Rename some hostnames
This commit is contained in:
parent
bbf0696221
commit
17f2a16f48
13
flake.nix
13
flake.nix
|
|
@ -74,17 +74,16 @@
|
|||
in {
|
||||
# nixos-rebuild switch --flake /etc/nixos#hostname
|
||||
nixosConfigurations = {
|
||||
firefly = mkNix [ ./hosts/firefly ]; # Main Desktop
|
||||
detritus = mkNix [ ./hosts/detritus ]; # Acer Desktop
|
||||
tower = mkNix [ ./hosts/tower ]; # Main Desktop
|
||||
|
||||
shuttle = mkNix [ ./hosts/shuttleworth ]; # Pinebook Pro
|
||||
lacros = mkNix [ ./hosts/lacros ]; # Dell Chromebook
|
||||
redmond = mkNix [ ./hosts/redmond ]; # Lenovo Dual-Boot Laptop
|
||||
treefruit = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1
|
||||
leash = mkNix [ ./hosts/leash ]; # Portable Hard-Drive
|
||||
pomme = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1
|
||||
extern = mkNix [ ./hosts/extern ]; # Portable Hard-Drive
|
||||
|
||||
cyberspark = mkNix [ ./hosts/cyberspark ]; # Dell Optiplex 7010
|
||||
bomberman = mkNix [ ./hosts/bomberman ]; # Oracle ARM
|
||||
kitty = mkNix [ ./hosts/kitty ]; # Dell Optiplex 7010
|
||||
xenia = mkNix [ ./hosts/xenia ]; # Acer Veriton X2611G
|
||||
prophet = mkNix [ ./hosts/prophet ]; # Oracle Neoverse-N1
|
||||
};
|
||||
|
||||
# home-manager switch --flake /etc/nixos#username
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
../../../modules/home/users
|
||||
../../../modules/home/settings/nix
|
||||
../../../modules/home/programs/misc/headless
|
||||
../../../modules/home/programs/terminal/fastfetch
|
||||
../../../modules/home/programs/terminal/git
|
||||
../../../modules/home/programs/terminal/neovim
|
||||
../../../modules/home/programs/terminal/ranger
|
||||
../../../modules/home/programs/terminal/tmux
|
||||
../../../modules/home/programs/terminal/zsh
|
||||
../../../variables/domains
|
||||
];
|
||||
}
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
boot = {
|
||||
kernelPackages = pkgs.unstable.linuxPackages_latest;
|
||||
kernelPackages = pkgs.linuxPackages_5_10;
|
||||
kernel.sysctl."vm.max_map_count" = 2147483642;
|
||||
kernelParams = [
|
||||
"nvidia_drm.fbdev=1"
|
||||
|
|
@ -13,8 +13,8 @@
|
|||
services.root-reset = {
|
||||
description = "Reset root and snapshot last boot";
|
||||
wantedBy = [ "initrd.target" ];
|
||||
after = [ "dev-${config.networking.hostName}-root.device" ];
|
||||
before = [ "sysroot.mount" ];
|
||||
after = [ "dev-${config.networking.hostName}-root.device" ];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
|
|
@ -4,12 +4,12 @@
|
|||
./boot
|
||||
./disko
|
||||
./hardware
|
||||
./wireguard
|
||||
../../modules/system
|
||||
];
|
||||
|
||||
system.lanzaboote.enable = true;
|
||||
system.wireguard.client.enable = false;
|
||||
system.video.nvidia.enable = true;
|
||||
|
||||
networking.hostName = "leash";
|
||||
networking.hostName = "extern";
|
||||
}
|
||||
|
|
@ -6,11 +6,12 @@
|
|||
disk = {
|
||||
"${config.networking.hostName}" = {
|
||||
type = "disk";
|
||||
device = "/dev/sdi";
|
||||
device = "/dev/sdh";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
priority = 1;
|
||||
size = "2G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
|
|
@ -1,5 +1,7 @@
|
|||
{ config, lib, modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/all-hardware.nix") ];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
|
|
@ -7,15 +9,12 @@
|
|||
"xhci_pci"
|
||||
"ahci"
|
||||
"usbhid"
|
||||
"uas"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
kernelModules = [
|
||||
"dm-snapshot"
|
||||
"vfio"
|
||||
"vfio_pci"
|
||||
"vfio_iommu_type1"
|
||||
"kvm-amd"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
@ -23,7 +22,7 @@
|
|||
fileSystems = {
|
||||
# Remote
|
||||
"/home/jimbo/JimboNFS" = {
|
||||
device = "${config.ips.wgSpan}.1:/export/JimboNFS";
|
||||
device = "10.100.0.1:/export/JimboNFS";
|
||||
