451 lines
12 KiB
Nix
451 lines
12 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports =
|
|
[
|
|
./hardware-configuration.nix
|
|
|
|
./documentation.nix
|
|
];
|
|
|
|
profiles.clerie.mercury-vm.enable = true;
|
|
|
|
boot.loader.grub.enable = true;
|
|
boot.loader.grub.device = "/dev/vda";
|
|
|
|
systemd.network.networks."10-wan" = {
|
|
matchConfig.Name = "ens20";
|
|
address = [
|
|
"2001:638:904:ffc9::7/64"
|
|
];
|
|
routes = [
|
|
{ Gateway = "2001:638:904:ffc9::1"; }
|
|
];
|
|
linkConfig.RequiredForOnline = "routable";
|
|
ipv6AcceptRAConfig.DHCPv6Client = "no";
|
|
};
|
|
systemd.network.networks."10-nat-netz-mercury" = {
|
|
matchConfig.Name = "ens18";
|
|
address = [
|
|
"192.168.10.23/24"
|
|
];
|
|
routes = [
|
|
{ Gateway = "192.168.10.1"; }
|
|
];
|
|
linkConfig.RequiredForOnline = "routable";
|
|
ipv6AcceptRAConfig.DHCPv6Client = "no";
|
|
};
|
|
systemd.network.networks."10-dn42-ospf-netz" = {
|
|
matchConfig.Name = "ens19";
|
|
linkConfig.RequiredForOnline = "no";
|
|
ipv6AcceptRAConfig.DHCPv6Client = "no";
|
|
};
|
|
|
|
networking.wireguard.enable = true;
|
|
networking.wireguard.interfaces = {
|
|
# dn42-router-general-wireguard-key public key:
|
|
# r38qvXqu26x4f6yUGxg44Ji4db/g2HK7RZwG7Boh+38=
|
|
|
|
# darkpoint
|
|
wg0150 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg0150 fe80::2574/128 peer fe80::150/128
|
|
'';
|
|
listenPort = 50150;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "fra.darkpoint.xyz:22574";
|
|
publicKey = "nfoxTtmJdBdxNR3TmfVLG13KA5E+ZtU+uIGCegxrxxw=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
|
|
};
|
|
# e1mo
|
|
wg0565 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
# peer fe80::565/128
|
|
];
|
|
postSetup = ''
|
|
ip -6 route flush dev wg0565
|
|
ip addr del dev wg0565 fe80::2574/128 && ip addr add dev wg0565 fe80::2574/128 peer fe80::565/128
|
|
'';
|
|
listenPort = 50565;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "dn42-nbg1.net.dont-break.it:22574";
|
|
publicKey = "qYaDuYYVpuFqy7KyC5PmJavqs0a7GtyuES8VwugdPSQ=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg0565.path;
|
|
};
|
|
# pilz
|
|
wg0663 = {
|
|
ips = [
|
|
"fe80::1111/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg0663 fe80::1111/128 peer fe80::acab/128
|
|
'';
|
|
listenPort = 50663;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "dn42.ams1.as214958.net:163";
|
|
publicKey = "NxHkdwZPVL+3HdrHTFOslUpUckTf0dzEG9qpZ0FTBnA=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
|
|
};
|
|
# prefixlabs
|
|
# https://prefixlabs.net/
|
|
wg1240 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg1240 fe80::2574/128 peer fe80::1240:11/128
|
|
'';
|
|
listenPort = 51240;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "de-01.prefixlabs.net:22574";
|
|
publicKey = "ixeEBfac1BXpjNKbxcgL6Beg9HTgtmq6CjHIfMwNSDw=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg1240.path;
|
|
};
|
|
# fooker
|
|
wg1271 = {
|
|
ips = [
|
|
"fe80::1/128"
|
|
# peer fe80::2/128
|
|
];
|
|
postSetup = ''
|
|
ip -6 route flush dev wg1271
|
|
ip addr del dev wg1271 fe80::1/128 && ip addr add dev wg1271 fe80::1/128 peer fe80::2/128
|
|
'';
|
|
listenPort = 51271;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "north.zitadelle.dev.open-desk.net:23425";
