+
+
+
+ |
+ |
+ π§ Name |
+ π€ |
+ π Ort |
+ π§ Typ |
+
+
+
+"""
+
+ # Sortiere EintrΓ€ge:
+ # 1. Notrufnummern (3-Stellig) numerisch sortiert
+ # 2. alle weiteren Extensions: nach Location, dann Name
+ rows = sorted(
+ extensions.items(),
+ key=lambda x: (
+ (0, x[0], "")
+ if len(x[0]) < 4
+ else (1, x[1].get("location", ""), x[1].get("name", ""))
+ ),
+ )
+ html_rows = ""
+
+ for ext, info in rows:
+ name = info.get("name", "")
+ typ = info.get("type", "default")
+ location = info.get("location", "")
+ vanity = info.get("vanity", "")
+ dialin = info.get("dialin", "")
+ icon = type_icons.get(typ, type_icons["default"])
+ row_color = (
+ emergency_color if len(ext) < 4 else location_colors.get(location, "#fff")
+ )
+
+ name_cell = f"{name}"
+ if dialin:
+ name_cell = f'{name_cell}'
+
+ html_rows += f"""
+
+ | {icon} |
+ {ext} |
+ {name_cell} |
+ {vanity} |
+ {location} |
+ {typ} |
+
+"""
+
+ html_footer = """
+
+
+
+
+
+"""
+
+ return html_header + html_rows + html_footer
+
+
+def main():
+ INPUT_FILE, OUTPUT_FILE = sys.argv[1:]
+
+ with open(INPUT_FILE, "r") as f:
+ data = yaml.safe_load(f)
+
+ extensions = data.get("extensions", {})
+ with open(OUTPUT_FILE, "w", encoding="utf-8") as f:
+ f.write(generate_html(extensions))
+
+
+if __name__ == "__main__":
+ main()
diff --git a/hosts/pbx/services/public-ip4-tunnel.nix b/hosts/pbx/services/public-ip4-tunnel.nix
index ffef316..9cf2dc8 100644
--- a/hosts/pbx/services/public-ip4-tunnel.nix
+++ b/hosts/pbx/services/public-ip4-tunnel.nix
@@ -1,5 +1,6 @@
{
config,
+ lib,
pkgs,
...
}: let
@@ -17,6 +18,15 @@ in {
sopsFile = ../secrets.yaml;
};
+ services.yate.config.ysipchan = {
+ general = {
+ addr = externalIp;
+ type = "udp";
+ port = 5060;
+ rtp_localip = externalIp;
+ };
+ };
+
networking = {
iproute2 = {
enable = true;
@@ -24,18 +34,54 @@ in {
${toString rtTable.id} ${rtTable.name}
'';
};
- wireguard.interfaces."${interface}" = {
+
+ wireguard.interfaces."${interface}" = let
+ rules = [
+ "from 192.168.98.0/24 to 10.0.0.0/8 table main priority 10"
+ "from 192.168.98.0/24 to 192.168.0.0/16 table main priority 10"
+ "from 192.168.98.0/24 lookup ${rtTable.name} priority 20"
+
+ "from ${externalIp} to 10.0.0.0/8 table main priority 10"
+ "from ${externalIp} to 192.168.0.0/16 table main priority 10"
+ "from ${externalIp} table ${rtTable.name} priority 20"
+
+ "from ${externalIp} oif ${interface} lookup ${rtTable.name} priority 20"
+ ];
+ addRule = rule: "ip rule add " + rule;
+ deleteRule = rule: "ip rule delete " + rule;
+ path = pkgs.lib.makeBinPath [pkgs.iproute2 pkgs.nftables];
+ in {
ips = ["${externalIp}/32"];
privateKeyFile = config.sops.secrets."wireguard/${interface}".path;
table = rtTable.name;
- postSetup = ''
- ${pkgs.iproute2}/bin/ip rule add from ${externalIp} to 192.168.0.0/16 table main priority 10
- ${pkgs.iproute2}/bin/ip rule add from ${externalIp} table ${rtTable.name} priority 20
- '';
- postShutdown = ''
- ${pkgs.iproute2}/bin/ip rule del from ${externalIp} to 192.168.0.0/16 table main priority 10
- ${pkgs.iproute2}/bin/ip rule del from ${externalIp} table ${rtTable.name} priority 20
- '';
+ postSetup = lib.concatLines [
+ "export PATH=${path}"
+ "set -x"
+ (lib.concatMapStringsSep "\n" addRule rules)
+ /*
+ ip route change default dev ${interface} src ${externalIp} table ${rtTable.name}
+ */
+ ''
+
+ nft add table ip wg_nat-${interface}
+ nft add chain ip wg_nat-${interface} postrouting '{type nat hook postrouting priority srcnat;}'
+ nft add rule ip wg_nat-${interface} postrouting ip saddr 192.168.0.0/16 oifname "public-ip4" counter snat to ${externalIp}
+ nft add rule ip wg_nat-${interface} postrouting ip saddr 10.0.0.0/8 oifname "public-ip4" counter snat to ${externalIp}
+
+ nft add table inet wg_filter-${interface}
+ nft add chain inet wg_filter-${interface} forward '{type filter hook forward priority 0; policy accept;}'
+ ''
+ ];
+ postShutdown = lib.concatLines [
+ "export PATH=${path}"
+ "set -x"
+ (lib.concatMapStringsSep "\n" deleteRule rules)
+
+ ''
+ nft delete table ip wg_nat-${interface}
+ nft delete table inet wg_filter-${interface}
+ ''
+ ];
peers = [
{
inherit publicKey;
diff --git a/hosts/pbx/services/unifi-controller/default.nix b/hosts/pbx/services/unifi-controller/default.nix
new file mode 100644
index 0000000..baea9e9
--- /dev/null
+++ b/hosts/pbx/services/unifi-controller/default.nix
@@ -0,0 +1,46 @@
+args: let
+ domain = "unifi.weinturm.de";
+in {
+ imports = [
+ (import ./unpoller.nix (args // {inherit domain;}))
+ ];
+
+ services.unifi.enable = true;
+
+ networking.firewall.interfaces.weinturm = {
+ # https://help.ubnt.com/hc/en-us/articles/218506997
+ allowedTCPPorts = [
+ 8080 # Port for UAP to inform controller.
