bump & vpn

12 files changed, 424 insertions, 30 deletions

diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 257743fd..f51535ea 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -140,12 +140,6 @@ in {
       '';
     };
 
-    environment.etc."systemd/networkd.conf" = {
-      text = ''
-        [Network]
-        RouteTable=wgrz:1025
-      '';
-    };
     systemd.network = {
       netdevs = {
         wgrz = {
@@ -234,6 +228,7 @@ in {
           };
         };
       };
+      config.routeTables.wgrz = 1025;
     };
     sops.secrets.wgrz = {
       format = "binary";
diff --git a/hosts/surtr/bifrost/default.nix b/hosts/surtr/bifrost/default.nix
index 8f1e602d..790af94a 100644
--- a/hosts/surtr/bifrost/default.nix
+++ b/hosts/surtr/bifrost/default.nix
@@ -56,11 +56,5 @@ in {
       owner = "root";
       group = "systemd-network";
     };
-    environment.etc."systemd/networkd.conf" = {
-      text = ''
-        [Network]
-        RouteTable=bifrost:1026
-      '';
-    };
   };
 }
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index 87dd27b0..2be25560 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -2,7 +2,7 @@
 {
   imports = with flake.nixosModules.systemProfiles; [
     qemu-guest openssh rebuild-machines zfs
-    ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql.nix ./prometheus ./email
+    ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql.nix ./prometheus ./email ./vpn
   ];
 
   config = {
@@ -57,6 +57,7 @@
           { address = "202.61.241.61"; prefixLength = 22; }
         ];
         ipv6.addresses = [
+          { address = "2a03:4000:52:ada:98e7:16ff:feba:7a2e"; prefixLength = 128; }
           { address = "2a03:4000:52:ada::"; prefixLength = 96; }
         ];
       };
@@ -68,11 +69,15 @@
       };
     };
 
-    systemd.network.networks."40-ens3".networkConfig = {
-      Domains = lib.mkForce "~.";
-      DNS = [ "127.0.0.1:5353" "[::1]:5353" ];
-      # DNSSEC = true;
-      # DNS = [ "46.38.225.230" "46.38.252.230" "2a03:4000:0:1::e1e6" "2a03:4000:8000::fce6" ];
+    systemd.network = {
+      networks = {
+        "40-ens3".networkConfig = {
+          Domains = lib.mkForce "~.";
+          DNS = [ "127.0.0.1:5353" "[::1]:5353" ];
+          # DNSSEC = true;
+          # DNS = [ "46.38.225.230" "46.38.252.230" "2a03:4000:0:1::e1e6" "2a03:4000:8000::fce6" ];
+        };
+      };
     };
 
     services.resolved = {
@@ -85,8 +90,13 @@
       proxies = {
         ens3 = {
           router = false;
-          rules."2a03:4000:52:ada::/64" = {
-            method = "static";
+          rules = {
+            "2a03:4000:20:259::/64" = {
+              method = "static";
+            };
+            "2a03:4000:52:ada::/64" = {
+              method = "static";
+            };
           };
         };
       };
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index 889e78b2..1a4e4656 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022050505 ; serial
+  2022072800 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -43,6 +43,9 @@ surtr			IN	AAAA	2a03:4000:52:ada::
 surtr                   IN      MX      0 surtr.yggdrasil.li
 surtr                   IN      TXT     "v=spf1 a:surtr.yggdrasil.li -all"
 
+vpn                     IN      A       185.243.10.86
+vpn                     IN      AAAA    2a03:4000:20:259::
+
 surtr._domainkey.surtr  IN      CNAME   surtr._domainkey.yggdrasil.li.
 _dmarc.surtr            IN      TXT     "v=DMARC1;p=reject;sp=reject;pct=100;adkim=s;aspf=s;rua=mailto:postmaster@yggdrasil.li;ruf=mailto:postmaster@yggdrasil.li"
 
diff --git a/hosts/surtr/http/webdav/default.nix b/hosts/surtr/http/webdav/default.nix
index f0aec1e9..5f2955bc 100644
--- a/hosts/surtr/http/webdav/default.nix
+++ b/hosts/surtr/http/webdav/default.nix
@@ -1,4 +1,7 @@
-{ config, libs, pkgs, flakeInputs, ... }:
+{ config, lib, pkgs, flakeInputs, ... }:
+
+with lib;
+
 let
   webdavSocket = config.services.uwsgi.runDir + "/webdav.sock";
 