|
|
publicKey = "xxPjHWVzePinOOMnuhwGAI3PKY9pvpifIvIbPu3IwQw=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg1271.path;
|
|
};
|
|
wg1272 = {
|
|
ips = [
|
|
"fe80::1:1/128"
|
|
# peer fe80::1:2/128
|
|
];
|
|
postSetup = ''
|
|
ip -6 route flush dev wg1272
|
|
ip addr del dev wg1272 fe80::1:1/128 && ip addr add dev wg1272 fe80::1:1/128 peer fe80::1:2/128
|
|
'';
|
|
listenPort = 51272;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "south.zitadelle.dev.open-desk.net:23425";
|
|
publicKey = "Iae2R4B7VVsloKWK8T1j1vLMuxpP4dVDUdzEg/YpAjE=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg1272.path;
|
|
};
|
|
# margau
|
|
wg1280 = {
|
|
ips = [
|
|
"fde3:4c0d:2836:ff00::21/127"
|
|
# peer fde3:4c0d:2836:ff00::20/127
|
|
];
|
|
listenPort = 51280;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "wg1.margau.ipv6.church:51830";
|
|
publicKey = "CEge9jdHQArzdniUiWyB3IUZOjGiew3gPmz/MOf4ahU=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg1280.path;
|
|
};
|
|
# c4tg1rl5
|
|
# https://catgirls.systems/peering/
|
|
wg1411 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg1411 fe80::2574/128 peer fe80::1411/128
|
|
'';
|
|
listenPort = 51411;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
#{
|
|
# allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
# endpoint = "";
|
|
# publicKey = "";
|
|
#}
|
|
];
|
|
privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
|
|
};
|
|
# zaphyra
|
|
wg1718 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
# peer fe80::6b61/64
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg1718 fe80::2574/128 peer fe80::6b61/128
|
|
'';
|
|
listenPort = 51718;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "router-a.dn42.zaphyra.eu:51831";
|
|
publicKey = "Knm6uEpMsTfZAK68Pl98mHORtb8TtswBfYFGznpHUCI=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg1718.path;
|
|
};
|
|
# iedon
|
|
# https://iedon.net/
|
|
wg2189 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg2189 fe80::2574/128 peer fe80::2189:e9/128
|
|
'';
|
|
listenPort = 52189;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "de-fra.dn42.iedon.net:42463";
|
|
publicKey = "FHp0OR4UpAS8/Ra0FUNffTk18soUYCa6NcvZdOgxY0k=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
|
|
};
|
|
# jona / cryne
|
|
wg3402 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg3402 fe80::2574/128 peer fe80::3402/128
|
|
'';
|
|
listenPort = 53402;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "dn42.cryne.me:42574";
|
|
publicKey = "YsKInIp90is8ysnQDHGoKnz2CqlTMWMZDmQ+vwvN2C0=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
|
|
};
|
|
# lutoma
|
|
wg4719 = {
|
|
ips = [
|
|
#"fe80::1/128"
|
|
# peer fe80::acab/128
|
|
];
|
|
postSetup = ''
|
|
ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
|
|
'';
|
|
listenPort = 54719;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "[2603:c020:8001:ed42::42]:42546";
|
|
publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.wg4719.path;
|
|
};
|
|
# tbspace
|
|
wg6190 = {
|
|
ips = [
|
|
"fe80::2574/128"
|
|
];
|
|
postSetup = ''
|
|
ip addr replace dev wg6190 fe80::2574/128 peer fe80::1299:e/128
|
|
'';
|
|
listenPort = 56190;
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "fe80::/10" "fd00::/8" ];
|
|
