change nixos -> nix

nix/modules/networking/default.nix

@@ -0,0 +1,167 @@
+{ lib, config, machine, ... }:
+let cfg = config.lab.networking;
+in {
+  imports = [ ./dmz_services ];
+
+  options.lab.networking = {
+    dmz = {
+      allowConnectivity = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to allow networking on the DMZ bridge interface.
+        '';
+      };
+
+      bridgeName = lib.mkOption {
+        default = "bridgedmz";
+        type = lib.types.str;
+        description = ''
+          The name of the DMZ bridge.
+        '';
+      };
+    };
+
+    staticNetworking = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Whether this machine has static networking configuration applied.
+        Routing is prepopulated, but IP addresses have to be set.
+      '';
+    };
+
+    staticIPv4 = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        Static IPv4 address for the machine.
+      '';
+    };
+
+    staticIPv6 = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        Static IPv6 address for the machine.
+      '';
+    };
+  };
+
+  config = {
+    networking = {
+      domain = if machine.isPhysical then "hyp" else "dmz";
+      nftables.enable = true;
+      useDHCP = false;
+
+      firewall = {
+        enable = true;
+        checkReversePath = false;
+      };
+    };
+
+    systemd.network = {
+      enable = true;
+
+      netdevs = lib.mkIf machine.isHypervisor {
+        "20-vlandmz" = {
+          vlanConfig.Id = 30;
+
+          netdevConfig = {
+            Kind = "vlan";
+            Name = "vlandmz";
+          };
+        };
+
+        "20-bridgedmz" = {
+          netdevConfig = {
+            Kind = "bridge";
+            Name = cfg.dmz.bridgeName;
+          };
+        };
+      };
+
+      networks = lib.attrsets.mergeAttrsList [
+        (lib.optionalAttrs machine.isHypervisor {
+          "30-main-nic" = {
+            matchConfig.Name = "en*";
+            vlan = [ "vlandmz" ];
+
+            networkConfig = {
+              DHCP = "yes";
+            };
+          };
+
+          "40-vlandmz" = {
+            matchConfig.Name = "vlandmz";
+            linkConfig.RequiredForOnline = "enslaved";
+
+            networkConfig = {
+              IPv6AcceptRA = false;
+              LinkLocalAddressing = "no";
+              Bridge = cfg.dmz.bridgeName;
+            };
+          };
+
+          "40-bridgedmz" = {
+            matchConfig.Name = cfg.dmz.bridgeName;
+            linkConfig.RequiredForOnline = "carrier";
+
+            networkConfig = {
+              IPv6AcceptRA = cfg.dmz.allowConnectivity;
+              LinkLocalAddressing = if cfg.dmz.allowConnectivity then "ipv6" else "no";
+              DHCP = "yes";
+            };
+          };
+
+          "40-vms" = {
+            matchConfig.Name = "vm-*";
+            networkConfig.Bridge = cfg.dmz.bridgeName;
+          };
+        })
+        (lib.optionalAttrs machine.isVirtual {
+          "30-main-nic" = {
+            matchConfig.Name = "en*";
+
+            networkConfig = {
+              IPv6AcceptRA = ! cfg.staticNetworking;
+              DHCP = lib.mkIf (! cfg.staticNetworking) "yes";
+
+              Address = lib.mkIf cfg.staticNetworking [
+                "${cfg.staticIPv4}/${cfg.dmz.ipv4.prefixLength}"
+                "${cfg.staticIPv6}/${cfg.dmz.ipv6.prefixLength}"
+              ];
+
+              DNS = lib.mkIf cfg.staticNetworking [
+                cfg.dmz.ipv4.router
+                cfg.dmz.ipv6.router
+              ];
+            };
+
+            routes = lib.mkIf cfg.staticNetworking [
+              {
+                routeConfig = {
+                  Gateway = cfg.dmz.ipv4.router;
+                  Destination = "0.0.0.0/0";
+                };
+              }
+              {
+                routeConfig = {
+                  Gateway = cfg.dmz.ipv6.router;
+                  Destination = "::/0";
+                };
+              }
+            ];
+          };
+        })
+        (lib.optionalAttrs machine.isRaspberryPi {
+          "30-main-nic" = {
+            matchConfig.Name = "end*";
+            networkConfig = {
+              IPv6AcceptRA = true;
+              DHCP = "yes";
+            };
+          };
+        })
+      ];
+    };
+  };
+}

nix/modules/networking/dmz_services/default.nix

@@ -0,0 +1,73 @@
+# TODO: we should split this into DHCP and DNS
+# This decoupling makes it easier to put one service on another host.
+{ pkgs, lib, config, dns, ... }@inputs:
+let
+  cfg = config.lab.networking.dmz.services;
+
+  kunisZoneFile = pkgs.writeTextFile {
+    name = "kunis-zone-file";
+    text = (dns.lib.toString "kun.is" (import ./zones/kun.is.nix inputs));
+  };
+
+  geokunis2nlZoneFile = pkgs.writeTextFile {
+    name = "geokunis2nl-zone-file";
+    text = (dns.lib.toString "geokunis2.nl" (import ./zones/geokunis2.nl.nix inputs));
+  };
+in
+{
+  options.lab.networking.dmz.services.enable = lib.mkOption {
+    default = false;
+    type = lib.types.bool;
+    description = ''
+      Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    # TODO Remove this; make this explicit in the machine config.
+    lab.networking.dmz.allowConnectivity = true;
+
+    # TODO: listen only on dmz interface, make this portable between physical and VM.
+    networking.firewall = {
+      allowedTCPPorts = [ 53 5353 ];
+      allowedUDPPorts = [ 53 67 5353 ];
+    };
+
+    services = {
+      bind = {
+        enable = true;
+        forwarders = [ ];
+
+        extraOptions = ''
+          allow-transfer { none; };
+          allow-recursion { none; };
+          version none;
+          notify no;
+        '';
+
+        zones = {
+          "kun.is" = {
+            master = true;
+            file = kunisZoneFile;
+            allowQuery = [ "any" ];
+          };
+
+          "geokunis2.nl" = {
+            master = true;
+            file = geokunis2nlZoneFile;
+            allowQuery = [ "any" ];
+            slaves = [
+              "87.253.155.96/27"
+              "157.97.168.160/27"
+            ];
+          };
+        };
+      };
+
+      dnsmasq = {
+        enable = true;
+        settings = import ./dnsmasq.nix inputs;
+      };
+    };
+  };
+}

