237 lines
9.4 KiB
Nix
237 lines
9.4 KiB
Nix
{ config, lib, inputs, ... }: {
|
|
|
|
options.sysconfig.opts = {
|
|
|
|
netbird.enable = lib.options.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
};
|
|
|
|
virtualization.netbird = {
|
|
enable = lib.options.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = {
|
|
|
|
services.netbird = {
|
|
enable = config.sysconfig.opts.netbird.enable;
|
|
};
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [ 33080 ];
|
|
allowedUDPPorts = [ 3478 33073 ];
|
|
allowedUDPPortRanges = [{ from = 49152; to = 54152; }];
|
|
};
|
|
|
|
sops.secrets."netbird/coturnPass" = {};
|
|
|
|
containers.netbird = lib.mkIf config.sysconfig.opts.virtualization.netbird.enable {
|
|
|
|
autoStart = true;
|
|
privateNetwork = true;
|
|
hostAddress = "192.168.100.10";
|
|
localAddress = "192.168.100.23";
|
|
|
|
forwardPorts = [
|
|
|
|
{
|
|
hostPort = 3478;
|
|
containerPort = 3478;
|
|
protocol = "udp";
|
|
}
|
|
|
|
|
|
] ++ map (x: { hostPort = x; containerPort = x; protocol = "udp"; }) (builtins.genList (y: 49152 + y) (54152 - 49152));
|
|
|
|
|
|
extraFlags = [
|
|
"--load-credential=coturnPass:${config.sops.secrets."netbird/coturnPass".path}"
|
|
];
|
|
|
|
config = {
|
|
|
|
services.nginx.virtualHosts."vpn.blunkall.us" = {
|
|
listen = [
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 80;
|
|
ssl = false;
|
|
}
|
|
];
|
|
};
|
|
|
|
|
|
services.netbird = {
|
|
server = {
|
|
enable = true;
|
|
enableNginx = true;
|
|
domain = "vpn.blunkall.us";
|
|
|
|
dashboard = {
|
|
enable = true;
|
|
enableNginx = true;
|
|
settings = {
|
|
AUTH_AUTHORITY = "https://auth.blunkall.us/realms/General";
|
|
AUTH_CLIENT_ID = "netbird";
|
|
AUTH_SUPPORTED_SCOPES = "openid profile email offline_access api";
|
|
AUTH_AUDIENCE = "netbird";
|
|
USE_AUTH0 = false;
|
|
NETBIRD_TOKEN_SOURCE = "accessToken";
|
|
};
|
|
|
|
package = let
|
|
pkgs-us = import inputs.nixpkgs-us {
|
|
system = "x86_64-linux";
|
|
config.allowUnfree = true;
|
|
};
|
|
in pkgs-us.netbird-dashboard;
|
|
};
|
|
management = {
|
|
enable = true;
|
|
|
|
enableNginx = true;
|
|
|
|
disableAnonymousMetrics = true;
|
|
|
|
dnsDomain = "vpn";
|
|
|
|
turnDomain = "vpn.blunkall.us";
|
|
turnPort = 3478;
|
|
|
|
logLevel = "DEBUG";
|
|
|
|
oidcConfigEndpoint = "https://auth.blunkall.us/realms/General/.well-known/openid-configuration";
|
|
|
|
settings = {
|
|
"TURNConfig" = {
|
|
"Turns" = [
|
|
{
|
|
"Proto" = "udp";
|
|
"URI" = "turn:vpn.blunkall.us:3478";
|
|
"Username" = "netbird";
|
|
"Password"._secret = "/etc/netbird/coturnPass";
|
|
}
|
|
];
|
|
};
|
|
|
|
"DataStoreEncryptionKey" = null;
|
|
|
|
"HttpConfig" = {
|
|
"Address" = "0.0.0.0:443";
|
|
"AuthIssuer" = "https://auth.blunkall.us/realms/General";
|
|
"AuthAudience" = "netbird";
|
|
"AuthKeysLocation" = "https://auth.blunkall.us/realms/General/protocol/openid-connect/certs";
