1
0
Fork 0
hscloud/bgpwtf/machines/modules/router.nix

71 lines
4.3 KiB
Nix
Raw Permalink Normal View History

# Generic configuration for any bgpwtf router.
{ config, pkgs, lib, ... }:
with builtins;
rec {
imports = [
./routing.nix
./rename-interfaces.nix
./rsh-unbound.nix
./bootstrap.nix
./prometheus.nix
];
environment.systemPackages = with pkgs; [
tcpdump htop dstat file strace gdb mtr
vim wget curl htop dstat whois bind
rxvt-unicode-unwrapped.terminfo dhcpcd efibootmgr
];
networking.useDHCP = false;
networking.firewall.enable = false;
networking.useNetworkd = true;
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
boot.kernel.sysctl."net.ipv4.conf.*.accept_redirects" = 0;
boot.kernel.sysctl."net.ipv4.conf.*.send_redirects" = 0;
boot.kernel.sysctl."net.ipv4.conf.*.accept_source_route" = 0;
boot.kernel.sysctl."net.ipv4.conf.*.proxy_arp" = 0;
boot.kernel.sysctl."net.ipv4.conf.*.secure_redirects" = 1;
boot.kernel.sysctl."net.ipv4.conf.*.bootp_relay" = 0;
boot.kernel.sysctl."net.ipv4.conf.*.arp_filter" = 1;
boot.kernel.sysctl."net.ipv4.conf.*.arp_ignore" = 1;
boot.kernel.sysctl."net.ipv4.conf.*.arp_announce" = 2;
boot.kernel.sysctl."net.ipv4.conf.*.rp_filter" = 0;
boot.kernel.sysctl."net.ipv6.conf.*.forwarding" = 1;
boot.kernel.sysctl."net.ipv6.conf.*.accept_ra" = 0;
boot.kernel.sysctl."net.ipv6.conf.*.autoconf" = 0;
boot.kernel.sysctl."net.ipv6.conf.*.router_solicitations" = 0;
boot.kernel.sysctl."net.ipv6.route.max_size" = 2147483647;
# Limit nscd memory usage, as it sometimes just blows up and the OOMkiller
# sucks at picking it up.
systemd.services.nscd.serviceConfig.MemoryMax = "1G";
# enable coredumpctl
systemd.coredump.enable = true;
# Use Chrony instead of systemd-timesyncd
time.timeZone = "Europe/Warsaw";
services.chrony.enable = true;
networking.nameservers = [ "8.8.8.8" ];
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.passwordAuthentication = false;
# Allow for slightly more unauthenticated connections between dropping them,
# otherwise public bruteforcing will cause DoS preventing actual users from
# logging in.
services.openssh.extraConfig = ''
MaxStartups 100:30:1000
'';
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG599UildOrAq+LIOQjKqtGMwjgjIxozI1jtQQRKHtCP q3k@mimeomia"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQb3YQoiYFZLKwvHYKbu1bMqzNeDCAszQhAe1+QI5SLDOotclyY/vFmOReZOsmyMFl71G2d7d+FbYNusUnNNjTxRYQ021tVc+RkMdLJaORRURmQfEFEKbai6QSFTwErXzuoIzyEPK0lbsQuGgqT9WaVnRzHJ2Q/4+qQbxAS34PuR5NqEkmn4G6LMo3OyJ5mwPkCj9lsqz4BcxRaMWFO3mNcwGDfSW+sqgc3E8N6LKrTpZq3ke7xacpQmcG5DU9VO+2QVPdltl9jWbs3gXjmF92YRNOuKPVfAOZBBsp8JOznfx8s9wDgs7RwPmDpjIAJEyoABqW5hlXfqRbTnfnMvuR informatic@InformaticPC"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGkMgEVwQM8yeuFUYL2TwlJIq9yUNBmHnwce46zeL2PK2CkMz7sxT/om7sp/K5XDiqeD05Nioe+Dr3drP6B8uI33S5NgxPIfaqQsRS+CBEgk6cqFlcdlKETU/DT+/WsdoO173n7mgGeafPInEuQuGDUID0Fl099kIxtqfAhdeZFMM6/szAZEZsElLJ8K6dp1Ni/jmnXCZhjivZH3AZUlnqrmtDG7FY1bgcOfDXAal45LItughGPtrdiigXe9DK2fW3+9DBZZduh5DMJTNlphAZ+nfSrbyHVKUg6WsgMSprur4KdU47q1QwzqqvEj75JcdP1jOWoZi4F6VJDte9Wb9lhD1jGgjxY9O6Gs4CH35bx15W7CN9hgNa0C8NbPJe/fZYIeMZmJ1m7O2xmnYwP8j+t7RNJWu7Pa3Em4mOEXvhBF07Zfq+Ye/4SluoRgADy5eII2x5fFo5EBhInxK0/X8wF6XZvysalVifoCh7T4Edejoi91oAxFgYAxbboXGlod0eEHIi2hla8SM9+IBHOChmgawKBYp2kzAJyAmHNBF+Pah9G4arVCj/axp/SJZDZbJQoI7UT/fJzEtvlb5RWrHXRq+y6IvjpUq4pzpDWW04+9UMqEEXRmhWOakHfEVM9rN8h3aJBflLUBBnh0Z/hVsKNh8bCRHaKtah8TrD9i+wMw== patryk.jakuszew@gmail.com"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC33naG1ptCvUcRWX9cj9wXM1nW1lyQC4SvMJzWlr9aMD96O8hQ2JMkuIUgUJvorAY02QRplQ2BuoVoVkdkzwjMyi1bL3OdgcKo7Z1yByClGTTocqNJYY0lcUb6EJH8+6e6F9ydrQlSxNzL1uCaA7phZr+yPcmAmWbSfioXn98yXNkE0emHxzJv/nypJY56sDCMC2IXDRd8L2goDtPwgPEW7bWfAQdIFMJ75xOidZOTxJ8eqyXLw/kxY5UlyX66jdoYz1sE5XUHuoQl1AOG9UdlMo0aMhUvP4pX5l7r7EnA9OttKMFB3oWqkVK/R6ynZ52YNOU5BZ9V+Ppaj34W0xNu+p0mbHcCtXYCTrf/OU0hcZDbDaNTjs6Vtcm2wYw9iAKX7Tex+eOMwUwlrlcyPNRV5BTot7lGNYfauHCSIuWJKN4NhCLR/NtVNh4/94eKkPTwJsY6XqDcS7q49wPAs4DAH7BJgsbHPOqygVHrY0YYEfz3Pj0HTxJHQMCP/hQX4fXEGt0BjgoVJbXPAQtPyeg0JuxiUg+b4CgVVfQ6R060MlM1BZzhmh+FY5MJH6nJppS0aHYCvSg8Z68NUlCPKy0jpcyfuAIWQWwSGG1O010WShQG2ELsvNdg5/4HVdCGNl5mmoom6JOd72FOZyQlHDFfeQUQRn9HOeCq/c51rK99SQ== bartek@IHM"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTR292kx/2CNuWYIsZ6gykQ036aBGrmheIuZa6S1D2x implr@thonk"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGfIRe1nH6vwjQTjqHNnkKAdr1VYqGEeQnqInmf3A6UN ar@khas"
];
}