Add internal reverse proxy for gateways (Caddy, wildcard via DNS-01)
cnx.router.proxy serves <service>.<site><n>.cnx.network with a real Let's Encrypt wildcard obtained via a gateway-scoped TSIG key against ns1; Blocky resolves the names to the router's LAN address, so they exist only internally. First user: Omada UI on gw-cnx-1 (omada.cnx1.cnx.network).
This commit is contained in:
Berwn
@@ -0,0 +1,17 @@
|
||||
# Shared TSIG secret for a gateway's dedicated ACME key (function: machine
|
||||
# name -> module). The acme_gw_<x> key lets that gateway — and only it — write
|
||||
# _acme-challenge.<label> TXT records on ns1 to obtain its internal wildcard
|
||||
# cert via DNS-01. ns1 scopes it with a matching acl on the cnx.network zone.
|
||||
# Import on BOTH ns1 and the gateway machine, applied with the machine name:
|
||||
# (import ../../modules/dns/acme-gw-secret.nix "gw-cnx-1")
|
||||
machine:
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
clan.core.vars.generators."dns-acme-${machine}-secret" = {
|
||||
share = true;
|
||||
files."secret".secret = true;
|
||||
runtimeInputs = [ pkgs.openssl ];
|
||||
# 32 random bytes, base64 — a valid hmac-sha256 TSIG secret.
|
||||
script = ''openssl rand -base64 32 | tr -d '\n' > "$out"/secret'';
|
||||
};
|
||||
}
|
||||
@@ -84,6 +84,7 @@ in
|
||||
./dns-dhcp.nix
|
||||
./crowdsec.nix
|
||||
./omada.nix
|
||||
./proxy.nix
|
||||
];
|
||||
|
||||
options.cnx.router = {
|
||||
|
||||
@@ -0,0 +1,141 @@
|
||||
# Internal reverse proxy for the gateway: Caddy terminates TLS for
|
||||
# <service>.<site><siteId>.cnx.network (e.g. omada.cnx1.cnx.network) and
|
||||
# forwards to backends by their internal address. The cert is a real Let's
|
||||
# Encrypt wildcard (*.<site><siteId>.cnx.network) obtained via ACME DNS-01
|
||||
# against ns1 with a gateway-scoped TSIG key, so browsers trust it without
|
||||
# any CA install; the names only *resolve* internally — Blocky answers them
|
||||
# with the router's LAN address, the public zone never carries them.
|
||||
#
|
||||
# Requires the machine to also import the shared secret generator:
|
||||
# (import ../../modules/dns/acme-gw-secret.nix "<hostname>")
|
||||
# and ns1 to hold the matching key + acl (see machines/ns1/configuration.nix).
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
hosts = import ../hosts.nix;
|
||||
hostname = config.networking.hostName;
|
||||
tsigKey = "acme_${lib.replaceStrings [ "-" ] [ "_" ] hostname}";
|
||||
certName = "${cfg.site}${toString cfg.siteId}.cnx.network";
|
||||
|
||||
serviceModule = {
|
||||
options = {
|
||||
backend = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "https://127.0.0.1:8043";
|
||||
description = "URL Caddy forwards to (internal/mesh address).";
|
||||
};
|
||||
insecureSkipVerify = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Skip TLS verification towards the backend (self-signed upstreams like Omada).";
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options.cnx.router.proxy = {
|
||||
enable = lib.mkEnableOption "internal reverse proxy (Caddy, wildcard cert via DNS-01)";
|
||||
|
||||
services = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule serviceModule);
|
||||
default = { };
|
||||
description = "Proxied services; attr name becomes <name>.${certName}.";
|
||||
};
|
||||
|
||||
allowVlans = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [
|
||||
"mgmt"
|
||||
"lan"
|
||||
];
|
||||
description = "VLANs whose clients may reach the proxy (443, plus 80 for the redirect).";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf (cfg.enable && cfg.proxy.enable) {
|
||||
assertions = [
|
||||
{
|
||||
assertion = lib.all (v: cfg.vlans ? ${v}) cfg.proxy.allowVlans;
|
||||
message = "cnx.router.proxy.allowVlans must name VLANs defined in cnx.router.vlans.";
|
||||
}
|
||||
];
