maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ops/machines): IPv6 setup for bugry

Browse source 
Adman (the hoster) have not provided an ETA for native v6 on bugry yet, so we
establish a public v6 connection through nevsky for now.

In traffic flows going West->East the overhead is minimal (a few ms), though I
guess it might be worse if you're in the middle (Yekaterinburg or something).

The prefix was chosen by the bugry public v4 address encoded in hex, and
appended to the nevsky prefix.

Change-Id: I133622c17bd02eade0a6febc6bdf97f403fed14c
Reviewed-on: https://cl.tvl.fyi/c/depot/+/12974
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
This commit is contained in:
Vincent Ambo 2025-01-12 15:25:44 +03:00 • committed by clbot
parent dbdf211fe4
commit bf552f7a9b
7 changed files with 87 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

24
ops/machines/bugry/default.nix
View file

@ -8,6 +8,7 @@ in
imports = [
(mod "tvl-cache.nix")
(mod "tvl-users.nix")
(depot.third_party.agenix.src + "/modules/age.nix")
];
hardware.cpu.intel.updateMicrocode = true;
@ -81,19 +82,40 @@ in
};
};
age.secrets = {
wg-privkey.file = depot.ops.secrets."wg-bugry.age";
};
networking = {
hostName = "bugry";
domain = "tvl.fyi";
hostId = "8425e349";
useDHCP = false;
interfaces.enp6s0.ipv6.addresses = [{
interfaces.enp6s0.ipv4.addresses = [{
address = "91.199.149.239";
prefixLength = 24;
}];
defaultGateway = "91.199.149.1";
wireguard.interfaces.wg-nevsky = {
ips = [ "2a03:6f00:2:514b:5bc7:95ef:0:2/96" ];
privateKeyFile = "/run/agenix/wg-privkey";
peers = [{
publicKey = "gLyIY+R/YG9S8W8jtqE6pEV6MTyzeUX/PalL6iyvu3g="; # nevsky
endpoint = "188.225.81.75:51820";
persistentKeepalive = 25;
allowedIPs = [ "::/0" ];
}];
allowedIPsAsRoutes = false; # used as default v6 gateway below
};
defaultGateway6.address = "2a03:6f00:2:514b:5bc7:95ef::1";
defaultGateway6.interface = "wg-nevsky";
nameservers = [
"8.8.8.8"
"8.8.4.4"

27
ops/machines/nevsky/default.nix
View file

@ -7,6 +7,7 @@ in
{
imports = [
(mod "tvl-users.nix")
(depot.third_party.agenix.src + "/modules/age.nix")
];
hardware.cpu.amd.updateMicrocode = true;
@ -83,6 +84,10 @@ in
};
};
age.secrets = {
wg-privkey.file = depot.ops.secrets."wg-nevsky.age";
};
networking = {
hostName = "nevsky";
domain = "tvl.fyi";
@ -106,12 +111,34 @@ in
interface = "enp1s0f0np0";
};
wireguard.interfaces.wg-bugry = {
ips = [ "2a03:6f00:2:514b:5bc7:95ef::1/96" ];
privateKeyFile = "/run/agenix/wg-privkey";
listenPort = 51820;
postSetup = ''
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s '2a03:6f00:2:514b:5bc7:95ef::1/96' -o enp1s0f0np0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s '2a03:6f00:2:514b:5bc7:95ef::1/96' -o enp1s0f0np0 -j MASQUERADE
'';
peers = [{
publicKey = "+vFeWLH99aaypitw7x1J8IypoTrva28LItb1v2VjOAg="; # bugry
allowedIPs = [ "2a03:6f00:2:514b:5bc7:95ef::/96" ];
}];
allowedIPsAsRoutes = true;
};
nameservers = [
"8.8.8.8"
"8.8.4.4"
];
firewall.allowedTCPPorts = [ 22 80 443 ];
firewall.allowedUDPPorts = [ 51820 ];
};
# Generate an immutable /etc/resolv.conf from the nameserver settings