58 lines
1.2 KiB
Nix
58 lines
1.2 KiB
Nix
{config, ...}: let
|
|
netName = "m-infra";
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/networking/nebula.nix#L12
|
|
userGroup = "nebula-${netName}";
|
|
interface = "nebula.${netName}";
|
|
lhs = {"10.13.0.1" = ["min.rip:4242"];}; # TODO: hardcoding
|
|
lhsInt = builtins.attrNames lhs;
|
|
in {
|
|
sops.secrets."nebula-key" = {
|
|
mode = "0440";
|
|
owner = userGroup;
|
|
group = userGroup;
|
|
};
|
|
|
|
networking.firewall.trustedInterfaces = [interface];
|
|
|
|
services.nebula.networks.${netName} = {
|
|
ca = ../../keys/ca.crt;
|
|
cert = ../../keys/n-srv-eidola.crt;
|
|
key = config.sops.secrets."nebula-key".path;
|
|
|
|
lighthouses = lhsInt;
|
|
relays = lhsInt;
|
|
staticHostMap = lhs;
|
|
|
|
settings.punchy.punch = true;
|
|
|
|
firewall.outbound = [
|
|
{
|
|
port = "any";
|
|
proto = "any";
|
|
host = "any";
|
|
}
|
|
];
|
|
|
|
firewall.inbound = [
|
|
# Allow pings from anyone
|
|
{
|
|
port = "any";
|
|
proto = "icmp";
|
|
host = "any";
|
|
}
|
|
# Allow anything from `internal` group
|
|
{
|
|
port = "any";
|
|
proto = "any";
|
|
groups = ["internal"];
|
|
}
|
|
# Allow SSH from anyone
|
|
{
|
|
port = 22;
|
|
proto = "tcp";
|
|
host = "any";
|
|
}
|
|
];
|
|
};
|
|
}
|