karaolidis/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add haproxy/mmproxy combo

Browse Source 
Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
This commit is contained in:
Nick Karaolidis
2025-03-01 23:02:03 +00:00
parent ae66cfd854
commit a271e892c3
7 changed files with 101 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
hosts/jupiter-vps/configs/haproxy/default.nix Normal file
View File

@@ -0,0 +1,26 @@
{ ... }:
{
# TODO: Some way to automatically configure?
services.haproxy = {
enable = true;
config = ''
global
maxconn 4096
defaults
mode tcp
timeout connect 5s
timeout client 30s
timeout server 30s
frontend http
bind *:80
bind *:443
default_backend main
backend main
server jupiter 10.0.0.2:80 send-proxy-v2
server jupiter_ssl 10.0.0.2:443 send-proxy-v2
'';
};
}

54
hosts/jupiter-vps/configs/wireguard/default.nix
View File

@@ -1,12 +1,6 @@
{
config,
inputs,
pkgs,
...
}:
{ config, inputs, ... }:
let
jupiterConfig = inputs.self.nixosConfigurations.jupiter.config;
publicInterface = "ens3";
wireguardPort = 51820;
in
{
@@ -20,40 +14,18 @@ in
allowedUDPPorts = [ wireguardPort ] ++ jupiterConfig.networking.firewall.allowedUDPPorts;
};
wireguard.interfaces.wg0 =
let
iptables = "${pkgs.iptables}/bin/iptables";
in
rec {
ips = [ "10.0.0.1/24" ];
listenPort = wireguardPort;
privateKeyFile = config.sops.secrets."wireguard".path;
wireguard.interfaces.wg0 = {
ips = [ "10.0.0.1/24" ];
listenPort = wireguardPort;
privateKeyFile = config.sops.secrets."wireguard".path;
postSetup = [
"${iptables} -t nat -A PREROUTING -i ${publicInterface} -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -A PREROUTING -i ${publicInterface} -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -A PREROUTING -i ${publicInterface} -j DNAT --to-destination 10.0.0.2"
"${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -j SNAT --to-source 10.0.0.1"
];
postShutdown = [
"${iptables} -t nat -D PREROUTING -i ${publicInterface} -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -D PREROUTING -i ${publicInterface} -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -D PREROUTING -i ${publicInterface} -j DNAT --to-destination 10.0.0.2"
"${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -j SNAT --to-source 10.0.0.1"
];
peers = [
{
name = "jupiter";
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "Lvx7bpyqI8rUrxYVDolz7T+EPuRWDohJAAToq7kH7EU=";
}
];
};
peers = [
{
name = "jupiter";
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "Lvx7bpyqI8rUrxYVDolz7T+EPuRWDohJAAToq7kH7EU=";
}
];
};
};
}

2
hosts/jupiter-vps/default.nix
View File

@@ -7,6 +7,7 @@
./hardware
../common/configs/system/impermanence
../common/configs/system/neovim
../common/configs/system/nix
../common/configs/system/nixpkgs
../common/configs/system/sops
@@ -16,6 +17,7 @@
../common/configs/system/zsh
./configs/boot
./configs/haproxy
./configs/sshd
./configs/wireguard
];

42
hosts/jupiter/configs/mmproxy/default.nix Normal file
View File

@@ -0,0 +1,42 @@
{
inputs,
system,
pkgs,
...
}:
let
selfPkgs = inputs.self.packages.${system};
in
{
environment.systemPackages = [ selfPkgs.go-mmproxy ];
boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
networking = {
iproute2 = {
enable = true;
rttablesExtraConfig = ''
100 mmproxy
'';
};
localCommands =
let
ip = "${pkgs.iproute2}/bin/ip";
iptables = "${pkgs.iptables}/bin/iptables";
in
''
${iptables} -t mangle -D PREROUTING -m mark --mark 100 -m comment --comment mmproxy -j CONNMARK --save-mark || true
${iptables} -t mangle -I PREROUTING -m mark --mark 100 -m comment --comment mmproxy -j CONNMARK --save-mark
${iptables} -t mangle -D OUTPUT -m connmark --mark 100 -m comment --comment mmproxy -j CONNMARK --restore-mark || true
${iptables} -t mangle -I OUTPUT -m connmark --mark 100 -m comment --comment mmproxy -j CONNMARK --restore-mark
${ip} rule del fwmark 100 lookup 100 || true
${ip} rule add fwmark 100 lookup 100
${ip} route del local 0.0.0.0/0 dev lo table 100 || true
${ip} route add local 0.0.0.0/0 dev lo table 100
'';
};
}

1
hosts/jupiter/default.nix
View File

@@ -26,6 +26,7 @@
../common/configs/system/users
../common/configs/system/zsh
./configs/mmproxy
./configs/wireguard
./users/storm

2
packages/default.nix
View File

@@ -9,6 +9,8 @@
darktable-hald-clut = import ./darktable/hald-clut { inherit pkgs; };
darktable-lua-scripts = import ./darktable/lua-scripts { inherit pkgs; };
go-mmproxy = import ./go-mmproxy { inherit pkgs; };
obsidian-plugin-better-word-count = import ./obsidian/plugins/better-word-count { inherit pkgs; };
obsidian-plugin-dataview = import ./obsidian/plugins/dataview { inherit pkgs; };
obsidian-plugin-excalidraw = import ./obsidian/plugins/excalidraw { inherit pkgs; };

15
packages/go-mmproxy/default.nix Normal file
View File

@@ -0,0 +1,15 @@
{ pkgs, ... }:
# AUTO-UPDATE: nix-update --flake --version=branch=master go-mmproxy
pkgs.buildGoModule rec {
pname = "go-mmproxy";
version = "2.1-unstable-2023-11-20";
src = pkgs.fetchFromGitHub {
owner = "path-network";
repo = "go-mmproxy";
rev = "006247ca7ec618d2aff02052bac839ca769991a1";
hash = "sha256-sU0OYpJ0b/Fq5CzCA0TtC368LOyYCUkXt0pS4IEv8Ak=";
};
vendorHash = null;
}