From 2a45b6837ea381c893d0ebde2f8cce2897331c35 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sat, 24 May 2025 20:26:52 +0200 Subject: kimai --- hosts/vidhar/kimai/default.nix | 89 ++++++++++++++++++++++++ hosts/vidhar/kimai/ruleset.nft | 149 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 238 insertions(+) create mode 100644 hosts/vidhar/kimai/default.nix create mode 100644 hosts/vidhar/kimai/ruleset.nft (limited to 'hosts/vidhar/kimai') diff --git a/hosts/vidhar/kimai/default.nix b/hosts/vidhar/kimai/default.nix new file mode 100644 index 00000000..0258697b --- /dev/null +++ b/hosts/vidhar/kimai/default.nix @@ -0,0 +1,89 @@ +{ flake, config, ... }: + +{ + config = { + boot.enableContainers = true; + boot.kernel.sysctl = { + "net.netfilter.nf_log_all_netns" = true; + }; + + containers."kimai" = { + autoStart = true; + ephemeral = true; + bindMounts = { + "/var/lib/kimai" = { + hostPath = "/var/lib/kimai/state"; + isReadOnly = false; + }; + "/var/lib/mysql" = { + hostPath = "/var/lib/kimai/mysql"; + isReadOnly = false; + }; + }; + privateNetwork = true; + # forwardPorts = [ + # { containerPort = 80; + # hostPort = 28983; + # } + # ]; + hostAddress = "192.168.52.113"; + localAddress = "192.168.52.114"; + hostAddress6 = "2a03:4000:52:ada:6::1"; + localAddress6 = "2a03:4000:52:ada:6::2"; + config = let hostConfig = config; in { config, pkgs, lib, ... }: { + system.stateVersion = lib.mkIf hostConfig.containers."kimai".ephemeral config.system.nixos.release; + system.configurationRevision = lib.mkIf (flake ? rev) flake.rev; + nixpkgs.pkgs = hostConfig.nixpkgs.pkgs; + + services.kimai.sites."kimai.yggdrasil.li" = { + database.socket = "/run/mysqld/mysqld.sock"; + }; + + networking = { + useDHCP = false; + useNetworkd = true; + useHostResolvConf = false; + firewall.enable = false; + nftables = { + enable = true; + rulesetFile = ./ruleset.nft; + }; + }; + + services.resolved.fallbackDns = [ + "9.9.9.10#dns10.quad9.net" + "149.112.112.10#dns10.quad9.net" + "2620:fe::10#dns10.quad9.net" + "2620:fe::fe:10#dns10.quad9.net" + ]; + + systemd.network = { + networks.upstream = { + name = "eth0"; + matchConfig = { + Name = "eth0"; + }; + linkConfig = { + RequiredForOnline = true; + }; + networkConfig = { + Address = [ "192.168.52.114/32" "2a03:4000:52:ada:6::2/128" ]; + LLMNR = false; + MulticastDNS = false; + }; + routes = [ + { Destination = "192.168.52.113/32"; } + { Destination = "2a03:4000:52:ada:6::1/128"; } + { Destination = "0.0.0.0/0"; + Gateway = "192.168.52.113"; + } + { Destination = "::/0"; + Gateway = "2a03:4000:52:ada:6::1"; + } + ]; + }; + }; + }; + }; + }; +} diff --git a/hosts/vidhar/kimai/ruleset.nft b/hosts/vidhar/kimai/ruleset.nft new file mode 100644 index 00000000..ad4db6d5 --- /dev/null +++ b/hosts/vidhar/kimai/ruleset.nft @@ -0,0 +1,149 @@ +define icmp_protos = {ipv6-icmp, icmp, igmp} + +table arp filter { + limit lim_arp { + rate over 50 mbytes/second burst 50 mbytes + } + + counter arp-rx {} + counter arp-tx {} + + counter arp-ratelimit-rx {} + counter arp-ratelimit-tx {} + + chain input { + type filter hook input priority filter + policy accept + + limit name lim_arp counter name arp-ratelimit-rx drop + + counter name arp-rx + } + + chain output { + type filter hook output priority filter + policy accept + + limit name lim_arp counter name arp-ratelimit-tx drop + + counter name arp-tx + } +} + +table inet filter { + limit lim_reject { + rate over 1000/second burst 1000 packets + } + + limit lim_icmp { + rate over 50 mbytes/second burst 50 mbytes + } + + counter invalid-fw {} + counter fw-lo {} + + counter reject-ratelimit-fw {} + counter reject-fw {} + counter reject-tcp-fw {} + counter reject-icmp-fw {} + + counter drop-fw {} + + counter invalid-rx {} + + counter rx-lo {} + counter invalid-local4-rx {} + counter invalid-local6-rx {} + + counter icmp-ratelimit-rx {} + counter icmp-rx {} + + counter kimai-rx {} + + counter established-rx {} + + counter reject-ratelimit-rx {} + counter reject-rx {} + counter reject-tcp-rx {} + counter reject-icmp-rx {} + + counter drop-rx {} + + counter tx-lo {} + + counter icmp-ratelimit-tx {} + counter icmp-tx {} + + counter kimai-tx {} + + counter tx {} + + chain forward { + type filter hook forward priority filter + policy drop + + + ct state invalid log level debug prefix "kimai: drop invalid forward: " counter name invalid-fw drop + + + iifname lo counter name fw-lo accept + + + limit name lim_reject log level debug prefix "kimai: drop forward: " counter name reject-ratelimit-fw drop + log level debug prefix "kimai: reject forward: " counter name reject-fw + meta l4proto tcp ct state new counter name reject-tcp-fw reject with tcp reset + ct state new counter name reject-icmp-fw reject + + + counter name drop-fw + } + + chain input { + type filter hook input priority filter + policy drop + + + ct state invalid log level debug prefix "kimai: drop invalid input: " counter name invalid-rx drop + + + iifname lo counter name rx-lo accept + iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject + iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject + + + meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-rx drop + meta l4proto $icmp_protos counter name icmp-rx accept + + + tcp dport 80 counter name kimai-rx accept + + + ct state { established, related } counter name established-rx accept + + + limit name lim_reject log level debug prefix "kimai: drop input: " counter name reject-ratelimit-rx drop + log level debug prefix "kimai: reject input: " counter name reject-rx + meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset + ct state new counter name reject-icmp-rx reject + + + counter name drop-rx + } + + chain output { + type filter hook output priority filter + policy accept + + + oifname lo counter name tx-lo accept + + meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-tx drop + meta l4proto $icmp_protos counter name icmp-tx accept + + + tcp sport 80 counter name kimai-tx + + + counter name tx + } +} -- cgit v1.2.3