Arg, fucking port forwarding is shit
This commit is contained in:
parent
098b55d047
commit
d3e395b71d
@ -2,4 +2,4 @@
|
||||
|
||||
{
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@ -26,6 +26,8 @@
|
||||
domain = "rus.selby.ca";
|
||||
site = "russell";
|
||||
profile = "server";
|
||||
ssh-pubkey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB07Jf/NB4OlFSEI/eLJlNLA2sM9cHw1hX43r43nQ7a5";
|
||||
};
|
||||
|
||||
downstairs-desktop = {
|
||||
@ -43,6 +45,8 @@
|
||||
domain = "rus.selby.ca";
|
||||
site = "russell";
|
||||
profile = "desktop";
|
||||
ssh-pubkey =
|
||||
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPqyDT/JqTxWZbpOXzy1Sxba2z2hNzt2BqjLspPvJLVc9zks1GMlnKAY5Nb7y7oi+CzeZMU+KAa069wZ/mYvpas=";
|
||||
};
|
||||
|
||||
france = {
|
||||
@ -59,6 +63,8 @@
|
||||
domain = "fudo.org";
|
||||
site = "portage";
|
||||
profile = "server";
|
||||
ssh-pubkey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1COad5NSK3mi66WK5uWf79NLMf5rk350kvJGsEdDmn";
|
||||
};
|
||||
|
||||
google-wifi = {
|
||||
@ -96,6 +102,8 @@
|
||||
domain = "sea.fudo.org";
|
||||
site = "seattle";
|
||||
profile = "server";
|
||||
ssh-pubkey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHT8Uf6m8ZrSn4nmPyIO+JWLbgXJGX4jJTk0wfqDzzjb";
|
||||
};
|
||||
|
||||
plato = {
|
||||
@ -111,6 +119,8 @@
|
||||
domain = "rus.selby.ca";
|
||||
site = "russell";
|
||||
profile = "server";
|
||||
ssh-pubkey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGuClWAtkOMBOVFAFFdWosCT8NvuJBps46P4RV+Qqz4b";
|
||||
};
|
||||
|
||||
procul = {
|
||||
|
||||
@ -27,6 +27,8 @@ with lib; {
|
||||
"L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
|
||||
"L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
|
||||
"L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
|
||||
"L /etc/ssh/ssh_host_ed25519_key - - - - /state/ssh/ssh_host_ed25519_key"
|
||||
"L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
|
||||
];
|
||||
|
||||
services = {
|
||||
|
||||
@ -59,7 +59,10 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
fail2ban.enable = true;
|
||||
fail2ban = {
|
||||
enable = true;
|
||||
bantime-increment.enable = true;
|
||||
};
|
||||
|
||||
xserver = {
|
||||
layout = "us";
|
||||
|
||||
@ -20,7 +20,6 @@
|
||||
|
||||
fudo.hosts."${hostname}" = {
|
||||
domain = domain;
|
||||
hostname = hostname;
|
||||
site = site;
|
||||
profile = profile;
|
||||
};
|
||||
|
||||
@ -16,6 +16,7 @@ with lib; {
|
||||
./fudo/domains.nix
|
||||
./fudo/garbage-collector.nix
|
||||
./fudo/git.nix
|
||||
./fudo/global.nix
|
||||
./fudo/grafana.nix
|
||||
./fudo/hosts.nix
|
||||
./fudo/ipfs.nix
|
||||
|
||||
@ -1,65 +1,5 @@
|
||||
# General Fudo config, shared across packages
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib; {
|
||||
options.fudo.common = {
|
||||
|
||||
hostname = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
Hostname of the local host (without domain).
|
||||
'';
|
||||
};
