wymiller/nix-config-v2
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

modularized all the things

Browse Source 
part one (?)
This commit is contained in:
Wyatt J. Miller
2024-12-15 18:22:36 -05:00
parent d8a9e92dff
commit adabefd821
15 changed files with 848 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
modules/networking/README.md Normal file
View File

@ -0,0 +1,90 @@
# Network and networking modules
This directory houses all network, firewall, DHCP, DNS, and all other related networking enablement.
## `core.nix`
This is where the firewall and NetworkManager live. For the firewall, you have pre-defined options that will open ports for you by enabling some network service.
For example:
```nix
tcpPorts.web.enable = true;
udpPorts.dns.enable = true;
```
Here's a more featureful example of how you would enable a firewall and set up NetworkManager:
```nix
customNetworking = {
firewall = {
enable = true;
# Open web service ports
tcpPorts.web.enable = true;
# Custom TCP ports
tcpPorts.allowedPorts = [ 8080 22 ];
# Custom UDP ports
udpPorts.allowedPorts = [ 5000 ];
};
networkManager = {
enable = true;
extraPlugins = with pkgs; [
# Additional NetworkManager plugins
networkmanager-openvpn
networkmanager-openconnect
];
};
};
```
As shown above, you'll have to open ports for services you would want to access remotely.
## DNS
There are two options here: BIND9 (or simply Bind) or Technitium DNS server. Enabling both DNS servers will throw an error and your configuration will not build.
You'll have to import `./dns.nix` for the services to be enabled.
Here's an example of what configuration might look like:
```nix
dns.bind = {
enable = true;
settings = {
interfaces = [ "127.0.0.1" "192.168.100.100" ];
zones = [
{
name = "example.com";
type = "master";
file = "/etc/named/zones/example.com.zone";
}
];
extraConfig = ''
// Additional BIND configuration
options {
directory "/var/named";
recursion yes;
}
'';
}
};
```
_or_
```nix
dns.technitium = {
enable = true;
settings = {
address = "192.168.100.0";
port = 5380;
extraOptions = {
LOG_LEVEL = "info";
};
}
};
```

145
modules/networking/core.nix Normal file
View File

@ -0,0 +1,145 @@
{
config,
lib,
pkgs,
...
}: let
cfg = config.customNetworking;
in {
options.customNetworking = {
# Firewall Configuration
firewall = {
enable = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Enable system firewall";
};
tcpPorts = {
# Predefined, default common service ports
ssh = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open SSH service port (22)";
};
};
web = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open common web service ports (80, 443)";
};
};
smtp = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open SMTP service ports (25, 465, 587)";
};
};
imap = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open IMAP service ports (143, 993)";
};
};
mysql = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open MySQL service port (3306)";
};
};
mssql = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open Microsoft SQL Server service port (1433)";
};
};
postgres = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open Postgres service port (5432)";
};
};
allowedPorts = lib.mkOption {
type = lib.types.listOf lib.types.port;
default = [];
description = "List of custom TCP ports to open";
};
};
udpPorts = {
dns = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open DNS service port (53)";
};
};
ntp = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open NTP service port (123)";
};
};
allowedPorts = lib.mkOption {
type = lib.types.listOf lib.types.port;
default = [];
description = "List of custom UDP ports to open";
};
};
};
networkManager = {
enable = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Enable NetworkManager for network connection management";
};
extraPlugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [];
description = "Additional NetworkManager plugins to install";
};
};
};
config = {
networking.firewall = {
enable = cfg.firewall.enable;
allowedTCPPorts =
(
lib.optionals
cfg.firewall.tcpPorts.ssh.enable [22]
cfg.firewall.tcpPorts.web.enable [80 443]
cfg.firewall.tcpPorts.smtp.enable [25 465 587]
cfg.firewall.tcpPorts.imap.enable [143 993]
cfg.firewall.tcpPorts.mysql.enable [3306]
cfg.firewall.tcpPorts.mssql.enable [1433]
cfg.firewall.tcpPorts.postgres.enable [5432]
)
++ cfg.firewall.tcpPorts.allowedPorts;
allowedUDPPorts =
(
lib.optionals
cfg.firewall.udpPorts.dns.enable [53]
cfg.firewall.udpPorts.ntp.enable [123]
)
++ cfg.firewall.udpPorts.allowedPorts;
};
networking.networkmanager = {
enable = cfg.networkManager.enable;
packages = cfg.networkManager.extraPlugins;
};
};
}

133
modules/networking/dns.nix Normal file
View File

@ -0,0 +1,133 @@
{
config,
lib,
pkgs,
...
}: let
cfg = config.dns;
in {
options.dns = {
bind = {
enable = lib.mkEnableOption "BIND DNS server";
settings = {
interfaces = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = ["127.0.0.1"];
description = "Network interfaces BIND should listen on";
};
zones = lib.mkOption {
type = lib.types.listOf (lib.types.submodule {
options = {
name = lib.mkOption {
type = lib.types.str;
description = "Name of the DNS zone";
};
type = lib.mkOption {
type = lib.types.enum ["master" "slave"];
default = "master";
description = "Type of DNS zone";
};
file = lib.mkOption {
type = lib.types.str;
default = "";
description = "Path to zone file";
};
};
});
default = [];
description = "DNS zones to configure";
};
extraConfig = lib.mkOption {
type = lib.types.lines;
default = "";
description = "Additional BIND configuration options";
};
};
};
technitium = {
enable = lib.mkEnableOption "Technitium DNS server";
settings = {
address = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "IP address Technitium should listen on";
};
port = lib.mkOption {
type = lib.types.port;
default = 5380;
description = "Port for Technitium DNS server";
};
extraOptions = lib.mkOption {
type = lib.types.attrs;
default = {};
description = "Additional Technitium configuration options";
};
};
};
};
# Validate that only one DNS server is enabled
imports = [
(lib.mkIf (cfg.bind.enable && cfg.technitium.enable) (throw "Only one DNS server can be enabled at a time"))
];
# Implementation of the configuration
config = lib.mkMerge [
# BIND DNS Server Configuration
(lib.mkIf cfg.bind.enable {
services.named = {
enable = true;
interfaces = cfg.bind.settings.interfaces;
zones =
map (zone: {
name = zone.name;
type = zone.type;
file = zone.file;
})
cfg.bind.settings.zones;
extraConfig = cfg.bind.settings.extraConfig;
};
networking.firewall = {
allowedTCPPorts = [53];
allowedUDPPorts = [53];
};
environment.systemPackages = [pkgs.bind];
})
# Technitium DNS Server Configuration
(lib.mkIf cfg.technitium.enable {
# Create a systemd service for Technitium
systemd.services.technitium-dns = {
description = "Technitium DNS Server";
wantedBy = ["multi-user.target"];
serviceConfig = {
ExecStart = "${pkgs.technitium}/bin/dns-server-start.sh";
Restart = "on-failure";
};
# Environment configuration
environment =
{
DNS_LISTEN_ADDRESS = cfg.technitium.settings.address;
DNS_LISTEN_PORT = toString cfg.technitium.settings.port;
}
// lib.mapAttrs' (
name: value:
lib.nameValuePair "DNS_${lib.toUpper name}" (toString value)
)
cfg.technitium.settings.extraOptions;
};
networking.firewall = {
allowedTCPPorts = [cfg.technitium.settings.port];
allowedUDPPorts = [cfg.technitium.settings.port];
};
environment.systemPackages = [pkgs.technitium];
})
];
}