stuffs
This commit is contained in:
mjallen18
@@ -24,7 +24,10 @@ in
|
||||
};
|
||||
};
|
||||
ai = enabled;
|
||||
arrs = enabled;
|
||||
arrs = {
|
||||
enable = true;
|
||||
enableVpn = true;
|
||||
};
|
||||
attic = {
|
||||
enable = true;
|
||||
port = 9012;
|
||||
|
||||
@@ -17,6 +17,7 @@ in
|
||||
./users.nix
|
||||
./services.nix
|
||||
./sops.nix
|
||||
./vpn.nix
|
||||
];
|
||||
|
||||
services.kmscon = disabled;
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
systemd.network.wait-online.enable = false;
|
||||
# Force tailscaled to use nftables (Critical for clean nftables-only systems)
|
||||
@@ -8,8 +13,10 @@
|
||||
];
|
||||
networking.nftables.enable = true;
|
||||
boot.initrd.systemd.network.wait-online.enable = false;
|
||||
|
||||
# Services configs
|
||||
services = {
|
||||
|
||||
tailscale = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
|
||||
293
systems/x86_64-linux/jallen-nas/vpn.nix
Normal file
293
systems/x86_64-linux/jallen-nas/vpn.nix
Normal file
@@ -0,0 +1,293 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
# let
|
||||
# configFile = pkgs.writeText "openvpn-config-us.protonvpn.udp" ''
|
||||
# errors-to-stderr
|
||||
# ${config.services.openvpn.servers."us.protonvpn.udp".config}
|
||||
# auth-user-pass ${config.services.openvpn.servers."us.protonvpn.udp".authUserPass}
|
||||
# '';
|
||||
# in
|
||||
{
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
||||
sops = {
|
||||
secrets = {
|
||||
"protonvpn/username" = { };
|
||||
"protonvpn/password" = { };
|
||||
};
|
||||
templates = {
|
||||
"protonvpn" = {
|
||||
mode = "660";
|
||||
owner = "nix-apps";
|
||||
group = "jallen-nas";
|
||||
restartUnits = [ "openvpn-us.protonvpn.udp.service" ];
|
||||
content = ''
|
||||
${config.sops.placeholder."protonvpn/username"}
|
||||
${config.sops.placeholder."protonvpn/password"}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# networking.nftables = {
|
||||
# enable = true;
|
||||
# ruleset = ''
|
||||
# table ip nat {
|
||||
# chain postrouting {
|
||||
# type nat hook postrouting priority 100;
|
||||
# oifname "enp197s0" ip saddr 10.200.0.0/30 masquerade
|
||||
# }
|
||||
# }
|
||||
# '';
|
||||
# };
|
||||
|
||||
# systemd.services = {
|
||||
# vpn-netns =
|
||||
# let
|
||||
# ip = "${pkgs.iproute2}/bin/ip";
|
||||
# in {
|
||||
# description = "Create VPN network namespace";
|
||||
# wantedBy = [ "multi-user.target" ];
|
||||
# before = [ "openvpn-us.protonvpn.udp.service" ];
|
||||
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# RemainAfterExit = true;
|
||||
|
||||
# ExecStart = pkgs.writeShellScript "vpn-netns-up" ''
|
||||
# set -euxo pipefail
|
||||
|
||||
# # Ensure namespace exists
|
||||
# ${ip} netns add vpn 2>/dev/null || true
|
