92 lines
2 KiB
Nix
92 lines
2 KiB
Nix
|
/*
|
||
|
|
|
||
|
|
Name: https://en.wikipedia.org/wiki/Ash_(Alien)
|
||
|
|
Why: Infilitrate into the network
|
||
|
|
Type: VM
|
||
|
|
Hardware: -
|
||
|
|
From: 2023
|
||
|
|
Role: Wireguard (VPN) Server
|
||
|
|
Notes: Thius vpn is for admin use only, to give access to all the servers via ssh
|
||
|
|
|
||
|
|
*/
|
||
|
|
|
||
|
|
{ pkgs, lib, nodes, ... }:
|
||
|
|
let
|
||
|
|
# name of the server, sets teh hostname and record for it
|
||
|
|
name = "ash";
|
||
|
|
ip_pub = "193.1.99.75";
|
||
|
|
ip_priv = "172.20.20.5";
|
||
|
|
# hostname = "${name}.skynet.ie";
|
||
|
|
hostname = ip_pub;
|
||
|
|
|
||
|
|
in {
|
||
|
|
imports = [
|
||
|
|
# applications for this particular server
|
||
|
|
../applications/firewall.nix
|
||
|
|
../applications/dns.nix
|
||
|
|
];
|
||
|
|
|
||
|
|
deployment = {
|
||
|
|
targetHost = hostname;
|
||
|
|
targetPort = 22;
|
||
|
|
targetUser = "root";
|
||
|
|
};
|
||
|
|
|
||
|
|
# these two are to be able to add the rules for firewall and dns
|
||
|
|
# open the firewall for this
|
||
|
|
skynet_firewall.forward = [
|
||
|
|
"ip saddr ${ip_pub} udp dport 51820 counter packets 0 bytes 0 accept"
|
||
|
|
];
|
||
|
|
|
||
|
|
skynet_dns.records = {
|
||
|
|
external = [
|
||
|
|
"${name} A ${ip_pub}"
|
||
|
|
];
|
||
|
|
cname = [
|
||
|
|
#may asw ell add a cname for this
|
||
|
|
"wg CNAME ${name}"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
age.secrets.wireguard.file = ../secrets/wireguard.age;
|
||
|
|
|
||
|
|
networking = {
|
||
|
|
nat = {
|
||
|
|
enable = true;
|
||
|
|
externalInterface = "eth0";
|
||
|
|
internalInterfaces = ["wg0"];
|
||
|
|
};
|
||
|
|
|
||
|
|
firewall = {
|
||
|
|
allowedTCPPorts = [22];
|
||
|
|
allowedUDPPorts = [51820];
|
||
|
|
interfaces.wg0 = {
|
||
|
|
allowedTCPPorts = [53];
|
||
|
|
allowedUDPPorts = [53];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
wireguard.interfaces.wg0 = {
|
||
|
|
# may need to change this to the same base as the full network
|
||
|
|
ips = ["172.20.21.0/24"];
|
||
|
|
listenPort = 51820;
|
||
|
|
privateKeyFile = "/run/agenix/wireguard";
|
||
|
|
|
||
|
|
peers = [
|
||
|
|
{ # silver - Brendan
|
||
|
|
publicKey = "46jMR/DzJ4rQCR8MBqLMwcyr2tsSII/xeCjihb6EQgQ=";
|
||
|
|
allowedIPs = [ "172.20.21.2/32" ];
|
||
|
|
}
|
||
|
|
];
|
||
|
|
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
environment.systemPackages = [
|
||
|
|
# needed to generate keys
|
||
|
|
pkgs.wireguard-tools
|
||
|
|
];
|
||
|
|
|
||
|
|
}
|