Compare commits

...

12 Commits

Author SHA1 Message Date
Egor Savkin addc202345 Use IPv6 for WG transport to decrease latency by 20%
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin 6dded5a701 Ip rules instead of iptables tracking
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin 17b21f3801 Apply tested client configuration
Adds an additional route, but doesn't enforce it so other apps will remain the same, but smtp can use tunnel for sending. Also sends replies through the tunnel if connection arrives on the tunnel.
Better have something tested and working before I start doing "perfect".

Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin dba87d68d3 Use wireguard instead of strongswan since its in the kernel
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin 4966465b1c WIP: Use gre/ipsec instead of proxy
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin a230f3fa68 Use proxychains-ng instead of tsocks
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin c3be96a166 Use tsocks to wrap socks and add sock transport type
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin 3237cfb50f Use wildcard instead of explicit specification
As in example at https://www.postfix.org/transport.5.html

Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Egor Savkin f0d13c40ba Use postfix options for routing mails through ssh tunnel
Signed-off-by: Egor Savkin <es@m-labs.hk>
2024-09-13 16:47:43 +08:00
Sebastien Bourdeauducq aaf70f36df nixops: remove user accounts 2024-09-13 13:23:15 +08:00
Sébastien Bourdeauducq 4a288abe2b nixbld: keep automatic flarum DB migrations 2024-09-10 17:12:44 +08:00
Sébastien Bourdeauducq 246a375dfb add remote IPsec settings 2024-09-05 14:36:37 +08:00
4 changed files with 97 additions and 24 deletions

View File

@ -90,7 +90,7 @@ in
hostId = "e423f012"; hostId = "e423f012";
firewall = { firewall = {
allowedTCPPorts = [ 53 80 443 2222 7402 ]; allowedTCPPorts = [ 53 80 443 2222 7402 ];
allowedUDPPorts = [ 53 67 500 4500 ]; allowedUDPPorts = [ 53 67 500 4500 51820 ];
trustedInterfaces = [ netifLan ]; trustedInterfaces = [ netifLan ];
}; };
useDHCP = false; useDHCP = false;
@ -246,6 +246,30 @@ in
} }
]; ];
}; };
wireguard.interfaces = {
intl0 = {
ips = [ "10.42.0.2/30" ];
listenPort = 51820;
privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key`
postUp = ''
${pkgs.iproute2}/bin/ip rule add from 10.42.0.0/30 lookup 51820
${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820
'';
preDown = ''
${pkgs.iproute2}/bin/ip rule del from 10.42.0.0/30 lookup 51820
${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820
'';
peers = [
{
publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
allowedIPs = [ "0.0.0.0/0" ];
allowedIPsAsRoutes = false;
endpoint = "2a01:4ff:1f0:83de::1:51820";
persistentKeepalive = 25;
}
];
};
};
}; };
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1"; boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1"; boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
@ -1150,6 +1174,7 @@ in
enable = true; enable = true;
package = pkgs.callPackage ./flarum {}; package = pkgs.callPackage ./flarum {};
domain = "forum.m-labs.hk"; domain = "forum.m-labs.hk";
createDatabaseLocally = true;
}; };
services.rt = { services.rt = {
@ -1178,6 +1203,18 @@ in
}; };
}; };
environment.etc."postfix/sender_relay".text = ''
m-labs-intl.com smtptun:
* :
'';
systemd.services.postfix-rebuild-sender-relay = {
description = "Postfix Rebuild Sender Dependent Relayhost Maps";
serviceConfig = {
ExecStart = "${pkgs.postfix}/sbin/postmap /etc/postfix/sender_relay";
};
wantedBy = [ "multi-user.target" ];
};
mailserver = { mailserver = {
enable = true; enable = true;
localDnsResolver = false; # conflicts with dnsmasq localDnsResolver = false; # conflicts with dnsmasq
@ -1186,8 +1223,17 @@ in
enablePop3 = true; enablePop3 = true;
enablePop3Ssl = true; enablePop3Ssl = true;
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
policydSPFExtraConfig = "skip_addresses = 5.78.86.156,2a01:4ff:1f0:83de::1";
} // (import /etc/nixos/secret/email_settings.nix); } // (import /etc/nixos/secret/email_settings.nix);
services.postfix = {
config = {
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
masterConfig.smtptun = {
type = "smtp";
command = "smtp";
args = "-o smtp_bind_address=10.42.0.2";
};
};
};
services.roundcube = { services.roundcube = {
enable = true; enable = true;
hostName = "mail.m-labs.hk"; hostName = "mail.m-labs.hk";

