Initialize project structure with basic configuration files and main function
This commit is contained in:
commit
e5ccdbfb75
GPG key ID:
087F0A95E5766D72
10 changed files with 656 additions and 0 deletions
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
/target
|
||||||
8
.idea/.gitignore
generated
vendored
Normal file
8
.idea/.gitignore
generated
vendored
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Default ignored files
|
||||||
|
/shelf/
|
||||||
|
/workspace.xml
|
||||||
|
# Editor-based HTTP Client requests
|
||||||
|
/httpRequests/
|
||||||
|
# Datasource local storage ignored files
|
||||||
|
/dataSources/
|
||||||
|
/dataSources.local.xml
|
||||||
14
.idea/discord.xml
generated
Normal file
14
.idea/discord.xml
generated
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<project version="4">
|
||||||
|
<component name="DiscordProjectSettings">
|
||||||
|
<option name="show" value="ASK" />
|
||||||
|
<option name="description" value="" />
|
||||||
|
<option name="applicationTheme" value="default" />
|
||||||
|
<option name="iconsTheme" value="default" />
|
||||||
|
<option name="button1Title" value="" />
|
||||||
|
<option name="button1Url" value="" />
|
||||||
|
<option name="button2Title" value="" />
|
||||||
|
<option name="button2Url" value="" />
|
||||||
|
<option name="customApplicationId" value="" />
|
||||||
|
</component>
|
||||||
|
</project>
|
||||||
7
Cargo.lock
generated
Normal file
7
Cargo.lock
generated
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
# This file is automatically @generated by Cargo.
|
||||||
|
# It is not intended for manual editing.
|
||||||
|
version = 4
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "the-prg-server-structure"
|
||||||
|
version = "0.1.0"
|
||||||
6
Cargo.toml
Normal file
6
Cargo.toml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
[package]
|
||||||
|
name = "the-prg-server-structure"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition = "2024"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
1
nix-system-configs/new-server-notes.md
Normal file
1
nix-system-configs/new-server-notes.md
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
#
|
||||||
388
nix-system-configs/nixos-gateway.nix
Normal file
388
nix-system-configs/nixos-gateway.nix
Normal file
|
|
@ -0,0 +1,388 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [./hardware-configuration.nix];
|
||||||
|
|
||||||
|
### Lix Package Manager ###
|
||||||
|
nixpkgs.overlays = [
|
||||||
|
(final: prev: {
|
||||||
|
inherit
|
||||||
|
(prev.lixPackageSets.stable)
|
||||||
|
nixpkgs-review
|
||||||
|
nix-eval-jobs
|
||||||
|
nix-fast-build
|
||||||
|
colmena
|
||||||
|
;
|
||||||
|
})
|
||||||
|
];
|
||||||
|
|
||||||
|
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||||
|
|
||||||
|
### Network Configuration ###
|
||||||
|
networking.hostName = "prg-lan-gateway";
|
||||||
|
networking.domain = "prg.dtu.dk";
|
||||||
|
networking.useDHCP = false;
|
||||||
|
networking.useNetworkd = true;
|
||||||
|
|
||||||
|
# Set MAC addresses to match DTU documentation
|
||||||
|
systemd.network.links."10-wan" = {
|
||||||
|
matchConfig. OriginalName = "eth*";
|
||||||
|
matchConfig.Type = "ether";
|
||||||
|
linkConfig = {
|
||||||
|
Name = "ens18";
|
||||||
|
MACAddress = "2a:99:d6:03:dd:92"; # Hardcoded MAC, ensuring that DTU's sysadmin sees it is still the same
|
||||||
|
WakeOnLan = "off";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Discuss removing/changing them?
