146 lines
3.7 KiB
Nix
146 lines
3.7 KiB
Nix
{ lib, config, pkgs, self, system, ... }:
|
||
|
||
let
|
||
tradebyteDnsServers = [
|
||
"10.170.254.30"
|
||
"10.170.254.40"
|
||
];
|
||
in
|
||
{
|
||
imports = [
|
||
./hardware-configuration.nix
|
||
../../home-manager/users/jal.nix
|
||
];
|
||
|
||
networking = {
|
||
hostName = "hafnium";
|
||
networkmanager = {
|
||
enable = true;
|
||
};
|
||
useDHCP = false;
|
||
interfaces = {
|
||
enp2s0f0.useDHCP = false;
|
||
enp5s0.useDHCP = false;
|
||
wlp3s0.useDHCP = false;
|
||
};
|
||
firewall = {
|
||
allowedUDPPorts = [
|
||
53
|
||
];
|
||
allowedTCPPorts = [
|
||
53
|
||
];
|
||
};
|
||
extraHosts = ''
|
||
#10.10.10.10 example.com
|
||
'';
|
||
};
|
||
|
||
environment.systemPackages = with pkgs; [
|
||
brightnessctl
|
||
gnome3.adwaita-icon-theme
|
||
openconnect
|
||
redir
|
||
tcpdump
|
||
];
|
||
|
||
environment.variables.EDITOR = "nvim";
|
||
|
||
programs.mtr.enable = true;
|
||
|
||
|
||
services.udisks2.enable = true;
|
||
|
||
jalr = {
|
||
bootloader = "systemd-boot";
|
||
bluetooth.enable = true;
|
||
uefi.enable = true;
|
||
gui.enable = true;
|
||
workstation.enable = true;
|
||
sdr.enable = false;
|
||
libvirt.enable = true;
|
||
autologin.enable = true;
|
||
autologin.username = "jal";
|
||
tradebyte.enable = true;
|
||
};
|
||
|
||
|
||
sops.secrets = (
|
||
lib.listToAttrs (map
|
||
(name: lib.nameValuePair "wireguard_key_${name}" {
|
||
sopsFile = ./secrets.yaml;
|
||
})
|
||
[
|
||
"tbcore"
|
||
"ops-testing"
|
||
]
|
||
)
|
||
);
|
||
|
||
networking.wireguard.interfaces = {
|
||
tbcore = {
|
||
ips = [ "172.27.27.16/32" ];
|
||
privateKeyFile = config.sops.secrets.wireguard_key_tbcore.path;
|
||
listenPort = 51930;
|
||
|
||
peers = [{
|
||
publicKey = "K5vF/yTag6NnWjZsMug63DERdCFRfHoqxVkgKH55oFE=";
|
||
endpoint = "194.33.184.175:51930";
|
||
#endpoint = "ccs-emergency-vpn.core.tradebyte.com:51930";
|
||
persistentKeepalive = 25;
|
||
allowedIPs = [
|
||
"10.158.128.0/23"
|
||
"10.158.224.0/20"
|
||
"10.18.0.0/16"
|
||
"10.64.64.0/20" # CPS
|
||
"172.31.1.0/24"
|
||
];
|
||
}];
|
||
};
|
||
ops-testing = {
|
||
ips = [ "10.254.254.2/30" ];
|
||
privateKeyFile = config.sops.secrets.wireguard_key_ops-testing.path;
|
||
peers = [{
|
||
publicKey = "+jZETJfwaRiM+7ys5eYjgiWEAtxP47RzZSCx0w4l2nI=";
|
||
endpoint = "3.68.138.217:2048";
|
||
persistentKeepalive = 25;
|
||
allowedIPs = [
|
||
"10.254.254.0/30"
|
||
"10.250.0.0/16"
|
||
];
|
||
}];
|
||
};
|
||
};
|
||
|
||
services.dnsmasq.settings.server = lib.lists.flatten (
|
||
map (domain: (map (srv: "/${domain}/${srv}") tradebyteDnsServers)) [
|
||
"vpce-0c1c169d1e33a1c2f-yugtdam1.s3.eu-central-1.vpce.amazonaws.com"
|
||
"ccs.tradebyte.com"
|
||
"instance.tradebyte.com"
|
||
]) ++ [
|
||
"/internal.production.core.tradebyte.com/10.158.224.2"
|
||
"/internal.development.core.tradebyte.com/10.170.254.30"
|
||
"/rds.amazonaws.com/9.9.9.9"
|
||
"/tradebyte.com/9.9.9.9"
|
||
"/tradebyte.org/9.9.9.9"
|
||
"/develop.sys.tradebyte.com/10.0.3.1"
|
||
"/corp.ad.zalando.net/10.160.19.100"
|
||
];
|
||
services.actkbd = {
|
||
enable = true;
|
||
bindings = [
|
||
{ keys = [ 232 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s -5%"; }
|
||
{ keys = [ 233 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s +5%"; }
|
||
];
|
||
};
|
||
|
||
# This value determines the NixOS release from which the default
|
||
# settings for stateful data, like file locations and database versions
|
||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||
# this value at the release version of the first install of this system.
|
||
# Before changing this value read the documentation for this option
|
||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||
system.stateVersion = "22.05"; # Did you read the comment?
|
||
|
||
}
|
||
|