···

       
14
       
 
       
      lib.mkMerge [

     

       
15
       
 
       
        {

     

       
16
       
 
       
          # Expose nebula for doing cert signing.

     

       
17
       
-
       
          environment.systemPackages = [ pkgs.nebula ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
18
       
 
       
          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];

     

       
19
       
 
       
          services.openssh.enable = true;

     

       
20
       
 
       
          networking.firewall.enable = true; # Implicitly true, but let's make sure.

     
···

       
51
       
 
       
      lighthouse =

     

       
52
       
 
       
        { ... }@args:

     

       
53
       
 
       
        makeNebulaNode args "lighthouse" {

     

       
0
       
 
       

     

       
54
       
 
       
          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       
55
       
 
       
            {

     

       
56
       
 
       
              address = "192.168.1.1";

     
···

       
76
       
 
       
                  host = "any";

     

       
77
       
 
       
                }

     

       
78
       
 
       
              ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       
            };

     

       
80
       
 
       
          };

     

       
81
       
 
       
        };

     
···

       
338
       
 
       
        # allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall

     

       
339
       
 
       
        allowAny.succeed("ping -c3 10.0.100.1")

     

       
340
       
 
       
        allowAny.fail("ping -c3 10.0.100.3")

     

       
0
       
 
       

     

       
0
       
 
       

     

       
341
       
 
       


     

       
342
       
 
       
        # allowFromLighthouse can ping the lighthouse and allowAny

     

       
343
       
 
       
        allowFromLighthouse.succeed("ping -c3 10.0.100.1")

     

···

       
14
       
 
       
      lib.mkMerge [

     

       
15
       
 
       
        {

     

       
16
       
 
       
          # Expose nebula for doing cert signing.

     

       
17
       
+
       
          environment.systemPackages = [

     

       
18
       
+
       
            pkgs.dig

     

       
19
       
+
       
            pkgs.nebula

     

       
20
       
+
       
          ];

     

       
21
       
 
       
          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];

     

       
22
       
 
       
          services.openssh.enable = true;

     

       
23
       
 
       
          networking.firewall.enable = true; # Implicitly true, but let's make sure.

     
···

       
54
       
 
       
      lighthouse =

     

       
55
       
 
       
        { ... }@args:

     

       
56
       
 
       
        makeNebulaNode args "lighthouse" {

     

       
57
       
+
       
          networking.firewall.allowedUDPPorts = [ 53 ];

     

       
58
       
 
       
          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       
59
       
 
       
            {

     

       
60
       
 
       
              address = "192.168.1.1";

     
···

       
80
       
 
       
                  host = "any";

     

       
81
       
 
       
                }

     

       
82
       
 
       
              ];

     

       
83
       
+
       
            };

     

       
84
       
+
       
            lighthouse = {

     

       
85
       
+
       
              dns = {

     

       
86
       
+
       
                enable = true;

     

       
87
       
+
       
                host = "10.0.100.1"; # bind to lighthouse interface

     

       
88
       
+
       
                port = 53; # answer on standard DNS port

     

       
89
       
+
       
              };

     

       
90
       
 
       
            };

     

       
91
       
 
       
          };

     

       
92
       
 
       
        };

     
···

       
349
       
 
       
        # allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall

     

       
350
       
 
       
        allowAny.succeed("ping -c3 10.0.100.1")

     

       
351
       
 
       
        allowAny.fail("ping -c3 10.0.100.3")

     

       
352
       
+
       
        # allowAny can also resolve DNS on lighthouse

     

       
353
       
+
       
        allowAny.succeed("dig @10.0.100.1 allowToLighthouse | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")

     

       
354
       
 
       


     

       
355
       
 
       
        # allowFromLighthouse can ping the lighthouse and allowAny

     

       
356
       
 
       
        allowFromLighthouse.succeed("ping -c3 10.0.100.1")