fsType = "nfs4";
|
||||
options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ];
|
||||
};
|
||||
23
hosts/extern/wireguard/default.nix
vendored
Normal file
23
hosts/extern/wireguard/default.nix
vendored
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedUDPPorts = [ 51820 ];
|
||||
trustedInterfaces = [ "wgc" ];
|
||||
};
|
||||
|
||||
wireguard.interfaces.wgc = {
|
||||
ips = [ "10.100.0.20/24" ];
|
||||
listenPort = 51820;
|
||||
privateKey = config.secrets.wgClientPriv;
|
||||
peers = [
|
||||
{ # Cyberspark Server
|
||||
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
|
||||
allowedIPs = [ "10.100.0.0/24" ];
|
||||
endpoint = "sv.${config.domains.jim1}:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -21,5 +21,5 @@
|
|||
../../../variables
|
||||
];
|
||||
|
||||
networking.hostName = "cyberspark";
|
||||
networking.hostName = "kitty";
|
||||
}
|
||||
45
hosts/kitty/firewall/default.nix
Normal file
45
hosts/kitty/firewall/default.nix
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
networking = {
|
||||
firewall = {
|
||||
allowPing = false;
|
||||
extraInputRules = ''
|
||||
ip saddr { ${config.ips.localSpan}.0/24, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS"
|
||||
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
|
||||
'';
|
||||
};
|
||||
|
||||
# Nftables configuration only if server is enabled
|
||||
nftables.tables.forwarding = {
|
||||
family = "ip";
|
||||
content = ''
|
||||
chain PREROUTING {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
|
||||
tcp dport 2222 dnat to 10.100.0.19:22 comment "SSH to Oracle VM"
|
||||
|
||||
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
|
||||
|
||||
tcp dport { 48010, 47989, 47984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
|
||||
udp dport { 47998, 47999, 48000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
|
||||
|
||||
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
|
||||
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
|
||||
|
||||
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
|
||||
|
||||
ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP"
|
||||
ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP"
|
||||
}
|
||||
|
||||
chain POSTROUTING {
|
||||
type nat hook postrouting priority 100; policy accept;
|
||||
oifname "${config.ips.netInt}" masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Enable IP forwarding for the server configuration
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkIf config.system.firewall.server.enable 1;
|
||||
}
|
||||
28
hosts/kitty/wireguard/default.nix
Normal file
28
hosts/kitty/wireguard/default.nix
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
networking = {
|
||||
firewall.allowedUDPPorts = [ 51820 ];
|
||||
|
||||
nat = {
|
||||
enable = config.system.wireguard.server.enable;
|
||||
externalInterface = "eno1";
|
||||
internalInterfaces = [ "wgs" ];
|
||||
};
|
||||
|
||||
wireguard.interfaces.wgs = {
|
||||
ips = [ "10.100.0.1/24" ];
|
||||
listenPort = 51820;
|
||||
privateKey = config.secrets.wgServerPriv;
|
||||
peers = [
|
||||
{ # NixOS Config Key
|
||||
publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
|
||||
allowedIPs = [ "10.100.0.16/28" ];
|
||||
}
|
||||
{ # Pixel 9
|
||||
publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
|
||||
allowedIPs = [ "10.100.0.2/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,8 +1,10 @@
|
|||
{ config, lib, ... }:
|
||||
{ lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware
|
||||
./boot
|
||||
./disko
|
||||
./hardware
|
||||
./wireguard
|
||||
|
||||
# Apps and programs
|
||||
../../../modules/system
|
||||
|
|
@ -30,5 +32,4 @@
|
|||
};
|
||||
|
||||
networking.hostName = "lacros";
|
||||
networking.wireguard.interfaces."${config.ips.wgInt}".ips = [ "${config.ips.wgSpan}.18/24" ];
|