View File

@ -23,7 +23,6 @@ ns A 94.190.212.123
ns AAAA 2001:470:18:390::2 ns AAAA 2001:470:18:390::2
mail A 5.78.86.156 mail A 5.78.86.156
mail AAAA 2a01:4ff:1f0:83de::1
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB" mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
_dmarc TXT "v=DMARC1; p=none" _dmarc TXT "v=DMARC1; p=none"

View File

@ -111,27 +111,6 @@
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBK1tUg7TtceARRnGI80Ai5kNFolFfZ++LH9v1UoRCiJdxeQWPdNYO0Gj7+ejJvgZXwvN4yHGgcZHraEml4Mj/dKrEMFygfuYLDRmXtPFwX6TNMrWlxMhPzuNY+yCaxlqYg==" "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBK1tUg7TtceARRnGI80Ai5kNFolFfZ++LH9v1UoRCiJdxeQWPdNYO0Gj7+ejJvgZXwvN4yHGgcZHraEml4Mj/dKrEMFygfuYLDRmXtPFwX6TNMrWlxMhPzuNY+yCaxlqYg=="
]; ];
}; };
architeuthis = {
isNormalUser = true;
extraGroups = ["plugdev" "dialout"];
openssh.authorizedKeys.keys = [
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMhLPEGWDUauFHjiVduBMJrIMKT8SvtTDHXDVudUZrhewQy08h4NEEyWmczP4WMeyugI/L/a+J+Vc8mImgqSoHw52823LVcnR9EKnJoqnwAHU/J+41vIWAN2LAryd4p9yg=="
];
};
abdul = {
isNormalUser = true;
extraGroups = ["plugdev" "dialout"];
openssh.authorizedKeys.keys = [
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBONzKWn65erPM2xBCe9Dcw8dHRQCJmvzwhX72iHE1xVlAr7UcB1PMOjEB25MFfV/kCIFS5UB5wuoPvq+/oZ3EXiFjmQtsb669KN6MkZNyDqP5Y2W8gR1wVa/ZLfH4HynHg=="
];
};
lyken = {
isNormalUser = true;
extraGroups = ["plugdev" "dialout"];
openssh.authorizedKeys.keys = [
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJ88QJlh/+F/xwXQlPEmQVmtycb8FfabxCdeiP3gTHUCV8y4PLh3ubY+EsY+Xhy/GlOAPdX7KSpiII3dndYfwZWzorXVoPBhhPKEIumFBOinWfp5kRVzWOD61gCwsYoVBg=="
];
};
dpn = { dpn = {
isNormalUser = true; isNormalUser = true;

49
remote-ipsec.txt Normal file
View File

@ -0,0 +1,49 @@
connections {
bypass-ipsec {
remote_addrs = 127.0.0.1
children {
bypass-isakmp-v4 {
local_ts = 0.0.0.0/0[udp/isakmp]
remote_ts = 0.0.0.0/0[udp/isakmp]
mode = pass
start_action = trap
}
bypass-isakmp-v6 {
local_ts = ::/0[udp/isakmp]
remote_ts = ::/0[udp/isakmp]
mode = pass
start_action = trap
}
}
}
m_labs {
version = 2
encap = no
mobike = no
send_certreq = no
proposals = aes128gcm128-sha256-prfsha256-curve25519,aes128gcm128-sha256-prfsha256-ecp256
local_addrs = 103.206.98.1
remote_addrs = 94.190.212.123
local {
auth = pubkey
id = fqdn:igw0.hkg.as150788.net
pubkeys = igw0.hkg.as150788.net
}
remote {
auth = pubkey
id = fqdn:m-labs.hk
pubkeys = m-labs.hk
}
children {
con1 {
mode = transport
ah_proposals = sha256-curve25519,sha256-ecp256
esp_proposals =
local_ts = 103.206.98.1[gre]
remote_ts = 94.190.212.123[gre]
start_action = none
close_action = none
}
}
}
}