From 8753230721bd5721385a605945e586da11e1b564 Mon Sep 17 00:00:00 2001 From: Gene Liverman Date: Mon, 5 Feb 2024 22:38:53 -0500 Subject: [PATCH] enable fail2ban, fix network config --- .sops.yaml | 6 ++ README.md | 13 +++++ modules/hosts/nixos/hetznix01/default.nix | 56 +++++++++++++++++++ .../hetznix01/hardware-configuration.nix | 12 ---- modules/hosts/nixos/hetznix01/secrets.yaml | 23 ++++++++ 5 files changed, 98 insertions(+), 12 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index 0414560..2c1d07c 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,11 +1,16 @@ --- keys: + - &system_hetznix01 age1a652ev7gekx4aj589s8fd27ul9j5ugpdwg7pxhmqcwdjwwq9gf2qv38um9 - &system_nixnuc age1g24zhwvgenpc4wqejt63thvgd4rn5x9n7nnwwme7dm83nfqpp93se2vmq4 - &system_rainbow_planet age15xlw5vnnjdx2ypz6rq0mqcywuaj3yx8y6lrgf95satafqf7y4qus6rv6ck - &user_airpuppet age1awdf9h0avajf57cudx0rjfmxu2wlxw8wf3sa7yvfk8rp4j6taecsu74x77 - &user_blue_rock age1rt72txg22w8y3cdvq9w7zff0cas6xtkplpj36kxnevfnrtn82f6ss7yw7d - &user_mini_watcher age1rpy8edlpgxuf6w75cvlqexuq2xe4c49h9t2ge6jhc3fzczp8vfasnjelwq creation_rules: + - path_regex: hetznix01/secrets.yaml$ + key_groups: + - age: + - *system_hetznix01 - path_regex: nixnuc/secrets.yaml$ key_groups: - age: @@ -29,6 +34,7 @@ creation_rules: - path_regex: modules/system/common/secrets.yaml$ key_groups: - age: + - *system_hetznix01 - *system_nixnuc - *system_rainbow_planet - *user_airpuppet diff --git a/README.md b/README.md index 0177651..e1bde52 100644 --- a/README.md +++ b/README.md @@ -119,3 +119,16 @@ read -s ak read -s ap atuin login --key $ak --password $ap --username gene ``` + +## Adding a NixOS host + +### Post-install + +1. clone this repo +2. setup SOPS via `mkdir -p ~/.config/sops/age && nix run nixpkgs#ssh-to-age -- -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt && nix run nixpkgs#ssh-to-age -- -i ~/.ssh/id_ed25519.pub > ~/.config/sops/age/pub-keys.txt` +3. copy output of `~/.config/sops/age/pub-keys.txt` +4. add entries to `.sops.yaml` +5. run `sops modules/hosts/nixos/$(hostname)/secrets.yaml` + - if there is an empty yaml file in where you target you will get an error... just delete it and try again +6. edit `sops modules/hosts/nixos/$(hostname)/default.nix` and add the tailscale service and the block of config for sops. + - if there is an empty yaml file in where you target you diff --git a/modules/hosts/nixos/hetznix01/default.nix b/modules/hosts/nixos/hetznix01/default.nix index a8c7c21..292d6a4 100644 --- a/modules/hosts/nixos/hetznix01/default.nix +++ b/modules/hosts/nixos/hetznix01/default.nix @@ -27,6 +27,62 @@ programs.mtr.enable = true; + services = { + fail2ban.enable = true; + tailscale = { + enable = true; + authKeyFile = config.sops.secrets.tailscale_key.path; + extraUpFlags = [ + "--advertise-exit-node" + "--operator" + "${username}" + "--ssh" + ]; + }; + }; + + sops = { + age.keyFile = /home/${username}/.config/sops/age/keys.txt; + defaultSopsFile = ./secrets.yaml; + secrets = { + local_git_config = { + owner = "${username}"; + path = "/home/${username}/.gitconfig-local"; + }; + local_private_env = { + owner = "${username}"; + path = "/home/${username}/.private-env"; + }; + tailscale_key = { + restartUnits = [ "tailscaled-autoconnect.service" ]; + }; + }; + }; + + systemd.network = { + enable = true; + networks."10-wan" = { + matchConfig.Name = "enp1s0"; + address = [ + "167.235.18.32/32" + "2a01:4f8:c2c:2e49::1/64" + ]; + dns = [ + "185.12.64.1" + "185.12.64.2" + "2a01:4ff:ff00::add:1" + "2a01:4ff:ff00::add:2" + ]; + routes = [ + { routeConfig = { Destination = "172.31.1.1"; }; } + { routeConfig = { Gateway = "172.31.1.1"; GatewayOnLink = true; }; } + { routeConfig.Gateway = "fe80::1"; } + ]; + # make the routes on this interface a dependency for network-online.target + linkConfig.RequiredForOnline = "routable"; + }; + }; + users.users.${username} = { isNormalUser = true; description = "Gene Liverman"; diff --git a/modules/hosts/nixos/hetznix01/hardware-configuration.nix b/modules/hosts/nixos/hetznix01/hardware-configuration.nix index 8ef049d..d0554f2 100644 --- a/modules/hosts/nixos/hetznix01/hardware-configuration.nix +++ b/modules/hosts/nixos/hetznix01/hardware-configuration.nix @@ -14,18 +14,6 @@ boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - systemd.network.networks."10-wan" = { - networkConfig.DHCP = "no"; - address = [ - "167.235.18.32/32" - "2a01:4f8:c2c:2e49::1/64" - ]; - routes = [ - { routeConfig = { Destination = "172.31.1.1"; }; } - { routeConfig = { Gateway = "172.31.1.1"; GatewayOnLink = true; }; } - { routeConfig.Gateway = "fe80::1"; } - ]; - }; nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; } diff --git a/modules/hosts/nixos/hetznix01/secrets.yaml b/modules/hosts/nixos/hetznix01/secrets.yaml index e69de29..543ee2e 100644 --- a/modules/hosts/nixos/hetznix01/secrets.yaml +++ b/modules/hosts/nixos/hetznix01/secrets.yaml @@ -0,0 +1,23 @@ +local_git_config: ENC[AES256_GCM,data:/1FaGgxRJT01Xg3NYvcGfTaqxklv3PtoBdVN/H7+Mhlxwed5O++leUA=,iv:VKjkzqH8ayRE9hgNrqwSSx4RKCBYVkUkPtA1dvnkfvA=,tag:lfgezmDGQ/yVfLypLBanYA==,type:str] +local_private_env: "" +tailscale_key: ENC[AES256_GCM,data:yiAug7VEfZ5jROEg3NVmZcfdbfUxBZk2duM6mG/BVXKuAYj4u0SB1HtMCmvX6nr7P3y3YyuqiLw6,iv:bN5xbBOPWJfH+DxcHp2ODLm95jyzUwjSkKynPmvQvnY=,tag:8b/0hnNH7T64xBFMkXRjeQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1a652ev7gekx4aj589s8fd27ul9j5ugpdwg7pxhmqcwdjwwq9gf2qv38um9 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NFBqRFNnSmJCK0ZPYUR5 + SXRXRDhaMmVCbGFVUWxoYkhPbUczdHBJdkZvClcxcE5IUnMvN0tHbllNU3hwMTY1 + SXlhUHFJd3JCYU5MVDB2UnJPaW5xYncKLS0tIENqd3N1dnZ1NFltQ1pOSjA2dU5N + VUIzR0FqbFNvOXAzREZtdDJNTWhjYUEKYfA5s8PRVbefoOefKLs7NiHUd6fYZ62I + ZwUi9YZt+zHxBxxFFMpduSSd5q50Qz+CMBNQHv2CPOBcGeFjToiDxg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-02-06T02:07:39Z" + mac: ENC[AES256_GCM,data:JWLLdojUJlI0SDdT8Yg0pj03Jmc7eCJL8GHPtXOfw28vcqlK2tnR/yWLI+MClFVu+o4vrV9HZv+41VItqAkeMjBlgAYib9JgTwtkiECZz8o6i8FXEk09Qkml9WKyKrAU1Og/+gt3y1MUSzrmGgg8YkM3YVv7nyGr8lZ0nf/rWb8=,iv:rYtawgUgxsXCY4OHbLW6l2X/x1f+C7X22MoYVlfHIaw=,tag:pdACJHoe56N1lllrFoyHow==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1