mynix/system
1
1
Fork 0
Code Issues 2 Pull requests Activity

host/tatos: fix configs

Browse source
This commit is contained in:
Dmitriy Pleshevskiy 2024-04-18 12:54:40 +03:00
parent 7324c1d1dd
commit 1cec47e1e2
Signed by: pleshevskiy
GPG key ID: 17041163DA10A9A2
5 changed files with 13 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
hosts/tatos/hardware-configuration/networking.secret.nix
View file

Binary file not shown.

5
hosts/tatos/services/default.nix
View file

@ -1,5 +1,8 @@
{ ... }:
{
imports = [ ./wireguard ];
imports = [
./wireguard
./dns.nix
];
}

4
hosts/tatos/services/dns.nix
View file

@ -2,7 +2,7 @@
let dnsport = 53; in
{
services.dnscrypt-proxy2.settings.listen_addresses = [ "[::1]:51" ];
services.dnscrypt-proxy2.settings.listen_addresses = [ "127.0.0.1:51" "[::1]:51" ];
# Forward loopback traffic on port 53 to dnscrypt-proxy2.
networking.firewall.extraCommands = ''
@ -25,4 +25,4 @@ let dnsport = 53; in
interface = "wg0";
};
};
};
}

16
hosts/tatos/services/wireguard/default.nix
View file

@ -7,7 +7,6 @@ let
tatosData = import ../../data.secret.nix;
port = tatosData.wireguard.port;
in
{
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@ -20,20 +19,19 @@ in
internalInterfaces = [ "wg0" ];
};
networking.firewall.allowedUDPPorts = [ port ];
services.cron =
let
update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { };
cmd = "${update_ru_routes}/bin/update_ru_routes > /root/update_routes.log 2>&1";
in
let update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { }; in
let cmd = "${update_ru_routes}/bin/update_ru_routes > /root/update_routes.log 2>&1"; in
{
enable = true;
systemCronJobs = [
"@reboot sleep 30 && ${cmd}"
"0 3 * * mon ${cmd}"
"@reboot root sleep 30 && ${cmd}"
"0 3 * * mon root ${cmd}"
];
};
networking.wg-quick.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
@ -46,13 +44,11 @@ in
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postUp = ''
gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o $interface -j MASQUERADE
${pkgs.iproute}/bin/ip rule add from ${tatosData.addr} table main
'';
preDown = ''
gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o $interface -j MASQUERADE
${pkgs.iproute}/bin/ip rule del from ${tatosData.addr} table main

1
hosts/tatos/services/wireguard/update_ru_routes.sh
View file

@ -20,6 +20,7 @@ interface=`ip route | awk '/default/ {print $5; exit}'`
# Get addresses RU segment
echo "Add stat.ripe.net to $interface"
ip route add 193.0.6.150/32 via $gateway_for_internal_ip dev $interface
echo "Download RU subnets..."
curl --progress-bar "https://stat.ripe.net/data/country-resource-list/data.json?resource=ru" | jq -r ".data.resources.ipv4[]" > $file_raw