|
||||||
|
systemd.network.links."20-lan1" = {
|
||||||
|
matchConfig.OriginalName = "eth*";
|
||||||
|
matchConfig.Type = "ether";
|
||||||
|
linkConfig = {
|
||||||
|
Name = "ens19";
|
||||||
|
MACAddress = "0e:27:6a:11:a0:77";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.links."30-lan2" = {
|
||||||
|
matchConfig.OriginalName = "eth*";
|
||||||
|
matchConfig.Type = "ether";
|
||||||
|
linkConfig = {
|
||||||
|
Name = "ens20";
|
||||||
|
MACAddress = "42:d7:85:15:e1:ff";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# WAN Interface (ens18)
|
||||||
|
systemd.network.networks."10-wan" = {
|
||||||
|
matchConfig.Name = "ens18";
|
||||||
|
address = ["130.225.91.242/27"];
|
||||||
|
gateway = ["130.225.91.225"];
|
||||||
|
networkConfig = {
|
||||||
|
IPv6AcceptRA = false;
|
||||||
|
DHCP = "no";
|
||||||
|
};
|
||||||
|
linkConfig = {
|
||||||
|
RequiredForOnline = "routable";
|
||||||
|
MTUBytes = "1500";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# LAN Interface 1 (ens19) - Dual IP
|
||||||
|
systemd.network.networks."20-lan1" = {
|
||||||
|
matchConfig.Name = "ens19";
|
||||||
|
address = [
|
||||||
|
"10.123.123.1/24"
|
||||||
|
"192.168.0.1/24"
|
||||||
|
];
|
||||||
|
networkConfig = {
|
||||||
|
IPv6AcceptRA = false;
|
||||||
|
DHCP = "no";
|
||||||
|
ConfigureWithoutCarrier = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# LAN Interface 2 (ens20)
|
||||||
|
systemd.network.networks."30-lan2" = {
|
||||||
|
matchConfig.Name = "ens20";
|
||||||
|
address = ["10.255.255.1/24"];
|
||||||
|
networkConfig = {
|
||||||
|
IPv6AcceptRA = false;
|
||||||
|
DHCP = "no";
|
||||||
|
ConfigureWithoutCarrier = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# DNS Configuration
|
||||||
|
services.resolved = {
|
||||||
|
enable = true;
|
||||||
|
dnssec = "false";
|
||||||
|
domains = ["prg.dtu.dk"];
|
||||||
|
fallbackDns = ["1.1.1.1" "8.8.8.8" "130.225.89.2"];
|
||||||
|
extraConfig = ''
|
||||||
|
DNSStubListener=no
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Kernel parameters for gateway/security
|
||||||
|
boot.kernel.sysctl = {
|
||||||
|
# IP forwarding (gateway)
|
||||||
|
"net.ipv4.ip_forward" = 1;
|
||||||
|
|
||||||
|
# Reverse Path Filtering
|
||||||
|
"net.ipv4.conf.all.rp_filter" = 1;
|
||||||
|
"net.ipv4.conf.default.rp_filter" = 1;
|
||||||
|
|
||||||
|
# SYN flood
|
||||||
|
"net.ipv4.tcp_syncookies" = 1;
|
||||||
|
"net.ipv4.tcp_syn_retries" = 5;
|
||||||
|
|
||||||
|
# ICMP redirects / sending redirects
|
||||||
|
"net.ipv4.conf.all.accept_redirects" = 0;
|
||||||
|
"net.ipv4.conf.default.accept_redirects" = 0;
|
||||||
|
"net.ipv4.conf.all.send_redirects" = 0;
|
||||||
|
"net.ipv4.conf.default.send_redirects" = 0;
|
||||||
|
"net.ipv4.conf.all.secure_redirects" = 0;
|
||||||
|
|
||||||
|
# Source route / routing protections
|
||||||
|
"net.ipv4.conf.all.accept_source_route" = 0;
|
||||||
|
"net.ipv4.conf.default.accept_source_route" = 0;
|
||||||
|
|
||||||
|
# Log suspicious packets
|
||||||
|
"net.ipv4.conf.all.log_martians" = 1;
|
||||||
|
"net.ipv4.conf.default.log_martians" = 1;
|
||||||
|
|
||||||
|
# ICMP hygiene
|
||||||
|
"net.ipv4.icmp_echo_ignore_broadcasts" = 1;
|
||||||
|
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
|
||||||
|
|
||||||
|
# Performance
|
||||||
|
"net.ipv4.tcp_window_scaling" = 1;
|
||||||
|
|
||||||
|
# Disable IPv6 if desired
|
||||||
|
"net.ipv6.conf.all.disable_ipv6" = 1;
|
||||||
|