endpoint = "dn42.tbspace.de:49168";
|
|
publicKey = "skvyDl81J8Zu3Ziem+7JKeU4UYLhhWt7gWelg8nEbzQ=";
|
|
}
|
|
];
|
|
privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedUDPPorts = [
|
|
50150 # wg0150
|
|
50565 # wg0565
|
|
50663 # wg0663
|
|
51240 # wg1240
|
|
51241 # wg1241
|
|
51271 # wg1271
|
|
51272 # wg1272
|
|
51280 # wg1280
|
|
51411 # wg1411
|
|
51718 # wg1718
|
|
52189 # wg2189
|
|
53402 # wg3402
|
|
54719 # wg4719
|
|
56190 # wg6190
|
|
];
|
|
|
|
profiles.clerie.dn42-router = {
|
|
enable = true;
|
|
loopbackIp = "fd56:4902:eca0:1::1";
|
|
routerId = "192.168.10.23";
|
|
|
|
ospfInterfaces = [
|
|
"ens19"
|
|
];
|
|
|
|
ibgpPeers = [
|
|
{
|
|
peerName = "gw5";
|
|
remoteAddress = "fd56:4902:eca0:5::1";
|
|
}
|
|
{
|
|
peerName = "gw6";
|
|
remoteAddress = "fd56:4902:eca0:6::1";
|
|
}
|
|
];
|
|
|
|
wireguardPeers = [
|
|
{
|
|
peerName = "peer_0150";
|
|
remoteAddress = "fe80::150";
|
|
interfaceName = "wg0150";
|
|
remoteAsn = "4242420150";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_0565";
|
|
remoteAddress = "fe80::565";
|
|
interfaceName = "wg0565";
|
|
remoteAsn = "4242420565";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_0663";
|
|
remoteAddress = "fe80::acab";
|
|
interfaceName = "wg0663";
|
|
remoteAsn = "4242420663";
|
|
localAddress = "fe80::1111";
|
|
}
|
|
{
|
|
peerName = "peer_1240_de_01";
|
|
remoteAddress = "fe80::1240:11";
|
|
interfaceName = "wg1240";
|
|
remoteAsn = "4242421240";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_1271_north";
|
|
remoteAddress = "fe80::2";
|
|
interfaceName = "wg1271";
|
|
remoteAsn = "4242421271";
|
|
localAddress = "fe80::1";
|
|
}
|
|
{
|
|
peerName = "peer_1271_south";
|
|
remoteAddress = "fe80::1:2";
|
|
interfaceName = "wg1272";
|
|
remoteAsn = "4242421271";
|
|
localAddress = "fe80::1:1";
|
|
}
|
|
{
|
|
peerName = "peer_1280_wg1";
|
|
remoteAddress = "fde3:4c0d:2836:ff00::20";
|
|
interfaceName = "wg1280";
|
|
remoteAsn = "4242421280";
|
|
localAddress = "fde3:4c0d:2836:ff00::21";
|
|
}
|
|
{
|
|
peerName = "peer_1411_de_fsn";
|
|
remoteAddress = "fe80::1411";
|
|
interfaceName = "wg1411";
|
|
remoteAsn = "4242421411";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_1718";
|
|
remoteAddress = "fe80::6b61";
|
|
interfaceName = "wg1718";
|
|
remoteAsn = "4242421718";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_2189_de_fra";
|
|
remoteAddress = "fe80::2189:e9";
|
|
interfaceName = "wg2189";
|
|
remoteAsn = "4242422189";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_3402";
|
|
remoteAddress = "fe80::3402";
|
|
interfaceName = "wg3402";
|
|
remoteAsn = "4242423402";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
{
|
|
peerName = "peer_4719";
|
|
remoteAddress = "fe80::acab";
|
|
interfaceName = "wg4719";
|
|
remoteAsn = "64719";
|
|
localAddress = "fe80::1";
|
|
}
|
|
{
|
|
peerName = "peer_6190";
|
|
remoteAddress = "fe80::1299:e";
|
|
interfaceName = "wg6190";
|
|
remoteAsn = "76190";
|
|
localAddress = "fe80::2574";
|
|
}
|
|
];
|
|
};
|
|
|
|
services.bijwerken = {
|
|
autoUpgrade = true;
|
|
};
|
|
|
|
clerie.monitoring = {
|
|
enable = true;
|
|
id = "301";
|
|
pubkey = "kTuC3/rLr4Qb3C4oEn1ecB/vS78poxmu6/Id3Rc1VGY=";
|
|
bird = true;
|
|
};
|
|
|
|
system.stateVersion = "21.03";
|
|
}
|