added wireguard

nixos/hosts/headscale/configuration.nix

@@ -0,0 +1,72 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ lib, config, pkgs, inputs, ... }:
+{
+  imports = [ ];
+
+  networking.hostName = "headscale";
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.11"; # Did you read the comment?
+
+  # Additional packages
+  environment.systemPackages = with pkgs; [ ];
+
+  environment.noXlibs = lib.mkForce false;
+
+  networking.firewall.allowedTCPPorts = [ config.services.headscale.port 50443 ];
+
+  services.postgresql =
+    let
+      db_name = config.services.headscale.database.name;
+      db_user = config.services.headscale.database.user;
+    in
+    {
+      enable = false;
+      package = pkgs.postgresql_13;
+      ensureDatabases = [ db_name ];
+      authentication = "host ${db_name} ${db_user} 127.0.0.1/32 trust";
+      ensureUsers = [
+        {
+          name = db_user;
+          ensurePermissions = { "DATABASE ${db_name}" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+  services.headscale = {
+    enable = false;
+    address = "0.0.0.0";
+    serverUrl = "https://vpn.0x76.dev";
+    logLevel = "debug";
+
+    settings = {
+      grpc_listen_addr = "0.0.0.0:50443";
+      grpc_allow_insecure = true;
+
+      ip_prefixes = [
+        "fd7a:115c:a1e0::/48"
+        "100.64.0.0/10"
+      ];
+    };
+
+    database = {
+      type = "postgres";
+      port = config.services.postgresql.port;
+      name = "headscale";
+      user = "headscale";
+      host = "127.0.0.1";
+    };
+  };
+
+  systemd.services.headscale.environment = {
+    GIN_MODE = "release";
+  };
+}

nixos/hosts/minecraft/configuration.nix

@@ -21,11 +21,11 @@
 
   environment.noXlibs = lib.mkForce false;
 
-  networking.firewall.allowedTCPPorts = [ config.services.minecraft-server.serverProperties."rcon.port"];
+  networking.firewall.allowedTCPPorts = [ ];
 
   services.minecraft-server = {
     enable = true;
-    package = pkgs.minecraftServers.purpur_1_18_2;
+    package = pkgs.minecraftServers.purpur_1_18;
     jvmOpts = "--add-modules=jdk.incubator.vector -Xmx2048M -Xms2048M";
 
     declarative = true;
@@ -43,6 +43,5 @@
       red_shifts = "e0afdee5-e776-49a9-a0cd-c8753faf4255";
       iampilot = "4055515e-0567-4610-972e-8e530a5a9ccb";
     };
-
   };
 }

nixos/hosts/minio/configuration.nix

@@ -3,7 +3,10 @@
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
 { config, pkgs, ... }:
-let vs = config.vault-secrets.secrets;
+let 
+  vs = config.vault-secrets.secrets;
+  listenPort = 9000;
+  consolePort = 9001;
 in {
   imports = [ ];
 
@@ -20,12 +23,14 @@ in {
   # Additional packages
   environment.systemPackages = with pkgs; [ ];
 
-  networking.firewall.allowedTCPPorts = [ 9000 9001 ];
+  networking.firewall.allowedTCPPorts = [ listenPort consolePort ];
 
   vault-secrets.secrets.minio = { };
 
   services.minio = {
     enable = true;
     rootCredentialsFile = "${vs.minio}/environment";
+    listenAddress = ":${toString listenPort}";
+    consoleAddress = ":${toString consolePort}";
   };
 }

nixos/hosts/mosquitto/configuration.nix

@@ -4,7 +4,8 @@
 
 { config, pkgs, ... }:
 let mosquittoPort = 1883;
-in {
+in
+{
   imports = [ ];
 
   networking.hostName = "mosquitto";
@@ -21,11 +22,9 @@ in {
   environment.systemPackages = with pkgs; [ ];
 
   services.mosquitto = {
-
     enable = true;
-
     listeners = [{
-      port = 1883;
+      port = mosquittoPort;
       settings.allow_anonymous = true;
       acl = [ "topic readwrite #" ];
       users = {

nixos/hosts/nginx/configuration.nix

@@ -9,7 +9,8 @@ let
     };
   };
   k8s_proxy = proxy "http://10.42.42.150:8000/";
-in {
+in
+{
   networking.hostName = "nginx";
 