"net.ipv6.conf.default.disable_ipv6" = 1;
|
||||||
|
|
||||||
|
# Additional hardening knobs
|
||||||
|
"kernel.kptr_restrict" = 1; # hide kernel pointers in /proc
|
||||||
|
"kernel.dmesg_restrict" = 1; # restrict dmesg
|
||||||
|
"kernel.yama.ptrace_scope" = 1; # restrict ptrace
|
||||||
|
"fs.protected_hardlinks" = 1;
|
||||||
|
"fs.protected_symlinks" = 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
# NAT Configuration
|
||||||
|
networking.nat = {
|
||||||
|
enable = true;
|
||||||
|
externalInterface = "ens18";
|
||||||
|
internalInterfaces = ["ens19" "ens20"];
|
||||||
|
forwardPorts = []; # Empty - no port forwarding
|
||||||
|
};
|
||||||
|
|
||||||
|
# Firewall Configuration
|
||||||
|
networking.firewall = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
# Trusted LAN interfaces (all ports open)
|
||||||
|
trustedInterfaces = ["ens19" "ens20"];
|
||||||
|
|
||||||
|
# Interface-specific rules (keep permitted ports on LAN)
|
||||||
|
interfaces = {
|
||||||
|
ens19.allowedTCPPorts = [22 53];
|
||||||
|
ens19.allowedUDPPorts = [53 67 123];
|
||||||
|
ens20.allowedTCPPorts = [22 53];
|
||||||
|
ens20.allowedUDPPorts = [53 67 123];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Tightened iptables rules using conntrack, drop INVALID, rate-limit ICMP and logging.
|
||||||
|
extraCommands = ''
|
||||||
|
# Default policies
|
||||||
|
iptables -P INPUT DROP
|
||||||
|
iptables -P FORWARD ACCEPT
|
||||||
|
iptables -P OUTPUT ACCEPT
|
||||||
|
|
||||||
|
# Drop invalid packets early
|
||||||
|
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||||
|
|
||||||
|
# Allow loopback
|
||||||
|
iptables -A INPUT -i lo -j ACCEPT
|
||||||
|
|
||||||
|
# Established/related
|
||||||
|
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
|
||||||
|
# Rate-limit ICMP (allow limited pings)
|
||||||
|
iptables -A INPUT -p icmp -m conntrack --ctstate NEW -m limit --limit 1/second --limit-burst 5 -j ACCEPT
|
||||||
|
|
||||||
|
# Block new connections from WAN interface
|
||||||
|
iptables -A INPUT -i ens18 -m conntrack --ctstate NEW -j DROP
|
||||||
|
|
||||||
|
# Log dropped packets (rate-limited)
|
||||||
|
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables-dropped: " --log-level 7
|
||||||
|
'';
|
||||||
|
|
||||||
|
extraStopCommands = ''
|
||||||
|
iptables -P INPUT ACCEPT
|
||||||
|
iptables -P FORWARD ACCEPT
|
||||||
|
iptables -P OUTPUT ACCEPT
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Hosts file
|
||||||
|
networking.extraHosts = ''
|
||||||
|
130.225.91.242 prg-lan-gateway.prg.dtu.dk prg-lan-gateway
|
||||||
|
'';
|
||||||
|
|
||||||
|
# Time synchronization
|
||||||
|
time.timeZone = "Europe/Copenhagen";
|
||||||
|
services.chrony = {
|
||||||
|
enable = true;
|
||||||
|
servers = ["time.cloudflare.com"];
|
||||||
|
extraConfig = ''
|
||||||
|
makestep 1.0 3
|
||||||
|
rtcsync
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Locale settings
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
i18n.extraLocaleSettings = {
|
||||||
|
LC_ADDRESS = "da_DK.UTF-8";
|
||||||
|
LC_IDENTIFICATION = "da_DK.UTF-8";
|
||||||
|
LC_MEASUREMENT = "da_DK.UTF-8";
|
||||||
|
LC_MONETARY = "da_DK.UTF-8";
|
||||||
|
LC_NAME = "da_DK.UTF-8";
|
||||||
|
LC_NUMERIC = "da_DK. UTF-8";
|
||||||
|
LC_PAPER = "da_DK.UTF-8";
|
||||||
|
LC_TELEPHONE = "da_DK.UTF-8";
|
||||||
|
LC_TIME = "en_DK.UTF-8";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Console keymap