||||
|
||||
# # Clean up any previous veth (deleting one end deletes the peer too)
|
||||
# ${ip} link del veth-host 2>/dev/null || true
|
||||
|
||||
# # Create veth pair
|
||||
# ${ip} link add veth-host type veth peer name veth-vpn
|
||||
|
||||
# # Move peer into namespace
|
||||
# ${ip} link set veth-vpn netns vpn
|
||||
|
||||
# # Host side
|
||||
# ${ip} addr add 10.200.0.1/30 dev veth-host 2>/dev/null || true
|
||||
# ${ip} link set veth-host up
|
||||
|
||||
# # Namespace side
|
||||
# ${ip} -n vpn addr add 10.200.0.2/30 dev veth-vpn 2>/dev/null || true
|
||||
# ${ip} -n vpn link set veth-vpn up
|
||||
# ${ip} -n vpn link set lo up
|
||||
|
||||
# # Default route in namespace via host
|
||||
# ${ip} -n vpn route replace default via 10.200.0.1
|
||||
|
||||
# ${ip} -n vpn route replace 10.0.1.0/24 via 10.200.0.1 dev veth-vpn
|
||||
# '';
|
||||
# ExecStop = pkgs.writeShellScript "vpn-netns-down" ''
|
||||
# set -eux
|
||||
# ${ip} link del veth-host 2>/dev/null || true
|
||||
# '';
|
||||
# };
|
||||
# };
|
||||
|
||||
# "openvpn-us.protonvpn.udp" = {
|
||||
# after = [ "network-online.target" "vpn-netns.service" ];
|
||||
# wants = [ "network-online.target" ];
|
||||
# serviceConfig = {
|
||||
# ExecStart = lib.mkOverride 90 ''
|
||||
# ${pkgs.iproute2}/bin/ip netns exec vpn \
|
||||
# ${pkgs.openvpn}/sbin/openvpn --config ${configFile}
|
||||
# '';
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# Services configs
|
||||
services = {
|
||||
openvpn = {
|
||||
servers = {
|
||||
"us.protonvpn.udp" = lib.mkForce {
|
||||
authUserPass = config.sops.templates."protonvpn".path;
|
||||
updateResolvConf = lib.mkForce true;
|
||||
config = ''
|
||||
# ==============================================================================
|
||||
# Copyright (c) 2023 Proton AG (Switzerland)
|
||||
# Email: contact@protonvpn.com
|
||||
#
|
||||
# The MIT License (MIT)
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is
|
||||
# furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in all
|
||||
# copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR # OTHERWISE, ARISING
|
||||
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
||||
# IN THE SOFTWARE.
|
||||
# ==============================================================================
|
||||
|
||||
# If you are a paying user you can also enable the ProtonVPN ad blocker (NetShield) or Moderate NAT:
|
||||
# Use: "ErqosBHsDoqr8Hcq+f1" as username to enable anti-malware filtering
|
||||
# Use: "ErqosBHsDoqr8Hcq+f2" as username to additionally enable ad-blocking filtering
|
||||
# Use: "ErqosBHsDoqr8Hcq+nr" as username to enable Moderate NAT
|
||||
# Note that you can combine the "+nr" suffix with other suffixes.
|
||||
|
||||
client
|
||||
