDash "restart-iptables" ''
43 #soo hacky
44 ${pkgs.coreutils}/bin/sleep 5s
45 ${pkgs.systemd}/bin/systemctl restart krebs-iptables.service
46 '';
47 in restart-iptables;
48}