M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 11 Pull Requests 1 Releases Wiki Activity

Rebase and add intl interface to exceptions 

Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
Egor Savkin 2024-10-09 11:15:31 +08:00
parent bbfee50b53
commit 7131a54bb6
1 changed files with 1 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
nixbld-etc-nixos/configuration.nix
View File

@ -92,7 +92,7 @@ in
firewall = {
allowedTCPPorts = [ 53 80 443 2222 7402 ];
allowedUDPPorts = [ 53 67 500 4500 ];
trustedInterfaces = [ netifLan ];
trustedInterfaces = [ netifLan netifUSA ];
logRefusedConnections = false;
extraCommands = ''
iptables -A INPUT -s 5.78.86.156 -p gre -j ACCEPT
@ -260,29 +260,6 @@ in
}
];
};
greTunnels.intl0 = {
dev = netifWan;
remote = "5.78.86.156";
local = "94.190.212.123";
ttl = 255;
type = "tun";
};
interfaces.intl0 = {
ipv4.addresses = [
{
address = "10.47.3.1";
prefixLength = 31;
}
];
ipv4.routes = [
{
address = "0.0.0.0";
prefixLength = 0;
via = "10.47.3.0";
options.table = "3";
}
];
};
vlans = {
"${netifAltVlan}" = {
id = 2;
@ -351,27 +328,6 @@ in
start_action = "start";
};
};
services.strongswan-swanctl.swanctl.connections.intl = {
local_addrs = [ "94.190.212.123" ];
remote_addrs = [ "5.78.86.156" ];
local.main = {
auth = "pubkey";
id = "fqdn:m-labs.hk";
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
};
remote.main = {
auth = "pubkey";
id = "fqdn:m-labs-intl.com";
pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
};
children.intl0 = {
mode = "transport";
ah_proposals = [ "sha256-curve25519" ];
remote_ts = [ "5.78.86.156[gre]" ];
local_ts = [ "94.190.212.123[gre]" ];
start_action = "start";
};
};
systemd.services.network-custom-route-backup = {
wantedBy = [ "network.target" ];
@ -400,15 +356,6 @@ in
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
};
};
systemd.services.network-custom-route-intl = {
wantedBy = [ "network.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.iproute2}/bin/ip rule add from 10.47.3.0/31 table 3";
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
};
};
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
# chown named.named /etc/nixos/named