refactor: standardize hetzner machines
Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>
This commit is contained in:
parent
6289ac038f
commit
b3c5b0c362
GPG key ID:
0142722B4B0C536F
7 changed files with 266 additions and 129 deletions
153
hosts/servers/hosting-02.nix
Normal file
153
hosts/servers/hosting-02.nix
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
51820
|
||||
];
|
||||
};
|
||||
|
||||
networking.iproute2.enable = true;
|
||||
systemd.network.config = {
|
||||
routeTables = {
|
||||
vpn = 133;
|
||||
};
|
||||
addRouteTablesToIPRoute2 = true;
|
||||
};
|
||||
|
||||
systemd.services."netns@" = {
|
||||
description = "Network namespace %i";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pkgs.iproute2}/bin/ip netns add %i";
|
||||
ExecStop = "${pkgs.iproute2}/bin/ip netns del %i";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."veth-setup@" = {
|
||||
description = "Setup veth pair for %i namespace";
|
||||
after = [ "netns@%i.service" ];
|
||||
requires = [ "netns@%i.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart =
|
||||
let
|
||||
script = pkgs.writers.writeBash "veth-up" ''
|
||||
ns="$1"
|
||||
${pkgs.iproute2}/bin/ip link add veth-init-$ns type veth peer name veth-ns-$ns
|
||||
${pkgs.iproute2}/bin/ip link set veth-ns-$ns netns $ns
|
||||
${pkgs.iproute2}/bin/ip link set veth-init-$ns up
|
||||
${pkgs.iproute2}/bin/ip netns exec $ns ${pkgs.iproute2}/bin/ip link set veth-ns-$ns up
|
||||
${pkgs.iproute2}/bin/ip netns exec $ns ${pkgs.iproute2}/bin/ip addr add 10.0.0.2/24 dev veth-ns-$ns
|
||||
'';
|
||||
in
|
||||
"${script} %i";
|
||||
ExecStop = "${pkgs.iproute2}/bin/ip link del veth-%i";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network.networks."50-veth" = {
|
||||
matchConfig.Name = "veth-init-vpn";
|
||||
networkConfig = {
|
||||
Address = "10.0.0.1/24";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."wireguard-wg0".requires = [
|
||||
"netns@vpn.service"
|
||||
"veth-setup@vpn.service"
|
||||
];
|
||||
networking.wireguard = {
|
||||
enable = true;
|
||||
useNetworkd = false;
|
||||
|
||||
interfaces.wg0 = {
|
||||
ips = [
|
||||
"10.64.244.95/32"
|
||||
"fc00:bbbb:bbbb:bb01::1:f45e/128"
|
||||
];
|
||||
|
||||
peers = [
|
||||
{
|
||||
publicKey = "KkShcqgwbkX2A9n1hhST6qu+m3ldxdJ2Lx8Eiw6mdXw=";
|
||||
allowedIPs = [
|
||||
"0.0.0.0/0"
|
||||
"::0/0"
|
||||
];
|
||||
endpoint = "146.70.117.226:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
|
||||
listenPort = 51820;
|
||||
privateKeyFile = config.sops.secrets.wireguardKey.path;
|
||||
socketNamespace = "init";
|
||||
interfaceNamespace = "vpn";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
gocryptfs
|
||||
sshfs
|
||||
];
|
||||
|
||||
programs.ssh.knownHosts.storageBox = {
|
||||
hostNames = [ "u491729.your-storagebox.de" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
|
||||
};
|
||||
|
||||
fileSystems."/mnt/box" = {
|
||||
device = "u491729@u491729.your-storagebox.de:/home";
|
||||
fsType = "fuse.sshfs";
|
||||
options = [
|
||||
"defaults"
|
||||
"_netdev"
|
||||
"allow_other"
|
||||
"default_permissions"
|
||||
"port=23"
|
||||
"compression=no"
|
||||
"reconnect"
|
||||
"ServerAliveInterval=15"
|
||||
