move old hosts to single file

2026-09-23 17:39:36 -04:00
parent 41c4fd235a
commit a21f35a83b
13 changed files with 273 additions and 400 deletions
@@ -0,0 +1,82 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../modules/ssh.nix
+
+    ../lilac.nix
+  ];
+
+  networking.hostName = "vps";
+
+  # forwarding inbound network traffic over wireguard
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 ];
+      allowedUDPPorts = [ 51820 ];
+      trustedInterfaces = [ "wg0" ];
+    };
+
+    wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.3/32" ];
+      listenPort = 51820;
+      generatePrivateKeyFile = true;
+      privateKeyFile = "/var/lib/wireguard/wg0.key";
+      peers = [
+        {
+          allowedIPs = [ "10.0.0.1/32" ];
+          publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
+        }
+        {
+          allowedIPs = [ "10.0.0.2/32" ];
+          publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+        }
+        {
+          allowedIPs = [ "10.0.0.4/32" ];
+          publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
+        }
+      ];
+    };
+
+    nftables = {
+      enable = true;
+      tables.nat = {
+        family = "ip";
+        content = ''
+          chain prerouting {
+            type nat hook prerouting priority dstnat; policy accept;
+            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+          }
+          chain postrouting {
+            type nat hook postrouting priority srcnat; policy accept;
+            oifname "wg0" masquerade
+          }
+        '';
+      };
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "26.05";
+
+  boot = {
+    initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+    loader.efi.efiSysMountPoint = "/boot/efi";
+  };
+
+  fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
+  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.hypervGuest.enable = true;
+}