From a2e5f43a1fd178a3edf46f3383436287cbe460f5 Mon Sep 17 00:00:00 2001 From: macronova Date: Mon, 27 Nov 2023 21:44:04 -0800 Subject: [PATCH] Try tailscale --- common/auths.yaml | 8 ++------ common/constants.nix | 2 -- common/secrets.yaml | 7 ++----- linux/blitzar/default.nix | 1 + linux/blitzar/gui.nix | 5 ----- linux/blitzar/network.nix | 10 ---------- linux/blitzar/tailscale.nix | 7 +++++++ linux/nebula/conduit.nix | 1 + linux/nebula/default.nix | 1 + linux/nebula/forgejo.nix | 1 + linux/nebula/network.nix | 15 +-------------- linux/nebula/tailscale.nix | 8 ++++++++ linux/singularity/caddy.nix | 4 ++++ linux/singularity/default.nix | 2 +- linux/singularity/headscale.nix | 18 ++++++++++++++++++ linux/singularity/network.nix | 30 +++--------------------------- linux/singularity/xray.nix | 10 ---------- 17 files changed, 50 insertions(+), 80 deletions(-) create mode 100644 linux/blitzar/tailscale.nix create mode 100644 linux/nebula/tailscale.nix create mode 100644 linux/singularity/headscale.nix delete mode 100644 linux/singularity/xray.nix diff --git a/common/auths.yaml b/common/auths.yaml index a702413..eb8e364 100644 --- a/common/auths.yaml +++ b/common/auths.yaml @@ -6,10 +6,6 @@ mail: users: macronova: password: ENC[AES256_GCM,data:GSWsFhbxrUn1/tuURrl+D9wR80PZWzMU8sIjZpDyCyTrsCnbwcyqlsEx6MYSF/bRtAujR/kH2ppLM5O6QcIduETIMfjAMl8th9ZbQLUPiTpXRkfI01GKeUzYuvlATBGbnNHouJ2HJPamG+TJSBrbJJasoe5wUQ==,iv:RZQXTptp9MZejgrhWbeHSk0qgA4lSyo9yFdKZdJfvIk=,tag:38KJZbV19oT+3MH60d/grw==,type:str] -wireguard: - singularity: ENC[AES256_GCM,data:l9Caypu4lLh2uenMYgBxavvKvPMERx9t3yA4S9mDEonqJgQQivI/0+Iqfj4=,iv:VZmPjpsjzVjlXLjhVtvCduQyL2xO6UHf8RjjXhVbzYw=,tag:ob/jfUvWeFtsf/0J6Kee2A==,type:str] -xray: - config.json: ENC[AES256_GCM,data:OfdVi938yFyZxV9aXRmLcO6Yr/fwocu2msSUHXIfTZUn4D2lrQhZMCtdkJoZxI/4hCxPGGns9FlJ10++iVJTPAp0UyEV2f2bsWfR/K9X1oD0j0jSdF4V7bwXUeAFtdCJKcuZ8zj/7UrrUucQ3Pwg2iYrzkzyJq38qWu47mIv8N2ata+mS+mle66Fh2YX74pZ6BuziUGuZ6QSVjz/s/YvCfyhPQD1t4zAEjHD2/jigZ4ZKhE7HbdDt3/W1S8m5+DhWSf+INVjcQt+DU4buEz1jNrQQxZXJTR4ZtRQJI6/oUN6deQLQtzBIIL7dGlbsTKp9IW6bho4mP/u162muq0vNskUafawWwaSpdyRnqTzqRHuzA1JfsSJVc6awf+3N35VjCBNmLXOTsdl4GNXt4IA4sRNyXS3dnToW1V9Jbr4zuECsdm2XnnODvkc/wwbL0JG9uav9soerd+FZ/9LZ8ETvN/8UcbjuQtrdSwLvu+bKb/mkJ9k03/cZL0OPeSYvJo1tBjN+bR/r2WG0iQSLsIkZoIv4PfhjveBRitFHUeZYQAbVbxK+LbV5pzfb8Nbf7tMJyXBSBf1d364Z85Aj5+AgTTW7LQqKKSs9YuHsQSARBlqPBdXnh25nTgPfUIt/Z+PDE8ryxOW8vITvo8RJ6b15Y1niwwFFcfbpdn13r+/9exFaV48huVllZz3C7HpC57GBrMyIN34G2ZA/VQ7UW8LxJLxhaBDLj0jHHI/BzTsBvwzvWKWFbnIu1yKX9Nn9I+Qa4RSxfSbiLjGUkRelL6+ktzCZmUxx+DiUOITpQ2F36XBGbclZHKhBIJRoSYNPGP6BKB/7s3l2pk5MZW8rmhe0Y1gK3aVZEfS2d6sIxD5xZ7gVV+U6hVaa+CAGf9mlHWbnMWnjuHeuKGAXgw0c0GjpQvL6c7G16sCFBDyeaiiJJPUDyHCiY83m/UeL2RjhYAbG4ydDflP1/BfZl4YV5xNFnbvMWehNV7JY5J8FbepdIwz6OJ6tibt7Qfny7/uYvA5+dKb53G/A0MzLG9IkiLpfTVdfVwD1iU288hqcADCY1yw+m46ivGvU/GJNHxUzmZ1rvxB9+cxox2BIJp75Fre39EMcu0at8br9K+NGE63e2epdXqUQ0Qi3PQL/4Dx9xI1SVtn62DwOuFuAgjYbVP3BA7PYePan6nMEBOhIR+pJJWxBhYGeKJIuqBECoX6ht0ldVzn8wyoa0eEs2sc5LpqqrxAJij4oRprjol/7MYU+ZESMP2Cap46qsSeqCX8v6d/wz73VEmyzbzgSsfGfoXhu9k9eM+Xt5ULhjYyK1Rt+HoVRapyBI+tsk+AUc14ItBvQZfmZ0QZZgTyLXyYzDbGg3t2ZBCC/vedPzeRSW/PgBTS/fiVBRzKTms62IWZ1ggyn9X8QXpyWbIix9BFThfm2c1stKcCXp1iKs0IdNj6Lrwvoimuzs6nS7+oWhTJrELuNz9ok6sFxg6GDAv+9v+7dYZnYm6SwlzTD/DIxlqT2ozW2cqwNwilBC7gyxFH7wUuHD1tz7t5mkkIi+r2rq4gIRS/UFcW37zV0deg3JpFxhEkitIw4+WWG8gcuollYw60xfCI5qu4kIZiTYV7oRQYJTnJDF44pDngq1frOuPIT+D5lh+R4TSYL9/4zt6Cdp+2FLddyyyW6mUSXIz6ribg+q6JV2Su8qozBWAlAr3lkesBCuobgBRXECPfIksg9SOVhZulAu1/mo0H/F7XJvTBgQurx1+nTgfJSoQtLlbgSCYr4aViJZOMOdL+yZk5tBwKNx+sF6mZwhe4pSlpIbqtPJeDDA0JC6/OabvSFFXhkYOUll7nA071oUvtdiXYoh2Vv7GJdJMHxxbSVjKv/dYbfXuDN+036bXnXbu2WPbxRTyRxLeLSCli+ngxbl5BOPS+2N/JItTcaRur7K98vuaHDzr1y6eA0GXJxm0PDqMd2F2MW12QDLTtEhq0+hn5HJcOBB4CNLn0mBXbMS8VHDoLokwMtZg3ukcBMnBfza9Q7BcBovypOtjrZ50zU40x4bA7YwPojHSXkAHrUNElBPSOjV5JvkAcX6CF6BG8PloJc+5aC3eGFQ/teymS9HbmPpCI7rXV5D7gsy9kdL1yVtQpOLsdcoERidyh21aEL2q5s26ri8/7e7TF4bpVE1bNiuus68kNZxqabuBfVOEzS0yKBnEHxqtJxZlPvakVQjdfQ0faLLjzXCvXsn3+pPQf0h8yXtLKmlIOlC+G2CoSGtXQ30ha7XuQqzWQBCu5Wv3fAHQyAgJIRzGn+OVz86r2/Gt4sRIECWKPylZi3Yh0XkNIA53T170hUTIi+aSSUgH7trKm0hp7VMJIBa74gyBuQnfez/lI/IDxkiZICmatYgjRL1QkHBvvxmT+4LYHy+nIuSu8OQX0HVRlRY3mkdarH8ypMvqqDkuCtOJPyQlW3qZxg1Us68X4lyviQISd0EeBf7/pRXXGpk6t50CYCvB0Hpz6e/CQZnTcyMvLzwpR1L/SqLL0vHY+bE7B72pL97o3o5GfiBvgKvIhgqqqwYQpt34mR580ZH2UkfgeCWI9uvpv/WaX8y0jHf2rifhLcTYShDLcv2j+/Kq5kGx+UjaRe2JFYKWOCX0S7JUO/FVDaL56F1u/WVSj7LSWQhtWK18OdZfyx8Epdce+bgcEx2zv5I8HByQznbib6bIrWOIWzp5y4wdoIlbmbUC2zax6j9v5Mxwpdy5VW2731fCsOX9SarqeK4GGzhYzqqxePJpif+AD4xcAY53XgOg38hQ8nUdJvSk7xVb0Sl4iWezHF6tt495/tlw6yyNQfs1TfMnYP4o0UhN8jTi8FnA1V1cMiKnOz4FWPl06X6cyZZDwO3ZmfSNjilusNdeuXUMJk67+h5xyik+r7Mkduz6fbno6YRTGFwkz,iv:a/F/UBjwV+rteo2Qle9XOVYW9ltdD/nfLh/1Pr5yiWU=,tag:tYd1w+b7DfZERGZQwRbHoA==,type:str] sops: kms: [] gcp_kms: [] @@ -34,8 +30,8 @@ sops: ZW9EMlgrMnFHaHdQSWgvM25ocmNoVEkKo7H1Y+kZrtmk58Oe6d51wJQLF5T7OZtX 