65 lines
2.0 KiB
Nix
65 lines
2.0 KiB
Nix
{
|
|
roles.default.perInstance = { settings, ... }: {
|
|
nixosModule =
|
|
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
|
|
dir = config.clan.core.settings.directory;
|
|
instance = "zerotier";
|
|
|
|
networkId = builtins.readFile "${dir}/vars/shared/zerotier-network-${instance}/network-id/value";
|
|
full = "fd" + networkId + "9993";
|
|
hextet = i: builtins.substring (i * 4) 4 full;
|
|
subnetZtier = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
|
|
|
|
vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") settings.vlans;
|
|
wanVlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") (
|
|
lib.filterAttrs (_: vlan: vlan.allowWan) settings.vlans
|
|
);
|
|
nonMgmtIfs = lib.filter (i: i != "vlan-mgmt") vlanIfs;
|
|
ifSet = ifs: "{ ${lib.concatStringsSep ", " (map (i: "\"${i}\"") ifs)} }";
|
|
in
|
|
{
|
|
networking.nftables.enable = true;
|
|
|
|
services.openssh.openFirewall = false;
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
filterForward = true;
|
|
trustedInterfaces = [ "vlan-mgmt" ];
|
|
|
|
interfaces = lib.genAttrs nonMgmtIfs (_: {
|
|
allowedTCPPorts = [ 53 ];
|
|
allowedUDPPorts = [
|
|
53
|
|
67
|
|
];
|
|
});
|
|
|
|
extraInputRules = ''
|
|
ip6 saddr ${subnetZtier} tcp dport 22 accept comment "admin ssh over the mesh"
|
|
ip6 saddr ${subnetZtier} tcp dport 4000 accept comment "blocky metrics scrape from control"
|
|
'';
|
|
|
|
extraForwardRules = ''
|
|
tcp flags syn tcp option maxseg size set rt mtu comment "MSS clamp for PPPoE mtu 1492"
|
|
iifname "vlan-mgmt" accept comment "mgmt reaches all VLANs and the WAN"
|
|
iifname ${ifSet wanVlanIfs} oifname "ppp0" accept comment "LAN to internet"
|
|
'';
|
|
};
|
|
|
|
networking.nat = {
|
|
enable = true;
|
|
externalInterface = "ppp0";
|
|
internalInterfaces = vlanIfs;
|
|
};
|
|
|
|
};
|
|
};
|
|
}
|