diff options
| -rw-r--r-- | .sops.yaml | 2 | ||||
| -rw-r--r-- | hosts/underworld/default.nix | 21 | ||||
| -rw-r--r-- | hosts/underworld/home.nix | 2 | ||||
| -rw-r--r-- | hosts/underworld/network.nix | 135 | ||||
| -rw-r--r-- | wireguard.nix | 4 |
5 files changed, 157 insertions, 7 deletions
@@ -1,6 +1,6 @@ keys: - &machine_sagittarius age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern - - &machine_underworld age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6 + - &machine_underworld age1c8ff4rph28fvpy2e2kwh9m8hwrpyxzet75uhpxvxe90ncjcded5qmt64zq creation_rules: - path_regex: secrets/[^/]+\.(yaml|json|env|ini|txt)$ key_groups: diff --git a/hosts/underworld/default.nix b/hosts/underworld/default.nix index 98e5d97..a9b3494 100644 --- a/hosts/underworld/default.nix +++ b/hosts/underworld/default.nix @@ -1,5 +1,6 @@ { pkgs, + lib, flakeRoot, inputs, config, @@ -10,6 +11,7 @@ # Include the results of the hardware scan. ./hardware.nix + ./network.nix ./home.nix (flakeRoot + /share/system/client-common.nix) { @@ -97,11 +99,20 @@ #media-session.enable = true; }; - security.pki.certificateFiles = [ ../../share/certs.crt ]; - networking.useNetworkd = false; - networking.networkmanager = { - enable = true; - plugins = [ pkgs.networkmanager-openconnect ]; + boot.kernelModules = [ "8852au" ]; + # boot.extraModulePackages = [ + # config.boot.kernelPackages.rtl8852bu # TP-Link Archer TX20U Nano + # ]; + services.udev.extraRules = + # Switch TP-Link Archer TX20U Nano from CDROM mode (default) to WiFi mode + '' + ATTR{idVendor}=="0bda", ATTR{idProduct}=="1a2b", RUN+="${lib.getExe pkgs.usb-modeswitch} -K -v 0bda -p 1a2b" + ''; + + nixpkgs.config = { + problems.handlers = { + rtl8852bu.broken = "warn"; # or "ignore" + }; }; users.users = { diff --git a/hosts/underworld/home.nix b/hosts/underworld/home.nix index 8ea7921..bb5f23b 100644 --- a/hosts/underworld/home.nix +++ b/hosts/underworld/home.nix @@ -22,7 +22,7 @@ (flakeRoot + /share/home/dev-stuff.nix) (flakeRoot + /share/home/shell.nix) (flakeRoot + /share/home/gui-tools.nix) - (flakeRoot + /share/home/gaming.nix) + # (flakeRoot + /share/home/gaming.nix) (flakeRoot + /share/home/niri.nix) ]; diff --git a/hosts/underworld/network.nix b/hosts/underworld/network.nix new file mode 100644 index 0000000..5b8380f --- /dev/null +++ b/hosts/underworld/network.nix @@ -0,0 +1,135 @@ +{ + config, + flakeRoot, + ... +}: +let + secrets = config.sops.secrets; +in +{ + imports = [ (flakeRoot + /wireguard.nix) ]; + + sops = { + age.keyFile = "/var/lib/sops-nix/key.txt"; + secrets."wireless.env" = { + sopsFile = ../../secrets/wireless.env; + format = "dotenv"; + reloadUnits = [ "iwd.service" ]; + }; + }; + + networking = { + hostName = "underworld"; + useNetworkd = true; + firewall.enable = false; + nftables = { + enable = true; + tables.filter = { + enable = true; + family = "inet"; + content = '' + set temp-ports { + type inet_proto . inet_service + flags interval + comment "Temporarily opened ports" + } + + chain rpfilter { + type filter hook prerouting priority mangle + 10; policy drop; + meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server" + fib saddr . mark . iif check exists accept + jump rpfilter-allow + } + + chain rpfilter-allow { + } + + chain prerouting { + type filter hook prerouting priority mangle; + iifname "wg0" meta mark set 42 + } + + chain input { + type