|
||||
|
||||
# domain = mkOption {
|
||||
# type = types.str;
|
||||
# description = ''
|
||||
# Domain of the local network.
|
||||
# '';
|
||||
# };
|
||||
|
||||
# local-networks = mkOption {
|
||||
# type = with types; listOf str;
|
||||
# description = ''
|
||||
# A list of networks to consider 'local'. Used by various services to
|
||||
# limit access to the external world.
|
||||
# '';
|
||||
# default = [ ];
|
||||
# };
|
||||
|
||||
# profile = mkOption {
|
||||
# type = with types; nullOr str;
|
||||
# example = "desktop";
|
||||
# description = ''
|
||||
# The profile to use for this host. This will do some profile-dependent
|
||||
# configuration, for example removing X-libs from servers and adding UI
|
||||
# packages to desktops.
|
||||
# '';
|
||||
# default = null;
|
||||
# };
|
||||
|
||||
# site = mkOption {
|
||||
# type = with types; nullOr str;
|
||||
# example = "seattle";
|
||||
# description = ''
|
||||
# The site at which this host is located. This will do some site-dependent
|
||||
# configuration.
|
||||
# '';
|
||||
# default = null;
|
||||
# };
|
||||
|
||||
# www-root = mkOption {
|
||||
# type = types.path;
|
||||
# description = "Path at which to store www files for serving.";
|
||||
# example = /var/www;
|
||||
# };
|
||||
|
||||
# admin-email = mkOption {
|
||||
# type = types.str;
|
||||
# description = "Email for administrator of this system.";
|
||||
# default = "admin@fudo.org";
|
||||
# };
|
||||
|
||||
# enable-gui = mkEnableOption "Install desktop GUI software.";
|
||||
};
|
||||
}
|
||||
with lib;
|
||||
{ }
|
||||
|
||||
5
lib/fudo/global.nix
Normal file
5
lib/fudo/global.nix
Normal file
@ -0,0 +1,5 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib; {
|
||||
config = { };
|
||||
}
|
||||
@ -4,21 +4,28 @@ with lib;
|
||||
let
|
||||
hostOpts = { hostname, ... }: {
|
||||
options = with types; {
|
||||
hostname = mkOption {
|
||||
type = types.str;
|
||||
description = "Hostname (without domain name).";
|
||||
default = hostname;
|
||||
};
|
||||
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
type = str;
|
||||
description =
|
||||
"Domain to which the host belongs, in the form of a domain name.";
|
||||
"Primary domain to which the host belongs, in the form of a domain name.";
|
||||
default = "fudo.org";
|
||||
};
|
||||
|
||||
extra-domains = mkOption {
|
||||
type = listOf str;
|
||||
description = "Extra domain in which this host is reachable.";
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
aliases = mkOption {
|
||||
type = listOf str;
|
||||
description =
|
||||
"Host aliases used by the current host. Note this will be multiplied with extra-domains.";
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
site = mkOption {
|
||||
type = types.str;
|
||||
type = str;
|
||||
description = "Site at which the host is located.";
|
||||
};
|
||||
|
||||
@ -50,7 +57,7 @@ let
|
||||
};
|
||||
|
||||
description = mkOption {
|
||||
type = types.str;
|
||||
type = str;
|
||||
description = "Description of this host.";
|
||||
default = "Another Fudo Host.";
|
||||
};
|
||||
@ -92,6 +99,13 @@ let
|
||||
"List of services which should exist for this host, if it belongs to a realm.";
|
||||
default = [ "ssh" "host" ];
|
||||
};
|
||||
|
||||
ssh-pubkey = mkOption {
|
||||
type = nullOr str;
|
||||
description =
|
||||
"SSH key of the host. Find with `ssh-keyscan`. Skip the hostname, just type and key.";
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -136,5 +150,32 @@ in {
|
||||
enableOnBoot = true;
|
||||
autoPrune.enable = true;
|
||||
};
|
||||
|
||||
programs.ssh.knownHosts = let
|
||||
keyed-hosts =
|
||||
filterAttrs (host: opts: opts.ssh-pubkey != null) config.fudo.hosts;
|
||||
|
||||
traceOut = obj: builtins.trace obj obj;
|
||||
|
||||
crossProduct = f: list0: list1:
|
||||
