mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
e5b95affa6
Hosts used to trust the router as the only boundary (servers ran with the firewall off; service ports were opened globally), so any LAN device could reach every host service. Move filtering to the hosts as defence in depth behind the router, which keeps its firewall on and uses a port mapping for the few ports we actually need. - base: nftables backend; deny inbound by default; trust the home LAN by source and the tailnet by interface (restrict the tailnet with ACLs); suppress per-service `openFirewall` global ports; allow node_exporter only from the monitoring host. The local podman bridge, the tailnet and the pod CIDRs are accepted only after the node_exporter drop. - servers: stop disabling the firewall; drop redundant global port opens (caddy 80/443, NFS 2049, Jellyfin, localsend/test ports); delete the redundant desktop firewall module; aarch64/riscv64 import the firewall explicitly (akane was missing it). - k3s: Cilium pods (10.0.0.0/8, fd00::/8) may reach host services; drop the flannel-era cni0/flannel.1 trust. - youko: postgres listens on localhost + the LAN with pg_hba limited to the LAN; the NFS export stays LAN-scoped; remove the unauthenticated v2ray proxy. - tests: `security-firewall` asserts every host runs the shared firewall, has the LAN CIDR rule and no global ports.
Variables
Common variables and configuration used across my NixOS and nix-darwin configurations.
Current Structure
vars/
├── README.md
├── default.nix # Main variables entry point
└── networking.nix # Network configuration and host definitions
Components
1. default.nix
Contains user information, SSH keys, and password configuration:
- User credentials (username, full name, email)
- Initial hashed password for new installations
- SSH authorized keys (main and backup sets)
- Public key references for system access
2. networking.nix
Comprehensive network configuration including:
- Gateway settings: Main router and proxy gateway configurations
- DNS servers: IPv4 and IPv6 name servers
- Host inventory: Complete mapping of all hosts with their network interfaces and IP addresses
- SSH configuration: Remote builder aliases and known hosts configuration
- Network topology: Physical machines, VMs, Kubernetes clusters, and SBCs
Host Categories
The networking configuration covers:
- Physical machines: Desktop PCs, Apple Silicon systems, SBCs
- Virtual machines: VM guests, K3s nodes
- Kubernetes clusters: the
k3s-test-1testing cluster - Network infrastructure: Routers, gateways, and DNS configuration
Usage
These variables are imported and used throughout the configuration to ensure consistency across all hosts and maintain centralized network and security settings.