SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 14:01:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

nebula: Enable firewall and restrict ssh access by role

Browse source
This commit is contained in:
SebastianStork 2026-01-03 00:41:13 +01:00
parent 382dae6cbb
commit 61f5c54196
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
5 changed files with 69 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

85
modules/system/services/nebula/default.nix
View file

@ -6,49 +6,58 @@
}:
let
cfg = config.custom.services.nebula.node;
peers = config.custom.services.nebula.peers;
hostname = config.networking.hostName;
nodes =
self.nixosConfigurations
|> lib.filterAttrs (name: _: name != hostname)
|> lib.attrValues
|> lib.map (value: value.config.custom.services.nebula.node)
|> lib.filter (node: node.enable);
lighthouses = peers |> lib.filter (node: node.isLighthouse);
lighthouses = nodes |> lib.filter (node: node.isLighthouse);
routableNodes = nodes |> lib.filter (node: node.routableAddress != null);
routablePeers = peers |> lib.filter (node: node.routableAddress != null);
in
{
options.custom.services.nebula.node = {
enable = lib.mkEnableOption "";
name = lib.mkOption {
type = lib.types.nonEmptyStr;
default = config.networking.hostName;
};
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
isLighthouse = lib.mkEnableOption "";
options.custom.services.nebula = {
node = {
enable = lib.mkEnableOption "";
name = lib.mkOption {
type = lib.types.nonEmptyStr;
default = hostname;
};
address = lib.mkOption {
type = lib.types.nonEmptyStr;
default = "";
};
isLighthouse = lib.mkEnableOption "";
isServer = lib.mkEnableOption "";
isClient = lib.mkEnableOption "";
routableAddress = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
routablePort = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = if cfg.routableAddress != null then 47141 else null;
routableAddress = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
routablePort = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = if cfg.routableAddress != null then 47141 else null;
};
publicKeyPath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.pub";
};
certificatePath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.crt";
};
};
publicKeyPath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.pub";
};
certificatePath = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${hostname}/keys/nebula.crt";
peers = lib.mkOption {
type = lib.types.anything;
default =
self.nixosConfigurations
|> lib.filterAttrs (name: _: name != hostname)
|> lib.attrValues
|> lib.map (value: value.config.custom.services.nebula.node)
|> lib.filter (node: node.enable);
readOnly = true;
};
};
@ -80,7 +89,7 @@ in
);
staticHostMap =
routableNodes
routablePeers
|> lib.map (lighthouse: {
name = lighthouse.address;
value = lib.singleton "${lighthouse.routableAddress}:${toString lighthouse.routablePort}";
@ -89,14 +98,14 @@ in
firewall = {
outbound = lib.singleton {
host = "any";
port = "any";
proto = "any";
host = "any";
};
inbound = lib.singleton {
host = "any";
port = "any";
proto = "any";
proto = "icmp";
host = "any";
};
};

25
modules/system/services/nebula/sshd.nix
View file

@ -16,14 +16,25 @@ in
config = lib.mkIf (cfg.enable && cfg.sshd.enable) {
meta.ports.tcp = [ cfg.sshd.port ];
services.openssh = {
enable = true;
openFirewall = false;
ports = [ ];
listenAddresses = lib.singleton {
addr = cfg.address;
inherit (cfg.sshd) port;
services = {
openssh = {
enable = true;
openFirewall = false;
ports = [ ];
listenAddresses = lib.singleton {
addr = cfg.address;
inherit (cfg.sshd) port;
};
};
nebula.networks.mesh.firewall.inbound =
config.custom.services.nebula.peers
|> lib.filter (node: node.isClient)
|> lib.map (nebula: {
port = "22";
proto = "tcp";
host = nebula.name;
});
};
systemd.services.sshd = {