nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Working vm-nameserver

Browse Source
This commit is contained in:
niten
2023-11-15 12:22:14 -08:00
parent 5f7ff14550
commit 44589ddc77
5 changed files with 176 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/hardware/system3.nix
+3 -6
View File
@@ -1,8 +1,7 @@
{ config, lib, pkgs, ... }:
with lib;
let
let inherit (config.instance) hostname;
in {
system.stateVersion = "21.11";
@@ -116,10 +115,8 @@ in {
};
interfaces = {
intif0 = {
# output of: echo lambda-intif0|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
macAddress = "02:0d:df:2d:46:90";
};
intif0.macAddress =
pkgs.lib.network.generate-mac-address hostname "intif0";
};
};
config/host-config/system3.nix
+122 -52
View File
@@ -1,70 +1,140 @@
{ config, lib, pkgs, ... }:
with lib;
let state-dir = "/state";
let
state-dir = "/state";
inherit (config.instance) hostname;
vmConfig = { pkgs, lib, ... }: {
config = {
containers.tester = {
autoStart = true;
# hostAddress = "10.0.0.14";
additionalCapabilities = [ "CAP_NET_ADMIN" ];
# privateNetwork = true;
macvlans = [ "enp7s0" ];
# hostBridge = "tester0";
config = {
imports = [ pkgs.moduleRegistry.authoritativeDns ];
services.openssh.enable = true;
users.users.niten = config.users.users.niten;
services.authoritative-dns = {
enable = true;
identity = "ns.sea.fudo.org";
listen-ips = [ "10.0.0.14" ];
state-directory = "/var/lib/nsd";
timestamp = toString config.instance.build-timestamp;
domains = {
"sea.fudo.org" = { zone = config.fudo.zones."sea.fudo.org"; };
};
};
networking = {
defaultGateway = pkgs.lib.getHostGatewayV4 hostname;
firewall = {
enable = true;
allowedTCPPorts = [ 22 53 ];
allowedUDPPorts = [ 53 ];
};
interfaces = {
mv-enp7s0.ipv4.addresses = [{
address = "10.0.0.14";
prefixLength = 24;
}];
};
};
};
};
};
};
in {
fudo = {
slynk.enable = true;
wallfly.location = "office";
};
imports = [ vmConfig ];
networking = {
interfaces.intif0.useDHCP = true;
firewall.enable = false;
};
config = {
fudo = {
slynk.enable = true;
wallfly.location = "office";
};
systemd.tmpfiles.rules = [
"L /root/.gnupg - - - - ${state-dir}/user/root/gnupg"
"L /root/.ssh/id_rsa - - - - ${state-dir}/user/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
"L /var/lib/flatpak - - - - ${state-dir}/lib/flatpak"
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
"d ${state-dir}/lib/cups 755 root root - -"
];
networking = {
defaultGateway = {
address = pkgs.lib.getHostGatewayV4 hostname;
interface = "intif0";
};
services = {
blueman.enable = true;
interfaces = {
intif0 = {
ipv4.addresses = [{
address = pkgs.lib.getHostIpv4 hostname;
prefixLength = 16;
}];
};
# intif1.ipv4.addresses = [{
# address = "10.0.0.14";
# prefixLength = 32;
# }];
};
firewall.enable = false;
};
openssh.hostKeys = [
{
path = "${state-dir}/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
{
path = "${state-dir}/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
systemd.tmpfiles.rules = [
"L /root/.gnupg - - - - ${state-dir}/user/root/gnupg"
"L /root/.ssh/id_rsa - - - - ${state-dir}/user/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
"L /var/lib/flatpak - - - - ${state-dir}/lib/flatpak"
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
"d ${state-dir}/lib/cups 755 root root - -"
];
};
fileSystems = {
"/var/lib/cups" = {
device = "${state-dir}/lib/cups";
options = [ "bind" ];
services = {
blueman.enable = true;
openssh.hostKeys = [
{
path = "${state-dir}/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
{
path = "${state-dir}/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
};
fonts.fontconfig = {
hinting = {
enable = true;
style = "hintfull";
fileSystems = {
"/var/lib/cups" = {
device = "${state-dir}/lib/cups";
options = [ "bind" ];
};
};
subpixel.lcdfilter = "default";
antialias = true;
};
environment.etc = {
nixos.source = "/etc/nixos-live";
NIXOS.source = "${state-dir}/etc/NIXOS";
};
fonts.fontconfig = {
hinting = {
enable = true;
style = "hintfull";
};
subpixel.lcdfilter = "default";
antialias = true;
};
hardware = {
bluetooth = {
enable = true;
package = pkgs.bluezFull;
environment.etc = {
nixos.source = "/etc/nixos-live";
NIXOS.source = "${state-dir}/etc/NIXOS";
};
hardware = {
bluetooth = {
enable = true;
package = pkgs.bluezFull;
};
xpadneo.enable = true;
};
xpadneo.enable = true;
};
}
config/service/local-network.nix
+7 -8
View File
@@ -99,7 +99,7 @@ in {
config = mkIf (site.local-gateway != null) (let
host-ipv4 = pkgs.lib.network.host-ipv4 config;
gateway-host = site.local-gateway;
gateway-host = site.local-gateway;
nameserver-host = gateway-host;
gateway-ip = host-ipv4 gateway-host;
nameserver-ip = host-ipv4 gateway-host;
@@ -140,8 +140,7 @@ in {
zones.${zone-name} = {
aliases = {
${agp.http-host-alias} = optionalAttrs (agp.enable)
(fqdn gateway-host);
"${agp.http-host-alias}" = mkIf (agp.enable) (fqdn gateway-host);
ns = (fqdn nameserver-host);
gw = (fqdn gateway-host);
};
@@ -151,9 +150,7 @@ in {
nameserver.ipv4-address = nameserver-ip;
};
nameservers = [
"nameserver"
];
nameservers = [ "nameserver" ];
srv-records = {
tcp.domain = [{
@@ -173,8 +170,10 @@ in {
dns-servers = [ nameserver-ip ];
gateway = gateway-ip;
dhcp-interfaces = cfg.internal-interfaces;
dns-listen-ips = optionals is-gateway [ nameserver-ip "127.0.0.1" "127.0.1.1" ];
dns-listen-ipv6s = optionals (is-gateway && config.networking.enableIPv6) [ "::1" ];
dns-listen-ips =
optionals is-gateway [ nameserver-ip "127.0.0.1" "127.0.1.1" ];
dns-listen-ipv6s =
optionals (is-gateway && config.networking.enableIPv6) [ "::1" ];
recursive-resolver = if agp.enable then {
host = "127.0.0.1";
port = agp.dns-listen-port;