nixos-config/hosts/nostromo.nix

{ lib, config, pkgs, ... }:

with lib;
let
  hostname = "nostromo";
  host-internal-ip = "10.0.0.1";

in {

  environment.systemPackages = with pkgs; [
    dnsproxy
    google-photos-uploader
    libguestfs-with-appliance
    libvirt
    powerdns
    virtmanager
  ];

  boot.kernelModules = [ "kvm-amd" ];

  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  boot.loader.grub.device = "/dev/sda";

  hardware.bluetooth.enable = false;

  imports = [
    ../defaults.nix
    ../hardware-configuration.nix
  ];

  fudo.common = {
    profile = "server";
    site = "seattle";
  };

  fudo.local-network = {
    enable = true;
    # See fudo/sites/seattle.nix for general settings
    dns-servers = [ host-internal-ip ];
    gateway = host-internal-ip;
    dhcp-interfaces = [ "intif0" ];
    dns-serve-ips = [ host-internal-ip "127.0.0.1" "127.0.1.1" ];
    # Using a pihole running in docker, see below
    recursive-resolver = "${host-internal-ip} port 5353";
    server-ip = host-internal-ip;
  };

  fudo.slynk = {
    # NOTE: for now, had to do: XDG_RUNTIME_DIR=/run/user/$UID systemctl start --user slynk
    enable = true;
  };

  networking = {
    hostName = hostname;

    nameservers = [ host-internal-ip ];

    # Create a bridge for VMs to use
    macvlans = {
      intif0 = {
        interface = "eno1";
        mode = "bridge";
      };
    };

    interfaces = {
      eno1.useDHCP = false;
      eno3.useDHCP = false;
      eno4.useDHCP = false;
      enp33s0f0.useDHCP = false;
      enp33s0f1.useDHCP = false;
      enp9s0f0.useDHCP = false;
      enp9s0f1.useDHCP = false;

      eno2.useDHCP = true;

      intif0 = {
        useDHCP = false;
        macAddress = "46:54:76:06:f1:10";
        ipv4.addresses = [
          {
            address = host-internal-ip;
            prefixLength = 22;
          }
          {
            address = "10.0.10.2";
            prefixLength = 24;
          }
        ];
      };
    };

    nat = {
      enable = true;
      externalInterface = "eno2";
      internalInterfaces = [ "intif0" ];
    };
  };

  users = {
    users = {
      backplane-powerdns = {
        isSystemUser = true;
      };
      backplane-dns = {
        isSystemUser = true;
      };
      fudo-client = {
        isSystemUser = true;
      };
    };

    groups = {
      backplane-powerdns = {
        members = [ "backplane-powerdns" ];
      };
      backplane-dns = {
        members = [ "backplane-dns" ];
      };
    };
  };

  fudo = {
    password.file-generator = {
      dns_backplane_powerdns = {
        file = "/srv/backplane/dns/secure/db_powerdns.passwd";
        user = config.services.postgresql.superUser;
        group = "backplane-powerdns";
        restart-services = [
          "backplane-dns-config-generator.service"
          "postgresql-password-setter.service"
          "backplane-powerdns.service"
        ];
      };
      dns_backplane_database = {
        file = "/srv/backplane/dns/secure/db_backplane.passwd";
        user = config.services.postgresql.superUser;
        group = "backplane-dns";
        restart-services = [
          "backplane-dns.service"
          "postgresql-password-setter.service"
        ];
      };
    };

    backplane.dns = {
      enable = true;
      port = 353;
      listen-addresses = [ "10.0.0.1" ];
      required-services = [ "fudo-passwords.target" ];
      user = "backplane-dns";
      group = "backplane-dns";
      database = {
        username = "backplane_powerdns";
        database = "backplane_dns";
        # Uses an IP to avoid cyclical dependency...not really relevant, but
        # whatever
        host = "127.0.0.1";
        password-file = "/srv/backplane/dns/secure/db_powerdns.passwd";
      };
      backplane = {
        host = "backplane.fudo.org";
        role = "service-dns";
        password-file = "/srv/backplane/dns/secure/backplane.passwd";
        database = {
          username = "backplane_dns";
          database = "backplane_dns";
          host = "127.0.0.1";
          password-file = "/srv/backplane/dns/secure/db_backplane.passwd";
        };
      };
    };