@@ -10,9 +13,10 @@ let
     python = "python3";
     requirements = ''
       PyNaCl ==1.5.*
-      psycopg ==3.0.*
       WsgiDAV ==4.0.*
     '';
+    # psycopg >=3.0.15,<3.1
+    # _.psycopg.patches = [];
   };
 in {
   config = {
diff --git a/hosts/surtr/http/webdav/py-webdav/setup.py b/hosts/surtr/http/webdav/py-webdav/setup.py
index dbe345c1..d59c2548 100644
--- a/hosts/surtr/http/webdav/py-webdav/setup.py
+++ b/hosts/surtr/http/webdav/py-webdav/setup.py
@@ -11,7 +11,7 @@ setuptools.setup(
     python_requires=">=3.8",
     install_requires=[
         "PyNaCl ==1.5.*",
-        "psycopg ==3.0.*",
+        # "psycopg ==3.0.*",
         "WsgiDAV ==4.0.*",
     ],
 )
diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
new file mode 100644
index 00000000..4f334105
--- /dev/null
+++ b/hosts/surtr/vpn/default.nix
@@ -0,0 +1,177 @@
+{ pkgs, config, lib, ... }:
+
+with lib;
+
+let
+  trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str;
+  prefix4 = "10.84.47";
+  prefix6 = "2a03:4000:52:ada:5";
+in {
+  config = {
+    boot.kernel.sysctl = {
+      "net.netfilter.nf_log_all_netns" = true;
+    };
+    
+    networking.namespaces = {
+      enable = true;
+      containers."vpn".config = {
+        boot.kernel.sysctl = {
+          "net.core.rmem_max" = "4194304";
+          "net.core.wmem_max" = "4194304";
+        };
+
+        environment = {
+          noXlibs = true;
+          systemPackages = with pkgs; [ wireguard-tools ];
+        };
+
+        networking = {
+          useDHCP = false;
+          useNetworkd = true;
+          useHostResolvConf = false;
+          firewall.enable = false;
+          nftables = {
+            enable = true;
+            rulesetFile = ./ruleset.nft;
+          };
+        };
+
+        services.resolved.fallbackDns = [
+          "9.9.9.9#dns.quad9.net"
+          "149.112.112.112#dns.quad9.net"
+          "2620:fe::fe#dns.quad9.net"
+          "2620:fe::9#dns.quad9.net"
+        ];
+
+        systemd.tmpfiles.rules = [
+          "d /etc/wireguard 0755 root systemd-network - -"
+          "C /etc/wireguard/surtr.priv 0640 root systemd-network - /run/host/credentials/surtr.priv"
+        ];
+
+        systemd.network = {
+          netdevs = {
+            vpn = {
+              netdevConfig = {
+                Name = "vpn";
+                Kind = "wireguard";
+              };
+              wireguardConfig = {
+                PrivateKeyFile = "/etc/wireguard/surtr.priv";
+                ListenPort = 51820;
+              };
+              wireguardPeers = [
+                { wireguardPeerConfig = {
+                    AllowedIPs = ["${prefix6}:1::/96" "${prefix4}.1/32"];
+                    PublicKey = trim (readFile ./geri.pub);
+                  };
+                }
+              ];
+            };
+          };
+
+          networks = {
+            upstream = {
+              name = "upstream";
+              matchConfig = {
+                Name = "upstream";
+              };
+              linkConfig = {
+                RequiredForOnline = true;
+              };
+              networkConfig = {
+                Address = [ "185.243.10.86/32" "2a03:4000:20:259::/64" ];
+                LLMNR = false;
+                MulticastDNS = false;
+              };
+              routes = [
+                { routeConfig = {
