Merge remote-tracking branch 'origin/copy-blueprint'

3 files changed, 212 insertions, 0 deletions

diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix
new file mode 100644
index 0000000..7242855
--- /dev/null
+++ b/modules/xnet/net/default.nix
@@ -0,0 +1,128 @@
+{ config, lib, ... }:
+let
+  cfg = config.xnet.net;
+
+  inherit (builtins)
+    attrNames
+    attrValues
+    map
+    length
+    ;
+
+  inherit (lib)
+    concatLines
+    genAttrs
+    mapAttrsToList
+    mergeAttrsList
+    mkOption
+    mkIf
+    types
+    ;
+
+  # Networks are logical groupings of hosts wired together. This is
+  # accomplished using VLANS on the same layer 2 network.
+  #
+  # Hosts can hard code their spot on a network here. This module aims
+  # to generate network information for a host using this set of facts.
+  # The module should gracefully fall back to defaults if a given fact
+  # is not specified for the host consuming the module.
+  #
+  # A host will have it's /etc/hosts populated with all other hosts in
+  # a network to avoid a dynamic DNS server.
+  networks = {
+
+    # Open network for xnet hosts
+    plaza = {
+      mask = 24;
+      vlan = 88;
+      hosts = {
+        t1 = "10.88.88.1";
+        radon = "10.88.88.2";
+        iridium = "10.88.88.3";
+      };
+    };
+
+    # Reserved network for kubernetes related nodes. A distinct network
+    # is created here for hosts that provide resources to workers.
+    # Generally, nodes on this network are spawned dynamically and are
+    # not a part of this NixOS config directly, although they may boot
+    # from assets served from a node here.
+    kubenet = {
+      mask = 24;
+      vlan = 42;
+      hosts = {
+        iridium = "10.88.42.254";
+      };
+    };
+  };
+in
+{
+  imports = [
+    ./sshd.nix
+    ./dns.nix
+  ];
+
+  options.xnet.net = {
+    join = mkOption {
+      type = types.listOf (types.enum (attrNames networks));
+      default = [ ];
+      description = "Available networks.";
+    };
+
+    interface = mkOption {
+      type = types.str;
+      default = "";
+      description = "Network interface connecting to xnet.";
+    };
+  };
+
+  config = mkIf ((length cfg.join) > 0) {
+    # networkd will handle this
+    networking.useDHCP = false;
+
+    systemd.network =
+      let
+        name = config.networking.hostName;
+
+        genConfig = net: {
+          netdevs."${toString networks.${net}.vlan}-${net}" = {
+            netdevConfig.Kind = "vlan";
+            netdevConfig.Name = net;
+            vlanConfig.Id = networks.${net}.vlan;
+          };
+
+          networks."10-${cfg.interface}" = {
+            matchConfig.Name = cfg.interface;
+            vlan = cfg.join;
+
+            # Accept DHCP on physical interface
+            DHCP = "ipv4";
+
+            # Network is up when xnet physical interface gets carrier
+            linkConfig.RequiredForOnline = "carrier";
+
+            # Allow resolved to resolve mDNS
+            networkConfig.MulticastDNS = true;
+          };
+
+          networks."${toString networks.${net}.vlan}-${net}" = {
+            matchConfig.Name = net;
+
+            # Set up address for known host
+            address = [ "${networks.${net}.hosts.${name}}/${toString networks.${net}.mask}" ];
+          };
+        };
+
+        values = attrValues (genAttrs cfg.join genConfig);
+      in
+      { enable = true; } // mergeAttrsList values;
+
+    networking.extraHosts =
+      let
+        genHosts = net: concatLines
+          (mapAttrsToList (name: value: "${value} ${name} ${name}.${net}.4kb.net")
+            networks.${net}.hosts);
+      in
+      concatLines (map (net: genHosts net) cfg.join);
+  };
+}
diff --git a/modules/xnet/net/dns.nix b/modules/xnet/net/dns.nix
new file mode 100644
index 0000000..0632fa9
--- /dev/null
+++ b/modules/xnet/net/dns.nix
@@ -0,0 +1,38 @@
+{ lib, ... }:
+let
+  inherit (lib)
+    mkDefault
+    ;
+
+  quad9 = [
+    "9.9.9.9#dns.quad9.net"
+    "149.112.112.112#dns.quad9.net"
+    "2620:fe::fe#dns.quad9.net"
+    "2620:fe::9#dns.quad9.net"
+  ];
+
+  cloudflare = [
+    "1.1.1.1#one.one.one.one"
+    "1.0.0.1#one.one.one.one"
+    "2606:4700:4700::1111#one.one.one.one"
+    "2606:4700:4700::1001#one.one.one.one"
+  ];
+in
+{
+
+  networking.nameservers = mkDefault quad9;
+
+  services.resolved = {
+    enable = true;
+    llmnr = "false";
+    dnssec = "false";
+    dnsovertls = mkDefault "opportunistic";
+    fallbackDns = quad9 ++ cloudflare;
+    extraConfig = ''
+      MulticastDNS=yes
+    '';
+  };
+
+  # Allow mDNS resolution
+  networking.firewall.allowedTCPPorts = [ 5353 ];
+}
diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix
new file mode 100644
index 0000000..9d7976e
--- /dev/null
+++ b/modules/xnet/net/sshd.nix
@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+let
+  cfg = config.xnet.net.sshd;
+  inherit (lib) mkOption mkIf types;
+in
+{
+  options.xnet.net.sshd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable hardened SSH service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      startWhenNeeded = true;
+      openFirewall = true;
+      hostKeys = [{
+        path = "/persist/certs/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }];
+      settings = {
+        UsePAM = false;
+        X11Forwarding = false;
+        PermitRootLogin = "prohibit-password";
+        PasswordAuthentication = false;
+        Ciphers = [ "chacha20-poly1305@openssh.com" ];
+        Macs = [ "hmac-sha2-512-etm@openssh.com" ];
+        KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+      };
+      sftpServerExecutable = "internal-sftp";
+      sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
+      extraConfig =
+        let
+          pubkeyTypes = lib.strings.concatStringsSep "," [
+            "sk-ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519"
+          ];
+        in
+        "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
+    };
+  };
+}