67 lines
1.3 KiB
Nix
67 lines
1.3 KiB
Nix
{config, ...}: let
|
|
netName = "m-infra"; # TODO: hardcoding
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/networking/nebula.nix#L12
|
|
userGroup = "nebula-${netName}";
|
|
interface = "nebula.${netName}";
|
|
in {
|
|
sops.secrets."svc-nebula-key" = {
|
|
mode = "0440";
|
|
owner = userGroup;
|
|
group = userGroup;
|
|
};
|
|
|
|
networking.firewall = {
|
|
trustedInterfaces = [interface];
|
|
allowedUDPPorts = [4242];
|
|
};
|
|
|
|
services.nebula.networks.${netName} = {
|
|
ca = ../../../keys/ca.crt;
|
|
cert = ../../../keys/lh-silver.crt;
|
|
key = config.sops.secrets."svc-nebula-key".path;
|
|
|
|
isLighthouse = true;
|
|
isRelay = true;
|
|
|
|
listen = {
|
|
host = "0.0.0.0";
|
|
port = 4242;
|
|
};
|
|
|
|
firewall.outbound = [
|
|
{
|
|
port = "any";
|
|
proto = "any";
|
|
host = "any";
|
|
}
|
|
];
|
|
|
|
firewall.inbound = [
|
|
# Allow pings from anyone
|
|
{
|
|
port = "any";
|
|
proto = "icmp";
|
|
host = "any";
|
|
}
|
|
# Allow anything from `internal` group
|
|
{
|
|
port = "any";
|
|
proto = "any";
|
|
groups = ["internal"];
|
|
}
|
|
# Allow SSH from anyone
|
|
{
|
|
port = 22;
|
|
proto = "tcp";
|
|
host = "any";
|
|
}
|
|
# Allow `kube-apiserver` from anyone
|
|
{
|
|
port = 6443;
|
|
proto = "tcp";
|
|
host = "any";
|
|
}
|
|
];
|
|
};
|
|
}
|