|
||||
|
||||
# Render the shared per-gateway TSIG secret into a lego rfc2136 env file;
|
||||
# same pattern as web01 (modules/web-proxy.nix), scoped on ns1 to
|
||||
# _acme-challenge.<site><siteId> TXT records only.
|
||||
clan.core.vars.generators."dns-acme-${hostname}-rfc2136" = {
|
||||
files."rfc2136.env".secret = true; # root-owned; systemd reads it as root
|
||||
dependencies = [ "dns-acme-${hostname}-secret" ];
|
||||
script = ''
|
||||
printf 'RFC2136_NAMESERVER=${hosts.ns1.ipv4}:53\nRFC2136_TSIG_ALGORITHM=hmac-sha256.\nRFC2136_TSIG_KEY=${tsigKey}\nRFC2136_TSIG_SECRET=%s\n' \
|
||||
"$(cat "$in"/dns-acme-${hostname}-secret/secret)" > "$out"/rfc2136.env
|
||||
'';
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "postmaster@cnx.email";
|
||||
# One wildcard for every proxied service; DNS-01 against ns1, so issuance
|
||||
# works behind PPPoE with no inbound reachability at all.
|
||||
certs.${certName} = {
|
||||
domain = "*.${certName}";
|
||||
dnsProvider = "rfc2136";
|
||||
environmentFile =
|
||||
config.clan.core.vars.generators."dns-acme-${hostname}-rfc2136".files."rfc2136.env".path;
|
||||
# ns1 is the only nameserver that accepts this key's UPDATE; check
|
||||
# propagation against it directly rather than a public resolver.
|
||||
dnsResolver = "${hosts.ns1.ipv4}:53";
|
||||
# Caddy reads the cert from explicit file paths (tls directive below),
|
||||
# so it won't notice a renewal on its own.
|
||||
reloadServices = [ "caddy.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
# The lego-issued cert is owned group=acme; Caddy needs to read the key.
|
||||
users.users.caddy.extraGroups = [ "acme" ];
|
||||
|
||||
# The explicit `tls cert key` points Caddy at the wildcard cert and disables
|
||||
# its automatic ACME, so no extra issuance happens.
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts = lib.mapAttrs' (
|
||||
name: svc:
|
||||
lib.nameValuePair "${name}.${certName}" {
|
||||
extraConfig = ''
|
||||
tls /var/lib/acme/${certName}/cert.pem /var/lib/acme/${certName}/key.pem
|
||||
${
|
||||
if svc.insecureSkipVerify then
|
||||
''
|
||||
reverse_proxy ${svc.backend} {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
}''
|
||||
else
|
||||
"reverse_proxy ${svc.backend}"
|
||||
}
|
||||
'';
|
||||
}
|
||||
) cfg.proxy.services;
|
||||
};
|
||||
|
||||
# Blocky answers <anything>.<site><siteId>.cnx.network (customDNS covers
|
||||
# subdomains) with the router's LAN address — clients on any allowed VLAN
|
||||
# reach that address through the router's input path.
|
||||
services.blocky.settings.customDNS.mapping.${certName} = cfg.vlans.lan.address;
|
||||
|
||||
# 443 serves the proxy; 80 only carries Caddy's automatic HTTP->HTTPS
|
||||
# redirect. mgmt is already a trusted interface; listed anyway so shrinking
|
||||
# trustedInterfaces later doesn't silently break the proxy.
|
||||
networking.firewall.interfaces = lib.genAttrs (map (v: "vlan-${v}") cfg.proxy.allowVlans) (_: {
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
});
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user