|
||||||
|
# Change it back to Danish?
|
||||||
|
console.keyMap = "us";
|
||||||
|
|
||||||
|
# User configuration -
|
||||||
|
users.users.admin = {
|
||||||
|
isNormalUser = true;
|
||||||
|
description = "Gateway Administrator";
|
||||||
|
extraGroups = ["wheel" "networkmanager" "systemd-journal"];
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
# Christine's Hardware Key - Copy and change to the desired hardware keys
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3pjIXlpg7H9h1RrmdxbIRnDIdQvf/EZKI9PG2/rY7D openpgp:0x8BCD4992"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
# Passwordless sudo for wheel group
|
||||||
|
security.sudo.wheelNeedsPassword = false;
|
||||||
|
|
||||||
|
# Hardware U2F support - Passwordless sudo with hardware key
|
||||||
|
security.pam.u2f = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
authfile = "/etc/u2f_keys";
|
||||||
|
cue = true;
|
||||||
|
pinverification = 0; # No PIN verification
|
||||||
|
userpresence = 1; # Require user presence (touch)
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# SSH Agent authentication
|
||||||
|
security.pam.enableSSHAgentAuth = true;
|
||||||
|
|
||||||
|
# System packages
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
# Network tools
|
||||||
|
wget
|
||||||
|
curl
|
||||||
|
dig
|
||||||
|
tcpdump
|
||||||
|
ethtool
|
||||||
|
iptables
|
||||||
|
nftables
|
||||||
|
iproute2
|
||||||
|
bridge-utils
|
||||||
|
netcat-gnu
|
||||||
|
traceroute
|
||||||
|
mtr
|
||||||
|
|
||||||
|
# Monitoring
|
||||||
|
btop
|
||||||
|
htop
|
||||||
|
iotop
|
||||||
|
bandwhich
|
||||||
|
|
||||||
|
# Editors
|
||||||
|
micro
|
||||||
|
vim
|
||||||
|
helix
|
||||||
|
|
||||||
|
# System info
|
||||||
|
fastfetch
|
||||||
|
lshw
|
||||||
|
pciutils
|
||||||
|
usbutils
|
||||||
|
];
|
||||||
|
|
||||||
|
# OpenSSH
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
PermitRootLogin = "no";
|
||||||
|
PasswordAuthentication = false;
|
||||||
|
KbdInteractiveAuthentication = false;
|
||||||
|
X11Forwarding = false;
|
||||||
|
|
||||||
|
# Additional hardening
|
||||||
|
MaxAuthTries = 3;
|
||||||
|
LoginGraceTime = "20s";
|
||||||
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
AllowUsers admin
|
||||||
|
'';
|
||||||
|
openFirewall = false; # Manually configured in firewall section
|
||||||
|
};
|
||||||
|
|
||||||
|
# Tailscale VPN - We need to discuss about this long term
|
||||||
|
services.tailscale = {
|
||||||
|
enable = true;
|
||||||
|
useRoutingFeatures = "server";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Automatic upgrades
|
||||||
|
system.autoUpgrade = {
|
||||||
|
enable = true; # Set to true for automatic updates
|
||||||
|
dates = "daily";
|
||||||
|
allowReboot = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Nix garbage collection
|
||||||
|
nix.gc = {
|
||||||
|
automatic = true;
|
||||||
|
dates = "weekly";
|
||||||
|
