diff options
Diffstat (limited to 'modules/xnet/net')
| -rw-r--r-- | modules/xnet/net/default.nix | 128 | ||||
| -rw-r--r-- | modules/xnet/net/dns.nix | 38 | ||||
| -rw-r--r-- | modules/xnet/net/sshd.nix | 46 |
3 files changed, 212 insertions, 0 deletions
diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix new file mode 100644 index 0000000..7242855 --- /dev/null +++ b/modules/xnet/net/default.nix @@ -0,0 +1,128 @@ +{ config, lib, ... }: +let + cfg = config.xnet.net; + + inherit (builtins) + attrNames + attrValues + map + length + ; + + inherit (lib) + concatLines + genAttrs + mapAttrsToList + mergeAttrsList + mkOption + mkIf + types + ; + + # Networks are logical groupings of hosts wired together. This is + # accomplished using VLANS on the same layer 2 network. + # + # Hosts can hard code their spot on a network here. This module aims + # to generate network information for a host using this set of facts. + # The module should gracefully fall back to defaults if a given fact + # is not specified for the host consuming the module. + # + # A host will have it's /etc/hosts populated with all other hosts in + # a network to avoid a dynamic DNS server. + networks = { + + # Open network for xnet hosts + plaza = { + mask = 24; + vlan = 88; + hosts = { + t1 = "10.88.88.1"; + radon = "10.88.88.2"; + iridium = "10.88.88.3"; + }; + }; + + # Reserved network for kubernetes related nodes. A distinct network + # is created here for hosts that provide resources to workers. + # Generally, nodes on this network are spawned dynamically and are + # not a part of this NixOS config directly, although they may boot + # from assets served from a node here. + kubenet = { + mask = 24; + vlan = 42; + hosts = { + iridium = "10.88.42.254"; + }; + }; + }; +in +{ + imports = [ + ./sshd.nix + ./dns.nix + ]; + + options.xnet.net = { + join = mkOption { + type = types.listOf (types.enum (attrNames networks)); + default = [ ]; + description = "Available networks."; + }; + + interface = mkOption { + type = types.str; + default = ""; + description = "Network interface connecting to xnet."; + }; + }; + + config = mkIf ((length cfg.join) > 0) { + # networkd will handle this + networking.useDHCP = false; + + systemd.network = + let + name = config.networking.hostName; + + genConfig = net: { + netdevs."${toString networks.${net}.vlan}-${net}" = { + netdevConfig.Kind = "vlan"; + netdevConfig.Name = net; + vlanConfig.Id = networks.${net}.vlan; + }; + + networks."10-${cfg.interface}" = { + matchConfig.Name = cfg.interface; + vlan = cfg.join; + + # Accept DHCP on physical interface + DHCP = "ipv4"; + + # Network is up when xnet physical interface gets carrier + linkConfig.RequiredForOnline = "carrier"; + + # Allow resolved to resolve mDNS + networkConfig.MulticastDNS = true; + }; + + networks."${toString networks.${net}.vlan}-${net}" = { + matchConfig.Name = net; + + # Set up address for known host + address = [ "${networks.${net}.hosts.${name}}/${toString networks.${net}.mask}" ]; + }; + }; + + values = attrValues (genAttrs cfg.join genConfig); + in + { enable = true; } // mergeAttrsList values; + + networking.extraHosts = + let + genHosts = net: concatLines + (mapAttrsToList (name: value: "${value} ${name} ${name}.${net}.4kb.net") + networks.${net}.hosts); + in + concatLines (map (net: genHosts net) cfg.join); + }; +} diff --git a/modules/xnet/net/dns.nix b/modules/xnet/net/dns.nix new file mode 100644 index 0000000..0632fa9 --- /dev/null +++ b/modules/xnet/net/dns.nix @@ -0,0 +1,38 @@ +{ lib, ... }: +let + inherit (lib) + mkDefault + ; + + quad9 = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + "2620:fe::fe#dns.quad9.net" + "2620:fe::9#dns.quad9.net" + ]; + + cloudflare = [ + "1.1.1.1#one.one.one.one" + "1.0.0.1#one.one.one.one" + "2606:4700:4700::1111#one.one.one.one" + "2606:4700:4700::1001#one.one.one.one" + ]; +in +{ + + networking.nameservers = mkDefault quad9; + + services.resolved = { + enable = true; + llmnr = "false"; + dnssec = "false"; + dnsovertls = mkDefault "opportunistic"; + fallbackDns = quad9 ++ cloudflare; + extraConfig = '' + MulticastDNS=yes + ''; + }; + + # Allow mDNS resolution + networking.firewall.allowedTCPPorts = [ 5353 ]; +} diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix new file mode 100644 index 0000000..9d7976e --- /dev/null +++ b/modules/xnet/net/sshd.nix @@ -0,0 +1,46 @@ +{ config, lib, ... }: +let + cfg = config.xnet.net.sshd; + inherit (lib) mkOption mkIf types; +in +{ + options.xnet.net.sshd = { + enable = mkOption { + type = types.bool; + default = false; + description = "Enable hardened SSH service."; + }; + }; + + config = mkIf cfg.enable { + services.openssh = { + enable = true; + startWhenNeeded = true; + openFirewall = true; + hostKeys = [{ + path = "/persist/certs/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + }]; + settings = { + UsePAM = false; + X11Forwarding = false; + PermitRootLogin = "prohibit-password"; + PasswordAuthentication = false; + Ciphers = [ "chacha20-poly1305@openssh.com" ]; + Macs = [ "hmac-sha2-512-etm@openssh.com" ]; + KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; + }; + sftpServerExecutable = "internal-sftp"; + sftpFlags = [ "-f AUTHPRIV" "-l INFO" ]; + extraConfig = + let + pubkeyTypes = lib.strings.concatStringsSep "," [ + "sk-ssh-ed25519-cert-v01@openssh.com" + "ssh-ed25519-cert-v01@openssh.com" + "ssh-ed25519" + ]; + in + "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; + }; + }; +} |