+                    Destination = "202.61.240.0/22";
+                  };
+                }
+                { routeConfig = {
+                    Destination = "0.0.0.0/0";
+                    Gateway = "202.61.240.1";
+                  };
+                }
+                { routeConfig = {
+                    Destination = "::/0";
+                    Gateway = "fe80::1";
+                  };
+                }
+              ];
+              extraConfig = ''
+                [Neighbor]
+                Address=202.61.240.1
+                LinkLayerAddress=00:00:5e:00:01:01
+              '';
+            };
+            vpn = {
+              name = "vpn";
+              matchConfig = {
+                Name = "vpn";
+              };
+              address = ["${prefix6}::/96" "${prefix4}.0/32"];
+              routes = [
+                { routeConfig = {
+                    Destination = "${prefix6}::/80";
+                  };
+                }
+                { routeConfig = {
+                    Destination = "${prefix4}.0/24";
+                  };
+                }
+              ];
+              linkConfig = {
+                RequiredForOnline = false;
+              };
+              networkConfig = {
+                LLMNR = false;
+                MulticastDNS = false;
+              };
+            };
+          };
+        };
+      };
+    };
+
+    systemd.services = {
+      "vpn-upstream" = {
+        bindsTo = ["netns@vpn.service"];
+        after = ["netns@vpn.service"];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStop = "${pkgs.iproute}/bin/ip netns exec vpn ip link delete upstream";
+        };
+        path = with pkgs; [ iproute procps ];
+        script = ''
+          ip netns exec vpn sysctl \
+            net.ipv6.conf.all.forwarding=1 \
+            net.ipv6.conf.default.forwarding=1 \
+            net.ipv4.conf.all.forwarding=1 \
+            net.ipv4.conf.default.forwarding=1
+
+          ip link add link ens3 name upstream type ipvlan mode l2
+          ip link set upstream netns vpn
+        '';
+      };
+
+      "netns-container@vpn" = {
+        wantedBy = ["multi-user.target" "network-online.target"];
+        after = ["vpn-upstream.service"];
+        bindsTo = ["vpn-upstream.service"];
+
+        serviceConfig = {
+          LoadCredential = [
+            "surtr.priv:${config.sops.secrets.vpn.path}"
+          ];
+        };
+      };
+    };
+
+    sops.secrets.vpn = {
+      format = "binary";
+      sopsFile = ./surtr.priv;
+    };
+  };
+}
diff --git a/hosts/surtr/vpn/geri.pub b/hosts/surtr/vpn/geri.pub
new file mode 100644
index 00000000..ed5de2b2
--- /dev/null
+++ b/hosts/surtr/vpn/geri.pub
@@ -0,0 +1 @@
+sYuQSNZHzfegv8HRz71jnZm2nFLGeRnaGwVonhKUj2k=
diff --git a/hosts/surtr/vpn/ruleset.nft b/hosts/surtr/vpn/ruleset.nft
new file mode 100644
index 00000000..3cdb7a8a
--- /dev/null
+++ b/hosts/surtr/vpn/ruleset.nft
@@ -0,0 +1,189 @@
+define icmp_protos = {ipv6-icmp, icmp, igmp}
+
+table arp filter {
+  limit lim_arp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+
+  counter arp-rx {}
+  counter arp-tx {}
+
+  counter arp-ratelimit-rx {}
+  counter arp-ratelimit-tx {}
+
+  chain input {
+    type filter hook input priority filter
+    policy accept
+