concatMap (el0: map (el1: f el0 el1) list1) list0;
|
||||
|
||||
getHostnames = hostOpts:
|
||||
[ hostOpts.hostname ]
|
||||
++ (crossProduct (host: domain: "${host}.${domain}")
|
||||
([ hostOpts.hostname ] ++ hostOpts.aliases)
|
||||
([ hostOpts.domain ] ++ hostOpts.extra-domains));
|
||||
|
||||
getHostEntryPairs = host:
|
||||
map (hostname: nameValuePair hostname { publicKey = host.ssh-pubkey; })
|
||||
(getHostnames host);
|
||||
|
||||
hostAttrsToList = hostAttrs:
|
||||
mapAttrsToList (hostname: opts: { hostname = hostname; } // opts)
|
||||
hostAttrs;
|
||||
|
||||
getKnownHosts = hosts:
|
||||
concatMap getHostEntryPairs (hostAttrsToList hosts);
|
||||
in listToAttrs (getKnownHosts keyed-hosts);
|
||||
};
|
||||
}
|
||||
|
||||
@ -34,14 +34,13 @@ let
|
||||
${pkgs.heimdalFull}/bin/kstash --key-file=${key-file} --random-key
|
||||
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- init --realm-max-ticket-life="${max-lifetime}" --realm-max-renewable-life="${max-renewal}" RUS.SELBY.CA
|
||||
${add-hosts-principals realm kdc-conf}
|
||||
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- add --random-key --use-defaults kadmin/${local-hostname}@${realm}
|
||||
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- ext_keytab --keytab=${primary-keytab} */${local-hostname}@${realm}
|
||||
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- ext_keytab --keytab=${kadmin-keytab} kadmin/${local-hostname}@${realm}
|
||||
${pkgs.coreutils}/bin/chown ${user}:${group} ${key-file}
|
||||
${pkgs.coreutils}/bin/chown ${user}:${group} ${db-name}
|
||||
${pkgs.coreutils}/bin/chown ${user}:${group} ${iprop-log}
|
||||
${pkgs.coreutils}/bin/chown ${user}:${group} ${primary-keytab}
|
||||
${pkgs.coreutils}/bin/chown ${user}:${group} ${kadmin-keytab}
|
||||
${pkgs.heimdalFull}/bin/kadmin -l -c ${kdc-conf} -- ext_keytab --keytab=${kadmin-keytab} kadmin/admin@${realm}
|
||||
#${pkgs.coreutils}/bin/chown ${user}:${group} ${key-file}
|
||||
#${pkgs.coreutils}/bin/chown ${user}:${group} ${db-name}
|
||||
#${pkgs.coreutils}/bin/chown ${user}:${group} ${iprop-log}
|
||||
#${pkgs.coreutils}/bin/chown ${user}:${group} ${primary-keytab}
|
||||
#${pkgs.coreutils}/bin/chown ${user}:${group} ${kadmin-keytab}
|
||||
fi
|
||||
'';
|
||||
|
||||
|
||||
@ -435,53 +435,88 @@ in {
|
||||
};
|
||||
|
||||
config = {
|
||||
# boot.kernel.sysctl = mkIf (cfg.internal-port-map != { }) {
|
||||
# "net.ipv4.conf.all.route_localhost" = "1";
|
||||
# };
|
||||
|
||||
# networking.firewall = let
|
||||
# ip-forward-line = protocols: internal: external:
|
||||
# concatStringsSep "\n" (map (protocol:
|
||||
# "${pkgs.iptables}/bin/iptables -t nat -I PREROUTING -p ${protocol} --dport ${
|
||||
# toString external
|
||||
# } -j DNAT --to 127.0.0.1:${toString internal}") protocols);
|
||||
|
||||
# ip-unforward-line = protocols: internal: external:
|
||||
# concatStringsSep "\n" (map (protocol:
|
||||
# "${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -p ${protocol} --dport ${
|
||||
# toString external
|
||||
# } -j DNAT --to 127.0.0.1:${toString internal} || true") protocols);
|
||||
|
||||
# protocol-list = protocol:
|
||||
# if (protocol == null) then [ "tcp" "udp" ] else [ protocol ];
|
||||
# in {
|
||||
# extraCommands = concatStringsSep "\n" (mapAttrsToList (name: opts:
|
||||
# ip-forward-line (protocol-list opts.protocol) opts.internal-port
|
||||
# opts.external-port) cfg.internal-port-map);
|
||||
|
||||
# extraStopCommands = concatStringsSep "\n" (mapAttrsToList (name: opts:
|
||||
# ip-unforward-line (protocol-list opts.protocol) opts.internal-port
|
||||
# opts.external-port) cfg.internal-port-map);
|
||||
# };
|
||||
|
||||
services.xinetd = mkIf ((length (attrNames cfg.internal-port-map)) > 0) {
|
||||
enable = true;
|
||||
services = let
|
||||
