M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 10 Pull Requests Releases Wiki Activity

WIP: Use gre/ipsec instead of proxy 

Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
Egor Savkin 2024-08-28 17:25:02 +08:00
parent a2d7b847a9
commit 684c63bb49
1 changed files with 49 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
nixbld-etc-nixos/configuration.nix
View File

@ -216,6 +216,29 @@ in
} }
]; ];
}; };
greTunnels.intl0 = {
dev = netifWan;
remote = "5.78.86.156";
local = "94.190.212.123";
ttl = 255;
type = "tun";
};
interfaces.intl0 = {
ipv4.addresses = [
{
address = "5.78.86.156";
prefixLength = 32;
}
];
ipv4.routes = [
{
address = "0.0.0.0";
prefixLength = 0;
via = "5.78.86.156";
options.table = "2";
}
];
};
vlans = { vlans = {
vlan0 = { vlan0 = {
id = 2; id = 2;
@ -263,6 +286,27 @@ in
start_action = "start"; start_action = "start";
}; };
}; };
services.strongswan-swanctl.swanctl.connections.intl = {
local_addrs = [ "94.190.212.123" ];
remote_addrs = [ "5.78.86.156" ];
local.main = {
auth = "pubkey";
id = "fqdn:m-labs.hk";
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
};
remote.main = {
auth = "pubkey";
id = "fqdn:m-labs-intl.com";
pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
};
children.intl0 = {
mode = "transport";
ah_proposals = [ "sha256-curve25519" ];
remote_ts = [ "5.78.86.156[gre]" ];
local_ts = [ "94.190.212.123[gre]" ];
start_action = "start";
};
};
systemd.services.network-custom-route-backup = { systemd.services.network-custom-route-backup = {
wantedBy = [ "network.target" ]; wantedBy = [ "network.target" ];
@ -1176,20 +1220,9 @@ in
ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'"; ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'";
}; };
}; };
systemd.services.ssh-tunnel-intl = {
description = "SSH Tunnel to Intl";
wantedBy = [ "multi-user.target" ];
after = [ "sockets.service" ];
serviceConfig = {
Restart = "on-failure";
User = "hydra-queue-runner"; # TODO needs new user here
Group = "hydra";
ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1587 ssh_tunnel@5.78.86.156";
};
};
environment.etc."postfix/sender_relay".text = '' environment.etc."postfix/sender_relay".text = ''
m-labs-intl.com socks: m-labs-intl.com smtptun:
* : * :
''; '';
systemd.services.postfix-rebuild-sender-relay = { systemd.services.postfix-rebuild-sender-relay = {
@ -1209,28 +1242,15 @@ in
enablePop3Ssl = true; enablePop3Ssl = true;
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
} // (import /etc/nixos/secret/email_settings.nix); } // (import /etc/nixos/secret/email_settings.nix);
ssh_proxy_conf = builtins.toFile "proxychains.conf" ''
strict_chain
tcp_read_time_out 15000
tcp_connect_time_out 8000
localnet 192.168.1.0/255.255.255.0
localnet 127.0.0.0/255.0.0.0
localnet ::1/128
localnet 94.190.212.123/255.255.255.255
localnet 202.77.7.238/255.255.255.255
localnet 2001:470:18:390::2/255.255.255.255
[ProxyList]
socks5 127.0.0.1 1587
'';
services.postfix = { services.postfix = {
config = { config = {
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay"; sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
postscreen_upstream_proxy_protocol = "haproxy"; postscreen_upstream_proxy_protocol = "haproxy";
postscreen_upstream_proxy_timeout = "5s"; postscreen_upstream_proxy_timeout = "5s";
masterConfig.socks = { masterConfig.smtptun = {
type = "unix"; type = "smtp";
command = "pipe"; command = "smtp";
args = "flags=R user=nobody argv=${pkgs.proxychains-ng}/bin/proxychains4 -f ${config.ssh_proxy_conf} ${pkgs.postfix}/bin/sendmail -oi -f $sender $recipient"; args = "-o smtp_bind_address=5.78.86.156";
}; };
}; };
}; };