Buskerud: Remove OV-link, general cleanup
This commit is contained in:
parent
2b834eee14
commit
799293e39b
|
@ -1,13 +1,11 @@
|
||||||
{ config, pkgs, values, ... }:
|
{ config, pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
../../base.nix
|
../../base.nix
|
||||||
../../misc/metrics-exporters.nix
|
../../misc/metrics-exporters.nix
|
||||||
|
];
|
||||||
# ./services/openvpn-client.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
# buskerud does not support efi?
|
# buskerud does not support efi?
|
||||||
# boot.loader.systemd-boot.enable = true;
|
# boot.loader.systemd-boot.enable = true;
|
||||||
|
@ -25,20 +23,10 @@
|
||||||
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
};
|
};
|
||||||
|
|
||||||
# Buskerud should use the default gateway received from DHCP
|
|
||||||
networking.interfaces.enp14s0f1.useDHCP = true;
|
|
||||||
|
|
||||||
# networking.interfaces.tun = {
|
|
||||||
# virtual = true;
|
|
||||||
# ipv4.adresses = [ {address="129.241.210.252"; prefixLength=25; } ];
|
|
||||||
# };
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
# List packages installed in system profile
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
];
|
];
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
# settings for stateful data, like file locations and database versions
|
# settings for stateful data, like file locations and database versions
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
@ -46,5 +34,4 @@
|
||||||
# Before changing this value read the documentation for this option
|
# Before changing this value read the documentation for this option
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,109 +0,0 @@
|
||||||
{ lib, values, ... }:
|
|
||||||
{
|
|
||||||
services.openvpn.servers."ov-tunnel" = {
|
|
||||||
config = let
|
|
||||||
conf = {
|
|
||||||
# TODO: use aliases
|
|
||||||
client = true;
|
|
||||||
dev = "tap";
|
|
||||||
proto = "udp";
|
|
||||||
#remote = "129.241.210.253 1194";
|
|
||||||
remote = "129.241.210.191 1194";
|
|
||||||
|
|
||||||
resolv-retry = "infinite";
|
|
||||||
nobind = true;
|
|
||||||
|
|
||||||
ca = "/etc/openvpn/ca.pem";
|
|
||||||
cert = "/etc/openvpn/crt.pem";
|
|
||||||
key = "/etc/openvpn/key.pem";
|
|
||||||
remote-cert-tls = "server";
|
|
||||||
cipher = "none";
|
|
||||||
|
|
||||||
user = "nobody";
|
|
||||||
group = "nobody";
|
|
||||||
|
|
||||||
status = "/var/log/openvpn-status.log";
|
|
||||||
|
|
||||||
persist-key = true;
|
|
||||||
persist-tun = true;
|
|
||||||
|
|
||||||
verb = 5;
|
|
||||||
|
|
||||||
# script-security = 2;
|
|
||||||
# up = "systemctl restart rwhod";
|
|
||||||
};
|
|
||||||
in lib.pipe conf [
|
|
||||||
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
|
||||||
(builtins.mapAttrs (_: value:
|
|
||||||
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
|
||||||
else if value == true then value
|
|
||||||
else if builtins.any (f: f value) [
|
|
||||||
builtins.isString
|
|
||||||
builtins.isInt
|
|
||||||
builtins.isFloat
|
|
||||||
lib.isPath
|
|
||||||
lib.isDerivation
|
|
||||||
] then toString value
|
|
||||||
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
|
|
||||||
))
|
|
||||||
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
|
||||||
(builtins.concatStringsSep "\n")
|
|
||||||
(x: x + "\n\n")
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."enp14s0f1" = {
|
|
||||||
matchConfig.Name = "enp14s0f1";
|
|
||||||
networkConfig = {
|
|
||||||
DefaultRouteOnDevice = true;
|
|
||||||
};
|
|
||||||
routes = [
|
|
||||||
{ routeConfig = {
|
|
||||||
Type = "unicast";
|
|
||||||
Destination = values.hosts.knutsen.ipv4 + "/32";
|
|
||||||
Metric = 50;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.netdevs."br0" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Kind = "bridge";
|
|
||||||
Name = "br0";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."br0" = {
|
|
||||||
matchConfig.Name = "br0";
|
|
||||||
routes = [
|
|
||||||
{ routeConfig = {
|
|
||||||
Type = "unicast";
|
|
||||||
Destination = values.ipv4-space;
|
|
||||||
Metric = 100;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."enp3s0f0" = {
|
|
||||||
matchConfig.Name = "enp3s0f0";
|
|
||||||
networkConfig.DefaultRouteOnDevice = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."enp3s0f1" = {
|
|
||||||
matchConfig.Name = "enp3s0f1";
|
|
||||||
bridge = [ "br0" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."tap0" = {
|
|
||||||
matchConfig.Name = "tap0";
|
|
||||||
bridge = [ "br0" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
#networking.nat = {
|
|
||||||
# enable = true;
|
|
||||||
# externalInterface = "enp14s0f1";
|
|
||||||
# internalInterfaces = [ "tun" ];
|
|
||||||
#};
|
|
||||||
}
|
|
Loading…
Reference in New Issue