dev tun
|
||||
proto udp
|
||||
|
||||
remote 37.221.112.194 51820
|
||||
remote 37.221.112.194 80
|
||||
remote 146.70.217.66 51820
|
||||
remote 217.138.198.246 51820
|
||||
remote 149.22.84.89 51820
|
||||
remote 146.70.217.66 4569
|
||||
remote 149.22.94.86 80
|
||||
remote 95.173.221.92 1194
|
||||
remote 79.127.160.158 5060
|
||||
remote 217.138.198.246 80
|
||||
remote 149.40.62.62 4569
|
||||
remote 79.127.160.158 4569
|
||||
remote 149.22.84.89 5060
|
||||
remote 95.173.221.33 51820
|
||||
remote 149.22.84.89 1194
|
||||
remote 146.70.183.146 80
|
||||
remote 149.22.94.86 5060
|
||||
remote 62.93.176.129 5060
|
||||
remote 95.173.221.33 80
|
||||
remote 146.70.183.146 1194
|
||||
remote 79.127.160.158 1194
|
||||
remote 217.138.198.246 4569
|
||||
remote 217.138.198.246 80
|
||||
remote 95.173.221.33 5060
|
||||
remote 95.173.221.33 1194
|
||||
remote 149.22.94.86 1194
|
||||
remote 149.40.62.62 1194
|
||||
remote 62.93.176.129 51820
|
||||
remote 95.173.221.92 4569
|
||||
remote 37.221.112.194 1194
|
||||
remote 95.173.221.92 5060
|
||||
remote 149.40.62.62 5060
|
||||
remote 217.138.198.246 5060
|
||||
remote 79.127.160.158 51820
|
||||
remote 62.93.176.129 1194
|
||||
remote 95.173.221.33 4569
|
||||
remote 146.70.217.66 1194
|
||||
remote 95.173.221.92 51820
|
||||
remote 62.93.176.129 4569
|
||||
remote 149.22.94.86 51820
|
||||
remote 37.221.112.194 4569
|
||||
remote 149.40.62.62 51820
|
||||
remote 146.70.183.146 5060
|
||||
remote 217.138.198.246 4569
|
||||
remote 146.70.217.66 5060
|
||||
remote 146.70.217.66 80
|
||||
remote 149.22.94.86 4569
|
||||
remote 217.138.198.246 51820
|
||||
remote 146.70.183.146 51820
|
||||
remote 217.138.198.246 5060
|
||||
remote 95.173.221.92 80
|
||||
remote 217.138.198.246 1194
|
||||
remote 37.221.112.194 5060
|
||||
remote 79.127.160.158 80
|
||||
remote 217.138.198.246 1194
|
||||
remote 149.40.62.62 80
|
||||
remote 62.93.176.129 80
|
||||
remote 149.22.84.89 80
|
||||
remote 149.22.84.89 4569
|
||||
remote 146.70.183.146 4569
|
||||
server-poll-timeout 20
|
||||
|
||||
remote-random
|
||||
resolv-retry infinite
|
||||
nobind
|
||||
|
||||
cipher AES-256-GCM
|
||||
|
||||
setenv CLIENT_CERT 0
|
||||
tun-mtu 1500
|
||||
mssfix 0
|
||||
persist-key
|
||||
persist-tun
|
||||
|
||||
reneg-sec 0
|
||||
|
||||
remote-cert-tls server
|
||||
auth-user-pass
|
||||
|
||||
script-security 2
|
||||
|
||||
<ca>
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFnTCCA4WgAwIBAgIUCI574SM3Lyh47GyNl0WAOYrqb5QwDQYJKoZIhvcNAQEL
|
||||
BQAwXjELMAkGA1UEBhMCQ0gxHzAdBgNVBAoMFlByb3RvbiBUZWNobm9sb2dpZXMg
|
||||
QUcxEjAQBgNVBAsMCVByb3RvblZQTjEaMBgGA1UEAwwRUHJvdG9uVlBOIFJvb3Qg
|
||||
Q0EwHhcNMTkxMDE3MDgwNjQxWhcNMzkxMDEyMDgwNjQxWjBeMQswCQYDVQQGEwJD
|
||||