   # This value determines the NixOS release from which the default
@@ -33,7 +34,7 @@ in {
     # Reverse Proxies
     virtualHosts."ha.0x76.dev" = proxy "http://home-assistant.olympus:8123/";
     virtualHosts."zookeeper-dev.0x76.dev" = proxy "http://eevee.olympus:8085/";
-    virtualHosts."analytics.0x76.dev" = proxy "http://plausible.olympus:8000/";
+    # virtualHosts."analytics.0x76.dev" = proxy "http://plausible.olympus:8000/";
     virtualHosts."git.0x76.dev" = proxy "http://gitea.olympus:3000";
 
     # Kubernetes endpoints
@@ -41,6 +42,47 @@ in {
     virtualHosts."zookeeper.0x76.dev" = k8s_proxy;
     virtualHosts."wooloofan.club" = k8s_proxy;
     virtualHosts."whoami.wooloofan.club" = k8s_proxy;
+
+    # Headscale
+    virtualHosts."vpn.0x76.dev" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations = {
+        "/headscale." = {
+          extraConfig = ''
+            grpc_pass grpc://headscale.olympus:50443;
+          '';
+          priority = 1;
+        };
+
+        # "/metrics" = {
+        #   proxyPass = "http://plausible.olympus:9090";
+        #   extraConfig = ''
+        #     allow 10.0.0.0/8;
+        #     allow 100.64.0.0/16;
+        #     deny all;
+        #   '';
+        #   priority = 2;
+        # };
+
+        "/" = {
+          proxyPass = "http://headscale.olympus:8080";
+          proxyWebsockets = true;
+          extraConfig = ''
+            keepalive_requests          100000;
+            keepalive_timeout           160s;
+            proxy_buffering             off;
+            proxy_connect_timeout       75;
+            proxy_ignore_client_abort   on;
+            proxy_read_timeout          900s;
+            proxy_send_timeout          600;
+            send_timeout                600;
+          '';
+          priority = 99;
+        };
+      };
+    };
   };
 
   security.acme.defaults.email = "victorheld12@gmail.com";

nixos/hosts/plausible/configuration.nix

@@ -3,10 +3,11 @@
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
 { config, pkgs, ... }:
-let 
+let
   vs = config.vault-secrets.secrets;
   cfg = config.services.plausible;
-in {
+in
+{
   imports = [ ];
 
   networking.hostName = "plausible";

nixos/hosts/wireguard/configuration.nix

@@ -0,0 +1,50 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ lib, config, pkgs, inputs, ... }:
+let vs = config.vault-secrets.secrets; in
+{
+  imports = [ ];
+
+  networking.hostName = "wireguard";
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.11"; # Did you read the comment?
+
+  # Additional packages
+  environment.systemPackages = with pkgs; [ wireguard-tools ];
+
+  environment.noXlibs = lib.mkForce false;
+
+  networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
+
+  vault-secrets.secrets.wireguard = {
+    services = [ "wireguard-wg0" ];
+  };
+
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "wg0" ];
+    externalInterface = "eth0";
+  };
+
+  networking.wireguard.interfaces.wg0 = {
+    ips = [ "10.100.0.1/24" ];
+    listenPort = 51820;
+    privateKeyFile = "${vs.wireguard}/privateKey";
+
+    peers = [
+      {
+        # Phone
+        publicKey = "K+99mvSYs4urcclreQDLA1pekD4xtu/mpS2uVWw8Bws=";
+        allowedIPs = [ "10.100.0.2/32" ];
+      }
+    ];
+  };
+}