+ 8880 # Port for HTTP portal redirect, if guest portal is enabled.
+ 8843 # Port for HTTPS portal redirect, ditto.
+ 6789 # Port for UniFi mobile speed test.
+ ];
+ allowedUDPPorts = [
+ 3478 # UDP port used for STUN.
+ 10001 # UDP port used for device discovery.
+ ];
+ };
+
+ environment.persistence."/persist".directories = [
+ {
+ directory = "/var/lib/unifi";
+ user = "unifi";
+ group = "unifi";
+ mode = "u=rwx,g=rx,o=rx";
+ }
+ ];
+
+ services.nginx.virtualHosts = {
+ "${domain}" = {
+ enableACME = true;
+ forceSSL = true;
+ locations."/" = {
+ proxyPass = "https://127.0.0.1:8443";
+ recommendedProxySettings = true;
+ extraConfig = ''
+ proxy_ssl_verify off;
+ '';
+ };
+ };
+ };
+}
diff --git a/hosts/pbx/services/unifi-controller/unpoller.nix b/hosts/pbx/services/unifi-controller/unpoller.nix
new file mode 100644
index 0000000..e89e089
--- /dev/null
+++ b/hosts/pbx/services/unifi-controller/unpoller.nix
@@ -0,0 +1,24 @@
+{
+ config,
+ domain,
+ ...
+}: {
+ sops.secrets.unpoller = {
+ owner = config.services.prometheus.exporters.unpoller.user;
+ sopsFile = ../../secrets.yaml;
+ };
+
+ services.prometheus.exporters.unpoller = {
+ enable = true;
+ controllers = [
+ {
+ user = "unpoller";
+ url = "https://${domain}";
+ pass = config.sops.secrets.unpoller.path;
+ verify_ssl = false;
+ hash_pii = true;
+ }
+ ];
+ log.prometheusErrors = true;
+ };
+}
diff --git a/hosts/pbx/services/webserver.nix b/hosts/pbx/services/webserver.nix
index 583b446..0e460dc 100644
--- a/hosts/pbx/services/webserver.nix
+++ b/hosts/pbx/services/webserver.nix
@@ -1,6 +1,4 @@
-{config, ...}: let
- domain = "tel.weinturm.de";
-in {
+{config, ...}: {
networking.firewall.allowedTCPPorts = [
config.services.nginx.defaultHTTPListenPort
config.services.nginx.defaultSSLListenPort
@@ -21,13 +19,5 @@ in {
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
'';
- virtualHosts = {
- "${domain}" = {
- serverAliases = ["tel.weinturm-open-air.de"];
- enableACME = true;
- forceSSL = true;
- root = "/persist/html";
- };
- };
};
}
diff --git a/justfile b/justfile
index 684e369..11d0dc2 100644
--- a/justfile
+++ b/justfile
@@ -7,3 +7,6 @@ repl:
pkgs = inputs.nixpkgs.legacyPackages."\${builtins.currentSystem}".extend(import ./pkgs inputs); \
}) \
"
+upload-extensions:
+ scp extensions.yaml tel.weinturm.de:
+ ssh tel.weinturm.de fieldpoc-load-extensions extensions.yaml
diff --git a/modules/default.nix b/modules/default.nix
index 6497baa..41909df 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -10,6 +10,7 @@
./nix.nix
./security.nix
./sshd.nix
+ ./unfree.nix
./zram.nix
];
diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 70f99bb..1df8dad 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -24,10 +24,13 @@
cfg = config.weinturm.impermanence;
in
lib.mkIf cfg.enable {
+ users.mutableUsers = false;
+
fileSystems."/persist".neededForBoot = true;
environment.persistence."/persist".directories = [
"/var/lib/nixos"
+ "/var/lib/acme"
];
boot.initrd.postDeviceCommands = let
diff --git a/modules/unfree.nix b/modules/unfree.nix
new file mode 100644
index 0000000..b900b5f
--- /dev/null
+++ b/modules/unfree.nix
@@ -0,0 +1,7 @@
+{lib, ...}: {
+ nixpkgs.config.allowUnfreePredicate = pkg:
+ lib.elem (lib.getName pkg) [
+ "mongodb"
+ "unifi-controller"
+ ];
+}