||||
}
|
||||
|
|
|
|||
23
hosts/lacros/wireguard/default.nix
Normal file
23
hosts/lacros/wireguard/default.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedUDPPorts = [ 51820 ];
|
||||
trustedInterfaces = [ "wgc" ];
|
||||
};
|
||||
|
||||
wireguard.interfaces.wgc = {
|
||||
ips = [ "${config.ips.wgSpan}.18/24" ];
|
||||
listenPort = 51820;
|
||||
privateKey = config.secrets.wgClientPriv;
|
||||
peers = [
|
||||
{ # Cyberspark Server
|
||||
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
|
||||
allowedIPs = [ "10.100.0.0/24" ];
|
||||
endpoint = "sv.${config.domains.jim1}:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
../../../modules/home
|
||||
../../../modules/home/programs/misc/remote-desktop
|
||||
];
|
||||
|
||||
wayland.windowManager.sway.config.output.${config.displays.dI}.scale = "1.3";
|
||||
}
|
||||
|
|
@ -1 +0,0 @@
|
|||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+L723mCLy9/9UAXwkY3+06Oq22dOj+lDnA0lMLbrsR
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
boot = {
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
kernel.sysctl."vm.max_map_count" = 2147483642;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
{ config, lib, hardware, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware
|
||||
./boot
|
||||
|
||||
# Apps and programs
|
||||
../../../modules/system
|
||||
../../../modules/system/accounts
|
||||
../../../modules/system/desktop
|
||||
../../../modules/system/programs
|
||||
../../../modules/system/services
|
||||
|
||||
# Devices and hardware
|
||||
../../../modules/system/devices
|
||||
../../../modules/system/devices/boot/extlinux
|
||||
../../../modules/system/devices/networking/wireless
|
||||
../../../modules/system/devices/networking/firewall/pc
|
||||
../../../modules/system/devices/networking/wireguard/pc
|
||||
|
||||
# Extras
|
||||
../../../overlays
|
||||
../../../variables
|
||||
|
||||
# Imports
|
||||
hardware.nixosModules.pine64-pinebook-pro
|
||||
];
|
||||
|
||||
networking.hostName = "shuttle";
|
||||
hardware.opengl.driSupport32Bit = lib.mkForce false;
|
||||
networking.wireguard.interfaces."${config.ips.wgInt}".ips = [ "${config.ips.wgSpan}.17/24" ];
|
||||
}
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ ];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
blacklistedKernelModules = [
|
||||
"pcspkr"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-uuid/25738e24-385e-4bcf-bff5-d0e6274003b6";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/01D2-E962";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
"/home/jimbo/Downloads" = {
|
||||
device = "/dev/disk/by-uuid/f0b6cf4e-9576-4ab5-96ae-2a7e57599a35";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
"/home/jimbo/JimboNFS" = {
|
||||
device = "${config.ips.wgSpan}.1:/export/JimboNFS";
|
||||
fsType = "nfs4";
|
||||
options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-uuid/95c43e5a-b53d-41fd-99a3-54181510070e"; }
|
||||
];
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
|
|
@ -30,8 +30,8 @@ in {
|
|||
services.root-reset = {
|
||||
description = "Reset root and snapshot last boot";
|
||||
wantedBy = [ "initrd.target" ];
|
||||
after = [ "dev-${config.networking.hostName}-root.device" ];
|
||||
before = [ "sysroot.mount" ];
|
||||
after = [ "dev-${config.networking.hostName}-root.device" ];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
|
|
@ -3,17 +3,17 @@
|
|||
imports = [
|
||||
./boot
|
||||
./disko
|
||||
./firewall
|
||||
./hardware
|
||||
../../modules/system
|
||||
];
|
||||
|
||||
system.lanzaboote.enable = true;
|
||||
system.wireless.enable = false;
|
||||
system.wireguard.client.enable = false;
|
||||
system.video.nvidia.enable = true;
|
||||
system.libvirtd.enable = true;
|
||||
|
||||
environment.sessionVariables.NIXOS_OZONE_WL = "1";
|
||||
|
||||
