From 5f6564ef5b690271dc594a727e0d287ffd59ea83 Mon Sep 17 00:00:00 2001 From: teutat3s Date: Fri, 12 Apr 2024 21:31:36 +0200 Subject: [PATCH] networking: add wireguard hosts to /etc/hosts Also re-enable DNSSEC, it's reported fixed in systemd-resolved --- hosts/flora-6/apps/drone.nix | 2 ++ modules/networking.nix | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/hosts/flora-6/apps/drone.nix b/hosts/flora-6/apps/drone.nix index 88bd302..9620d2b 100644 --- a/hosts/flora-6/apps/drone.nix +++ b/hosts/flora-6/apps/drone.nix @@ -78,6 +78,7 @@ extraOptions = [ "--network=drone-net" "--pull=always" + "--add-host=nachtigall.pub.solar:10.7.6.1" ]; environment = { DRONE_GITEA_SERVER = "https://git.pub.solar"; @@ -101,6 +102,7 @@ extraOptions = [ "--network=drone-net" "--pull=always" + "--add-host=nachtigall.pub.solar:10.7.6.1" ]; environment = { DRONE_RPC_HOST = "ci.pub.solar"; diff --git a/modules/networking.nix b/modules/networking.nix index 21242d3..490715b 100644 --- a/modules/networking.nix +++ b/modules/networking.nix @@ -2,6 +2,11 @@ # Don't expose SSH via public interfaces networking.firewall.interfaces.wg-ssh.allowedTCPPorts = [ 22 ]; + networking.hosts = { + "10.7.6.1" = ["nachtigall.pub.solar"]; + "10.7.6.2" = ["flora-6.pub.solar"]; + }; + services.openssh = { enable = true; openFirewall = lib.mkDefault false; @@ -31,14 +36,11 @@ services.resolved = { enable = true; - # DNSSEC=false because of random SERVFAIL responses with Greenbaum DNS - # when using allow-downgrade, see https://github.com/systemd/systemd/issues/10579 extraConfig = '' DNS=193.110.81.0#dns0.eu 185.253.5.0#dns0.eu 2a0f:fc80::#dns0.eu 2a0f:fc81::#dns0.eu 9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net FallbackDNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net Domains=~. DNSOverTLS=yes - DNSSEC=false ''; }; }