lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix rt routing & nftables

Browse source
This commit is contained in:
asyncnomi 2025-07-22 21:00:30 +02:00
parent 71be15629e
commit ccf23a35b8
3 changed files with 42 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nodes.nix
View file

@ -308,7 +308,7 @@
bastion-ren-lasuite-federez = { bastion-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 14; id = 1;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -331,7 +331,7 @@
db-ren-lasuite-federez = { db-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 15; id = 2;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -354,7 +354,7 @@
dns-ren-lasuite-federez = { dns-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 16; id = 3;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -377,7 +377,7 @@
docs-ren-lasuite-federez = { docs-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 17; id = 4;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -400,7 +400,7 @@
meet-ren-lasuite-federez = { meet-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 18; id = 5;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -423,7 +423,7 @@
gris-ren-lasuite-federez = { gris-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 19; id = 6;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -446,7 +446,7 @@
mail-ren-lasuite-federez = { mail-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 20; id = 7;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -469,7 +469,7 @@
garage-ren-lasuite-federez = { garage-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 21; id = 8;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -492,7 +492,7 @@
livekit-ren-lasuite-federez = { livekit-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 22; id = 9;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -515,7 +515,7 @@
backup-ren-lasuite-federez = { backup-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 23; id = 10;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -538,7 +538,7 @@
prom-ren-lasuite-federez = { prom-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 24; id = 11;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [
@ -561,7 +561,7 @@
auth-ren-lasuite-federez = { auth-ren-lasuite-federez = {
zone = 2; zone = 2;
id = 25; id = 12;
system = "x86_64-linux"; system = "x86_64-linux";
ver = "25.05"; ver = "25.05";
modules = [ modules = [

66
shared/commons/mesh.nix
View file

@ -19,48 +19,40 @@ let
}; };
generatedSecrets = lib.mapAttrsToList (name: node: buildSecret node.zone node.id) nodes; generatedSecrets = lib.mapAttrsToList (name: node: buildSecret node.zone node.id) nodes;
generateWireGuardInterface = nodesConfig: let # Filter itself out of the peer list
myPeer = nodesConfig."${config.hostName}"; peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodes;
myZone = myPeer.zone;
myId = myPeer.id; peers = lib.mapAttrsToList (peerName: peerConfig: {
name = "${peerName}";
# Filter itself out of the peer list publicKey = peerConfig.wg-pub;
peerConfigs = lib.filterAttrs (_peerName: peerConfig: (peerConfig.zone != myZone) || (peerConfig.id != myId)) nodesConfig; allowedIPs = [
"172.19.${toString peerConfig.zone}.${toString peerConfig.id}/32"
peers = lib.mapAttrsToList (peerName: peerConfig: { "fc00::${toString peerConfig.zone}:${toString peerConfig.id}/128"
name = "${peerName}"; ] ++ lib.optionals (lib.elem peerName mapping.bastion) [
publicKey = peerConfig.wg-pub; "172.19.${toString (peerConfig.zone + 127)}.0/24"
allowedIPs = [ "fc00:f::${toString (peerConfig.zone + 127)}:0/112"
"172.19.${toString peerConfig.zone}.${toString peerConfig.id}/32" ];
"fc00::${toString peerConfig.zone}:${toString peerConfig.id}/128" endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820";
] ++ lib.optionals (lib.elem peerName mapping.bastion) [ persistentKeepalive = 25;
"172.19.${toString (peerConfig.zone + 127)}.0/24" }) peerConfigs;
"fc00:f::${toString (peerConfig.zone + 127)}:0/112"
interfaces = {
"mesh" = {
ips = [
"172.19.${toString myZone}.${toString myId}/16"
"fc00::${toString myZone}:${toString myId}/96"
]; ];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:51820"; privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
persistentKeepalive = 25; listenPort = 51820;
}) peerConfigs; peers = peers;
interface = {
"mesh" = {
ips = [
"172.19.${toString myZone}.${toString myId}/16"
"fc00::${toString myZone}:${toString myId}/96"
];
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
listenPort = 51820;
peers = peers;
};
}; };
in interface; };
wireguardInterfaces = generateWireGuardInterface nodes;
generateRoute = peerName: peerConfig: '' generateRoute = peerName: peerConfig: ''
# Return path for mgmt trafic # Return path for mgmt trafic
${if lib.elem peerName mapping.bastion then '' ${if lib.elem peerName mapping.bastion then ''
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.id}.${toString myId} dev mesh ${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.zone}.${toString peerConfig.id} dev mesh
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.id}:${toString myId} dev mesh ${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.zone}:${toString peerConfig.id} dev mesh
'' else ""} '' else ""}
''; '';
@ -83,7 +75,7 @@ in
networking.wireguard.useNetworkd = false; networking.wireguard.useNetworkd = false;
# Return all WireGuard interfaces for each node # Return all WireGuard interfaces for each node
networking.wireguard.interfaces = wireguardInterfaces; networking.wireguard.interfaces = interfaces;
# Execute custom routing for wireguard # Execute custom routing for wireguard
systemd.services.wireguardStaticRouting = { systemd.services.wireguardStaticRouting = {

6
shared/commons/nftables.nix
View file

@ -7,10 +7,6 @@ let
# Import mapping # Import mapping
mapping = import ./../../mapping.nix; mapping = import ./../../mapping.nix;
meshUdpRange = "51000-${toString (51000 + builtins.head (
builtins.sort (a: b: a > b) (
lib.mapAttrsToList (name: node: node.id) nodes)))}";
in in
{ {
networking = { networking = {
@ -50,7 +46,7 @@ in
tcp dport 22 accept tcp dport 22 accept
# Mesh # Mesh
udp dport ${meshUdpRange} accept udp dport 51820 accept
${if lib.elem myName mapping.bastion then '' ${if lib.elem myName mapping.bastion then ''
# Mgmt # Mgmt