numbus/numbus-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update networking

Browse Source
This commit is contained in:
Raphaël Numbus
2026-01-02 22:05:21 +01:00
parent 3418988c83
commit d90a1af7d3
3 changed files with 96 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/nix-config/configuration.nix
+7 -1
View File
@@ -6,6 +6,8 @@
(modulesPath + "/profiles/qemu-guest.nix")
inputs.sops-nix.nixosModules.sops
./disks/disko.nix
./misc/networking.nix
./misc/mail.nix
# ./disks/snapraid.nix
# ./disks/pcr-check.nix
# ./pcie-coral/coral.nix
@@ -112,11 +114,15 @@
virtualisation.podman.enable = true;
virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
# Enable libvirt
# virtualisation.libvirtd.enable = true;
# programs.virt-manager.enable = true;
# User account
users.users.numbus-admin = {
isNormalUser = true;
description = "Numbus Admin";
extraGroups = [ "networkmanager" "wheel" ];
extraGroups = [ "wheel" ];
uid = 1000;
initialPassword = "changeMe!";
};
templates/nix-config/misc/networking.nix
+23 -16
View File
@@ -4,34 +4,41 @@
# Hostname
networking.hostName = "numbus-server";
# Enable networking and firewall
networking.interfaces.eth0.ipv4.addresses = [
{
address = "HOME_SERVER_IP";
prefixLength = 24;
}
];
networking.defaultGateway = "HOME_ROUTER_IP";
networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ];
networking.networkmanager.enable = true;
networking.wireless.enable = false;
networking.networkmanager.enable = false;
networking.nftables.enable = true;
networking.firewall.enable = true;
# Bridge configuration for VMs
networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ];
networking.interfaces.br0.useDHCP = false;
networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ];
networking.interfaces.br0.ipv4.addresses = [{
address = "HOME_SERVER_IP";
prefixLength = 24;
}];
networking.defaultGateway = {
address = "HOME_ROUTER_IP";
interface = "br0";
};
networking.nftables.tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
tcp dport 80 redirect to :8080
tcp dport 443 redirect to :8443
tcp dport 53 redirect to :5353
udp dport 53 redirect to :5353
iifname "br0" tcp dport 80 redirect to :8080
iifname "br0" tcp dport 443 redirect to :8443
iifname "br0" tcp dport 53 redirect to :5353
iifname "br0" udp dport 53 redirect to :5353
iifname "br0" udp dport 67 redirect to :6767
}
'';
};
# Open ports in the firewall
networking.firewall.allowPing = true;
networking.firewall.allowedTCPPorts = [ 53 80 443 ];
networking.firewall.allowedUDPPorts = [ 53 ];
networking.firewall.allowedTCPPorts = [ 5353 8080 8443 ];
networking.firewall.allowedUDPPorts = [ 5353 6767 ];
}