numbus/numbus-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Networking updates. Postrun debugging info.

Browse Source
This commit is contained in:
Raphaël Numbus
2026-02-16 15:23:57 +01:00
parent e5503a3ef3
commit dcdb29d952
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy.sh
+4
View File
@@ -930,15 +930,19 @@ postrun_action() {
echo "Enrolling boot disk key to TPM..." echo "Enrolling boot disk key to TPM..."
BOOT_DISKS_ID=(${BOOT_DISKS_ID[@]}) BOOT_DISKS_ID=(${BOOT_DISKS_ID[@]})
DEBUG=${DEBUG}
DISK_PATH="" DISK_PATH=""
j=1 j=1
for i in \${!BOOT_DISKS_ID[@]}; do for i in \${!BOOT_DISKS_ID[@]}; do
if echo "\${BOOT_DISKS_ID[\${i}]}" | grep -iq "nvme"; then if echo "\${BOOT_DISKS_ID[\${i}]}" | grep -iq "nvme"; then
[[ "\${DEBUG}" == "true" ]] && echo "NVMe detected..."
DISK_PATH="/dev/\${BOOT_DISKS_ID[\${i}]}p2" DISK_PATH="/dev/\${BOOT_DISKS_ID[\${i}]}p2"
else else
[[ "\${DEBUG}" == "true" ]] && echo "Non-NVMe drive detected..."
DISK_PATH="/dev/\${BOOT_DISKS_ID[\${i}]}2" DISK_PATH="/dev/\${BOOT_DISKS_ID[\${i}]}2"
fi fi
[[ "\${DEBUG}" == "true" ]] && echo "Issuing enroll command for disk \${DISK_PATH}..."
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-\${j} \${DISK_PATH} echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-\${j} \${DISK_PATH}
j=\$((j + 1)) j=\$((j + 1))
done done
templates/nix-config/configuration.nix
+1 -1
View File
@@ -172,5 +172,5 @@
# Enable auto nix-store optimization # Enable auto nix-store optimization
nix.settings.auto-optimise-store = true; nix.settings.auto-optimise-store = true;
system.stateVersion = "25.05"; system.stateVersion = "25.11";
} }
templates/nix-config/misc/networking.nix
+4 -3
View File
@@ -6,14 +6,12 @@
networking.networkmanager.enable = false; networking.networkmanager.enable = false;
networking.nftables.enable = true;
networking.firewall.enable = true;
# Allow rootless containers to bind to port 53 and up # Allow rootless containers to bind to port 53 and up
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53; boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;
# Bridge configuration for VMs # Bridge configuration for VMs
networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ]; networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ];
networking.interfaces."TARGET_INTERFACE".useDHCP = false;
networking.interfaces.br0.useDHCP = false; networking.interfaces.br0.useDHCP = false;
networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ]; networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ];
networking.interfaces.br0.ipv4.addresses = [{ networking.interfaces.br0.ipv4.addresses = [{
@@ -25,8 +23,11 @@
interface = "br0"; interface = "br0";
}; };
networking.nftables.enable = true;
# Open ports in the firewall # Open ports in the firewall
networking.firewall = { networking.firewall = {
enable = true;
allowPing = true; allowPing = true;
allowedTCPPorts = [ 53 80 443 ]; allowedTCPPorts = [ 53 80 443 ];
allowedUDPPorts = [ 53 443 ]; allowedUDPPorts = [ 53 443 ];