From f08f3812f40322b6098d75573413ed83f358871f Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sun, 1 Dec 2024 22:30:26 -0500 Subject: Cleanup xnet module and add baseline modules With these changes, the xnet module is useable as a system builder. At this point, it is still undecided whether all configuration will be generalized into this module, rather than keeping mini-modules local to the machine they will run on. --- modules/xnet/net/default.nix | 33 ++----------- modules/xnet/net/sshd.nix | 46 +++++++++++++++++ modules/xnet/net/vpn-gateway.nix | 103 --------------------------------------- 3 files changed, 50 insertions(+), 132 deletions(-) create mode 100644 modules/xnet/net/sshd.nix delete mode 100644 modules/xnet/net/vpn-gateway.nix (limited to 'modules/xnet/net') diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix index 143f189..2255f53 100644 --- a/modules/xnet/net/default.nix +++ b/modules/xnet/net/default.nix @@ -5,6 +5,10 @@ let prefix = "10.26.4"; in { + imports = [ + ./sshd.nix + ]; + options.xnet.net = { interface = mkOption { type = types.str; @@ -17,12 +21,6 @@ in description = "Final octet for xnet address."; example = 4; }; - - sshd = mkOption { - type = types.bool; - default = false; - description = "Enable hardened SSH service."; - }; }; # TODO: @@ -42,28 +40,5 @@ in prefixLength = 24; }]; }; - - services.openssh = { - enable = cfg.sshd; - startWhenNeeded = true; - settings = { - X11Forwarding = false; - UsePAM = false; - PermitRootLogin = "prohibit-password"; - }; - extraConfig = - let - p = [ - "sk-ssh-ed25519-cert-v01@openssh.com" - "ssh-ed25519-cert-v01@openssh.com" - "ssh-ed25519" - ]; - in - "PubkeyAcceptedKeyTypes ${lib.strings.concatStringsSep "," p}"; - hostKeys = [{ - path = "/certs/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - }]; - }; }; } diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix new file mode 100644 index 0000000..ef225db --- /dev/null +++ b/modules/xnet/net/sshd.nix @@ -0,0 +1,46 @@ +{ config, lib, ... }: +let + cfg = config.xnet.net.sshd; + inherit (lib) mkOption mkIf types; +in +{ + options.xnet.net.sshd = { + enable = mkOption { + type = types.bool; + default = false; + description = "Enable hardened SSH service."; + }; + }; + + config = mkIf cfg.enable { + services.openssh = { + enable = true; + startWhenNeeded = true; + openFirewall = true; + hostKeys = [{ + path = "/persist/certs/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + }]; + settings = { + UsePAM = true; + X11Forwarding = false; + PermitRootLogin = "no"; + PasswordAuthentication = false; + Ciphers = [ "chacha20-poly1305@openssh.com" ]; + Macs = [ "hmac-sha2-512-etm@openssh.com" ]; + KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; + }; + sftpServerExecutable = "internal-sftp"; + sftpFlags = [ "-f AUTHPRIV" "-l INFO" ]; + extraConfig = + let + pubkeyTypes = lib.strings.concatStringsSep "," [ + "sk-ssh-ed25519-cert-v01@openssh.com" + "ssh-ed25519-cert-v01@openssh.com" + "ssh-ed25519" + ]; + in + "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; + }; + }; +} diff --git a/modules/xnet/net/vpn-gateway.nix b/modules/xnet/net/vpn-gateway.nix deleted file mode 100644 index d26ced1..0000000 --- a/modules/xnet/net/vpn-gateway.nix +++ /dev/null @@ -1,103 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.xnet.net.vpnGateway; - inherit (lib) mkOption mkIf types; - - iface = "enp2s0"; - fwmark = "0x1"; - ip = "192.168.2.113"; - vpn = { - iface = "wg0"; - endpoint = "149.88.22.129:51820"; - addr = "10.69.70.71/32"; - peers = [ - - ]; - }; -in - -{ - # options.xnet.net.vpnGateway = { - # interface = mkOption { - # type = types.str; - # description = "Interface to forward VPN routed packets to internet"; - # }; - # - # vpn = types.subModule { - # interface = mkOption { - # type = types.str; - # default = "wg0"; - # description = "Name of VPN interface."; - # }; - # - # endpoint = mkOption { - # type = types.str; - # description = "ip:port of the VPN endpoint."; - # }; - # - # addr = mkOption { - # type = types.str; - # description = "Address of the VPN interface."; - # }; - # - # privateKeyFile = mkOption { - # type = types.str; - # description = "Path to private key."; - # }; - # - # peers = types.listOf types.subModule { - # - # }; - # }; - - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = 1; - "net.ipv6.conf.all.forwarding" = 1; - }; - - networking = { - wg-quick.interfaces."${vpn.iface}" = { - address = [ vpn.addr ]; - privateKeyFile = "/certs/wg/private.key"; - - peers = [{ - publicKey = "yxyntWsANEwxeR0pOPNAcfWY7zEVICZe9G+GxortzEY="; - allowedIPs = [ "0.0.0.0/0" ]; - endpoint = "149.88.22.129:51820"; - persistentKeepalive = 25; - }]; - }; - - nat = { - enable = true; - externalInterface = "wg0"; - internalInterfaces = [ "enp2s0" ]; - }; - - firewall = { - extraCommands = '' - # Create a new routing table for forwarded traffic - echo "200 vpn" >> /etc/iproute2/rt_tables - - # Mark packets from other hosts - iptables -t mangle -A PREROUTING -i enp2s0 ! -s 192.168.1.113 -j MARK --set-mark 0x1 - - # Route marked packets through WireGuard - ip rule add fwmark 0x1 table vpn - ip route add default dev wg0 table vpn - - # Allow forwarding - iptables -A FORWARD -i enp2s0 -o wg0 -j ACCEPT - iptables -A FORWARD -i wg0 -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT - - # NAT only forwarded traffic - iptables -t nat -A POSTROUTING -o wg0 ! -s 192.168.1.113 -j MASQUERADE - ''; - - extraStopCommands = '' - ip rule del fwmark 0x1 table vpn 2>/dev/null || true - ip route flush table vpn 2>/dev/null || true - ''; - }; - }; -} -- cgit v1.3.1