options = "--delete-older-than 30d";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Nix settings
|
||||||
|
nix.settings = {
|
||||||
|
experimental-features = ["nix-command" "flakes"];
|
||||||
|
auto-optimise-store = true;
|
||||||
|
trusted-users = ["root" "@wheel"];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Allow unfree packages
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
|
||||||
|
# Boot configuration TO BE CHANGED ACCORDING TO INSTALL VERSION
|
||||||
|
boot.loader = {
|
||||||
|
systemd-boot.enable = true;
|
||||||
|
efi.canTouchEfiVariables = true;
|
||||||
|
timeout = 3;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Kernel optimization
|
||||||
|
boot.kernelParams = [
|
||||||
|
"quiet"
|
||||||
|
"splash"
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enable zram swap
|
||||||
|
zramSwap = {
|
||||||
|
enable = true;
|
||||||
|
memoryPercent = 50;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Protect /tmp as a tmpfs with nosuid/nodev/noexec
|
||||||
|
fileSystems."/tmp" = {
|
||||||
|
device = "tmpfs";
|
||||||
|
fsType = "tmpfs";
|
||||||
|
options = ["mode=1777" "nosuid" "nodev" "noexec"];
|
||||||
|
};
|
||||||
|
|
||||||
|
# System state version
|
||||||
|
system.stateVersion = "XX.XX";
|
||||||
|
}
|
||||||
105
nix-system-configs/nixos-template.nix
Normal file
105
nix-system-configs/nixos-template.nix
Normal file
|
|
@ -0,0 +1,105 @@
|
||||||
|
# Headless server configuration with Lix
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
./hardware-configuration.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
## Use Lix, instead of Nix NixOS default ##
|
||||||
|
nixpkgs.overlays = [
|
||||||
|
(final: prev: {
|
||||||
|
inherit
|
||||||
|
(prev.lixPackageSets.stable)
|
||||||
|
nixpkgs-review
|
||||||
|
nix-eval-jobs
|
||||||
|
nix-fast-build
|
||||||
|
colmena
|
||||||
|
;
|
||||||
|
})
|
||||||
|
];
|
||||||
|
|
||||||
|
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||||
|
|
||||||
|
### TO BE CHANGED ACCORDING TO INSTALL ###
|
||||||
|
|
||||||
|
# Networking
|
||||||
|
networking.hostName = "server";
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
|
||||||
|
# Time zone
|
||||||
|
time.timeZone = "Europe/Copenhagen";
|
||||||
|
|
||||||
|
# Locale
|
||||||
|
i18n.defaultLocale = "en_GB.UTF-8";
|
||||||
|
# Also install Danish and Norwegian locales
|
||||||
|
i18n.extraLocales = ["da_DK.UTF-8" "nb_NO.UTF-8"];
|
||||||
|
|
||||||
|
# User account with hardware key support
|
||||||
|
users.users.admin = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = ["wheel" "networkmanager"];
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3pjIXlpg7H9h1RrmdxbIRnDIdQvf/EZKI9PG2/rY7D openpgp:0x8BCD4992"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Hardware Key Passwordless Sudo
|
||||||
|
security.pam.u2f.enable = true;
|
||||||
|
security.pam.u2f.settings = {
|
||||||
|