SDEfMB0GA1UECgwWUHJvdG9uIFRlY2hub2xvZ2llcyBBRzESMBAGA1UECwwJUHJv
|
||||
dG9uVlBOMRowGAYDVQQDDBFQcm90b25WUE4gUm9vdCBDQTCCAiIwDQYJKoZIhvcN
|
||||
AQEBBQADggIPADCCAgoCggIBAMkUT7zMUS5C+NjQ7YoGpVFlfbN9HFgG4JiKfHB8
|
||||
QxnPPRgyTi0zVOAj1ImsRilauY8Ddm5dQtd8qcApoz6oCx5cFiiSQG2uyhS/59Zl
|
||||
5wqIkw1o+CgwZgeWkq04lcrxhhfPgJZRFjrYVezy/Z2Ssd18s3/FFNQ+2iV1KC2K
|
||||
z8eSPr50u+l9vEKsKiNGkJTdlWjoDKZM2C15i/h8Smi+PdJlx7WMTtYoVC1Fzq0r
|
||||
aCPDQl18kspu11b6d8ECPWghKcDIIKuA0r0nGqF1GvH1AmbC/xUaNrKgz9AfioZL
|
||||
MP/l22tVG3KKM1ku0eYHX7NzNHgkM2JKnBBannImQQBGTAcvvUlnfF3AHx4vzx7H
|
||||
ahpBz8ebThx2uv+vzu8lCVEcKjQObGwLbAONJN2enug8hwSSZQv7tz7onDQWlYh0
|
||||
El5fnkrEQGbukNnSyOqTwfobvBllIPzBqdO38eZFA0YTlH9plYjIjPjGl931lFAA
|
||||
3G9t0x7nxAauLXN5QVp1yoF1tzXc5kN0SFAasM9VtVEOSMaGHLKhF+IMyVX8h5Iu
|
||||
IRC8u5O672r7cHS+Dtx87LjxypqNhmbf1TWyLJSoh0qYhMr+BbO7+N6zKRIZPI5b
|
||||
MXc8Be2pQwbSA4ZrDvSjFC9yDXmSuZTyVo6Bqi/KCUZeaXKof68oNxVYeGowNeQd
|
||||
g/znAgMBAAGjUzBRMB0GA1UdDgQWBBR44WtTuEKCaPPUltYEHZoyhJo+4TAfBgNV
|
||||
HSMEGDAWgBR44WtTuEKCaPPUltYEHZoyhJo+4TAPBgNVHRMBAf8EBTADAQH/MA0G
|
||||
CSqGSIb3DQEBCwUAA4ICAQBBmzCQlHxOJ6izys3TVpaze+rUkA9GejgsB2DZXIcm
|
||||
4Lj/SNzQsPlZRu4S0IZV253dbE1DoWlHanw5lnXwx8iU82X7jdm/5uZOwj2NqSqT
|
||||
bTn0WLAC6khEKKe5bPTf18UOcwN82Le3AnkwcNAaBO5/TzFQVgnVedXr2g6rmpp9
|
||||
gdedeEl9acB7xqfYfkrmijqYMm+xeG2rXaanch3HjweMDuZdT/Ub5G6oir0Kowft
|
||||
lA1ytjXRg+X+yWymTpF/zGLYfSodWWjMKhpzZtRJZ+9B0pWXUyY7SuCj5T5SMIAu
|
||||
x3NQQ46wSbHRolIlwh7zD7kBgkyLe7ByLvGFKa2Vw4PuWjqYwrRbFjb2+EKAwPu6
|
||||
VTWz/QQTU8oJewGFipw94Bi61zuaPvF1qZCHgYhVojRy6KcqncX2Hx9hjfVxspBZ
|
||||
DrVH6uofCmd99GmVu+qizybWQTrPaubfc/a2jJIbXc2bRQjYj/qmjE3hTlmO3k7V
|
||||
EP6i8CLhEl+dX75aZw9StkqjdpIApYwX6XNDqVuGzfeTXXclk4N4aDPwPFM/Yo/e
|
||||
KnvlNlKbljWdMYkfx8r37aOHpchH34cv0Jb5Im+1H07ywnshXNfUhRazOpubJRHn
|
||||
bjDuBwWS1/Vwp5AJ+QHsPXhJdl3qHc1szJZVJb3VyAWvG/bWApKfFuZX18tiI4N0
|
||||
EA==
|
||||
-----END CERTIFICATE-----
|
||||
</ca>
|
||||
|
||||
<tls-crypt>
|
||||
-----BEGIN OpenVPN Static key V1-----
|
||||
6acef03f62675b4b1bbd03e53b187727
|
||||
423cea742242106cb2916a8a4c829756
|
||||
3d22c7e5cef430b1103c6f66eb1fc5b3
|
||||
75a672f158e2e2e936c3faa48b035a6d
|
||||
e17beaac23b5f03b10b868d53d03521d
|
||||
8ba115059da777a60cbfd7b2c9c57472
|
||||
78a15b8f6e68a3ef7fd583ec9f398c8b
|
||||
d4735dab40cbd1e3c62a822e97489186
|
||||
c30a0b48c7c38ea32ceb056d3fa5a710
|
||||
e10ccc7a0ddb363b08c3d2777a3395e1
|
||||
0c0b6080f56309192ab5aacd4b45f55d
|
||||
a61fc77af39bd81a19218a79762c3386
|
||||
2df55785075f37d8c71dc8a42097ee43
|
||||
344739a0dd48d03025b0450cf1fb5e8c
|
||||
aeb893d9a96d1f15519bb3c4dcb40ee3
|
||||
16672ea16c012664f8a9f11255518deb
|
||||
-----END OpenVPN Static key V1-----
|
||||
</tls-crypt>
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user