voronind/nix
0
0
Fork 0
Code Issues 40 Pull requests Packages Projects Releases Wiki Activity

Vpn: Fix proxy access.

Browse source
This commit is contained in:
Dmitry Voronin 2024-11-24 04:41:06 +03:00
parent 76f33841c8
commit 02006b1ff7
Signed by: voronind
SSH key fingerprint: SHA256:3kBb4iV2ahufEBNq+vFbUe4QYfHt98DHQjN7QaptY9k
23 changed files with 31 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
container/Vpn.nix
View file

@ -30,6 +30,10 @@ in {
default = "${config.container.storage}/vpn"; default = "${config.container.storage}/vpn";
type = lib.types.str; type = lib.types.str;
}; };
clients = lib.mkOption {
default = "10.1.1.0/24";
type = lib.types.str;
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@ -38,14 +42,14 @@ in {
]; ];
# HACK: When using `networking.interfaces.*` it breaks. This works tho. # HACK: When using `networking.interfaces.*` it breaks. This works tho.
systemd.services.vpn-route = { systemd.services.vpn-route = util.mkStaticSystemdService {
enable = true; enable = true;
description = "Hack vpn routes on host"; description = "Hack vpn routes on host";
after = [ "container@vpn.service" ]; after = [ "container@vpn.service" ];
wants = [ "container@vpn.service" ]; wants = [ "container@vpn.service" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
ExecStart = "${pkgs.iproute2}/bin/ip route add 10.1.1.0/24 via ${cfg.address} dev ve-vpn"; ExecStart = "${pkgs.iproute2}/bin/ip route add ${cfg.clients} via ${cfg.address} dev ve-vpn";
Type = "oneshot"; Type = "oneshot";
}; };
}; };

2
container/proxy/host/Camera.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
return 301 rtsp://${address}:${toString port}/live/main; return 301 rtsp://${address}:${toString port}/live/main;

2
container/proxy/host/Change.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;

2
container/proxy/host/Chat.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;

2
container/proxy/host/Cloud.nix
View file

@ -15,7 +15,7 @@ in {
location ~ ^/(settings/admin|settings/users|settings/apps|login|api) { location ~ ^/(settings/admin|settings/users|settings/apps|login|api) {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Download.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Git.nix
View file

@ -14,7 +14,7 @@ in {
location ~ ^/(admin|api|user) { location ~ ^/(admin|api|user) {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Home.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Iot.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;

2
container/proxy/host/Mail.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Office.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
# allow ${config.container.localAccess}; # allow ${config.container.localAccess};
# allow ${config.container.module.status.address}; # allow ${config.container.module.status.address};
# allow ${config.container.module.vpn.address}; # allow ${config.container.module.vpn.clients};
# allow ${config.container.module.frkn.address}; # allow ${config.container.module.frkn.address};
# deny all; # deny all;
add_header X-Forwarded-Proto https; add_header X-Forwarded-Proto https;

2
container/proxy/host/Paper.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Pass.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Print.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;

2
container/proxy/host/Printer.nix
View file

@ -17,7 +17,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Read.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Router.nix
View file

@ -17,7 +17,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Search.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

4
container/proxy/host/Status.nix
View file

@ -14,7 +14,7 @@ in {
location ~ ^/(dashboard|settings) { location ~ ^/(dashboard|settings) {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
@ -22,7 +22,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Stock.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Watch.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;

2
container/proxy/host/Yt.nix
View file

@ -15,7 +15,7 @@ in {
location / { location / {
allow ${config.container.localAccess}; allow ${config.container.localAccess};
allow ${config.container.module.status.address}; allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address}; allow ${config.container.module.vpn.clients};
allow ${config.container.module.frkn.address}; allow ${config.container.module.frkn.address};
deny all; deny all;

7
host/x86_64-linux/home/Network.nix
View file

@ -50,8 +50,7 @@ in {
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 0/0 -o ${wan} -j MASQUERADE iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 0/0 -o ${wan} -j MASQUERADE
# Full access from VPN clients. # Full access from VPN clients.
# iptables -I INPUT -j ACCEPT -s ${cfg.vpn.address} -d ${internal} iptables -I INPUT -j ACCEPT -s ${cfg.vpn.clients} -d ${internal}
iptables -I INPUT -j ACCEPT -s 10.1.1.0/24 -d ${internal}
iptables -I INPUT -j ACCEPT -s ${cfg.frkn.address} -d ${internal} iptables -I INPUT -j ACCEPT -s ${cfg.frkn.address} -d ${internal}
# Full access from Lan. # Full access from Lan.
@ -89,13 +88,13 @@ in {
+ (mkForward external 54631 cfg.download.address 54631 udp) + (mkForward external 54631 cfg.download.address 54631 udp)
# Git SSH connections. # Git SSH connections.
# + (mkForward external cfg.git.portSsh cfg.git.address cfg.git.portSsh tcp) + (mkForward external cfg.git.portSsh cfg.git.address cfg.git.portSsh tcp)
+ (mkForward internal cfg.git.portSsh cfg.git.address cfg.git.portSsh tcp) + (mkForward internal cfg.git.portSsh cfg.git.address cfg.git.portSsh tcp)
# Print serivce. # Print serivce.
+ (mkForward internal cfg.print.port cfg.print.address cfg.print.port tcp); + (mkForward internal cfg.print.port cfg.print.address cfg.print.port tcp);
# SSH access. # SSH access from WAN.
# + (mkForward external 22143 config.container.host 22143 tcp) # + (mkForward external 22143 config.container.host 22143 tcp)
}; };