WIP: Use gre/ipsec instead of proxy
Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
parent
a6f30cff27
commit
6a46388d68
|
@ -227,6 +227,29 @@ in
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
greTunnels.intl0 = {
|
||||||
|
dev = netifWan;
|
||||||
|
remote = "5.78.16.0";
|
||||||
|
local = "94.190.212.123";
|
||||||
|
ttl = 255;
|
||||||
|
type = "tun";
|
||||||
|
};
|
||||||
|
interfaces.intl0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "5.78.16.0";
|
||||||
|
prefixLength = 32;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv4.routes = [
|
||||||
|
{
|
||||||
|
address = "0.0.0.0";
|
||||||
|
prefixLength = 0;
|
||||||
|
via = "5.78.16.0";
|
||||||
|
options.table = "3";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
vlans = {
|
vlans = {
|
||||||
"${netifAltVlan}" = {
|
"${netifAltVlan}" = {
|
||||||
id = 2;
|
id = 2;
|
||||||
|
@ -279,6 +302,27 @@ in
|
||||||
after = [ "network-addresses-${netifAlt}.service" ];
|
after = [ "network-addresses-${netifAlt}.service" ];
|
||||||
requires = [ "network-addresses-${netifAlt}.service" ];
|
requires = [ "network-addresses-${netifAlt}.service" ];
|
||||||
};
|
};
|
||||||
|
services.strongswan-swanctl.swanctl.connections.intl = {
|
||||||
|
local_addrs = [ "94.190.212.123" ];
|
||||||
|
remote_addrs = [ "5.78.16.0" ];
|
||||||
|
local.main = {
|
||||||
|
auth = "pubkey";
|
||||||
|
id = "fqdn:m-labs.hk";
|
||||||
|
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
|
||||||
|
};
|
||||||
|
remote.main = {
|
||||||
|
auth = "pubkey";
|
||||||
|
id = "fqdn:m-labs-intl.com";
|
||||||
|
pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
|
||||||
|
};
|
||||||
|
children.intl0 = {
|
||||||
|
mode = "transport";
|
||||||
|
ah_proposals = [ "sha256-curve25519" ];
|
||||||
|
remote_ts = [ "5.78.16.0[gre]" ];
|
||||||
|
local_ts = [ "94.190.212.123[gre]" ];
|
||||||
|
start_action = "start";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
systemd.services.network-custom-route-backup = {
|
systemd.services.network-custom-route-backup = {
|
||||||
wantedBy = [ "network.target" ];
|
wantedBy = [ "network.target" ];
|
||||||
|
@ -298,6 +342,15 @@ in
|
||||||
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
systemd.services.network-custom-route-intl = {
|
||||||
|
wantedBy = [ "network.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.16.0/32 table 3";
|
||||||
|
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
||||||
# chown named.named /etc/nixos/named
|
# chown named.named /etc/nixos/named
|
||||||
|
@ -1177,20 +1230,9 @@ in
|
||||||
ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'";
|
ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
systemd.services.ssh-tunnel-intl = {
|
|
||||||
description = "SSH Tunnel to Intl";
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
after = [ "sockets.service" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Restart = "on-failure";
|
|
||||||
User = "hydra-queue-runner"; # TODO needs new user here
|
|
||||||
Group = "hydra";
|
|
||||||
ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1587 ssh_tunnel@5.78.86.156";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.etc."postfix/sender_relay".text = ''
|
environment.etc."postfix/sender_relay".text = ''
|
||||||
m-labs-intl.com socks:
|
m-labs-intl.com smtptun:
|
||||||
* :
|
* :
|
||||||
'';
|
'';
|
||||||
systemd.services.postfix-rebuild-sender-relay = {
|
systemd.services.postfix-rebuild-sender-relay = {
|
||||||
|
@ -1210,28 +1252,13 @@ in
|
||||||
enablePop3Ssl = true;
|
enablePop3Ssl = true;
|
||||||
certificateScheme = "acme-nginx";
|
certificateScheme = "acme-nginx";
|
||||||
} // (import /etc/nixos/secret/email_settings.nix);
|
} // (import /etc/nixos/secret/email_settings.nix);
|
||||||
ssh_proxy_conf = builtins.toFile "proxychains.conf" ''
|
|
||||||
strict_chain
|
|
||||||
tcp_read_time_out 15000
|
|
||||||
tcp_connect_time_out 8000
|
|
||||||
localnet 192.168.1.0/255.255.255.0
|
|
||||||
localnet 127.0.0.0/255.0.0.0
|
|
||||||
localnet ::1/128
|
|
||||||
localnet 94.190.212.123/255.255.255.255
|
|
||||||
localnet 202.77.7.238/255.255.255.255
|
|
||||||
localnet 2001:470:18:390::2/255.255.255.255
|
|
||||||
[ProxyList]
|
|
||||||
socks5 127.0.0.1 1587
|
|
||||||
'';
|
|
||||||
services.postfix = {
|
services.postfix = {
|
||||||
config = {
|
config = {
|
||||||
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
|
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
|
||||||
postscreen_upstream_proxy_protocol = "haproxy";
|
masterConfig.smtptun = {
|
||||||
postscreen_upstream_proxy_timeout = "5s";
|
type = "smtp";
|
||||||
masterConfig.socks = {
|
command = "smtp";
|
||||||
type = "unix";
|
args = "-o smtp_bind_address=5.78.16.0";
|
||||||
command = "pipe";
|
|
||||||
args = "flags=R user=nobody argv=${pkgs.proxychains-ng}/bin/proxychains4 -f ${config.ssh_proxy_conf} ${pkgs.postfix}/bin/sendmail -oi -f $sender $recipient";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -22,8 +22,7 @@ $TTL 7200
|
||||||
ns A 94.190.212.123
|
ns A 94.190.212.123
|
||||||
ns AAAA 2001:470:18:390::2
|
ns AAAA 2001:470:18:390::2
|
||||||
|
|
||||||
mail A 5.78.86.156
|
mail A 5.78.16.0
|
||||||
mail AAAA 2a01:4ff:1f0:83de::1
|
|
||||||
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
|
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
|
||||||
_dmarc TXT "v=DMARC1; p=none"
|
_dmarc TXT "v=DMARC1; p=none"
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue