SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 12:51:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Create networking abstraction on top of nebula

Browse source
This commit is contained in:
SebastianStork 2026-01-11 19:13:30 +01:00
parent 6804112df6
commit 252abe9443
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
15 changed files with 223 additions and 165 deletions
Download patch file Download diff file Expand all files Collapse all files

2
flake-parts/hosts.nix
View file

@ -22,7 +22,7 @@ let
mkDeployNode = hostname: { mkDeployNode = hostname: {
hostname = "${hostname}.${ hostname = "${hostname}.${
self.nixosConfigurations.${hostname}.config.custom.services.nebula.network.domain self.nixosConfigurations.${hostname}.config.custom.networking.overlay.domain
}"; }";
user = "root"; user = "root";
interactiveSudo = true; interactiveSudo = true;

13
hosts/desktop/default.nix
View file

@ -23,14 +23,17 @@
}; };
de.hyprland.enable = true; de.hyprland.enable = true;
networking = {
overlay.address = "10.254.250.1";
underlay.interface = "enp6s0";
isClient = true;
};
services = { services = {
gc.enable = true; gc.enable = true;
sound.enable = true; sound.enable = true;
nebula.node = { nebula.enable = true;
enable = true; sshd.enable = true;
address = "10.254.250.1";
isClient = true;
};
syncthing = { syncthing = {
enable = true; enable = true;
deviceId = "FAJS5WM-UAWGW2U-FXCGPSP-VAUOTGM-XUKSEES-D66PMCJ-WBODJLV-XTNCRA7"; deviceId = "FAJS5WM-UAWGW2U-FXCGPSP-VAUOTGM-XUKSEES-D66PMCJ-WBODJLV-XTNCRA7";

13
hosts/laptop/default.nix
View file

@ -23,17 +23,20 @@
}; };
de.hyprland.enable = true; de.hyprland.enable = true;
networking = {
overlay.address = "10.254.250.3";
underlay.interface = "wlan0";
isClient = true;
};
services = { services = {
resolved.enable = true; resolved.enable = true;
gc.enable = true; gc.enable = true;
wlan.enable = true; wlan.enable = true;
bluetooth.enable = true; bluetooth.enable = true;
sound.enable = true; sound.enable = true;
nebula.node = { nebula.enable = true;
enable = true; sshd.enable = true;
address = "10.254.250.3";
isClient = true;
};
syncthing = { syncthing = {
enable = true; enable = true;
deviceId = "Q4YPD3V-GXZPHSN-PT5X4PU-FBG4GX2-IASBX75-7NYMG75-4EJHBMZ-4WGDDAP"; deviceId = "Q4YPD3V-GXZPHSN-PT5X4PU-FBG4GX2-IASBX75-7NYMG75-4EJHBMZ-4WGDDAP";

24
hosts/vps-monitor/default.nix
View file

@ -20,25 +20,31 @@
boot.loader.grub.enable = true; boot.loader.grub.enable = true;
networking = {
overlay.address = "10.254.250.5";
underlay = {
interface = "enp1s0";
address = "188.245.223.145";
isPublic = true;
};
isLighthouse = true;
isServer = true;
};
services = { services = {
gc = { gc = {
enable = true; enable = true;
onlyCleanRoots = true; onlyCleanRoots = true;
}; };
nebula.node = { nebula.node.enable = true;
enable = true; sshd.enable = true;
address = "10.254.250.5"; dns.enable = true;
routableAddress = "188.245.223.145";
isLighthouse = true;
isServer = true;
dns.enable = true;
};
}; };
web-services = web-services =
let let
privateDomain = config.custom.services.nebula.network.domain; privateDomain = config.custom.networking.overlay.domain;
in in
{ {
gatus = { gatus = {

