felixalb
/
pvv-nixos-config
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request 'Buskerud: Comment out openvpn-client' (#23) from buskerud-no-vpn into main 

Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/23
This commit is contained in:
Felix Albrigtsen 2023-12-12 18:09:31 +01:00
parent 9ed2ca8883 80ef1ce4fa
commit 1ab1b3a84e
2 changed files with 4 additions and 127 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
hosts/buskerud/configuration.nix
View File

@ -1,13 +1,10 @@
{ config, pkgs, values, ... }:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
../../base.nix
../../misc/metrics-exporters.nix
./services/openvpn-client.nix
];
./hardware-configuration.nix
../../base.nix
../../misc/metrics-exporters.nix
];
# buskerud does not support efi?
# boot.loader.systemd-boot.enable = true;
@ -25,20 +22,10 @@
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
};
# Buskerud should use the default gateway received from DHCP
networking.interfaces.enp14s0f1.useDHCP = true;
# networking.interfaces.tun = {
# virtual = true;
# ipv4.adresses = [ {address="129.241.210.252"; prefixLength=25; } ];
# };
# List packages installed in system profile
environment.systemPackages = with pkgs; [
];
# List services that you want to enable:
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
@ -46,5 +33,4 @@
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
}

109
hosts/buskerud/services/openvpn-client.nix
View File

@ -1,109 +0,0 @@
{ lib, values, ... }:
{
services.openvpn.servers."ov-tunnel" = {
config = let
conf = {
# TODO: use aliases
client = true;
dev = "tap";
proto = "udp";
#remote = "129.241.210.253 1194";
remote = "129.241.210.191 1194";
resolv-retry = "infinite";
nobind = true;
ca = "/etc/openvpn/ca.pem";
cert = "/etc/openvpn/crt.pem";
key = "/etc/openvpn/key.pem";
remote-cert-tls = "server";
cipher = "none";
user = "nobody";
group = "nobody";
status = "/var/log/openvpn-status.log";
persist-key = true;
persist-tun = true;
verb = 5;
# script-security = 2;
# up = "systemctl restart rwhod";
};
in lib.pipe conf [
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
(builtins.mapAttrs (_: value:
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
else if value == true then value
else if builtins.any (f: f value) [
builtins.isString
builtins.isInt
builtins.isFloat
lib.isPath
lib.isDerivation
] then toString value
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
))
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
(builtins.concatStringsSep "\n")
(x: x + "\n\n")
];
};
systemd.network.networks."enp14s0f1" = {
matchConfig.Name = "enp14s0f1";
networkConfig = {
DefaultRouteOnDevice = true;
};
routes = [
{ routeConfig = {
Type = "unicast";
Destination = values.hosts.knutsen.ipv4 + "/32";
Metric = 50;
};
}
];
};
systemd.network.netdevs."br0" = {
netdevConfig = {
Kind = "bridge";
Name = "br0";
};
};
systemd.network.networks."br0" = {
matchConfig.Name = "br0";
routes = [
{ routeConfig = {
Type = "unicast";
Destination = values.ipv4-space;
Metric = 100;
};
}
];
};
systemd.network.networks."enp3s0f0" = {
matchConfig.Name = "enp3s0f0";
networkConfig.DefaultRouteOnDevice = false;
};
systemd.network.networks."enp3s0f1" = {
matchConfig.Name = "enp3s0f1";
bridge = [ "br0" ];
};
systemd.network.networks."tap0" = {
matchConfig.Name = "tap0";
bridge = [ "br0" ];
};
#networking.nat = {
# enable = true;
# externalInterface = "enp14s0f1";
# internalInterfaces = [ "tun" ];
#};
}