Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

wirelum -> wiregrill

Browse Source
This commit is contained in:
lassulus 2018-12-16 16:11:02 +01:00
parent 9e464d9888
commit 24330950fe
8 changed files with 65 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
krebs/3modules/lass/default.nix
View File

@ -8,7 +8,7 @@ with import <stockholm/lib>;
}; };
r6 = ip: (krebs.genipv6 "retiolum" "lass" ip).address; r6 = ip: (krebs.genipv6 "retiolum" "lass" ip).address;
w6 = ip: (krebs.genipv6 "wirelum" "lass" ip).address; w6 = ip: (krebs.genipv6 "wiregrill" "lass" ip).address;
in { in {
dns.providers = { dns.providers = {
@ -89,7 +89,7 @@ in {
-----END RSA PUBLIC KEY----- -----END RSA PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
via = internet; via = internet;
ip4.addr = "10.244.1.1"; ip4.addr = "10.244.1.1";
ip6.addr = w6 "1"; ip6.addr = w6 "1";
@ -191,7 +191,7 @@ in {
-----END RSA PUBLIC KEY----- -----END RSA PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
ip6.addr = w6 "dea7"; ip6.addr = w6 "dea7";
aliases = [ aliases = [
"mors.w" "mors.w"
@ -224,7 +224,7 @@ in {
-----END RSA PUBLIC KEY----- -----END RSA PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
ip6.addr = w6 "50da"; ip6.addr = w6 "50da";
aliases = [ aliases = [
"shodan.w" "shodan.w"
@ -257,7 +257,7 @@ in {
-----END RSA PUBLIC KEY----- -----END RSA PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
ip6.addr = w6 "1205"; ip6.addr = w6 "1205";
aliases = [ aliases = [
"icarus.w" "icarus.w"
@ -419,7 +419,7 @@ in {
-----END PUBLIC KEY----- -----END PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
ip6.addr = w6 "3110"; ip6.addr = w6 "3110";
aliases = [ aliases = [
"yellow.w" "yellow.w"
@ -456,7 +456,7 @@ in {
-----END PUBLIC KEY----- -----END PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
ip6.addr = w6 "b1ce"; ip6.addr = w6 "b1ce";
aliases = [ aliases = [
"blue.w" "blue.w"
@ -469,7 +469,7 @@ in {
}; };
phone = { phone = {
nets = { nets = {
wirelum = { wiregrill = {
ip4.addr = "10.244.1.2"; ip4.addr = "10.244.1.2";
ip6.addr = w6 "a"; ip6.addr = w6 "a";
aliases = [ aliases = [
@ -506,7 +506,7 @@ in {
-----END RSA PUBLIC KEY----- -----END RSA PUBLIC KEY-----
''; '';
}; };
wirelum = { wiregrill = {
ip6.addr = w6 "012f"; ip6.addr = w6 "012f";
aliases = [ aliases = [
"morpheus.w" "morpheus.w"

6
lass/1systems/prism/config.nix
View File

@ -298,15 +298,15 @@ with import <stockholm/lib>;
} }
{ {
imports = [ imports = [
<stockholm/lass/2configs/wirelum.nix> <stockholm/lass/2configs/wiregrill.nix>
]; ];
krebs.iptables.tables.nat.PREROUTING.rules = [ krebs.iptables.tables.nat.PREROUTING.rules = [
{ v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; } { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
{ v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; } { v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
]; ];
krebs.iptables.tables.filter.FORWARD.rules = [ krebs.iptables.tables.filter.FORWARD.rules = [
{ precedence = 1000; predicate = "-i wirelum -o retiolum"; target = "ACCEPT"; } { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
{ precedence = 1000; predicate = "-i retiolum -o wirelum"; target = "ACCEPT"; } { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
]; ];
krebs.iptables.tables.nat.POSTROUTING.rules = [ krebs.iptables.tables.nat.POSTROUTING.rules = [
{ v4 = false; predicate = "-s 42:1:ce16::/48 ! -d 42:1:ce16::48"; target = "MASQUERADE"; } { v4 = false; predicate = "-s 42:1:ce16::/48 ! -d 42:1:ce16::48"; target = "MASQUERADE"; }

4
lass/2configs/blue.nix
View File

@ -22,9 +22,9 @@ with (import <stockholm/lib>);
krebs.iptables.tables.filter.INPUT.rules = [ krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";} { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
{ predicate = "-i wirelum -p udp --dport 60000:61000"; target = "ACCEPT";} { predicate = "-i wiregrill -p udp --dport 60000:61000"; target = "ACCEPT";}
{ predicate = "-i retiolum -p tcp --dport 9999"; target = "ACCEPT";} { predicate = "-i retiolum -p tcp --dport 9999"; target = "ACCEPT";}
{ predicate = "-i wirelum -p tcp --dport 9999"; target = "ACCEPT";} { predicate = "-i wiregrill -p tcp --dport 9999"; target = "ACCEPT";}
]; ];
systemd.services.chat = let systemd.services.chat = let

2
lass/2configs/default.nix
View File

@ -10,7 +10,7 @@ with import <stockholm/lib>;
./zsh.nix ./zsh.nix
./htop.nix ./htop.nix
./security-workarounds.nix ./security-workarounds.nix
./wirelum.nix ./wiregrill.nix
{ {
users.extraUsers = users.extraUsers =
mapAttrs (_: h: { hashedPassword = h; }) mapAttrs (_: h: { hashedPassword = h; })