24
hosts/vps-private/default.nix
View file

@ -15,7 +15,7 @@
custom = custom =
let let
privateDomain = config.custom.services.nebula.network.domain; privateDomain = config.custom.networking.overlay.domain;
in in
{ {
persistence.enable = true; persistence.enable = true;
@ -24,20 +24,26 @@
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
networking = {
overlay.address = "10.254.250.2";
underlay = {
interface = "enp1s0";
address = "49.13.231.235";
isPublic = true;
};
isLighthouse = true;
isServer = true;
};
services = { services = {
gc = { gc = {
enable = true; enable = true;
onlyCleanRoots = true; onlyCleanRoots = true;
}; };
nebula.node = { nebula.node.enable = true;
enable = true; sshd.enable = true;
address = "10.254.250.2"; dns.enable = true;
routableAddress = "49.13.231.235";
isLighthouse = true;
isServer = true;
dns.enable = true;
};
syncthing = { syncthing = {
enable = true; enable = true;

20
hosts/vps-public/default.nix
View file

@ -20,18 +20,24 @@
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
networking = {
overlay.address = "10.254.250.4";
underlay = {
interface = "enp1s0";
address = "167.235.73.246";
isPublic = true;
};
isServer = true;
};
services = { services = {
gc = { gc = {
enable = true; enable = true;
onlyCleanRoots = true; onlyCleanRoots = true;
}; };
nebula.node = { nebula.node.enable = true;
enable = true; sshd.enable = true;
address = "10.254.250.4";
routableAddress = "167.235.73.246";
isServer = true;
};
crowdsec = { crowdsec = {
enable = true; enable = true;
@ -76,7 +82,7 @@
alloy = { alloy = {
enable = true; enable = true;
domain = "alloy.${config.networking.hostName}.${config.custom.services.nebula.network.domain}"; domain = "alloy.${config.networking.hostName}.${config.custom.networking.overlay.domain}";
}; };
}; };
}; };

90
modules/system/networking.nix Normal file
View file

@ -0,0 +1,90 @@
{
config,
self,
lib,
...
}:
let
cfg = config.custom.networking;
in
{
options.custom.networking = {
hostname = lib.mkOption {
type = lib.types.nonEmptyStr;
default = config.networking.hostName;
readOnly = true;
};
isLighthouse = lib.mkEnableOption "";
isServer = lib.mkEnableOption "";
isClient = lib.mkEnableOption "";
overlay = {
networkAddress = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "10.254.250.0";
readOnly = true;
};
prefixLength = lib.mkOption {
type = lib.types.ints.between 0 32;
default = 24;
readOnly = true;
};
domain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "splitleaf.de";
readOnly = true;
};
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "nebula.mesh";
};
systemdUnit = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "nebula@mesh.service";
};
};
underlay = {
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
useDhcp = lib.mkEnableOption "";
isPublic = lib.mkEnableOption "";
address = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
gateway = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
};
nodes = lib.mkOption {
type = lib.types.anything;
default =
self.nixosConfigurations
|> lib.attrValues
|> lib.map (host: host.config.custom.networking)
|> lib.map (
node:
lib.removeAttrs node [
"nodes"
"peers"
]
);
readOnly = true;
};
peers = lib.mkOption {
type = lib.types.anything;
default = cfg.nodes |> lib.filter (node: node.hostname != cfg.hostname);
readOnly = true;
};
};
}

7
modules/system/services/caddy.nix
View file

@ -6,6 +6,7 @@
}: }:
let let
cfg = config.custom.services.caddy; cfg = config.custom.services.caddy;
netCfg = config.custom.networking;
virtualHosts = cfg.virtualHosts |> lib.attrValues |> lib.filter (value: value.enable); virtualHosts = cfg.virtualHosts |> lib.attrValues |> lib.filter (value: value.enable);
@ -33,7 +34,7 @@ let
in in
'' ''
tls ${certDir}/fullchain.pem ${certDir}/key.pem tls ${certDir}/fullchain.pem ${certDir}/key.pem
bind ${config.custom.services.nebula.node.address} bind ${config.custom.networking.overlay.address}
'' ''
)) ))
(lib.optionalString (port != null) "reverse_proxy localhost:${toString port}") (lib.optionalString (port != null) "reverse_proxy localhost:${toString port}")
@ -150,8 +151,8 @@ in
]; ];
systemd.services.caddy = { systemd.services.caddy = {
requires = [ "nebula@mesh.service" ]; requires = [ netCfg.overlay.systemdUnit ];
after = [ "nebula@mesh.service" ]; after = [ netCfg.overlay.systemdUnit ];
}; };
}) })
] ]