authfile = "/etc/u2f_keys";
|
||||||
|
authpending_file = "";
|
||||||
|
pinverification = 0;
|
||||||
|
userpresence = 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
# SSH Passwordless Sudo
|
||||||
|
security.pam.enableSSHAgentAuth = true;
|
||||||
|
security.pam.sshAgentAuth = {
|
||||||
|
enable = true;
|
||||||
|
authorizedKeysFiles = ["/etc/ssh/authorized_keys.d/admin"];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Essential packages
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
wget
|
||||||
|
curl
|
||||||
|
git
|
||||||
|
btop
|
||||||
|
htop
|
||||||
|
micro
|
||||||
|
vim
|
||||||
|
helix
|
||||||
|
fastfetch
|
||||||
|
];
|
||||||
|
|
||||||
|
# OpenSSH
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
PermitRootLogin = "no";
|
||||||
|
PasswordAuthentication = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Tailscale - Think about how we manage this long term
|
||||||
|
services.tailscale.enable = true;
|
||||||
|
|
||||||
|
# Garbage collection
|
||||||
|
nix.gc = {
|
||||||
|
automatic = true;
|
||||||
|
dates = "weekly";
|
||||||
|
options = "--delete-older-than 30d";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Firewall
|
||||||
|
networking.firewall.allowedTCPPorts = [22];
|
||||||
|
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
|
||||||
|
### TO BE CHANGED ACCORDING TO INSTALL VERSION ###
|
||||||
|
system.stateVersion = "XX.XX";
|
||||||
|
}
|
||||||
123
nix-system-configs/old-server-notes.md
Normal file
123
nix-system-configs/old-server-notes.md
Normal file
|
|
@ -0,0 +1,123 @@
|
||||||
|
|
||||||
|
|
||||||
|
# Old Server Notes
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Gateway WAN Configuration - Essential Info
|
||||||
|
|
||||||
|
## Network Details
|
||||||
|
```
|
||||||
|
WAN IP: 130.225.91.242/27
|
||||||
|
Netmask: 255.255.255.224
|
||||||
|
Gateway: 130.225.91.225
|
||||||
|
Gateway MAC: f0:7f:06:98:4a:64
|
||||||
|
Network: 130.225.91.224/27
|
||||||
|
Broadcast: 130.225.91.255
|
||||||
|
Interface: ens18
|
||||||
|
MTU: 1500
|
||||||
|
Domain: prg.dtu.dk
|
||||||
|
Hostname: prg-lan-gateway
|
||||||
|
FQDN: prg-lan-gateway.prg.dtu.dk
|
||||||
|
```
|
||||||
|
|
||||||
|
## Upstream Path
|
||||||
|
```
|
||||||
|
Gateway (130.225.91.225) → Cisco e11_0-1.bg106.internet.i3.cisco.net.local
|
||||||
|
Next Hop (192.38.93.34) → DTU edge router et2_12.90.sb-1g303-1
|
||||||
|
```
|
||||||
|
|
||||||
|
## Interface Configuration
|
||||||
|
```
|
||||||
|
Interface: ens18
|
||||||
|
Type: Static IPv4
|
||||||
|
Address: 130.225.91.242/27
|
||||||
|
Gateway: 130.225.91.225
|
||||||
|
No VLANs, No PPPoE, No MAC cloning
|
||||||
|
```
|
||||||
|
|
||||||
|
## Proxmox VM Configuration
|
||||||
|
```
|
||||||
|
VM ID: 100
|
||||||
|
Node: ve0
|
||||||
|
Memory: 2GB
|
||||||
|
CPU: 2 cores (1 socket)
|
||||||
|
Disk: 10GB (local-lvm)
|
||||||
|
NIC Model: VirtIO
|
||||||
|
|
||||||
|
