hosts/dn42-il-gw1: Add peer fsinfo tu-dortmund

hosts/carbon/configuration.nix

@@ -7,7 +7,6 @@
 
       ./dns.nix
       ./ds-lite-ncfttb.nix
-      ./mdns.nix
       ./net-dsl.nix
       ./net-heimnetz.nix
       ./net-iot.nix

hosts/carbon/mdns.nix

@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-
-    allowInterfaces = [
-      "net-heimnetz"
-      "net-iot"
-    ];
-
-    reflector = true;
-  };
-
-}

hosts/carbon/net-iot.nix

@@ -6,22 +6,19 @@
     id = 205;
     interface = "enp1s0";
   };
-  networking.bridges."net-iot".interfaces = [
-    "enp1s0.205"
-  ];
-  networking.interfaces."net-iot".ipv6.addresses = [
+  networking.interfaces."enp1s0.205".ipv6.addresses = [
     { address = "fe80::1"; prefixLength = 64; }
     { address = "fd00:152:152:205::1"; prefixLength = 64; }
   ];
-  networking.interfaces."net-iot".ipv4.addresses = [
+  networking.interfaces."enp1s0.205".ipv4.addresses = [
     { address = "10.152.205.1"; prefixLength = 24; }
   ];
 
   # Enable NTP
-  networking.firewall.interfaces."net-iot".allowedUDPPorts = [ 123 ];
+  networking.firewall.interfaces."enp1s0.205".allowedUDPPorts = [ 123 ];
 
   services.radvd.config = ''
-    interface net-iot {
+    interface enp1s0.205 {
       AdvSendAdvert on;
       MaxRtrAdvInterval 30;
       prefix ::/64 {
@@ -36,7 +33,7 @@
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-iot" ];
+        interfaces = [ "enp1s0.205" ];
       };
       subnet4 = [
         {
@@ -72,9 +69,9 @@
 
   clerie.firewall.extraForwardFilterCommands = ''
     # Allow access from Heimnetz to IOT devices
-    ip46tables -A forward-filter -i net-heimnetz -o net-iot -j ACCEPT
-    ip46tables -A forward-filter -i net-iot -j DROP
-    ip46tables -A forward-filter -o net-iot -j DROP
+    ip46tables -A forward-filter -i enp2s0 -o enp1s0.205 -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.205 -j DROP
+    ip46tables -A forward-filter -o enp1s0.205 -j DROP
   '';
 
 }

hosts/carbon/net-mgmt.nix

@@ -6,19 +6,16 @@
     id = 203;
     interface = "enp1s0";
   };
-  networking.bridges."net-mgmt".interfaces = [
-    "enp1s0.203"
-  ];
-  networking.interfaces."net-mgmt".ipv6.addresses = [
+  networking.interfaces."enp1s0.203".ipv6.addresses = [
     { address = "fe80::1"; prefixLength = 64; }
     { address = "fd00:152:152:203::1"; prefixLength = 64; }
   ];
-  networking.interfaces."net-mgmt".ipv4.addresses = [
+  networking.interfaces."enp1s0.203".ipv4.addresses = [
     { address = "10.152.203.1"; prefixLength = 24; }
   ];
 
   services.radvd.config = ''
-    interface net-mgmt {
+    interface enp1s0.203 {
       AdvSendAdvert on;
       MaxRtrAdvInterval 30;
       prefix ::/64 {
@@ -31,7 +28,7 @@
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-mgmt" ];
+        interfaces = [ "enp1s0.203" ];
       };
       subnet4 = [
         {
@@ -55,9 +52,9 @@
 
   clerie.firewall.extraForwardFilterCommands = ''
     # Allow access from Heimnetz to MGMT network
-    ip46tables -A forward-filter -i net-heimnetz -o net-mgmt -j ACCEPT
-    ip46tables -A forward-filter -i net-mgmt -j DROP
-    ip46tables -A forward-filter -o net-mgmt -j DROP
+    ip46tables -A forward-filter -i enp2s0 -o enp1s0.203 -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.203 -j DROP
+    ip46tables -A forward-filter -o enp1s0.203 -j DROP
   '';
 
 }

hosts/carbon/net-printer.nix

@@ -5,17 +5,14 @@
     id = 206;
     interface = "enp1s0";
   };
-  networking.bridges."net-printer".interfaces = [
-    "enp1s0.206"
-  ];
-  networking.interfaces."net-printer".ipv4.addresses = [
+  networking.interfaces."enp1s0.206".ipv4.addresses = [
     { address = "10.152.206.1"; prefixLength = 24; }
   ];
 
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "net-printer" ];
+        interfaces = [ "enp1s0.206" ];
       };
       subnet4 = [
         {
@@ -37,15 +34,11 @@
     };
   };
 
-  # Enable scan-to-gpg
-  networking.firewall.interfaces."net-printer".allowedTCPPorts = [ 2121 ];
-  networking.firewall.interfaces."net-printer".allowedTCPPortRanges = [ { from = 2130; to = 2134; } ];
-
   clerie.firewall.extraForwardFilterCommands = ''
     # Allow access from Heimnetz to printer
-    ip46tables -A forward-filter -i net-heimnetz -o net-printer -j ACCEPT
-    ip46tables -A forward-filter -i net-printer -j DROP
-    ip46tables -A forward-filter -o net-printer -j DROP
+    ip46tables -A forward-filter -i enp2s0 -o enp1s0.206 -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.206 -j DROP
+    ip46tables -A forward-filter -o enp1s0.206 -j DROP
   '';
 
 }

hosts/dn42-il-gw1/configuration.nix

@@ -243,6 +243,22 @@
       ];
       privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
     };
+    # fsinfo tu-dortmund
+    wg2870 = {
+      ips = [
+        "fdd6:a7d6:3090::42:2574:2574/112"
+      ];
+      listenPort = 52870;
+      allowedIPsAsRoutes = false;
+      peers = [
+        {
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          endpoint = "foss-ag-2.fsinfo.cs.tu-dortmund.de:22574";
+          publicKey = "JfFYi7koXoZfh6oQBeE6vasQPrQAKrUtBEzP3y9pujs=";
+        }
+      ];
+      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+    };
     # jona / cryne
     wg3402 = {
       ips = [
@@ -315,6 +331,7 @@
     51411 # wg1411
     51718 # wg1718
     52189 # wg2189
+    52870 # wg2870
     53402 # wg3402
     54719 # wg4719
     56190 # wg6190
@@ -411,6 +428,13 @@
         remoteAsn = "4242422189";
         localAddress = "fe80::2574";
       }
+      {
+        peerName = "peer_2870";
+        remoteAddress = "fdd6:a7d6:3090::42:2870:2870";
+        interfaceName = "wg2870";
+        remoteAsn = "4242422870";
+        localAddress = "fdd6:a7d6:3090::42:2574:2574";
+      }
       {
         peerName = "peer_3402";
         remoteAddress = "fe80::3402";