revamped proxy configs

4 files changed, 82 insertions, 27 deletions

diff --git a/os/core/networking.nix b/os/core/networking.nix
index d50d899..6cfe4ad 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -11,6 +11,25 @@ in
   options.os.core.network = {
     enable = lib.mkEnableOption "system-wide networking setup";
 
+    ips = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        router = "10.0.0.1";
+        host = "10.0.0.2";
+        vm1-opnsense = "10.0.0.3";
+        vm2-gateway = "10.0.0.4";
+        vm3-monitor = "10.0.0.5";
+        vm4-media = "10.0.0.6";
+        vm5-sandbox = "10.0.0.7";
+        vm6-storage = "10.0.0.8";
+        vm7-web = "10.0.0.9";
+        vm8-mail = "10.0.0.10";
+        vm9-relays = "10.0.0.11";
+        vm10-mc = "10.0.0.12";
+      };
+      description = "Central registry of static IP allocations for the cluster.";
+    };
+
     profile = lib.mkOption {
       type = lib.types.enum [
         "client"
diff --git a/os/srv/dns.nix b/os/srv/dns.nix
index f0c50a6..2da4c66 100644
--- a/os/srv/dns.nix
+++ b/os/srv/dns.nix
@@ -1,10 +1,22 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
 let
   cfg = config.os.srv.dns;
   unboundPort = 5335;
 in
 {
-  options.os.srv.dns.enable = lib.mkEnableOption "enables dns scanning";
+  options.os.srv.dns = {
+    enable = lib.mkEnableOption "enables dns scanning";
+    adguardProxyConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+    };
+  };
   config = lib.mkIf cfg.enable {
     services.unbound = {
       enable = true;
@@ -63,11 +75,17 @@ in
             config.os.core.network.wg.ip
             config.os.core.network.hs.ip
           ];
+          rewrites = [
+            {
+              domain = "router.local";
+              answer = config.os.core.network.ips.vm1-opnsense;
+            }
+          ];
           port = 53;
           upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
           bootstrap_dns = [ "9.9.9.9" ];
           cache_size = 536870912;
-          # anonymize_client_ip = true;
+          anonymize_client_ip = true;
         };
 
         filtering = {
@@ -239,6 +257,18 @@ in
       };
     };
 
+    os.srv.dns.adguardProxyConfig = {
+      "adguard.${masterDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
+          extraConfig = securityTemplates.restrictToInternal;
+        };
+      };
+    };
+
     networking.firewall = {
       allowedUDPPorts = [ 53 ];
       allowedTCPPorts = [ 53 ];
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index 4e74432..f00413d 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -12,7 +12,13 @@ in
 {
   options.os.srv.monero = {
     wallet.enable = lib.mkEnableOption "enables the monero wallet";
-    service.enable = lib.mkEnableOption "enables hosting a monero node";
+    service = {
+      enable = lib.mkEnableOption "enables hosting a monero node";
+      proxyConfig = lib.mkOption {
+        type = lib.types.attrs;
+        default = { };
+      };
+    };
   };
 
   config = lib.mkMerge [
@@ -22,10 +28,6 @@ in
     (lib.mkIf cfg.service.enable {
       assertions = [
         {
-          assertion = config.os.srv.nginx.enable;
-          message = "Hosting a Monero node requires nginx for proxying";
-        }
-        {
           assertion = config.os.srv.sops.enable;
           message = "Required for password secure password storing";
         }
@@ -55,19 +57,21 @@ in
         };
       };
 
-      services.nginx.virtualHosts."xmr.${masterDomain}" = {
-        enableACME = true;
-        forceSSL = true;
+      os.srv.monero.service.proxyConfig = {
+        "xmr.${masterDomain}" = {
+          enableACME = true;
+          forceSSL = true;
 
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:18081";
-          extraConfig = ''
-            proxy_read_timeout 600s;
-            proxy_send_timeout 600s;
-            client_max_body_size 50m;
+          locations."/" = {
+            proxyPass = "http://${config.os.core.network.ips.vm9-relays}:18081";
+            extraConfig = ''
+              proxy_read_timeout 600s;
+              proxy_send_timeout 600s;
+              client_max_body_size 50m;
 
-            ${securityTemplates.restrictToInternal}
-          '';
+              ${securityTemplates.restrictToInternal}
+            '';
+          };
         };
       };
 
diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
index 6159e25..a38b703 100644
--- a/os/srv/nginx.nix
+++ b/os/srv/nginx.nix
@@ -42,14 +42,16 @@ in
         recommendedTlsSettings = true;
         recommendedOptimisation = true;
         recommendedGzipSettings = true;
-        virtualHosts = {
-          default = {
-            serverName = "_";
-            default = true;
-            rejectSSL = true;
-            locations."/".return = "444";
-          };
-        };
+        virtualHosts = lib.mkMerge [
+          {
+            "_" = {
+              default = true;
+              rejectSSL = true;
+              locations."/".return = "444";
+            };
+          }
+          config.os.srv.monero.proxyConfig
+        ];
       };
 
       security.acme = {