24
modules/system/services/nebula/dns.nix → modules/system/services/dns.nix
View file

@ -6,13 +6,13 @@
... ...
}: }:
let let
nebulaCfg = config.custom.services.nebula; cfg = config.custom.services.dns;
cfg = nebulaCfg.node; netCfg = config.custom.networking;
in in
{ {
options.custom.services.nebula.node.dns.enable = lib.mkEnableOption ""; options.custom.services.dns.enable = lib.mkEnableOption "";
config = lib.mkIf (cfg.enable && cfg.dns.enable) { config = lib.mkIf cfg.enable {
# meta.ports = { # meta.ports = {
# tcp = [ 53 ]; # tcp = [ 53 ];
# udp = [ 53 ]; # udp = [ 53 ];
@ -24,17 +24,17 @@ in
settings = { settings = {
server = { server = {
interface = [ cfg.interface ]; interface = [ netCfg.overlay.interface ];
access-control = [ access-control = [
"${nebulaCfg.network.address}/${toString nebulaCfg.network.prefixLength} allow" "${netCfg.overlay.networkAddress}/${toString netCfg.overlay.prefixLength} allow"
]; ];
local-zone = "\"${nebulaCfg.network.domain}.\" static"; local-zone = "\"${netCfg.overlay.domain}.\" static";
local-data = local-data =
let let
nodeRecords = nodeRecords =
nebulaCfg.nodes netCfg.nodes
|> lib.map (node: "\"${node.name}.${nebulaCfg.network.domain}. A ${node.address}\""); |> lib.map (node: "\"${node.hostname}.${node.overlay.domain}. A ${node.overlay.address}\"");
serviceRecords = serviceRecords =
self.nixosConfigurations self.nixosConfigurations
|> lib.attrValues |> lib.attrValues
@ -42,7 +42,7 @@ in
host: host:
host.config.meta.domains.local host.config.meta.domains.local
|> lib.filter (domain: lib'.isPrivateDomain domain) |> lib.filter (domain: lib'.isPrivateDomain domain)
|> lib.map (domain: "\"${domain}. A ${host.config.custom.services.nebula.node.address}\"") |> lib.map (domain: "\"${domain}. A ${host.config.custom.networking.overlay.address}\"")
); );
in in
nodeRecords ++ serviceRecords; nodeRecords ++ serviceRecords;
@ -66,8 +66,8 @@ in
}; };
systemd.services.unbound = { systemd.services.unbound = {
requires = [ "nebula@mesh.service" ]; requires = [ netCfg.overlay.systemdUnit ];
after = [ "nebula@mesh.service" ]; after = [ netCfg.overlay.systemdUnit ];
}; };
}; };
} }