0LgNOjevRPfxG4FpNk9yhLyrelpHkiSmBFTGHqbnouFE54L1eot/UQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-11-15T04:26:43Z" - mac: ENC[AES256_GCM,data:8v+maj6UcpyVZJQGYurDjMAP824WJbiYrUpuCoow4R+bcmBecCu7F4v3G4T89tGP5ZgdOWryzoQwz6c3E5/YQkqiZh0JwYUJ2CY+UddDn1gbBU04Dyzmg/aKLWpWmwi9iyYVjVpNT26Jrykx+EQI9gfEEnUirPHZAW7mm+gT2Ww=,iv:xPTgMwKHPrNQiWyOxriIjoQsUR86M5UmQ5OIoZBhOE8=,tag:1E25JFRGxjMvvXXIoEh2jA==,type:str] + lastmodified: "2023-11-28T05:25:46Z" + mac: ENC[AES256_GCM,data:e6p67apo/byZ1dNhvHqcbcUOnTFInoL9t2RGki8Wd114w+1IZxfPAmXzvoea3txXWnrvCuuZBVD+RglcWjbkvE54J8YfACgRN5+93NLWVVHrgbwL7WiI+W+rpzUqiWxByD72ee9rvG1dehAEAT0QEARVehIHpPK8F9/i/a3F+IA=,iv:rjtqpbKe4FyrX4RdVMwyqkCDMSP1rUaZoC9U9CAlzR0=,tag:4KSAB5eooNTdd/2ff9zL5Q==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/common/constants.nix b/common/constants.nix index dd96f65..81e9a36 100644 --- a/common/constants.nix +++ b/common/constants.nix @@ -27,8 +27,6 @@ http = 80; https = 443; jellyfin = 8096; - wireguard-server = 45556; - xray = 50051; }; description = '' The mapping from service to ports. diff --git a/common/secrets.yaml b/common/secrets.yaml index bc2b686..200655b 100644 --- a/common/secrets.yaml +++ b/common/secrets.yaml @@ -3,9 +3,6 @@ cloudflare: users: macronova: password: ENC[AES256_GCM,data:o3WtsW7x9wy+gtl8UiT/s5q7F7Ym4q/CGvTy5Hl6FfvaEhbC/GPHQKVbz0MmRF3WV7Oq3jNxdryxWgXcd+WSCHoThNRIh/B4ZpLePD9Yi7Bf6trEYGWMdQM1Qx9pET7FaEBVOJC8eg+Ca4b/cASo53iuim6wzw==,iv:dbypWZHIXhl1kSnyiqW6R/O4NZb7u0R9X+tYpCKEMw4=,tag:bgCiGaH7EVfu7Sox0vulug==,type:str] -wireguard: - blitzar: ENC[AES256_GCM,data:Sk4BMqMiGlpy5wrczusc5/3w5DU3ceEe2Ktw9JDG5+3+TFlhs1aw/rENgOY=,iv:Ck68whhhw2nqCzirMfrSQA4uiGoP8ZKXM3ho97tkoYA=,tag:qJRMGCwB1iCyhhUKfD9s1Q==,type:str] - nebula: ENC[AES256_GCM,data:0psRgoaUQfP7zKnEaOIbvIPt0MDtRluICs+icz34kl7pJvnlVonY33qjJyA=,iv:hLL32WAy9VDND2/fiFvLzDPabvZjHzWRIOXvRDGVmgg=,tag:ltRzF8VZbPKC2GdxMrpF1Q==,type:str] sops: kms: [] gcp_kms: [] @@ -39,8 +36,8 @@ sops: TG5mYWd3MnI5TlZiNXBjb0JJY3BvN0EKUd0ldQPe0/zdHjsmKEUhH7xkpO4nLfd5 fnTk1jGonJg+t+TqLLg/YYKlcNkgExWaIZ7wrd0RVKXOeC2BtM/wzQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-11-15T04:54:01Z" - mac: ENC[AES256_GCM,data:B+NuRN+BkRPdF2Vr5M4y5sv+4iMuLVZM4Rzuqb+7I0/LqUHNBkgUDg6VYLBkYr4wbr6MCpgACeoevIRQbbjJnfHW7YMwDTqDsX40uELIy23828aKGRW6vWXnSLllpYn5IrXRCWjT8j29tJrhqPLiLLlQt3XQVtiNGBTyhnq5fTw=,iv:IDuSMnQ0FcTi3xDpXUhiolBajAAWrjgW14gOTF8iu/k=,tag:XHEGFeeJcgKoum970a0WCQ==,type:str] + lastmodified: "2023-11-28T05:25:16Z" + mac: ENC[AES256_GCM,data:B+ubIgddt+6DKFw70eHI9tVqUtSO6+BOwLyn7CfzpibCGCKgvWd4K05v7Wy4iZXfwMQ4eS5aNn58yPGrCXKU+LSCKKk4167woQ3CR0ALKj3vQfDMJn02SDrYyu+C8VNN0cOUkw9MwyyTZQgkypz/dTgYv/s1cmHHldvcgiqPchk=,iv:1iKgkaTxMZUvwpmUXRl/xk7p5rIG0gH2nCjmARkV4Dk=,tag:+Zers+yBe6T4Ss6sZRweMw==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/linux/blitzar/default.nix b/linux/blitzar/default.nix index 99cae6c..2f9e630 100644 --- a/linux/blitzar/default.nix +++ b/linux/blitzar/default.nix @@ -12,6 +12,7 @@ ./network.nix ./locale.nix ./syncthing.nix + ./tailscale.nix ./zfs.nix ../../common ]; diff --git a/linux/blitzar/gui.nix b/linux/blitzar/gui.nix index e5d4b49..968a5c9 100644 --- a/linux/blitzar/gui.nix +++ b/linux/blitzar/gui.nix @@ -70,11 +70,6 @@ }; programs = { - clash-verge = { - enable = true; - tunMode = true; - autoStart = true; - }; dconf.enable = true; steam.enable = true; }; diff --git a/linux/blitzar/network.nix b/linux/blitzar/network.nix index e0da014..793136a 100644 --- a/linux/blitzar/network.nix +++ b/linux/blitzar/network.nix @@ -7,17 +7,7 @@ wifi.backend = "iwd"; }; nftables.enable = true; - wireguard.interfaces.wgb = { - ips = [ "10.32.54.2/32" ]; - peers = [{ - allowedIPs = [ "10.32.54.0/24" ]; - endpoint = "${const.domain}:${toString const.port.wireguard-server}"; - publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4="; - }]; - privateKeyFile = config.sops.secrets."wireguard/${config.networking.hostName}".path; - }; wireless.iwd.enable = true; }; services.resolved.enable = true; - sops.secrets."wireguard/${config.networking.hostName}" = { }; } diff --git a/linux/blitzar/tailscale.nix b/linux/blitzar/tailscale.nix new file mode 100644 index 0000000..58797c6 --- /dev/null +++ b/linux/blitzar/tailscale.nix @@ -0,0 +1,7 @@ +{ ... }: { + services.tailscale = { + enable = true; + port = 22276; + useRoutingFeatures = "client"; + }; +} diff --git a/linux/nebula/conduit.nix b/linux/nebula/conduit.nix index 789053f..fdc1c14 100644 --- a/linux/nebula/conduit.nix +++ b/linux/nebula/conduit.nix @@ -5,6 +5,7 @@ enable = true; settings.global = { address = config.constants.localhost; + port = 29800; server_name = config.constants.domain; }; }; diff --git a/linux/nebula/default.nix b/linux/nebula/default.nix index e75f764..3816161 100644 --- a/linux/nebula/default.nix +++ b/linux/nebula/default.nix @@ -15,6 +15,7 @@ ./jellyfin.nix ./network.nix ./syncthing.nix + ./tailscale.nix ./zfs.nix ../../common ]; diff --git a/linux/nebula/forgejo.nix b/linux/nebula/forgejo.nix index f3de21b..2b94909 100644 --- a/linux/nebula/forgejo.nix +++ b/linux/nebula/forgejo.nix @@ -9,6 +9,7 @@ server = let dn = config.constants.domain; in { DOMAIN = dn; HTTP_ADDR = config.constants.localhost; + HTTP_PORT = 47674; ROOT_URL = "https://forgejo.