+    limit name lim_arp counter name arp-ratelimit-rx drop
+
+    counter name arp-rx
+  }
+
+  chain output {
+    type filter hook output priority filter
+    policy accept
+
+    limit name lim_arp counter name arp-ratelimit-tx drop
+
+    counter name arp-tx
+  }
+}
+
+table inet filter {
+  limit lim_reject {
+    rate over 1000/second burst 1000 packets
+  }
+
+  limit lim_icmp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+
+  counter invalid-fw {}
+  counter fw-lo {}
+  counter fw-vpn {}
+  counter fw-upstream {}
+
+  counter icmp-ratelimit-upstream-fw {}
+  counter icmp-ratelimit-vpn-fw {}
+  counter icmp-ratelimit-established-fw {}
+
+  counter icmp-upstream-fw {}
+  counter icmp-vpn-fw {}
+  counter icmp-established-fw {}
+
+  counter reject-ratelimit-fw {}
+  counter reject-fw {}
+  counter reject-tcp-fw {}
+  counter reject-icmp-fw {}
+
+  counter drop-fw {}
+
+  counter invalid-rx {}
+
+  counter rx-lo {}
+  counter invalid-local4-rx {}
+  counter invalid-local6-rx {}
+
+  counter icmp-ratelimit-rx {}
+  counter icmp-rx {}
+
+  counter wg-rx {}
+
+  counter established-rx {}
+
+  counter reject-ratelimit-rx {}
+  counter reject-rx {}
+  counter reject-tcp-rx {}
+  counter reject-icmp-rx {}
+
+  counter drop-rx {}
+
+  counter tx-lo {}
+
+  counter icmp-ratelimit-tx {}
+  counter icmp-tx {}
+
+  counter wg-tx {}
+
+  counter tx {}
+
+  chain forward {
+    type filter hook forward priority filter
+    policy drop
+
+
+    ct state invalid log level debug prefix "vpn: drop invalid forward: " counter name invalid-fw drop
+
+
+    iifname lo counter name fw-lo accept
+
+    meta l4proto $icmp_protos iifname upstream limit name lim_icmp counter name icmp-ratelimit-upstream-fw drop
+    meta l4proto $icmp_protos iifname upstream counter name icmp-upstream-fw accept
+    meta l4proto $icmp_protos iifname vpn limit name lim_icmp counter name icmp-ratelimit-vpn-fw drop
+    meta l4proto $icmp_protos iifname vpn counter name icmp-vpn-fw accept
+    meta l4proto $icmp_protos ct state {established, related} limit name lim_icmp counter name icmp-ratelimit-established-fw drop
+    meta l4proto $icmp_protos ct state {established, related} counter name icmp-established-fw accept
+
+
+    iifname upstream oifname vpn ct state {established, related} counter name fw-vpn accept
+    iifname vpn oifname upstream counter name fw-upstream accept
+
+
+    limit name lim_reject log level debug prefix "vpn: drop forward: " counter name reject-ratelimit-fw drop
+    log level debug prefix "vpn: reject forward: " counter name reject-fw
+    meta l4proto tcp ct state new counter name reject-tcp-fw reject with tcp reset
+    ct state new counter name reject-icmp-fw reject
+
+
+    counter name drop-fw
+  }
+
+  chain input {
+    type filter hook input priority filter
+    policy drop
+
+
+    ct state invalid log level debug prefix "vpn: drop invalid input: " counter name invalid-rx drop
+    
+
+    iifname lo counter name rx-lo accept
+    iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
+    iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
+
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-rx drop
+    meta l4proto $icmp_protos counter name icmp-rx accept
+
+    udp dport 51820 counter name wg-rx accept
+
+    ct state {established, related} counter name established-rx accept
+
+