123
modules/system/services/nebula/default.nix
View file

@ -5,92 +5,33 @@
... ...
}: }:
let let
nebulaCfg = config.custom.services.nebula; cfg = config.custom.services.nebula;
cfg = nebulaCfg.node; netCfg = config.custom.networking;
hostname = config.networking.hostName; publicPort = 47141;
in in
{ {
options.custom.services.nebula = { options.custom.services.nebula = {
network = { enable = lib.mkEnableOption "";
address = lib.mkOption {
type = lib.types.nonEmptyStr; publicKeyPath = lib.mkOption {
default = "10.254.250.0"; type = lib.types.path;
readOnly = true; default = "${self}/hosts/${netCfg.hostname}/keys/nebula.pub";
};
prefixLength = lib.mkOption {
type = lib.types.ints.between 0 32;
default = 24;
readOnly = true;
};
domain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "splitleaf.de";
readOnly = true;
};
}; };
certificatePath = lib.mkOption {
node = { type = lib.types.path;
enable = lib.mkEnableOption ""; default = "${self}/hosts/${netCfg.hostname}/keys/nebula.crt";
name = lib.mkOption {
type = lib.types.nonEmptyStr;
default = hostname;
};
interface = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "nebula.mesh";
};
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
isLighthouse = lib.mkEnableOption "";
isServer = lib.mkEnableOption "";
isClient = lib.mkEnableOption "";
routableAddress = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
routablePort = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = if cfg.routableAddress != null then 47141 else null;
};
publicKeyPath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.pub";
};
certificatePath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.crt";
};
};
nodes = lib.mkOption {
type = lib.types.anything;
default =
self.nixosConfigurations
|> lib.attrValues
|> lib.map (value: value.config.custom.services.nebula.node)
|> lib.filter (node: node.enable);
readOnly = true;
};
peers = lib.mkOption {
type = lib.types.anything;
default = nebulaCfg.nodes |> lib.filter (node: node.name != hostname);
readOnly = true;
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
meta.ports.udp = lib.optional (cfg.routablePort != null) cfg.routablePort;
assertions = lib.singleton { assertions = lib.singleton {
assertion = cfg.isLighthouse -> cfg.routableAddress != null; assertion = netCfg.isLighthouse -> netCfg.underlay.isPublic;
message = "'${hostname}' is a Nebula lighthouse, but routableAddress is not set. Lighthouses must be publicly reachable."; message = "'${netCfg.hostname}' is a Nebula lighthouse, but underlay.isPublic is not set. Lighthouses must be publicly reachable.";
}; };
meta.ports.udp = lib.optional (netCfg.underlay.isPublic) publicPort;
sops.secrets."nebula/host-key" = { sops.secrets."nebula/host-key" = {
owner = config.users.users.nebula-mesh.name; owner = config.users.users.nebula-mesh.name;
restartUnits = [ "nebula@mesh.service" ]; restartUnits = [ "nebula@mesh.service" ];
@ -103,19 +44,21 @@ in
cert = cfg.certificatePath; cert = cfg.certificatePath;
key = config.sops.secrets."nebula/host-key".path; key = config.sops.secrets."nebula/host-key".path;
listen.port = cfg.routablePort; listen.port = lib.mkIf netCfg.underlay.isPublic publicPort;
inherit (cfg) isLighthouse; inherit (netCfg) isLighthouse;
lighthouses = lib.mkIf (!cfg.isLighthouse) ( lighthouses = lib.mkIf (!netCfg.isLighthouse) (
nebulaCfg.peers |> lib.filter (node: node.isLighthouse) |> lib.map (lighthouse: lighthouse.address) netCfg.peers
|> lib.filter (peer: peer.isLighthouse)
|> lib.map (lighthouse: lighthouse.overlay.address)
); );
staticHostMap = staticHostMap =
nebulaCfg.peers netCfg.peers
|> lib.filter (node: node.routableAddress != null) |> lib.filter (peer: peer.underlay.isPublic)
|> lib.map (lighthouse: { |> lib.map (publicPeer: {
name = lighthouse.address; name = publicPeer.overlay.address;
value = lib.singleton "${lighthouse.routableAddress}:${toString lighthouse.routablePort}"; value = lib.singleton "${publicPeer.underlay.address}:${toString publicPort}";
}) })
|> lib.listToAttrs; |> lib.listToAttrs;
@ -138,13 +81,17 @@ in
}; };
}; };
networking.firewall.trustedInterfaces = [ cfg.interface ]; networking.firewall.trustedInterfaces = [ netCfg.overlay.interface ];
systemd.network.networks."40-nebula" = { systemd.network.networks."40-nebula" = {
matchConfig.Name = cfg.interface; matchConfig.Name = netCfg.overlay.interface;
address = [ "${cfg.address}/${toString nebulaCfg.network.prefixLength}" ]; address = [ "${netCfg.overlay.address}/${toString netCfg.overlay.prefixLength}" ];
dns = nebulaCfg.peers |> lib.filter (node: node.dns.enable) |> lib.map (node: node.address); dns =
domains = [ nebulaCfg.network.domain ]; self.nixosConfigurations
|> lib.attrValues
|> lib.filter (host: host.config.custom.services.dns.enable)
|> lib.map (host: host.config.custom.networking.overlay.address);
domains = [ netCfg.overlay.domain ];
}; };
}; };
} }