44
lass/2configs/wiregrill.nix Normal file
View File

@ -0,0 +1,44 @@
with import <stockholm/lib>;
{ config, pkgs, ... }: let
self = config.krebs.build.host.nets.wiregrill;
isRouter = !isNull self.via;
in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
#hack for modprobe inside containers
systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
(pkgs.writeDashBin "modprobe" ":")
]);
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
};
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
];
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [
{ precedence = 1000; predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
];
networking.wireguard.interfaces.wiregrill = {
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);
listenPort = 51820;
privateKeyFile = (toString <secrets>) + "/wiregrill.key";
allowedIPsAsRoutes = true;
peers = mapAttrsToList
(_: host: {
allowedIPs = if isRouter then
(optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) ++
(optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
else
host.nets.wiregrill.wireguard.subnets
;
endpoint = mkIf (!isNull host.nets.wiregrill.via) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}");
persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
publicKey = host.nets.wiregrill.wireguard.pubkey;
})
(filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
};
}

44
lass/2configs/wirelum.nix
View File

@ -1,44 +0,0 @@
with import <stockholm/lib>;
{ config, pkgs, ... }: let
self = config.krebs.build.host.nets.wirelum;
isRouter = !isNull self.via;
in mkIf (hasAttr "wirelum" config.krebs.build.host.nets) {
#hack for modprobe inside containers
systemd.services."wireguard-wirelum".path = mkIf config.boot.isContainer (mkBefore [
(pkgs.writeDashBin "modprobe" ":")
]);
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
};
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
];
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [
{ precedence = 1000; predicate = "-i wirelum -o wirelum"; target = "ACCEPT"; }
];
networking.wireguard.interfaces.wirelum = {
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);
listenPort = 51820;
privateKeyFile = (toString <secrets>) + "/wirelum.key";
allowedIPsAsRoutes = true;
peers = mapAttrsToList
(_: host: {
allowedIPs = if isRouter then
(optional (!isNull host.nets.wirelum.ip4) host.nets.wirelum.ip4.addr) ++
(optional (!isNull host.nets.wirelum.ip6) host.nets.wirelum.ip6.addr)
else
host.nets.wirelum.wireguard.subnets
;
endpoint = mkIf (!isNull host.nets.wirelum.via) (host.nets.wirelum.via.ip4.addr + ":${toString host.nets.wirelum.wireguard.port}");
persistentKeepalive = mkIf (!isNull host.nets.wirelum.via) 61;
publicKey = host.nets.wirelum.wireguard.pubkey;
})
(filterAttrs (_: h: hasAttr "wirelum" h.nets) config.krebs.hosts);
};
}

8
lass/5pkgs/l-gen-secrets/default.nix
View File

@ -8,8 +8,8 @@ pkgs.writeDashBin "l-gen-secrets" ''
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null
${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null ${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null
${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null ${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null
${pkgs.wireguard}/bin/wg genkey > $TMPDIR/wirelum.key ${pkgs.wireguard}/bin/wg genkey > $TMPDIR/wiregrill.key
${pkgs.coreutils}/bin/cat $TMPDIR/wirelum.key | ${pkgs.wireguard}/bin/wg pubkey > $TMPDIR/wirelum.pub ${pkgs.coreutils}/bin/cat $TMPDIR/wiregrill.key | ${pkgs.wireguard}/bin/wg pubkey > $TMPDIR/wiregrill.pub
cat <<EOF > $TMPDIR/hashedPasswords.nix cat <<EOF > $TMPDIR/hashedPasswords.nix
{ {
root = "$HASHED_PASSWORD"; root = "$HASHED_PASSWORD";
@ -37,13 +37,13 @@ pkgs.writeDashBin "l-gen-secrets" ''
$(cat $TMPDIR/retiolum.rsa_key.pub) $(cat $TMPDIR/retiolum.rsa_key.pub)
${"''"}; ${"''"};
}; };
wirelum = { wiregrill = {
ip6.addr = (wip6 "changeme").address; ip6.addr = (wip6 "changeme").address;
aliases = [ aliases = [
"$HOSTNAME.w" "$HOSTNAME.w"
]; ];
wireguard.pubkey = ${"''"} wireguard.pubkey = ${"''"}
$(cat $TMPDIR/wirelum.pub) $(cat $TMPDIR/wiregrill.pub)
${"''"}; ${"''"};
}; };
}; };

4
lib/krebs/genipv6.nix
View File

@ -16,12 +16,12 @@ let {
normalize-ip6-addr (appendZeros addressLength netPrefix); normalize-ip6-addr (appendZeros addressLength netPrefix);
netHash = toString { netHash = toString {
retiolum = 0; retiolum = 0;
wirelum = 1; wiregrill = 1;
}.${netname}; }.${netname};
netPrefix = "42:${netHash}"; netPrefix = "42:${netHash}";
netPrefixLength = { netPrefixLength = {
retiolum = 32; retiolum = 32;
wirelum = 32; wiregrill = 32;
}.${netname}; }.${netname};
inherit subnetname; inherit subnetname;