diff options
Diffstat (limited to 'makefu/2configs')
| -rw-r--r-- | makefu/2configs/home-manager/zsh.nix | 25 | ||||
| -rw-r--r-- | makefu/2configs/wireguard/wiregrill.nix | 45 |
2 files changed, 57 insertions, 13 deletions
diff --git a/makefu/2configs/home-manager/zsh.nix b/makefu/2configs/home-manager/zsh.nix index 13755de27..c875d52c8 100644 --- a/makefu/2configs/home-manager/zsh.nix +++ b/makefu/2configs/home-manager/zsh.nix @@ -61,6 +61,8 @@ direnv allow size = 900001; save = 900001; ignoreDups = true; + ignoreSpace = true; + extended = true; share = true; }; @@ -77,31 +79,32 @@ direnv allow xo = "mimeopen"; nmap = "nmap -oN $HOME/loot/scan-`date +\%s`.nmap -oX $HOME/loot/scan-`date +%s`.xml"; }; - # navi package does not come with the navi.plugin.zsh anymore so we use .src + #zplug = { + # enable = true; + # plugins = [ + # { name = "denisidoro/navi" ; } + # { name = "zsh-users/zsh-autosuggestions" ; } + # ]; + #}; initExtra = '' bindkey -e + zle -N edit-command-line + # ctrl-x ctrl-e + bindkey '^xe' edit-command-line + bindkey '^x^e' edit-command-line # shift-tab bindkey '^[[Z' reverse-menu-complete bindkey "\e[3~" delete-char zstyle ':completion:*' menu select setopt HIST_IGNORE_ALL_DUPS - setopt HIST_IGNORE_SPACE setopt HIST_FIND_NO_DUPS compdef _pass brain zstyle ':completion::complete:brain::' prefix "$HOME/brain" + compdef _pass secrets zstyle ':completion::complete:secrets::' prefix "$HOME/.secrets-pass/" - - # navi - . ${pkgs.navi.src}/shell/navi.plugin.zsh - # ctrl-x ctrl-e - autoload -U compinit && compinit - autoload -U edit-command-line - zle -N edit-command-line - bindkey '^xe' edit-command-line - bindkey '^x^e' edit-command-line ''; }; }; diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix index 082090755..070f01e10 100644 --- a/makefu/2configs/wireguard/wiregrill.nix +++ b/makefu/2configs/wireguard/wiregrill.nix @@ -13,16 +13,57 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { boot.kernel.sysctl = mkIf isRouter { "net.ipv6.conf.all.forwarding" = 1; + "net.ipv4.conf.all.forwarding" = 1; + }; + networking.nat = mkIf isRouter { + enable = true; + enableIPv6 = true; + externalInterface = ext-if; + internalInterfaces = [ "wiregrill" ]; }; networking.firewall = { allowedUDPPorts = [ self.wireguard.port ]; - extraCommands = '' - iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT + interfaces.wiregrill = mkIf isRouter { + allowedUDPPorts = [ 53 ]; + allowedTCPPorts = [ 53 ]; + }; + }; + + services.dnsmasq = mkIf isRouter { + enable = true; + resolveLocalQueries = false; + extraConfig = /* dnsmasq */ '' + bind-interfaces + interface=retiolum,wiregrill ''; + servers = [ "1.1.1.1" ]; }; networking.wireguard.interfaces.wiregrill = { + postSetup = optionalString isRouter '' + ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE + ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -i retiolum -o wiregrill -j ACCEPT + + ${pkgs.iptables}/bin/ip6tables -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -A FORWARD -i retiolum -o wiregrill -j ACCEPT + ''; + + # This undoes the above command + postShutdown = optionalString isRouter '' + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE + ${pkgs.iptables}/bin/iptables -D FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/iptables -D FORWARD -i retiolum -o wiregrill -j ACCEPT + + ${pkgs.iptables}/bin/ip6tables -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -D FORWARD -i retiolum -o wiregrill -j ACCEPT + '' ; ips = (optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip6) self.ip6.addr); |