27
modules/system/services/nebula/sshd.nix → modules/system/services/sshd.nix
View file

@ -5,14 +5,13 @@
... ...
}: }:
let let
cfg = config.custom.services.nebula.node; cfg = config.custom.services.sshd;
netCfg = config.custom.networking;
in in
{ {
options.custom.services.nebula.node.sshd.enable = lib.mkEnableOption "" // { options.custom.services.sshd.enable = lib.mkEnableOption "";
default = true;
};
config = lib.mkIf (cfg.enable && cfg.sshd.enable) { config = lib.mkIf cfg.enable {
meta.ports.tcp = [ 22 ]; meta.ports.tcp = [ 22 ];
services = { services = {
@ -21,7 +20,7 @@ in
openFirewall = false; openFirewall = false;
ports = [ ]; ports = [ ];
listenAddresses = lib.singleton { listenAddresses = lib.singleton {
addr = cfg.address; addr = netCfg.overlay.address;
port = 22; port = 22;
}; };
settings = { settings = {
@ -32,26 +31,26 @@ in
}; };
nebula.networks.mesh.firewall.inbound = nebula.networks.mesh.firewall.inbound =
config.custom.services.nebula.peers netCfg.peers
|> lib.filter (node: node.isClient) |> lib.filter (node: node.isClient)
|> lib.map (nebula: { |> lib.map (client: {
port = 22; port = 22;
proto = "tcp"; proto = "tcp";
host = nebula.name; host = client.hostname;
}); });
}; };
systemd.services.sshd = { systemd.services.sshd = {
requires = [ "nebula@mesh.service" ]; requires = [ netCfg.overlay.systemdUnit ];
after = [ "nebula@mesh.service" ]; after = [ netCfg.overlay.systemdUnit ];
}; };
users.users.seb.openssh.authorizedKeys.keyFiles = users.users.seb.openssh.authorizedKeys.keyFiles =
self.nixosConfigurations self.nixosConfigurations
|> lib.filterAttrs (name: _: name != config.networking.hostName)
|> lib.attrValues |> lib.attrValues
|> lib.filter (value: value.config |> lib.hasAttr "home-manager") |> lib.filter (host: host.config.custom.networking.hostname != netCfg.hostname)
|> lib.map (value: value.config.home-manager.users.seb.custom.programs.ssh) |> lib.filter (host: host.config |> lib.hasAttr "home-manager")
|> lib.map (host: host.config.home-manager.users.seb.custom.programs.ssh)
|> lib.filter (ssh: ssh.enable) |> lib.filter (ssh: ssh.enable)
|> lib.map (ssh: ssh.publicKeyPath); |> lib.map (ssh: ssh.publicKeyPath);
}; };