${dn}"; }; service.DISABLE_REGISTRATION = true; diff --git a/linux/nebula/network.nix b/linux/nebula/network.nix index ee1eb85..053dc88 100644 --- a/linux/nebula/network.nix +++ b/linux/nebula/network.nix @@ -11,16 +11,6 @@ let const = config.constants; hn = config.networking.hostName; in { }; nftables.enable = true; tempAddresses = "disabled"; - wireguard.interfaces.wgn = { - ips = [ "10.32.54.3/32" ]; - peers = [{ - allowedIPs = [ "10.32.54.0/24" ]; - endpoint = "${const.domain}:${toString const.port.wireguard-server}"; - persistentKeepalive = 54; - publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4="; - }]; - privateKeyFile = config.sops.secrets."wireguard/${hn}".path; - }; wireless.iwd.enable = true; }; @@ -48,8 +38,5 @@ let const = config.constants; hn = config.networking.hostName; in { resolved.enable = true; }; - sops.secrets = { - "cloudflare/${hn}" = { }; - "wireguard/${hn}" = { }; - }; + sops.secrets."cloudflare/${hn}" = { }; } diff --git a/linux/nebula/tailscale.nix b/linux/nebula/tailscale.nix new file mode 100644 index 0000000..61930df --- /dev/null +++ b/linux/nebula/tailscale.nix @@ -0,0 +1,8 @@ +{ ... }: { + services.tailscale = { + enable = true; + extraUpFlags = [ "--advertise-exit-node" ]; + port = 25555; + useRoutingFeatures = "both"; + }; +} diff --git a/linux/singularity/caddy.nix b/linux/singularity/caddy.nix index b855778..c005892 100644 --- a/linux/singularity/caddy.nix +++ b/linux/singularity/caddy.nix @@ -7,6 +7,7 @@ virtualHosts = let dn = config.constants.domain; + hsCfg = config.services.headscale; msfqdn = config.mailserver.fqdn; mtfqdn = "matrix.${dn}"; vaultCfg = config.services.vaultwarden.config; @@ -22,6 +23,9 @@ "m.identity_server": { "base_url": "https://${mtfqdn}" } }` ''; + "headscale.${dn}".extraConfig = '' + reverse_proxy ${hsCfg.address}:${toString hsCfg.port} + ''; ${msfqdn} = { extraConfig = '' file_server ${wn "acme-challenge"}/* { diff --git a/linux/singularity/default.nix b/linux/singularity/default.nix index 5a92eac..70e71ce 100644 --- a/linux/singularity/default.nix +++ b/linux/singularity/default.nix @@ -4,10 +4,10 @@ ./caddy.nix ./configuration.nix ./hardware-configuration.nix + ./headscale.nix ./mailserver.nix ./network.nix ./vaultwarden.nix - ./xray.nix ../../common ]; } diff --git a/linux/singularity/headscale.nix b/linux/singularity/headscale.nix new file mode 100644 index 0000000..9bb84da --- /dev/null +++ b/linux/singularity/headscale.nix @@ -0,0 +1,18 @@ +{ config, ... }: + +{ + services = let const = config.constants; in { + headscale = { + enable = true; + address = const.localhost; + port = 27327; + settings.server_url = "https://headscale.${const.domain}"; + }; + tailscale = { + enable = true; + extraUpFlags = [ "--advertise-exit-node" ]; + port = 27919; + useRoutingFeatures = "both"; + }; + }; +} diff --git a/linux/singularity/network.nix b/linux/singularity/network.nix index e30aa3d..6dbc163 100644 --- a/linux/singularity/network.nix +++ b/linux/singularity/network.nix @@ -1,34 +1,13 @@ { config, ... }: -let hn = config.networking.hostName; port = config.constants.port; wgi = "wgs"; in { +let hn = config.networking.hostName; in { networking = { domain = config.constants.domain; firewall = { - allowedTCPPorts = with port; [ http https xray ]; - allowedUDPPorts = with port; [ wireguard-server ]; + allowedTCPPorts = with config.constants.port; [ http https ]; }; hostId = "2cadb253"; - nat = { - enable = true; - externalInterface = "ens18"; - internalInterfaces = [ wgi ]; - }; nftables.enable = true; - wireguard.interfaces.${wgi} = { - ips = [ "10.32.54.76/24" ]; - listenPort = port.wireguard-server; - peers = [ - { - allowedIPs = [ "10.32.54.2/32" ]; - publicKey = "RhS1H8g47EnOhu1F6y3QO6XqxnabGcNNb0BixBuKkDQ="; - } - { - allowedIPs = [ "10.32.54.3/32" ]; - publicKey = "1OA03mqu7SxREAum4UabJKD7hf+foPLu1j0E1N5K508="; - } - ]; - privateKeyFile = config.sops.secrets."wireguard/${hn}".path; - }; }; services = { @@ -53,8 +32,5 @@ let hn = config.networking.hostName; port = config.constants.port; wgi = "wgs"; resolved.enable = true; }; - sops.secrets = { - "cloudflare/${hn}" = { }; - "wireguard/${hn}" = { }; - }; + sops.secrets."cloudflare/${hn}" = { }; } diff --git a/linux/singularity/xray.nix b/linux/singularity/xray.nix deleted file mode 100644 index 0ed6daa..0000000 --- a/linux/singularity/xray.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ config, ... }: - -let xrayCfg = "xray/config.json"; in { - services.xray = { - enable = true; - settingsFile = config.sops.secrets.${xrayCfg}.path; - }; - - sops.secrets.${xrayCfg}.mode = "0444"; -}