"IdentityFile=${config.sops.secrets.storageboxKey.path}"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/data" = {
|
||||
depends = [
|
||||
"/mnt/box"
|
||||
];
|
||||
device = "/mnt/box/crypt";
|
||||
fsType = "fuse.gocryptfs";
|
||||
options = [
|
||||
"rw"
|
||||
"allow_other"
|
||||
"passfile=${config.sops.secrets.storageboxCryptKey.path}"
|
||||
];
|
||||
};
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ./hosting-02.yaml;
|
||||
secrets = {
|
||||
wireguardKey = {
|
||||
owner = "root";
|
||||
};
|
||||
storageboxKey = {
|
||||
owner = "root";
|
||||
};
|
||||
storageboxCryptKey = {
|
||||
owner = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.defaults.email = "landervandenbulcke@gmail.com";
|
||||
security.acme.acceptTerms = true;
|
||||
|
||||
system.stateVersion = "25.05";
|
||||
}
|
||||
30
hosts/servers/hosting-02.yaml
Normal file
30
hosts/servers/hosting-02.yaml
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
wireguardKey: ENC[AES256_GCM,data:Z239oQMzOp4C33pBePuANX3aPkmjTcrT+Z/UY0dnUCmMOs2Oy3iktS6Fgsw=,iv:21XLXpgsoYpvz887ZlLJW/A6IOJwEX5YwJrnO725M5U=,tag:VDGjOiYqFN8tMhf8s2YV6g==,type:str]
|
||||
storageboxKey: ENC[AES256_GCM,data:uWDkiWIk3OePRfoaqjllVlRVzW5+ryE4sIOs8qm6cS8JN/+YFbnkCsT5sdFeXSpJyQ7ymgD6uJJ75RWH6Y/iIARbmZN/x/9hnB3LORHSl/C0F3xMHUf6prXtYyPNLWe+ghCMygaLyvBuCBiEhleevRQANXLUJCysiODepSkXwyasAHKTKuKQUPU/T+1R7eXaQPDMehzD4/0o8SdLkqcZXBQzs3VRp+CbQyl7dx6znwoPWckmFH2W+9fZCE+AxFxBP3jPVjBPuOC3BviTYFSvZPEkmtH+lxYv+PXFAPpgYwmAEjCwWyDMDRy6bNVQIG6TKHn60TJv+GCfRwPJ46mVtbruyil23d7g/V7dhu8btPbgtvcBx/8EexJ0PHAVWcIZ1FJwr7inMCAghbSDD3CkGpOV8btaYgUZtosqfg9r5cd75jB+7RZPwyb8/1mrLWE3eL9Za2lZ6bC7a9AeIn1q3Cn6+aoMKqXp8q/sVwozNpUJj73yhjR146MGjCGpqoKJqK453qc3VCC50OZTOULV,iv:sEwA6zrK6FFqTmVJOMD77g0OuDjCHDLRBlirjhZBx/0=,tag:z1fX+7goXk4U6Di+4EK6Fw==,type:str]
|
||||
storageboxCryptKey: ENC[AES256_GCM,data:ryYOzFvdPaVkOHmypYbqw+KU6aB2OQutLw==,iv:FL4c7P36qxYR1KJlg7t0dvFHlKGMIrTlQG+CDkeJu9U=,tag:Ia4mhV9Ed/m1rRMCNnHqXw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSlA1Z3Q0ZzNlSmVtZmhn
|
||||
dmxZWHplaEJXWFY3UjVSVDhaRkovb0srRkJvClpENmkzK3YrYysvVTJJQ1JVTDA0
|
||||
VG5ySFJYQTlqbkJVZ2pwYjhXeHNsQXcKLS0tIEZDdTRYUzJFdUdUeVpOd3gybkxs
|
||||
b1ZqUzZLUkFwNHJyVlhmK0FOZ1JFYUEKDU4NmBCHRY+ZK+RFK/LioGzjJTaOE1ky
|
||||
MC6jxt7Y5RkCk0BBqeoEVLaNXNViPjwakbvyfH0w0P6l0KDJ4mNlYQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-09-18T21:32:51Z"
|
||||
mac: ENC[AES256_GCM,data:y3iMxGNyJfkmJZebiJ/iW/fhX3758Bz8/z8GfzvBiosjHOE6Awka70uQ7rFvHrLIFATDCrWW09ERD16/EIGL7bZMBKeXmjpkTe9WrmqYu4aS9qj1A/UzcW9zkxj6kKSZlgbdh2RaPXj9VcVfdYs/WDp8cxAuNmFLLEpY9Ar0SSY=,iv:rSGm4Y9XWrYmA2rL3t63NfSgHd6wBPWbtvfGivj6Qq0=,tag:gdHWOS0NO5piFK3fQiCSrw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-09-18T21:32:42Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hF4DARdpY4woM6wSAQdA3//4oqX5uJuZHRzZ4TYvZ4rvbh1RLXKKwzmKkZ1wYBMw
|
||||
kXxBjyp9624BQvC0P/aXgr1dWnAqkqNG7/y6Zfg0CLK8qcCkDiur20EH35XOy2gv
|
||||
0l4BbPW04HWvJKU3y6WvVucG87gRi83kJbT6AHXfuw2mAw77pJNZY0g645fV9wBc
|
||||
tSkkum0EpC8P+4aiqcKyFy0KfsmOlouT6QqmlH1VZvCfRPZ1hysWG2bIzV0BDDOo
|
||||
=nKA3
|
||||
-----END PGP MESSAGE-----
|
||||
fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.10.2
|
||||
Loading…
Add table
Add a link
Reference in a new issue