    client.dns = {
      enable = true;
      ipv4 = true;
      ipv6 = true;
      domain = "dyn.fudo.org";
      user = "fudo-client";
      external-interface = "eno2";
      password-file = "/srv/client/secure/client.passwd";
    };

    postgresql = {
      enable = true;
      ssl-private-key = "/srv/nostromo/certs/private/privkey.pem";
      ssl-certificate = "/srv/nostromo/certs/cert.pem";
      keytab = "/srv/nostromo/keytabs/postgres.keytab";
      required-services = [ "fudo-passwords.target" ];

      local-networks = [
        "10.0.0.1/24"
        "127.0.0.1/8"
      ];

      users = {
        backplane_powerdns = {
          password-file = "/srv/backplane/dns/secure/db_powerdns.passwd";
          databases = {
            backplane_dns = {
              access = "CONNECT";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "SELECT";
              };
            };
          };
        };
        backplane_dns = {
          password-file = "/srv/backplane/dns/secure/db_backplane.passwd";
          databases = {
            backplane_dns = {
              access = "CONNECT";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE";
                "ALL SEQUENCES IN SCHEMA public" = "SELECT,UPDATE";
              };
            };
          };
        };
        niten = {
          databases = {
            backplane_dns = {
              access = "ALL PRIVILEGES";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
                "ALL SEQUENCES IN SCHEMA public" = "ALL PRIVILEGES";
              };
            };
          };
        };
      };

      local-users = ["niten"];

      databases = {
        backplane_dns = {
          users = ["niten"];
        };
      };
    };

    secure-dns-proxy = {
      enable = true;
      port = 3535;
      upstream-dns = [
        "https://cloudflare-dns.com/dns-query"
        # "https://dns.adguard.com/dns-query"
      ];
      bootstrap-dns = "1.1.1.1";
    };

    netinfo-email = {
      enable = true;
      env-file = "/srv/netinfo/secure/env";
    };
  };

  virtualisation = {
    docker = {
      enable = true;
      autoPrune.enable = true;
      enableOnBoot = true;
    };

    libvirtd = {
      enable = true;
      qemuPackage = pkgs.qemu_kvm;
      onShutdown = "shutdown";
    };
  };

  docker-containers = {
    pihole = {
      image = "pihole/pihole:4.3.2-1";
      ports = [
        "5353:53/tcp"
        "5353:53/udp"
        "3080:80/tcp"
      ];
      environment = {
        ServerIP = host-internal-ip;
        VIRTUAL_HOST = "dns-hole.sea.fudo.org";
        DNS1 = "1.1.1.1";
        DNS2 = "8.8.8.8";
      };
      volumes = [
        "/srv/pihole/etc-pihole/:/etc/pihole/"
        "/srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
      ];
      # TODO: DNS-over-HTTPS via cloudflared
      # extraDockerOptions = [
      #   "--dns=1.1.1.1"
      # ];
    };
  };

  services = {
    # dhcpd6.enable = true;

    nginx = {
      enable = true;

      virtualHosts = {
        "pihole.sea.fudo.org" = {
          serverAliases = [
            "dns-hole.sea.fudo.org"
            "hole.sea.fudo.org"
          ];

          locations."/" = {
            proxyPass = "http://127.0.0.1:3080";

            extraConfig = ''
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-By $server_addr:$server_port;
              proxy_set_header X-Forwarded-For $remote_addr;
              proxy_set_header X-Forwarded-Proto $scheme;
            '';
          };
        };
      };
    };
  };
}