rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-25 08:06:19 +02:00
Code Issues Projects Releases Packages Wiki Activity

wireguard and fail2ban

Browse source
This commit is contained in:
Rouven Seifert 2023-10-22 15:45:30 +02:00
parent 78a47101ac
commit 5148ff5953
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
15 changed files with 132 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/falkenstein-1/default.nix
View file

@ -5,7 +5,8 @@
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./modules/backup
# ./modules/backup
./modules/fail2ban
./modules/mail
./modules/networks
./modules/nginx

2
hosts/falkenstein-1/modules/backup/default.nix
View file

@ -5,8 +5,6 @@
services.borgmatic = {
enable = true;
settings = {
# fix failing check
location = null;
source_directories = [
"/var/lib"
"/var/log"

25
hosts/falkenstein-1/modules/fail2ban/default.nix Normal file
View file

@ -0,0 +1,25 @@
{ ... }:
{
services.fail2ban = {
enable = true;
bantime = "10m";
bantime-increment = {
enable = true;
};
jails = {
dovecot = ''
enabled = true
# aggressive mode add blocking for aborted connections
filter = dovecot[mode=aggressive]
bantime = 10m
maxretry = 3
'';
postfix = ''
enabled = true
filter = postfix[mode=aggressive]
maxretry = 3
'';
};
};
}

15
hosts/falkenstein-1/modules/networks/default.nix
View file

@ -42,8 +42,7 @@
netdevs."30-dorm" = {
netdevConfig = {
Kind = "wireguard";
Name = "dorm";
Description = "WireGuard to my Dorm Infra";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wireguard/dorm/private".path;
@ -52,29 +51,29 @@
wireguardPeers = [
{
wireguardPeerConfig = {
PublicKey = "vUmworuJFHjB4KUdkucQ+nzqO2ysARLomq4UuK1n430=";
PublicKey = "Z5lwwHTCDr6OF4lfaCdSHNveunOn4RzuOQeyB+El9mQ=";
PresharedKeyFile = config.sops.secrets."wireguard/dorm/preshared".path;
Endpoint = "dorm.vpn.rfive.de:51820";
AllowedIPs = "10.10.10.0/24, 192.168.10.0/24";
AllowedIPs = "192.168.42.0/24, 192.168.43.0/24";
};
}
];
};
networks."30-dorm" = {
matchConfig.Name = "dorm";
matchConfig.Name = "wg0";
networkConfig = {
DNS = "192.168.10.1";
DNS = "192.168.42.1";
};
addresses = [
{
addressConfig = {
Address = "10.10.10.4/24";
Address = "192.168.43.4/24";
RouteMetric = 30;
};
}
];
routes = [
{ routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.10.0/24"; Metric = 30; }; }
{ routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.42.0/24"; Metric = 30; }; }
];
};
};

2
hosts/falkenstein-1/modules/purge/default.nix
View file

@ -3,7 +3,7 @@ let
domain = "purge.${config.networking.domain}";
in
{
sops.secrets."purge/token".owner = "purge";
sops.secrets."purge/token" = { };
services.purge = {
enable = true;
discord = {

13
hosts/thinkpad/default.nix
View file

@ -38,12 +38,12 @@
settings = {
experimental-features = [ "nix-command" "flakes" ];
auto-optimise-store = true;
substituters = [
"ssh://nuc.lan"
];
trusted-public-keys = [
"nuc.lan:a9UkVw3AizAKCER1CfNGhx8UOMF4t4UGE3GJ9dmHwJc="
];
# substituters = [
# "ssh://nuc.lan"
# ];
# trusted-public-keys = [
# "nuc.lan:a9UkVw3AizAKCER1CfNGhx8UOMF4t4UGE3GJ9dmHwJc="
# ];
};
# distributedBuilds = true;
# extraOptions = ''
@ -231,7 +231,6 @@
deploy-rs
man-pages
man-pages-posix
];
programs.java.enable = true;
documentation.dev.enable = true;

22
hosts/thinkpad/modules/networks/default.nix
View file

@ -55,8 +55,8 @@
matchConfig.Name = "lo";
linkConfig.RequiredForOnline = false;
};
networks."10-wired" = {
matchConfig.Name = "enp0s31f6";
networks."10-wired-default" = {
matchConfig.Name = "en*";
linkConfig.RequiredForOnline = false;
networkConfig = {
DHCP = "yes";
@ -102,11 +102,10 @@
};
# some wireguard interfaces
netdevs."30-dorm" = {
netdevs."30-wg0" = {
netdevConfig = {
Kind = "wireguard";
Name = "dorm";
Description = "WireGuard to my Dorm Infra";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wireguard/dorm/private".path;
@ -118,28 +117,27 @@
PublicKey = "Z5lwwHTCDr6OF4lfaCdSHNveunOn4RzuOQeyB+El9mQ=";
PresharedKeyFile = config.sops.secrets."wireguard/dorm/preshared".path;
Endpoint = "141.30.227.6:51820";
# Endpoint = "dorm.vpn.rfive.de:51820";
AllowedIPs = "192.168.2.0/24, 192.168.1.0/24";
AllowedIPs = "192.168.42.0/24, 192.168.43.0/24";
};
}
];
};
networks."30-dorm" = {
matchConfig.Name = "dorm";
networks."30-wg0" = {
matchConfig.Name = "wg0";
networkConfig = {
DNS = "192.168.1.1";
DNS = "192.168.42.1";
};
addresses = [
{
addressConfig = {
Address = "192.168.2.3/24";
Address = "192.168.43.3/24";
RouteMetric = 30;
};
}
];
routes = [
# allowedIPs is somewhat broken
{ routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.1.0/24"; Metric = 30; }; }
{ routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.42.0/24"; Metric = 30; }; }
];
};
};

14
hosts/thinkpad/modules/networks/uni.nix
View file

@ -25,6 +25,20 @@
ca_cert="/etc/ssl/certs/ca-certificates.crt"
domain_suffix_match="radius.agdsn.de"
identity="r5"
password="@AGDSN_WIFI_AUTH@"
phase2="auth=PAP"
'';
authProtocols = [ "WPA-EAP" ];
};
agdsn-office = {
auth = ''
eap=TTLS
anonymous_identity="wifi@agdsn.de"
ca_cert="/etc/ssl/certs/ca-certificates.crt"
domain_suffix_match="radius.agdsn.de"
identity="r5"
priority=5
proto=WPA2
password="@AGDSN_AUTH@"
phase2="auth=PAP"
'';