9
modules/system/services/syncthing.nix
View file

@ -7,6 +7,7 @@
}: }:
let let
cfg = config.custom.services.syncthing; cfg = config.custom.services.syncthing;
netCfg = config.custom.networking;
inherit (config.services.syncthing) dataDir; inherit (config.services.syncthing) dataDir;
@ -50,10 +51,6 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
assertions = [ assertions = [
{
assertion = config.custom.services.nebula.node.enable;
message = "Syncthing requires nebula";
}
{ {
assertion = cfg.isServer -> (cfg.gui.domain != null); assertion = cfg.isServer -> (cfg.gui.domain != null);
message = "Running syncthing on a server requires `gui.domain` to be set"; message = "Running syncthing on a server requires `gui.domain` to be set";
@ -109,7 +106,7 @@ in
_: value: { _: value: {
id = value.config.custom.services.syncthing.deviceId; id = value.config.custom.services.syncthing.deviceId;
addresses = [ addresses = [
"tcp://${value.config.custom.services.nebula.node.address}:${toString cfg.syncPort}" "tcp://${value.config.custom.networking.overlay.address}:${toString cfg.syncPort}"
]; ];
} }
); );
@ -122,7 +119,7 @@ in
}); });
options = { options = {
listenAddress = "tcp://${config.custom.services.nebula.node.address}:${toString cfg.syncPort}"; listenAddress = "tcp://${netCfg.overlay.address}:${toString cfg.syncPort}";
globalAnnounceEnabled = false; globalAnnounceEnabled = false;
localAnnounceEnabled = false; localAnnounceEnabled = false;
relaysEnabled = false; relaysEnabled = false;

4
modules/system/web-services/alloy.nix
View file

@ -15,11 +15,11 @@ in
}; };
metricsEndpoint = lib.mkOption { metricsEndpoint = lib.mkOption {
type = lib.types.nonEmptyStr; type = lib.types.nonEmptyStr;
default = "https://metrics.${config.custom.services.nebula.network.domain}/prometheus/api/v1/write"; default = "https://metrics.${config.custom.networking.overlay.domain}/prometheus/api/v1/write";
}; };
logsEndpoint = lib.mkOption { logsEndpoint = lib.mkOption {
type = lib.types.nonEmptyStr; type = lib.types.nonEmptyStr;
default = "https://logs.${config.custom.services.nebula.network.domain}/insert/loki/api/v1/push"; default = "https://logs.${config.custom.networking.overlay.domain}/insert/loki/api/v1/push";
}; };
collect = { collect = {
metrics = { metrics = {

2
modules/system/web-services/gatus.nix
View file

@ -113,7 +113,7 @@ in
connectivity.checker.target = "1.1.1.1:53"; # Cloudflare DNS connectivity.checker.target = "1.1.1.1:53"; # Cloudflare DNS
alerting.ntfy = { alerting.ntfy = {
topic = "uptime"; topic = "uptime";
url = "https://alerts.${config.custom.services.nebula.network.domain}"; url = "https://alerts.${config.custom.networking.overlay.domain}";
click = "https://${cfg.domain}"; click = "https://${cfg.domain}";
default-alert = { default-alert = {
enable = true; enable = true;

6
modules/system/web-services/grafana.nix
View file

@ -23,21 +23,21 @@ in
enable = lib.mkEnableOption ""; enable = lib.mkEnableOption "";
url = lib.mkOption { url = lib.mkOption {
type = lib.types.nonEmptyStr; type = lib.types.nonEmptyStr;
default = "https://metrics.${config.custom.services.nebula.network.domain}"; default = "https://metrics.${config.custom.networking.overlay.domain}";
}; };
}; };
victoriametrics = { victoriametrics = {
enable = lib.mkEnableOption ""; enable = lib.mkEnableOption "";
url = lib.mkOption { url = lib.mkOption {
type = lib.types.nonEmptyStr; type = lib.types.nonEmptyStr;
default = "https://metrics.${config.custom.services.nebula.network.domain}"; default = "https://metrics.${config.custom.networking.overlay.domain}";
}; };
}; };
victorialogs = { victorialogs = {
enable = lib.mkEnableOption ""; enable = lib.mkEnableOption "";
url = lib.mkOption { url = lib.mkOption {
type = lib.types.nonEmptyStr; type = lib.types.nonEmptyStr;
default = "https://logs.${config.custom.services.nebula.network.domain}"; default = "https://logs.${config.custom.networking.overlay.domain}";
}; };
}; };
}; };