mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: replace personal mesh with guarded AstrNet stub

Browse source
This commit is contained in:
heather 2026-09-26 23:13:08 +00:00
commit 2ad5653fda
4 changed files with 203 additions and 175 deletions
Download patch file Download diff file Expand all files Collapse all files

55
hosts/heather/default.nix
View file

@ -23,8 +23,7 @@
./paseo.nix # paseo daemon (web UI для CLI-агентов, systemd + npm global)
./nick.nix # Nick timer prototype (systemd, localhost:8787)
./jupyter.nix # JupyterLab (systemd, localhost:8890, лимиты)
./mesh-clients.nix # Sol-style client pool (wg-clients1)
./mesh-egress.nix # Sol-style selected-destination egress policy
./astrnet.nix # AstrNet (Sol): two WireGuard legs, FRR/BGP, ingress guard
];
# Heather has 8 GiB RAM and runs several containers. Keep a 4 GiB
@ -36,10 +35,8 @@
}
];
# First server-to-server WireGuard backbone link: heather ↔ hyacinth.
# The private key is generated on the live host and stays outside the flake.
# Basic diagnostics/admin tools must be available even in non-login SSH
# sessions (and not depend on a stale Home Manager profile).
# WireGuard tooling is also used by AstrNet. Keep this package and the
# diagnostics tools available in non-login SSH sessions.
environment.systemPackages = with pkgs; [
wireguard-tools
tmux
@ -48,49 +45,7 @@
python3
];
# NixOS uses scripted networking here (not systemd-networkd), so create the
# dummy identity interface through a small idempotent systemd unit.
systemd.services.mesh-identity = {
description = "Create mesh identity interface";
wantedBy = [ "network.target" ];
after = [ "wireguard-wg-mesh.service" "network-addresses-wg-mesh.service" ];
wants = [ "wireguard-wg-mesh.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = pkgs.writeShellScript "mesh-identity-up" ''
set -eu
${pkgs.iproute2}/bin/ip link show mesh0 >/dev/null 2>&1 || ${pkgs.iproute2}/bin/ip link add mesh0 type dummy
${pkgs.iproute2}/bin/ip addr replace 10.0.0.1/32 dev mesh0
${pkgs.iproute2}/bin/ip link set mesh0 up
'';
ExecStop = "${pkgs.iproute2}/bin/ip link del mesh0";
};
};
networking.wireguard.interfaces.wg-mesh = {
ips = [ "10.99.0.1/30" ];
listenPort = 51820;
privateKeyFile = "/var/lib/wireguard/wg-mesh.key";
# Keep WG as transport/crypto ACL; install the identity route explicitly below.
allowedIPsAsRoutes = false;
peers = [
{
publicKey = "BxTH8+MiA8Hv48UfpWJDVXIhbO5HgO2KTBEXIqqr23k=";
# Match all destinations for future policy routes; allowedIPsAsRoutes=false
# keeps this from installing a default route automatically.
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "195.242.119.59:51820";
persistentKeepalive = 25;
}
];
};
networking.interfaces.wg-mesh.ipv4.routes = [
{ address = "10.0.0.2"; prefixLength = 32; }
];
# Needed later when this node becomes a transit/exit peer.
# Docker requires forwarding; AstrNet ingress is blocked by astrnet-guard.
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
# Arion-проект как systemd-сервис: arion-compose.nix → docker-compose → up.
@ -122,10 +77,8 @@
22070 # strelaysrv (status)
3478 # coturn TURN (tcp+udp)
8443 # xray VLESS+Reality (публичный прокси)
51820 # WireGuard mesh backbone
];
firewall.allowedUDPPorts = [
51820 # WireGuard mesh backbone
22000 # syncthing sync (QUIC)
10000 # jitsi jvb (RTP media)
3478 # coturn TURN