NixOS/hosts/vps/configuration.nix

{
  config,
  lib,
  inputs,
  ...
}:
let
  externalInterface = config.my.interfaces.${config.networking.hostName};
  wgInterface = "wg0";
  homeServer = config.my.ips.wg-server;
  wgFriendsSubnet = "${config.my.ips.wg-friends}/24";
  wgGuestsSubnet = "${config.my.ips.wg-gs}/24";
  wgServerSubnet = "${config.my.ips.wg-vps}/24";
  wgFriend1 = config.my.ips.wg-friend1;
  wgFriend2 = config.my.ips.wg-friend2;
  wgFriend3 = config.my.ips.wg-friend3;
  wgFriend4 = config.my.ips.wg-friend4;
  wgGuest1 = config.my.ips.wg-g1;
  giteaSshPort = 22;
  giteaSshPortStr = toString giteaSshPort;
  sshPort = 3456;
  webPorts = [
    80
    443
  ];
  wgPort = 51820;
  syncthingPort = toString 22000;
  synapseFederationPort = toString 8448;
  synapseClientPort = toString config.my.servers.synapse.port;
  syncplayPort = toString config.my.servers.syncplay.port;
  stashPort = toString config.my.servers.stash.port;
in
{
  imports = [
    ./hardware-configuration.nix
    ../../config/base.nix
  ];
  my = import ./toggles.nix { inherit config inputs; } // {
    secureHost = true;
    users.nixremote = {
      enable = true;
      authorizedKeys = inputs.self.lib.getSshKeys [
        "nixworkstation"
        "nixserver"
        "nixminiserver"
      ];
    };
  };
  image.modules.linode = { };
  services.smartd.enable = lib.mkForce false;
  environment.systemPackages = [ ];
  networking = {
    hostName = "vps";
    nat = {
      inherit externalInterface;
      enable = true;
      internalInterfaces = [ "wg0" ];
      forwardPorts = [
        {
          sourcePort = giteaSshPort;
          proto = "tcp";
          destination = "${homeServer}:${giteaSshPortStr}";
        }
      ];
    };
    nftables = {
      enable = true;
      tables."vps-snat" = {
        family = "ip";
        content = ''
          chain postrouting {
            type nat hook postrouting priority srcnat;
            iifname "${externalInterface}" oifname "${wgInterface}" ip daddr ${homeServer}/32 tcp dport ${giteaSshPortStr} masquerade comment "snat ssh forward"
          }
        '';
      };
    };
    firewall = {
      enable = true;
      filterForward = true;
      checkReversePath = "loose";
      allowedTCPPorts = [ sshPort ] ++ webPorts;
      allowedUDPPorts = [ wgPort ];
      extraForwardRules = ''
        iifname "${wgInterface}" ip saddr ${wgFriend1}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${wgFriend2}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${wgFriend3}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${wgFriend4}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend1}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend2}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend3}/32 tcp dport ${syncthingPort} accept
        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend4}/32 tcp dport ${syncthingPort} accept

        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} ip daddr ${homeServer}/32 tcp dport { ${synapseClientPort}, ${synapseFederationPort}, ${syncplayPort} } accept

        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} ip daddr ${homeServer}/32 icmp type echo-request accept
        iifname "${wgInterface}" ip saddr ${wgFriend1}/32 ip daddr ${homeServer}/32 tcp dport ${stashPort} accept
        iifname "${wgInterface}" ip saddr ${wgGuest1}/32 ip daddr ${homeServer}/32 tcp dport ${stashPort} accept
        iifname "${wgInterface}" ip saddr ${wgGuestsSubnet} ip daddr ${homeServer}/32 icmp type echo-request accept

        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} oifname "${externalInterface}" accept
        iifname "${wgInterface}" ip saddr ${wgGuestsSubnet} oifname "${externalInterface}" accept

        iifname "${externalInterface}" ip daddr ${homeServer}/32 tcp dport ${giteaSshPortStr} accept

        ip saddr ${wgFriendsSubnet} ip daddr ${wgServerSubnet} drop
        ip saddr ${wgServerSubnet} ip daddr ${wgFriendsSubnet} drop
        ip saddr ${wgGuestsSubnet} ip daddr ${wgServerSubnet} drop
        ip saddr ${wgServerSubnet} ip daddr ${wgGuestsSubnet} drop
        ip saddr ${wgGuestsSubnet} ip daddr ${wgFriendsSubnet} drop
        ip saddr ${wgFriendsSubnet} ip daddr ${wgGuestsSubnet} drop
      '';
    };
  };
  security.sudo-rs.extraRules = [
    {
      users = [ "nixremote" ];
      commands = [
        {
          command = "/run/current-system/sw/bin/nixos-rebuild";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];
  services.openssh.ports = [ sshPort ];
  sops.age = {
    generateKey = true;
    keyFile = "/var/lib/sops-nix/key.txt";
    sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  };
  users = {
    groups = {
      deploy = { };
      lidarr-reports = { };
    };
    users = {
      deploy = {
        isSystemUser = true;
        group = "deploy";
        openssh.authorizedKeys.keyFiles = [ ../../secrets/ssh/ed25519_deploy.pub ];
      };
      lidarr-reports = {
        isSystemUser = true;
        group = "lidarr-reports";
        openssh.authorizedKeys.keyFiles = [ ../../secrets/ssh/ed25519_lidarr-reports.pub ];
      };
    };
  };
}