svcs = mapAttrsToList (name: opts: opts // { name = name; })
|
||||
cfg.internal-port-map;
|
||||
svcs-protocols = concatMap
|
||||
(svc: map (protocol: svc // { protocol = protocol; }) svc.protocols)
|
||||
svcs;
|
||||
in map (opts: {
|
||||
name = opts.name;
|
||||
unlisted = true;
|
||||
port = opts.external-port;
|
||||
server = "${pkgs.coreutils}/bin/false";
|
||||
extraConfig = "redirect = localhost ${toString opts.internal-port}";
|
||||
protocol = opts.protocol;
|
||||
}) svcs-protocols;
|
||||
boot.kernel.sysctl = mkIf (cfg.internal-port-map != { }) {
|
||||
"net.ipv4.conf.all.route_localnet" = "1";
|
||||
};
|
||||
|
||||
networking.firewall = let
|
||||
iptables = "ip46tables";
|
||||
ip-forward-line = protocols: internal: external:
|
||||
concatStringsSep "\n" (map (protocol: ''
|
||||
# ${iptables} -I PREROUTING -p ${protocol} --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
# ${iptables} -I OUTPUT -p ${protocol} -i lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
# ${iptables} -I OUTPUT -p ${protocol} -o lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
|
||||
# ${iptables} -t nat -I PREROUTING -p ${protocol} --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
# ${iptables} -t nat -I OUTPUT -p ${protocol} -i lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports 127.0.0.1:${toString internal}
|
||||
# ${iptables} -t nat -I OUTPUT -p ${protocol} -o lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
'') protocols);
|
||||
|
||||
ip-unforward-line = protocols: internal: external:
|
||||
concatStringsSep "\n" (map (protocol: ''
|
||||
# ${iptables} -D PREROUTING -p ${protocol} --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
# ${iptables} -D OUTPUT -p ${protocol} -i lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
# ${iptables} -D OUTPUT -p ${protocol} -o lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
|
||||
|
||||
# ${iptables} -t nat -D PREROUTING -p ${protocol} --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
# ${iptables} -t nat -D OUTPUT -p ${protocol} -i lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports 127.0.0.1:${toString internal}
|
||||
# ${iptables} -t nat -D OUTPUT -p ${protocol} -o lo --dport ${
|
||||
toString external
|
||||
} -j REDIRECT --to-ports ${toString internal}
|
||||
'') protocols);
|
||||
in {
|
||||
enable = true;
|
||||
|
||||
extraCommands = concatStringsSep "\n" (mapAttrsToList (name: opts:
|
||||
ip-forward-line opts.protocols opts.internal-port opts.external-port)
|
||||
cfg.internal-port-map);
|
||||
|
||||
extraStopCommands = concatStringsSep "\n" (mapAttrsToList (name: opts:
|
||||
ip-unforward-line opts.protocols opts.internal-port opts.external-port)
|
||||
cfg.internal-port-map);
|
||||
};
|
||||
|
||||
# Services.xinetd = mkIf ((length (attrNames cfg.internal-port-map)) > 0) {
|
||||
# enable = true;
|
||||
# services = let
|
||||
# svcs = mapAttrsToList (name: opts: opts // { name = name; })
|
||||
# cfg.internal-port-map;
|
||||
# svcs-protocols = concatMap
|
||||
# (svc: map (protocol: svc // { protocol = protocol; }) svc.protocols)
|
||||
# svcs;
|
||||
# in map (opts: {
|
||||
# name = opts.name;
|
||||
# unlisted = true;
|
||||
# port = opts.external-port;
|
||||
# server = "${pkgs.coreutils}/bin/false";
|
||||
# extraConfig = "redirect = localhost ${toString opts.internal-port}";
|
||||
# protocol = opts.protocol;
|
||||
# }) svcs-protocols;
|
||||
# };
|
||||
|
||||
systemd.timers = mapAttrs (name: opts: {
|
||||
enable = true;
|
||||
description = opts.description;
|
||||
|
||||
@ -13,6 +13,7 @@ let
|
||||
|
||||
initialize = import ../../initialize.nix;
|
||||
|
||||
# This is a problem...it creates a second source of truth.
|
||||
host-config = ip: config:
|
||||
{ ... }: {
|
||||
imports = [
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user