filter hook input priority filter; policy drop; + iifname "lo" accept comment "trusted interfaces" + icmpv6 type echo-reply accept + ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow } + } + + chain input-allow { + # tcp dport { 22, 80, 443 } accept + udp dport 51820 accept + meta l4proto . th dport @temp-ports accept + icmp type echo-request accept comment "allow ping" + icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4." + ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client" + } + ''; + }; + }; + }; + + networking.wireless.iwd-ext = { + enable = true; + secretsEnvFile = secrets."wireless.env".path; + networks = { + "KopsiNet-5" = { + networkType = "psk"; + config.Security.Passphrase = "@KOPSINET_PSK@"; + }; + "Pixel_3169" = { + networkType = "psk"; + config.Security.Passphrase = "@PHONE_HOTSPOT_PSK@"; + }; + "eduroam" = { + networkType = "8021x"; + config.Security = { + EAP-Method = "TTLS"; + EAP-Identity = "anonymous@tvz.hr"; + EAP-TTLS-CACert = "embed:eduroam_ca_cert"; + EAP-TTLS-ServerDomainMask = "freeradius.tvz.hr"; + EAP-TTLS-Phase2-Method = "Tunneled-PAP"; + EAP-TTLS-Phase2-Identity = "mbastaja@tvz.hr"; + EAP-TTLS-Phase2-Password = "@EDUROAM_PASS@"; + }; + config.Settings.AutoConnect = true; + extraConfigLines = '' + [@@pem@@eduroam_ca_cert] + -----BEGIN CERTIFICATE----- + MIIDjzCCAnegAwIBAgIBADANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJIUjEP + MA0GA1UECAwGWmFncmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEj + MCEGA1UEAwwaQ0EgUm9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwHhcNMTcwNzE0MTE1 + MzUzWhcNMjcwNzEyMTE1MzUzWjBiMQswCQYDVQQGEwJIUjEPMA0GA1UECAwGWmFn + cmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEjMCEGA1UEAwwaQ0Eg + Um9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw + ggEKAoIBAQC+/60HDgUIMu3F61a0iihkxoAgGJpbaz8bu9WEaKNURFXMW/9FWIPf + xBQbYr3RFaPdpgTLKwtP8ZcCNqH4QM8bwBirk7gMjeNQfUc0DcC1xj0yCjWTLx7L + CxWzOPI/3QZdjlltV5g1bL0nObBXJTqLpJazfJa+c5rMSjuxeHQtOts4h9cPT+3c + Lc21IF3l0Ck4XjNrYMDuBq0B24ukkwqHkTzp5CyJk1gn4Bsr5RskUsgvbAQBacPd + EjwjzJPlMSMpcZw87e+U22FWuhkDEMf+nKtOPxbDz0P1rdXwtsLyYww3gx/ZjzZy + pnNJJDa+K008GJsOtRCgy1O82rOskHVxAgMBAAGjUDBOMB0GA1UdDgQWBBSJ843O + 80eWXlzlc5L2e5NSmJt8VTAfBgNVHSMEGDAWgBSJ843O80eWXlzlc5L2e5NSmJt8 + VTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBwrBXWaKBkL3vZBtDs + Ebez/E2vU8OSWt53l8gDgPoWVd66qh3k76IkwcW9OB3JwZpY63ZYTC/J+by4/hZh + f5l2AWjjW5sasXz3HlNUexJomk1llLvDJt/eKuTM/5k3LzgbAhmjhzE7Jh3wZJF5 + rKOQ9fN7zJ414EebjkeGSgDosq3ip290vFiBc+heqgdfZsDdyxuIKkJCtYYYI8hP + UcKRfJ4nr8enAVkbbjElc5qF7s2Gz0+0owI7ZV/KaXd2ZGcnh6nRx5OIcDGXNLK9 + I87CtgF5KX0AGXEMJeG/Jms9hDdn18SXwxIgG6jX7DlAUsz/PVcwDNxF3RCHvsuy + HoU+ + -----END CERTIFICATE----- + ''; + }; + "Students-TVZ" = { + networkType = "8021x"; + config.Security = { + EAP-Method = "PAP"; + EAP-Identity = "mbastaja@tvz.hr"; + EAP-PAEP-ServerDomainMasl = "freeradius.tvz.hr"; + EAP-PEAP-Phase2-Method = "MSCHAPV2"; + EAP-PEAP-Phase2-Identity = "mbastaja@tvz.hr"; + EAP-PEAP-Phase2-Password = "@EDUROAM_PASS@"; + }; + }; + }; + }; +} diff --git a/wireguard.nix b/wireguard.nix index 20307a1..16f1d40 100644 --- a/wireguard.nix +++ b/wireguard.nix @@ -25,6 +25,10 @@ let address = "2301:db8:acad:a::3/128"; publicKey = "awBcQzNBdlYWpoOF1n7ijol2EiaJy5cxrVXfrqCvM0k="; }; + underworld = { + address = "2301:db8:acad:a::4/128"; + publicKey = ""; + }; }; generatePeer = |