+    limit name lim_reject log level debug prefix "vpn: drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "vpn: reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+
+
+    counter name drop-rx
+  }
+
+  chain output {
+    type filter hook output priority filter
+    policy accept
+
+
+    oifname lo counter name tx-lo accept
+
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-tx drop
+    meta l4proto $icmp_protos counter name icmp-tx accept
+
+
+    udp sport 51820 counter name wg-tx
+    
+
+    counter name tx
+  }
+}
+
+table inet nat {
+  counter nat {}
+  
+  chain postrouting {
+    type nat hook postrouting priority srcnat
+    policy accept
+
+    iifname vpn counter name nat masquerade
+  }
+}
+
+table ip mss_clamp {
+  counter mss-clamp {}
+
+  chain postrouting {
+    type filter hook postrouting priority mangle
+    policy accept
+
+    iifname vpn oifname upstream tcp flags & (syn|rst) == syn counter name mss-clamp tcp option maxseg size set rt mtu
+  }
+}
\ No newline at end of file
diff --git a/hosts/surtr/vpn/surtr.priv b/hosts/surtr/vpn/surtr.priv
new file mode 100644
index 00000000..707287f5
--- /dev/null
+++ b/hosts/surtr/vpn/surtr.priv
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:dhGFzsKjzYTfFwxrcCGTVPKQoy12RDLfIqdBcxO7/aib90w/yfTWBQP2zNRa,iv:71HbOJRbpzLxYWztxzvM/qJNLdJQckaZVDOIAl5UKjI=,tag:JjF2zr78zjI7RPXqQaHmyg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-07-28T19:09:57Z",
+                "mac": "ENC[AES256_GCM,data:Q2179Mp3h/FXVzM1T5sRfci+mo/gCGfUm5824GBTbCzwIsTMjSpPz/wByg0WQJ/WB3wnns+VfCh+epqnKcP73KKUmNysGNJ9DH1hNukmTWMZEI309yLE/GgDs76xGyt9hXdHClq30qhKT17bXQ7Pq08c437vfSwSCcKoKOcr6Ls=,iv:u81NRHwKSKb7Nfz2gC1tjdYlfrFETjF/gEMGAha4Y7g=,tag:zdxYtbiKtY46MGP/nO8S5w==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-07-28T19:09:57Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAa7ohlS2wGvuH11I4GvYZQmKbQVZUcwpV1XX6YMvLQV0w\n8fMshflTFWUnmHAR5ERg6ZpESFiAXAlkUMTLIZBhDTAN92jCu7+nnNFK1QgBVE07\n0lwBilABJT++m953o6ic4h/9yeyx5Wc6+XxS3d1Mc4qgNBzX/TBVEoKmuUgkHwET\nd0nftLYbKmICgCBgDgllWJLSOU4XSksmYIeMwiSpyNzv8oKz8u73SZz20rJ9kQ==\n=phWI\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        },
+                        {
+                                "created_at": "2022-07-28T19:09:57Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAV4pW8CJP/QP0S/w5e7S/Xrox+Ix/NBvw2N2fWp+5FwAw\nATp3d/QGyk+vwuQpQj3zq/cEzrWrrq19Gl+UUjSyI2rkpUnxWboA2xICYVkb91Oz\n0lwBLu54X/3X5Nd2krPv+Qa7AWPBKF6BkE2PIjjrvPgyJ4/XiFzawJsILH37QPqs\n7PcrteF15UNR416omVNZoWpF3Tq/j4Jw+ewRhU9WjOXe2GO8/X9zjTD9fRrpIQ==\n=YtV+\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.3"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/vpn/surtr.pub b/hosts/surtr/vpn/surtr.pub
new file mode 100644
index 00000000..48edc8fc
--- /dev/null
+++ b/hosts/surtr/vpn/surtr.pub
@@ -0,0 +1 @@
+99nWsdE/KJHfOZjmG5suUQSfIj6UBuxS5+zOL+ynYmU=
diff --git a/hosts/vidhar/network/bifrost/default.nix b/hosts/vidhar/network/bifrost/default.nix
index ec78e6d9..752e3e3c 100644
--- a/hosts/vidhar/network/bifrost/default.nix
+++ b/hosts/vidhar/network/bifrost/default.nix
@@ -72,11 +72,5 @@ in {
       owner = "root";
       group = "systemd-network";
     };
-    environment.etc."systemd/networkd.conf" = {
-      text = ''
-        [Network]
-        RouteTable=bifrost:1026
-      '';
-    };
   };
 }