|
|
"AuthUserIDClaim" = "";
|
|
"CertFile" = "";
|
|
"CertKey" = "";
|
|
"IdpSignKeyRefreshEnabled" = false;
|
|
"OIDCConfigEndpoint" = "https://auth.blunkall.us/realms/General/.well-known/openid-configuration";
|
|
};
|
|
|
|
"DeviceAuthorizationFlow" = {
|
|
"Provider" = "none";
|
|
"ProviderConfig" = {
|
|
"Audience" = "netbird";
|
|
"AuthorizationEndpoint" = "";
|
|
"Domain" = "";
|
|
"ClientID" = "";
|
|
"ClientSecret" = "";
|
|
"TokenEndpoint" = "https://auth.blunkall.us/realms/General/protocol/openid-connect/token";
|
|
"DeviceAuthEndpoint" = "https://auth.blunkall.us/realms/General/protocol/openid-connect/auth/device";
|
|
"Scope" = "openid";
|
|
"UseIDToken" = false;
|
|
"RedirectURLs" = null;
|
|
};
|
|
};
|
|
|
|
"IdpManagerConfig" = {
|
|
"ManagerType" = "keycloak";
|
|
"ClientConfig" = {
|
|
"Issuer" = "https://auth.blunkall.us/realms/General";
|
|
"TokenEndpoint" = "https://auth.blunkall.us/realms/General/protocol/openid-connect/token";
|
|
"ClientID" = "netbird-backend";
|
|
"ClientSecret" = "QuqjTOAHKE6N6jJqkB1F1RGo3kqUhEdg";
|
|
"GrantType" = "client_credentials";
|
|
};
|
|
|
|
"ExtraConfig" = {
|
|
"AdminEndpoint" = "https://auth.blunkall.us/admin/realms/General";
|
|
};
|
|
"Auth0ClientCredentials" = null;
|
|
"AzureClientCredentials" = null;
|
|
"KeycloakClientCredentials" = null;
|
|
"ZitadelClientCredentials" = null;
|
|
};
|
|
|
|
"PKCEAuthorizationFlow" = {
|
|
"ProviderConfig" = {
|
|
"Audience" = "netbird";
|
|
"ClientID" = "netbird";
|
|
"ClientSecret" = "";
|
|
"Domain" = "";
|
|
"AuthorizationEndpoint" = "https://auth.blunkall.us/realms/General/protocol/openid-connect/auth";
|
|
"TokenEndpoint" = "https://auth.blunkall.us/realms/General/protocol/openid-connect/token";
|
|
"Scope" = "openid profile email offline_access api";
|
|
"RedirectURLs" = [
|
|
"http://localhost:53000"
|
|
];
|
|
"UseIDToken" = false;
|
|
"DisablePromptLogin" = false;
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
port = 443;
|
|
};
|
|
|
|
coturn = {
|
|
enable = true;
|
|
|
|
user = "netbird";
|
|
passwordFile = "/etc/netbird/coturnPass";
|
|
|
|
openPorts = map (x: x) (builtins.genList (y: 49152 + y) (54152 - 49152));
|
|
};
|
|
|
|
signal = {
|
|
enable = true;
|
|
enableNginx = true;
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
systemd.services.secrets_setup = {
|
|
wantedBy = [ "netbird-management.service" "coturn.service" ];
|
|
|
|
serviceConfig = {
|
|
LoadCredential = [
|
|
"coturnPass"
|
|
];
|
|
};
|
|
|
|
script = ''
|
|
cat ''${CREDENTIALS_DIRECTORY}/coturnPass > /etc/netbird/coturnPass
|
|
'';
|
|
};
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [ 80 ];
|
|
allowedUDPPorts = [ 3478 ];
|
|
allowedUDPPortRanges = [{ from = 49152; to = 54152; }];
|
|
};
|
|
|
|
system.stateVersion = "25.05";
|
|
};
|
|
};
|
|
};
|
|
|
|
|
|
|
|
}
|