Network Devices:
|
||||||
|
net0 (ens18): virtio=2A:99:D6:03:DD:92,bridge=vmbr1 ← WAN
|
||||||
|
net1 (ens19): virtio=0E:27:6A:11:A0:77,bridge=vmbr0 ← LAN
|
||||||
|
net2 (ens20): virtio=42:D7:85:15:E1:FF,bridge=vmbr2 ← LAN
|
||||||
|
```
|
||||||
|
|
||||||
|
## DNS Servers
|
||||||
|
```
|
||||||
|
Primary: 1.1.1.1 (Cloudflare)
|
||||||
|
Secondary: 8.8.8.8 (Google)
|
||||||
|
Tertiary: 130.225.89.2 (DTU)
|
||||||
|
Domain: prg.dtu.dk
|
||||||
|
Search: prg.dtu.dk
|
||||||
|
```
|
||||||
|
|
||||||
|
## NTP Servers
|
||||||
|
```
|
||||||
|
time.cloudflare.com
|
||||||
|
```
|
||||||
|
|
||||||
|
## Firewall Rules
|
||||||
|
|
||||||
|
### NAT (Outbound)
|
||||||
|
```
|
||||||
|
Chain: POSTROUTING
|
||||||
|
Action: Masquerade all traffic on interface ens18
|
||||||
|
```
|
||||||
|
|
||||||
|
### Filter (Inbound)
|
||||||
|
```
|
||||||
|
Accept: Loopback (lo)
|
||||||
|
Accept: Established/Related connections
|
||||||
|
Drop: All other traffic from ens18 (WAN)
|
||||||
|
Default: Accept (for other interfaces)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Port Forwarding
|
||||||
|
```
|
||||||
|
None configured
|
||||||
|
```
|
||||||
|
|
||||||
|
## System Requirements
|
||||||
|
```
|
||||||
|
IP Forwarding: Enabled (net.ipv4.ip_forward=1)
|
||||||
|
Reverse Path Filtering: Enabled (net.ipv4.conf.all.rp_filter=1)
|
||||||
|
SYN Cookies: Enabled (net.ipv4.tcp_syncookies=1)
|
||||||
|
Accept ICMP Redirects: Disabled (net.ipv4.conf.all.accept_redirects=0)
|
||||||
|
Send ICMP Redirects: Disabled (net.ipv4.conf.all.send_redirects=0)
|
||||||
|
Accept Source Route: Disabled (net.ipv4.conf.all.accept_source_route=0)
|
||||||
|
Log Martian Packets: Enabled (net.ipv4.conf.all.log_martians=1)
|
||||||
|
Ignore Broadcast Pings: Enabled (net.ipv4.icmp_echo_ignore_broadcasts=1)
|
||||||
|
Ignore Bogus ICMP Errors: Enabled (net.ipv4.icmp_ignore_bogus_error_responses=1)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Hosts File
|
||||||
|
```
|
||||||
|
127.0.0.1 localhost
|
||||||
|
130.225.91.242 prg-lan-gateway.prg.dtu.dk prg-lan-gateway
|
||||||
|
::1 localhost ip6-localhost ip6-loopback
|
||||||
|
ff02::1 ip6-allnodes
|
||||||
|
ff02::2 ip6-allrouters
|
||||||
|
```
|
||||||
|
|
||||||
|
## LAN Interfaces
|
||||||
|
```
|
||||||
|
ens19: 10.123.123.1/24, 192.168.0.1/24 (dual IP)
|
||||||
|
ens20: 10.255.255.1/24
|
||||||
|
```
|
||||||
|
|
||||||
|
## Critical Notes
|
||||||
|
```
|
||||||
|
Platform: Proxmox VM (node ve0, VM ID 100)
|
||||||
|
WAN MAC: 2A:99:D6:03:DD:92 (must preserve for rebuild maybe, due to DTU being very thorough maybe)
|
||||||
|
WAN Bridge: vmbr1 (not vmbr0)
|
||||||
|
IPv6: Not configured
|
||||||
|
```
|
||||||
3
src/main.rs
Normal file
3
src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
fn main() {
|
||||||
|
println!("Hello, this will be changed later!");
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue