karaolidis/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add dedicated jupiter ip

Browse Source 
Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
This commit is contained in:
Nick Karaolidis
2025-03-03 17:30:23 +00:00
parent a271e892c3
commit 4354a2149b
7 changed files with 62 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
hosts/jupiter/configs/mmproxy/default.nix
View File

@@ -1,42 +0,0 @@
{
inputs,
system,
pkgs,
...
}:
let
selfPkgs = inputs.self.packages.${system};
in
{
environment.systemPackages = [ selfPkgs.go-mmproxy ];
boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
networking = {
iproute2 = {
enable = true;
rttablesExtraConfig = ''
100 mmproxy
'';
};
localCommands =
let
ip = "${pkgs.iproute2}/bin/ip";
iptables = "${pkgs.iptables}/bin/iptables";
in
''
${iptables} -t mangle -D PREROUTING -m mark --mark 100 -m comment --comment mmproxy -j CONNMARK --save-mark || true
${iptables} -t mangle -I PREROUTING -m mark --mark 100 -m comment --comment mmproxy -j CONNMARK --save-mark
${iptables} -t mangle -D OUTPUT -m connmark --mark 100 -m comment --comment mmproxy -j CONNMARK --restore-mark || true
${iptables} -t mangle -I OUTPUT -m connmark --mark 100 -m comment --comment mmproxy -j CONNMARK --restore-mark
${ip} rule del fwmark 100 lookup 100 || true
${ip} rule add fwmark 100 lookup 100
${ip} route del local 0.0.0.0/0 dev lo table 100 || true
${ip} route add local 0.0.0.0/0 dev lo table 100
'';
};
}

63
hosts/jupiter/configs/wireguard/default.nix
View File

@@ -1,31 +1,58 @@
{ config, inputs, ... }:
{
config,
inputs,
pkgs,
...
}:
let
jupiterVpsConfig = inputs.self.nixosConfigurations.jupiter-vps.config;
jupiterVpsPublicIPv4 = "51.75.170.190";
wireguardPort = jupiterVpsConfig.networking.wireguard.interfaces.wg0.listenPort;
jupiterVpsPublicIPv4 = "51.75.170.190";
jupiterPublicIPv4 = "51.89.210.124";
in
{
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
sops.secrets."wireguard" = { };
networking = {
firewall.allowedUDPPorts = [ wireguardPort ];
wireguard.interfaces.wg0 = {
ips = [ "10.0.0.2/24" ];
listenPort = wireguardPort;
privateKeyFile = config.sops.secrets."wireguard".path;
peers = [
{
name = "jupiter-vps";
allowedIPs = [ "10.0.0.1/32" ];
publicKey = "BCTr2uWYFr5nAy+VxVQ5SIly6w60dOXY91DpXAMiHjI=";
endpoint = "${jupiterVpsPublicIPv4}:${builtins.toString wireguardPort}";
persistentKeepalive = 25;
}
];
iproute2 = {
enable = true;
rttablesExtraConfig = ''
100 wireguard
'';
};
wireguard.interfaces.wg0 =
let
ip = "${pkgs.iproute2}/bin/ip";
in
rec {
ips = [
"10.0.0.2/24"
"${jupiterPublicIPv4}/32"
];
listenPort = wireguardPort;
privateKeyFile = config.sops.secrets."wireguard".path;
table = "wireguard";
postSetup = [
"${ip} rule add from ${jupiterPublicIPv4} table ${table}"
];
postShutdown = [
"${ip} rule del from ${jupiterPublicIPv4} table ${table}"
];
peers = [
{
name = "jupiter-vps";
allowedIPs = [ "0.0.0.0/0" ];
publicKey = "BCTr2uWYFr5nAy+VxVQ5SIly6w60dOXY91DpXAMiHjI=";
endpoint = "${jupiterVpsPublicIPv4}:${builtins.toString wireguardPort}";
persistentKeepalive = 25;
}
];
};
};
}