networking.hostName = "firefly";
|
||||
networking.hostName = "tower";
|
||||
}
|
||||
|
|
@ -11,6 +11,7 @@
|
|||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
priority = 1;
|
||||
size = "2G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
9
hosts/tower/firewall/default.nix
Normal file
9
hosts/tower/firewall/default.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
{ ... }:
|
||||
{
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = [
|
||||
27015 # Half-Life
|
||||
7777 # Lethal Company
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -18,7 +18,6 @@
|
|||
"${config.ws.w6}"
|
||||
"${config.ws.w4a}"
|
||||
"${config.ws.w5a}"
|
||||
"${config.ws.w6a}"
|
||||
];
|
||||
workspaces3 = [
|
||||
"${config.ws.w7}"
|
||||
|
|
@ -26,6 +25,9 @@
|
|||
"${config.ws.w9}"
|
||||
"${config.ws.w7a}"
|
||||
"${config.ws.w8a}"
|
||||
];
|
||||
workspaces4 = [
|
||||
"${config.ws.w6a}"
|
||||
"${config.ws.w9a}"
|
||||
];
|
||||
assign = output: workspaces:
|
||||
|
|
@ -37,7 +39,8 @@
|
|||
in
|
||||
(assign "${config.displays.d1}" workspaces1) ++
|
||||
(assign "${config.displays.d2}" workspaces2) ++
|
||||
(assign "${config.displays.d3}" workspaces3);
|
||||
(assign "${config.displays.d3}" workspaces3) ++
|
||||
(assign "${config.displays.d4}" workspaces4);
|
||||
|
||||
# Rules
|
||||
defaultWorkspace = config.ws.w1;
|
||||
|
|
|
|||
|
|
@ -6,16 +6,15 @@
|
|||
hashedPassword = config.secrets.jimboAccPass;
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keys = [
|
||||
(builtins.readFile ../../../../../hosts/firefly/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/detritus/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/tower/id_ed25519.pub)
|
||||
|
||||
(builtins.readFile ../../../../../hosts/shuttle/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/lacros/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/redmond/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/treefruit/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/pomme/id_ed25519.pub)
|
||||
|
||||
(builtins.readFile ../../../../../hosts/cyberspark/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/bomberman/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/kitty/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/xenia/id_ed25519.pub)
|
||||
(builtins.readFile ../../../../../hosts/prophet/id_ed25519.pub)
|
||||
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahAoF74BY6GCTsFkt1ADKaraFgJJozW1Y1aBTLK0j9 Pixel9"
|
||||
];
|
||||
|
|
|
|||
|
|
@ -1,10 +1,6 @@
|
|||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./firewall
|
||||
./wireguard
|
||||
./wireless
|
||||
];
|
||||
imports = [ ./wireless ];
|
||||
|
||||
networking = {
|
||||
wireless.enable = false;
|
||||
|
|
|
|||
|
|
@ -1,66 +0,0 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
options.system.firewall = {
|
||||
server = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Enable server firewall settings";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking = {
|
||||
firewall = {
|
||||
allowPing = false;
|
||||
extraInputRules = ''
|
||||
${lib.optionalString (!config.system.firewall.server.enable) ''
|
||||
ip saddr { ${config.ips.server}, 10.100.0.1 } accept comment "Accept Server"
|
||||
''}
|
||||
${lib.optionalString config.system.firewall.server.enable ''
|
||||
ip saddr { ${config.ips.localSpan}.0/24, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS"
|
||||
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
|
||||
''}
|
||||
'';
|
||||
};
|
||||
|
||||
# Nftables configuration only if server is enabled
|
||||
nftables = lib.mkIf config.system.firewall.server.enable {
|
||||
tables = {
|
||||
forwarding = {
|
||||
family = "ip";
|
||||
content = ''
|
||||
chain PREROUTING {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
|
||||