nix/modules/networking/dmz_services/dnsmasq.nix

@@ -0,0 +1,50 @@
+{ config, ... }:
+let
+  cfg = config.lab.networking;
+in
+{
+  no-resolv = true;
+  local = "/dmz/";
+  dhcp-fqdn = true;
+  no-hosts = true;
+  expand-hosts = true;
+  domain = "dmz";
+  dhcp-authoritative = true;
+  ra-param = "*,0,0";
+  alias = "${cfg.public.ipv4.router},${cfg.dmz.ipv4.dockerSwarm}";
+  log-dhcp = true;
+  log-queries = true;
+  port = "5353";
+  host-record = [
+    "hermes.dmz,${cfg.dmz.ipv4.services},${cfg.dmz.ipv6.services}"
+    "ipv4.hermes.dmz,${cfg.dmz.ipv4.services}" # TODO: Do we need these?
+    "ipv6.hermes.dmz,${cfg.dmz.ipv6.services}"
+  ];
+
+  server = [
+    cfg.dmz.ipv4.router
+    "/geokunis2.nl/${cfg.dmz.ipv4.services}"
+    "/kun.is/${cfg.dmz.ipv4.services}"
+  ];
+
+  dhcp-range = [
+    "192.168.30.50,192.168.30.127,15m"
+    "2a0d:6e00:1a77:30::,ra-stateless,ra-names"
+  ];
+
+  dhcp-host = [
+    "b8:27:eb:b9:ab:e2,esrom"
+    "ba:db:ee:f0:00:01,maestro,${cfg.dmz.ipv4.dockerSwarm}"
+  ];
+
+  dhcp-option = [
+    "3,${cfg.dmz.ipv4.router}"
+    "option:dns-server,${cfg.dmz.ipv4.router}"
+    "option6:dns-server,[2a02:58:19a:30::1]"
+  ];
+
+  address = [
+    "/ns.pizzapim.nl/ns.geokunis2.nl/${cfg.dmz.ipv4.services}"
+    "/ns.pizzapim.nl/ns.geokunis2.nl/${cfg.dmz.ipv6.services}"
+  ];
+}

nix/modules/networking/dmz_services/zones/geokunis2.nl.nix

@@ -0,0 +1,41 @@
+{ config, dns, ... }:
+with dns.lib.combinators;
+let
+  cfg = config.lab.networking;
+in
+{
+  SOA = {
+    nameServer = "ns";
+    adminEmail = "hostmaster@geokunis2.nl";
+    serial = 2024020500;
+  };
+
+  NS = [
+    "ns.geokunis2.nl."
+    "ns0.transip.net."
+    "ns1.transip.nl."
+    "ns2.transip.eu."
+  ];
+
+  MX = [ (mx.mx 10 "mail.geokunis2.nl.") ];
+
+  CAA = letsEncrypt "caa@geokunis2.nl";
+
+  subdomains = {
+    ns = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.services ];
+    };
+
+    ns1 = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.services ];
+    };
+
+    ns2 = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.services ];
+    };
+
+  };
+}

nix/modules/networking/dmz_services/zones/kun.is.nix

@@ -0,0 +1,77 @@
+{ config, dns, ... }:
+with dns.lib.combinators;
+let
+  cfg = config.lab.networking;
+in
+{
+  CAA = letsEncrypt "caa@kun.is";
+
+  SOA = {
+    nameServer = "ns1";
+    adminEmail = "webmaster@kun.is";
+    serial = 2024021702;
+  };
+
+  NS = [
+    "ns1.kun.is."
+    "ns2.kun.is."
+  ];
+
+  MX = [
+    (mx.mx 10 "mail.kun.is.")
+  ];
+
+  subdomains = {
+    "*" = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.dockerSwarm ];
+    };
+
+    ns = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.services ];
+    };
+
+    ns1 = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.services ];
+    };
+
+    ns2 = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.services ];
+    };
+
+    # Override because we don't support IPv6 for Git SSH.
+    git = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ ];
+    };
+
+    # Override because we don't support IPv6 for KMS.
+    kms = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ ];
+    };
+
+    # Override because wg is on opnsense so ipv6 differs from "cfg.dmz.ipv6.services"
+    wg = {
+      A = [ cfg.public.ipv4.router ];
+      AAAA = [ cfg.dmz.ipv6.router ];
+    };
+
+#for SMTP2GO to be able send emails from kun.is domain
+    em670271 = {
+      CNAME = ["return.smtp2go.net."];
+    };
+
+    "s670271._domainkey" = {
+      CNAME = ["dkim.smtp2go.net."];
+    };
+
+    link = {
+      CNAME = ["track.smtp2go.net."];
+    };
+
+  };
+}