SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 12:51:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Create networking abstraction on top of nebula

Browse source
This commit is contained in:
SebastianStork 2026-01-11 19:13:30 +01:00
parent 6804112df6
commit 252abe9443
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
15 changed files with 223 additions and 165 deletions
Download patch file Download diff file Expand all files Collapse all files

90
modules/system/networking.nix Normal file
View file

@ -0,0 +1,90 @@
{
config,
self,
lib,
...
}:
let
cfg = config.custom.networking;
in
{
options.custom.networking = {
hostname = lib.mkOption {
type = lib.types.nonEmptyStr;
default = config.networking.hostName;
readOnly = true;
};
isLighthouse = lib.mkEnableOption "";
isServer = lib.mkEnableOption "";
isClient = lib.mkEnableOption "";
overlay = {
networkAddress = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "10.254.250.0";
readOnly = true;
};
prefixLength = lib.mkOption {
type = lib.types.ints.between 0 32;
default = 24;
readOnly = true;
};
domain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "splitleaf.de";
readOnly = true;
};
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "nebula.mesh";
};
systemdUnit = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "nebula@mesh.service";
};
};
underlay = {
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
useDhcp = lib.mkEnableOption "";
isPublic = lib.mkEnableOption "";
address = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
gateway = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
};
nodes = lib.mkOption {
type = lib.types.anything;
default =
self.nixosConfigurations
|> lib.attrValues
|> lib.map (host: host.config.custom.networking)
|> lib.map (
node:
lib.removeAttrs node [
"nodes"
"peers"
]
);
readOnly = true;
};
peers = lib.mkOption {
type = lib.types.anything;
default = cfg.nodes |> lib.filter (node: node.hostname != cfg.hostname);
readOnly = true;
};
};
}

7
modules/system/services/caddy.nix
View file

@ -6,6 +6,7 @@
}:
let
cfg = config.custom.services.caddy;
netCfg = config.custom.networking;
virtualHosts = cfg.virtualHosts |> lib.attrValues |> lib.filter (value: value.enable);
@ -33,7 +34,7 @@ let
in
''
tls ${certDir}/fullchain.pem ${certDir}/key.pem
bind ${config.custom.services.nebula.node.address}
bind ${config.custom.networking.overlay.address}
''
))
(lib.optionalString (port != null) "reverse_proxy localhost:${toString port}")
@ -150,8 +151,8 @@ in
];
systemd.services.caddy = {
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
requires = [ netCfg.overlay.systemdUnit ];
after = [ netCfg.overlay.systemdUnit ];
};
})
]

24
modules/system/services/nebula/dns.nix → modules/system/services/dns.nix
View file

@ -6,13 +6,13 @@
...
}:
let
nebulaCfg = config.custom.services.nebula;
cfg = nebulaCfg.node;
cfg = config.custom.services.dns;
netCfg = config.custom.networking;
in
{
options.custom.services.nebula.node.dns.enable = lib.mkEnableOption "";
options.custom.services.dns.enable = lib.mkEnableOption "";
config = lib.mkIf (cfg.enable && cfg.dns.enable) {
config = lib.mkIf cfg.enable {
# meta.ports = {
# tcp = [ 53 ];
# udp = [ 53 ];
@ -24,17 +24,17 @@ in
settings = {
server = {
interface = [ cfg.interface ];
interface = [ netCfg.overlay.interface ];
access-control = [
"${nebulaCfg.network.address}/${toString nebulaCfg.network.prefixLength} allow"
"${netCfg.overlay.networkAddress}/${toString netCfg.overlay.prefixLength} allow"
];
local-zone = "\"${nebulaCfg.network.domain}.\" static";
local-zone = "\"${netCfg.overlay.domain}.\" static";
local-data =
let
nodeRecords =
nebulaCfg.nodes
|> lib.map (node: "\"${node.name}.${nebulaCfg.network.domain}. A ${node.address}\"");
netCfg.nodes
|> lib.map (node: "\"${node.hostname}.${node.overlay.domain}. A ${node.overlay.address}\"");
serviceRecords =
self.nixosConfigurations
|> lib.attrValues
@ -42,7 +42,7 @@ in
host:
host.config.meta.domains.local
|> lib.filter (domain: lib'.isPrivateDomain domain)
|> lib.map (domain: "\"${domain}. A ${host.config.custom.services.nebula.node.address}\"")
|> lib.map (domain: "\"${domain}. A ${host.config.custom.networking.overlay.address}\"")
);
in
nodeRecords ++ serviceRecords;
@ -66,8 +66,8 @@ in
};
systemd.services.unbound = {
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
requires = [ netCfg.overlay.systemdUnit ];
after = [ netCfg.overlay.systemdUnit ];
};
};
}

123
modules/system/services/nebula/default.nix
View file

@ -5,92 +5,33 @@
...
}:
let
nebulaCfg = config.custom.services.nebula;
cfg = nebulaCfg.node;
cfg = config.custom.services.nebula;
netCfg = config.custom.networking;
hostname = config.networking.hostName;
publicPort = 47141;
in
{
options.custom.services.nebula = {
network = {
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "10.254.250.0";
readOnly = true;
};
prefixLength = lib.mkOption {
type = lib.types.ints.between 0 32;
default = 24;
readOnly = true;
};
domain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "splitleaf.de";
readOnly = true;
};
enable = lib.mkEnableOption "";
publicKeyPath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${netCfg.hostname}/keys/nebula.pub";
};
node = {
enable = lib.mkEnableOption "";
name = lib.mkOption {
type = lib.types.nonEmptyStr;
default = hostname;
};
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "nebula.mesh";
};
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
isLighthouse = lib.mkEnableOption "";
isServer = lib.mkEnableOption "";
isClient = lib.mkEnableOption "";
routableAddress = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
routablePort = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = if cfg.routableAddress != null then 47141 else null;
};
publicKeyPath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.pub";
};
certificatePath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.crt";
};
};
nodes = lib.mkOption {
type = lib.types.anything;
default =
self.nixosConfigurations
|> lib.attrValues
|> lib.map (value: value.config.custom.services.nebula.node)
|> lib.filter (node: node.enable);
readOnly = true;
};
peers = lib.mkOption {
type = lib.types.anything;
default = nebulaCfg.nodes |> lib.filter (node: node.name != hostname);
readOnly = true;
certificatePath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${netCfg.hostname}/keys/nebula.crt";
};
};
config = lib.mkIf cfg.enable {
meta.ports.udp = lib.optional (cfg.routablePort != null) cfg.routablePort;
assertions = lib.singleton {
assertion = cfg.isLighthouse -> cfg.routableAddress != null;
message = "'${hostname}' is a Nebula lighthouse, but routableAddress is not set. Lighthouses must be publicly reachable.";
assertion = netCfg.isLighthouse -> netCfg.underlay.isPublic;
message = "'${netCfg.hostname}' is a Nebula lighthouse, but underlay.isPublic is not set. Lighthouses must be publicly reachable.";
};
meta.ports.udp = lib.optional (netCfg.underlay.isPublic) publicPort;
sops.secrets."nebula/host-key" = {
owner = config.users.users.nebula-mesh.name;
restartUnits = [ "nebula@mesh.service" ];
@ -103,19 +44,21 @@ in
cert = cfg.certificatePath;
key = config.sops.secrets."nebula/host-key".path;
listen.port = cfg.routablePort;
listen.port = lib.mkIf netCfg.underlay.isPublic publicPort;
inherit (cfg) isLighthouse;
lighthouses = lib.mkIf (!cfg.isLighthouse) (
nebulaCfg.peers |> lib.filter (node: node.isLighthouse) |> lib.map (lighthouse: lighthouse.address)
inherit (netCfg) isLighthouse;
lighthouses = lib.mkIf (!netCfg.isLighthouse) (
netCfg.peers
|> lib.filter (peer: peer.isLighthouse)
|> lib.map (lighthouse: lighthouse.overlay.address)
);
staticHostMap =
nebulaCfg.peers
|> lib.filter (node: node.routableAddress != null)
|> lib.map (lighthouse: {
name = lighthouse.address;
value = lib.singleton "${lighthouse.routableAddress}:${toString lighthouse.routablePort}";
netCfg.peers
|> lib.filter (peer: peer.underlay.isPublic)
|> lib.map (publicPeer: {
name = publicPeer.overlay.address;
value = lib.singleton "${publicPeer.underlay.address}:${toString publicPort}";
})
|> lib.listToAttrs;
@ -138,13 +81,17 @@ in
};
};
networking.firewall.trustedInterfaces = [ cfg.interface ];
networking.firewall.trustedInterfaces = [ netCfg.overlay.interface ];
systemd.network.networks."40-nebula" = {
matchConfig.Name = cfg.interface;
address = [ "${cfg.address}/${toString nebulaCfg.network.prefixLength}" ];
dns = nebulaCfg.peers |> lib.filter (node: node.dns.enable) |> lib.map (node: node.address);
domains = [ nebulaCfg.network.domain ];
matchConfig.Name = netCfg.overlay.interface;
address = [ "${netCfg.overlay.address}/${toString netCfg.overlay.prefixLength}" ];
dns =
self.nixosConfigurations
|> lib.attrValues
|> lib.filter (host: host.config.custom.services.dns.enable)
|> lib.map (host: host.config.custom.networking.overlay.address);
domains = [ netCfg.overlay.domain ];
};
};
}

27
modules/system/services/nebula/sshd.nix → modules/system/services/sshd.nix
View file