tcp dport 2222 dnat to 10.100.0.19:22 comment "SSH to Oracle VM"
|
||||
|
||||
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
|
||||
|
||||
tcp dport { 58010, 57989, 57984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
|
||||
udp dport { 57998, 57999, 58000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
|
||||
|
||||
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
|
||||
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
|
||||
|
||||
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
|
||||
|
||||
ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP"
|
||||
ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP"
|
||||
}
|
||||
|
||||
chain POSTROUTING {
|
||||
type nat hook postrouting priority 100; policy accept;
|
||||
oifname "${config.ips.netInt}" masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Enable IP forwarding for the server configuration
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkIf config.system.firewall.server.enable 1;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
options.system.wireguard = {
|
||||
client = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Enable WireGuard client";
|
||||
};
|
||||
};
|
||||
server = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Enable WireGuard server";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking = {
|
||||
firewall.allowedUDPPorts = [ 51820 ];
|
||||
|
||||
nat = {
|
||||
enable = config.system.wireguard.server.enable;
|
||||
externalInterface = "${config.ips.netInt}";
|
||||
internalInterfaces = [ "wgs" ];
|
||||
};
|
||||
|
||||
wireguard.interfaces = {
|
||||
wgc = lib.mkIf config.system.wireguard.client.enable {
|
||||
# Define IP of client in per device config
|
||||
listenPort = 51820;
|
||||
privateKey = config.secrets.wgClientPriv;
|
||||
peers = [
|
||||
{ # NixOS Server
|
||||
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
|
||||
allowedIPs = [ "10.100.0.0/24" ];
|
||||
endpoint = "sv.${config.domains.jim1}:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
wgs = lib.mkIf config.system.wireguard.server.enable {
|
||||
ips = [ "10.100.0.1/24" ];
|
||||
listenPort = 51820;
|
||||
privateKey = config.secrets.wgServerPriv;
|
||||
peers = [
|
||||
{ # NixOS
|
||||
publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
|
||||
allowedIPs = [ "10.100.0.16/28" ];
|
||||
}
|
||||
{ # Pixel 9
|
||||
publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
|
||||
allowedIPs = [ "10.100.0.2/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -8,5 +8,6 @@
|
|||
./mpd
|
||||
./ssh
|
||||
./sunshine
|
||||
./tlp
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -16,17 +16,12 @@
|
|||
right = "noop";
|
||||
};
|
||||
|
||||
control = {
|
||||
ctrlmod = {
|
||||
backspace = "delete";
|
||||
h = "left";
|
||||
j = "down";
|
||||
k = "up";
|
||||
l = "right";
|
||||
g = "macro(C-h)";
|
||||
semicolon = "macro(C-l)";
|
||||
};
|
||||
|
||||
ctrlmod = {
|
||||
backspace = "delete";
|
||||
"1" = "f1";
|
||||
"2" = "f2";
|
||||
"3" = "f3";
|
||||
|
|
|
|||
|
|
@ -3,5 +3,6 @@
|
|||
services.sunshine = {
|
||||
enable = config.system.desktop.enable;
|
||||
autoStart = false;
|
||||
openFirewall = true;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
4
modules/system/services/general/tlp/default.nix
Normal file
4
modules/system/services/general/tlp/default.nix
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
services.tlp.enable = true;
|
||||
}
|
||||
|
|
@ -6,11 +6,10 @@
|
|||
};
|
||||
|
||||
config.ips = rec {
|
||||
netInt = "eno1";
|
||||
localSpan = "10.0.0";
|
||||
localSpan = "10.1.0";
|
||||
server = "${localSpan}.2";
|
||||
pc = "${localSpan}.3";
|
||||
vm = "${localSpan}.4";
|
||||
pc = "${localSpan}.4";
|
||||
vm = "${localSpan}.5";
|
||||
hx = "${localSpan}.70";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue