diff --git a/infra/common/default.nix b/infra/common/default.nix new file mode 100644 index 0000000..b0372b0 --- /dev/null +++ b/infra/common/default.nix @@ -0,0 +1 @@ +{ imports = [ ./networking.nix ]; } diff --git a/infra/common/networking.nix b/infra/common/networking.nix new file mode 100644 index 0000000..7688e0e --- /dev/null +++ b/infra/common/networking.nix @@ -0,0 +1,117 @@ +{ + config = { + services.openssh.enable = true; + + networking = { + hostName = "vm02116"; + domain = "procolix.com"; + interfaces = { + eth0 = { + ipv4 = { + addresses = [ + { + address = "185.206.232.34"; + prefixLength = 24; + } + ]; + }; + ipv6 = { + addresses = [ + { + address = "2a00:51c0:12:1201::20"; + prefixLength = 64; + } + ]; + }; + }; + }; + defaultGateway = { + address = "185.206.232.1"; + interface = "eth0"; + }; + defaultGateway6 = { + address = "2a00:51c0:12:1201::1"; + interface = "eth0"; + }; + nameservers = [ + "2a00:51c0::5fd7:b906" + "95.215.185.7" + ]; + firewall.enable = false; + nftables = { + enable = true; + ruleset = '' + #!/usr/sbin/nft -f + + flush ruleset + + ########### define usefull variables here ##################### + define wan = eth0 + define ssh_allow = { + 83.161.147.127/32, # host801 ipv4 + 95.215.185.92/32, # host088 ipv4 + 95.215.185.211/32, # host089 ipv4 + 95.215.185.34/32, # nagios2 ipv4 + 95.215.185.235, # ansible-hq + } + define snmp_allow = { + 95.215.185.31/32, # cacti ipv4 + } + define nrpe_allow = { + 95.215.185.34/32, # nagios2 ipv4 + } + + ########### here starts the automated bit ##################### + table inet filter { + chain input { + type filter hook input priority 0; + policy drop; + + # established/related connections + ct state established,related accept + ct state invalid drop + + # Limit ping requests. + ip protocol icmp icmp type echo-request limit rate over 10/second burst 50 packets drop + ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 50 packets drop + + # loopback interface + iifname lo accept + + # icmp + ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, source-quench, time-exceeded } accept + # Without the nd-* ones ipv6 will not work. + ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert, packet-too-big, parameter-problem, time-exceeded } accept + + # open tcp ports: sshd (22) + #ip saddr $ssh_allow tcp dport {ssh} accept + tcp dport {ssh} accept + + # open tcp ports: snmp (161) + ip saddr $snmp_allow udp dport {snmp} accept + + # open tcp ports: nrpe (5666) + ip saddr $nrpe_allow tcp dport {nrpe} accept + + # open tcp ports: http (80,443) + tcp dport {http,https} accept + } + chain forward { + type filter hook forward priority 0; + } + chain output { + type filter hook output priority 0; + } + } + + table ip nat { + chain postrouting { + } + chain prerouting { + } + } + ''; + }; + }; + }; +} diff --git a/infra/vm02116/configuration.nix b/infra/vm02116/configuration.nix index ba06610..20a5243 100644 --- a/infra/vm02116/configuration.nix +++ b/infra/vm02116/configuration.nix @@ -6,119 +6,6 @@ boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; - # Networking - networking = { - hostName = "vm02116"; - domain = "procolix.com"; - interfaces = { - eth0 = { - ipv4 = { - addresses = [ - { - address = "185.206.232.34"; - prefixLength = 24; - } - ]; - }; - ipv6 = { - addresses = [ - { - address = "2a00:51c0:12:1201::20"; - prefixLength = 64; - } - ]; - }; - }; - }; - defaultGateway = { - address = "185.206.232.1"; - interface = "eth0"; - }; - defaultGateway6 = { - address = "2a00:51c0:12:1201::1"; - interface = "eth0"; - }; - nameservers = [ - "2a00:51c0::5fd7:b906" - "95.215.185.7" - ]; - firewall.enable = false; - nftables = { - enable = true; - ruleset = '' - #!/usr/sbin/nft -f - - flush ruleset - - ########### define usefull variables here ##################### - define wan = eth0 - define ssh_allow = { - 83.161.147.127/32, # host801 ipv4 - 95.215.185.92/32, # host088 ipv4 - 95.215.185.211/32, # host089 ipv4 - 95.215.185.34/32, # nagios2 ipv4 - 95.215.185.235, # ansible-hq - } - define snmp_allow = { - 95.215.185.31/32, # cacti ipv4 - } - define nrpe_allow = { - 95.215.185.34/32, # nagios2 ipv4 - } - - ########### here starts the automated bit ##################### - table inet filter { - chain input { - type filter hook input priority 0; - policy drop; - - # established/related connections - ct state established,related accept - ct state invalid drop - - # Limit ping requests. - ip protocol icmp icmp type echo-request limit rate over 10/second burst 50 packets drop - ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 50 packets drop - - # loopback interface - iifname lo accept - - # icmp - ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, source-quench, time-exceeded } accept - # Without the nd-* ones ipv6 will not work. - ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert, packet-too-big, parameter-problem, time-exceeded } accept - - # open tcp ports: sshd (22) - #ip saddr $ssh_allow tcp dport {ssh} accept - tcp dport {ssh} accept - - # open tcp ports: snmp (161) - ip saddr $snmp_allow udp dport {snmp} accept - - # open tcp ports: nrpe (5666) - ip saddr $nrpe_allow tcp dport {nrpe} accept - - # open tcp ports: http (80,443) - tcp dport {http,https} accept - } - chain forward { - type filter hook forward priority 0; - } - chain output { - type filter hook output priority 0; - } - } - - table ip nat { - chain postrouting { - } - chain prerouting { - } - } - ''; - }; - }; - # Set your time zone. time.timeZone = "Europe/Amsterdam"; @@ -163,15 +50,7 @@ subversion ]; - # List services that you want to enable: - services = { - openssh = { - enable = true; - }; - xe-guest-utilities = { - enable = true; - }; - }; + services.xe-guest-utilities.enable = true; # This option defines the first version of NixOS you have installed on this particular machine, # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.