M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 10 Pull Requests Releases Wiki Activity

Return swan into the zoo 

Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
Egor Savkin 2024-09-20 17:36:31 +08:00
parent b1fb18a6c5
commit 42b3d6ccf3
2 changed files with 55 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
nixbld-etc-nixos/configuration.nix
View File

@ -91,7 +91,7 @@ in
hostId = "e423f012"; hostId = "e423f012";
firewall = { firewall = {
allowedTCPPorts = [ 53 80 443 2222 7402 ]; allowedTCPPorts = [ 53 80 443 2222 7402 ];
allowedUDPPorts = [ 53 67 500 4500 51820 ]; allowedUDPPorts = [ 53 67 500 4500 ];
trustedInterfaces = [ netifLan ]; trustedInterfaces = [ netifLan ];
logRefusedConnections = false; logRefusedConnections = false;
}; };
@ -252,6 +252,29 @@ in
} }
]; ];
}; };
greTunnels.intl0 = {
dev = netifWan;
remote = "5.78.16.0";
local = "94.190.212.123";
ttl = 255;
type = "tun";
};
interfaces.intl0 = {
ipv4.addresses = [
{
address = "5.78.16.0";
prefixLength = 32;
}
];
ipv4.routes = [
{
address = "0.0.0.0";
prefixLength = 0;
via = "5.78.16.0";
options.table = "3";
}
];
};
vlans = { vlans = {
"${netifAltVlan}" = { "${netifAltVlan}" = {
id = 2; id = 2;
@ -271,30 +294,6 @@ in
} }
]; ];
}; };
wireguard.interfaces = {
intl0 = {
ips = [ "10.42.0.2/30" ];
listenPort = 51820;
privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key`
postUp = ''
${pkgs.iproute2}/bin/ip rule add from 10.42.0.0/30 lookup 51820
${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820
'';
preDown = ''
${pkgs.iproute2}/bin/ip rule del from 10.42.0.0/30 lookup 51820
${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820
'';
peers = [
{
publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
allowedIPs = [ "0.0.0.0/0" ];
allowedIPsAsRoutes = false;
endpoint = "2a01:4ff:1f0:83de::1:51820";
persistentKeepalive = 25;
}
];
};
};
}; };
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1"; boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1"; boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
@ -344,6 +343,27 @@ in
start_action = "start"; start_action = "start";
}; };
}; };
services.strongswan-swanctl.swanctl.connections.intl = {
local_addrs = [ "94.190.212.123" ];
remote_addrs = [ "5.78.16.0" ];
local.main = {
auth = "pubkey";
id = "fqdn:m-labs.hk";
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
};
remote.main = {
auth = "pubkey";
id = "fqdn:m-labs-intl.com";
pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
};
children.intl0 = {
mode = "transport";
ah_proposals = [ "sha256-curve25519" ];
remote_ts = [ "5.78.16.0[gre]" ];
local_ts = [ "94.190.212.123[gre]" ];
start_action = "start";
};
};
systemd.services.network-custom-route-backup = { systemd.services.network-custom-route-backup = {
wantedBy = [ "network.target" ]; wantedBy = [ "network.target" ];
@ -372,6 +392,15 @@ in
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1"; ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
}; };
}; };
systemd.services.network-custom-route-intl = {
wantedBy = [ "network.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.16.0/32 table 3";
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
};
};
# https://kb.isc.org/docs/dnssec-key-and-signing-policy # https://kb.isc.org/docs/dnssec-key-and-signing-policy
# chown named.named /etc/nixos/named # chown named.named /etc/nixos/named

2
nixbld-etc-nixos/named/m-labs-intl.com
View File

@ -22,7 +22,7 @@ $TTL 7200
ns A 94.190.212.123 ns A 94.190.212.123
ns AAAA 2001:470:18:390::2 ns AAAA 2001:470:18:390::2
mail A 5.78.86.156 mail A 5.78.16.0
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB" mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
_dmarc TXT "v=DMARC1; p=none" _dmarc TXT "v=DMARC1; p=none"