@ -5,14 +5,13 @@
...
}:
let
cfg = config.custom.services.nebula.node;
cfg = config.custom.services.sshd;
netCfg = config.custom.networking;
in
{
options.custom.services.nebula.node.sshd.enable = lib.mkEnableOption "" // {
default = true;
};
options.custom.services.sshd.enable = lib.mkEnableOption "";
config = lib.mkIf (cfg.enable && cfg.sshd.enable) {
config = lib.mkIf cfg.enable {
meta.ports.tcp = [ 22 ];
services = {
@ -21,7 +20,7 @@ in
openFirewall = false;
ports = [ ];
listenAddresses = lib.singleton {
addr = cfg.address;
addr = netCfg.overlay.address;
port = 22;
};
settings = {
@ -32,26 +31,26 @@ in
};
nebula.networks.mesh.firewall.inbound =
config.custom.services.nebula.peers
netCfg.peers
|> lib.filter (node: node.isClient)
|> lib.map (nebula: {
|> lib.map (client: {
port = 22;
proto = "tcp";
host = nebula.name;
host = client.hostname;
});
};
systemd.services.sshd = {
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
requires = [ netCfg.overlay.systemdUnit ];
after = [ netCfg.overlay.systemdUnit ];
};
users.users.seb.openssh.authorizedKeys.keyFiles =
self.nixosConfigurations
|> lib.filterAttrs (name: _: name != config.networking.hostName)
|> lib.attrValues
|> lib.filter (value: value.config |> lib.hasAttr "home-manager")
|> lib.map (value: value.config.home-manager.users.seb.custom.programs.ssh)
|> lib.filter (host: host.config.custom.networking.hostname != netCfg.hostname)
|> lib.filter (host: host.config |> lib.hasAttr "home-manager")
|> lib.map (host: host.config.home-manager.users.seb.custom.programs.ssh)
|> lib.filter (ssh: ssh.enable)
|> lib.map (ssh: ssh.publicKeyPath);
};

9
modules/system/services/syncthing.nix
View file

@ -7,6 +7,7 @@
}:
let
cfg = config.custom.services.syncthing;
netCfg = config.custom.networking;
inherit (config.services.syncthing) dataDir;
@ -50,10 +51,6 @@ in
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.custom.services.nebula.node.enable;
message = "Syncthing requires nebula";
}
{
assertion = cfg.isServer -> (cfg.gui.domain != null);
message = "Running syncthing on a server requires `gui.domain` to be set";
@ -109,7 +106,7 @@ in
_: value: {
id = value.config.custom.services.syncthing.deviceId;
addresses = [
"tcp://${value.config.custom.services.nebula.node.address}:${toString cfg.syncPort}"
"tcp://${value.config.custom.networking.overlay.address}:${toString cfg.syncPort}"
];
}
);
@ -122,7 +119,7 @@ in
});
options = {
listenAddress = "tcp://${config.custom.services.nebula.node.address}:${toString cfg.syncPort}";
listenAddress = "tcp://${netCfg.overlay.address}:${toString cfg.syncPort}";
globalAnnounceEnabled = false;
localAnnounceEnabled = false;
relaysEnabled = false;

4
modules/system/web-services/alloy.nix
View file

@ -15,11 +15,11 @@ in
};
metricsEndpoint = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "https://metrics.${config.custom.services.nebula.network.domain}/prometheus/api/v1/write";
default = "https://metrics.${config.custom.networking.overlay.domain}/prometheus/api/v1/write";
};
logsEndpoint = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "https://logs.${config.custom.services.nebula.network.domain}/insert/loki/api/v1/push";
default = "https://logs.${config.custom.networking.overlay.domain}/insert/loki/api/v1/push";
};
collect = {
metrics = {

2
modules/system/web-services/gatus.nix
View file

@ -113,7 +113,7 @@ in
connectivity.checker.target = "1.1.1.1:53"; # Cloudflare DNS
alerting.ntfy = {
topic = "uptime";
url = "https://alerts.${config.custom.services.nebula.network.domain}";
url = "https://alerts.${config.custom.networking.overlay.domain}";
click = "https://${cfg.domain}";
default-alert = {
enable = true;

6
modules/system/web-services/grafana.nix
View file

@ -23,21 +23,21 @@ in
enable = lib.mkEnableOption "";
url = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "https://metrics.${config.custom.services.nebula.network.domain}";
default = "https://metrics.${config.custom.networking.overlay.domain}";
};
};
victoriametrics = {
enable = lib.mkEnableOption "";
url = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "https://metrics.${config.custom.services.nebula.network.domain}";
default = "https://metrics.${config.custom.networking.overlay.domain}";
};
};
victorialogs = {
enable = lib.mkEnableOption "";
url = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "https://logs.${config.custom.services.nebula.network.domain}";
default = "https://logs.${config.custom.networking.overlay.domain}";
};
};
};