Add omega-relay prototype host

4 files changed, 135 insertions, 1 deletions

diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
new file mode 100644
index 0000000..73bb853
--- /dev/null
+++ b/hosts/omega-relay/default.nix
@@ -0,0 +1,43 @@
+{ pkgs, lib, config, ...}: {
+  imports = [
+   ./firewall.nix
+   ./vm.nix 
+  ];
+
+  addons = {
+    desktop.hyprland.enable = lib.mkForce false; 
+    desktop.xfce.enable = lib.mkForce false; 
+    
+    virtialisation.guest = config.addons.virtualization.isTestVM; 
+    gpg.enable = true;
+  };
+
+  boot.loader.grub = {
+    useOSProber = true;
+  };
+
+  networking.hostName = "omega-relay";  
+  services.resolved = {
+    enable = true; 
+    dnsovertls = "opportunistic";
+  };
+
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    openFirewall = true;
+    allowSFTP = true;
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = [ "wilkuu" ];
+      X11Forwarding = false;
+      PermitRootLogin = "no";
+      PrintMotd = true;
+    };
+  };
+
+  
+
+
+  
+}
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
new file mode 100644
index 0000000..7b04813
--- /dev/null
+++ b/hosts/omega-relay/firewall.nix
@@ -0,0 +1,53 @@
+{ ... }:
+let
+  baseTCP = [
+    20 22 433
+  ];
+  baseUDP = [
+    16555 # Wireguard
+  ];
+  baseTCPRanges = [
+  ];
+
+  baseUDPRanges = [
+  ];
+
+  secureTCP = [
+  ];
+
+  secureUDP = [
+  ];
+
+  secureTCPRanges = [
+  ];
+
+  secureUDPRanges = [
+  ];
+in
+{
+  networking.nftables.enable = true;
+  networking.firewall = {
+    enable = true;
+    checkReversePath = false;
+    allowedTCPPorts = baseTCP;
+    allowedUDPPorts = baseUDP;
+    allowedUDPPortRanges = baseUDPRanges;
+    allowedTCPPortRanges = baseTCPRanges;
+    interfaces = {
+      "wg-home" = {
+        allowedTCPPorts = secureTCP;
+        allowedUDPPorts = secureUDP;
+        allowedUDPPortRanges = secureUDPRanges;
+        allowedTCPPortRanges = secureTCPRanges;
+      };
+    };
+    trustedInterfaces = [
+      "docker0"
+      "br-*"
+      "veth*"
+      "vnet*"
+      "virbr*"
+    ];
+
+  };
+}
diff --git a/hosts/omega-relay/vm.nix b/hosts/omega-relay/vm.nix
new file mode 100644
index 0000000..e2b80d1
--- /dev/null
+++ b/hosts/omega-relay/vm.nix
@@ -0,0 +1,38 @@
+{lib, config,...}: let 
+  tcpFromHost = gport: hport: {
+    from = "host"; 
+    proto = "tcp"; 
+    host = { 
+      port = hport; 
+      address = "10.0.69.1";
+    };
+    guest = { 
+      port = gport; 
+      address = "10.0.69.2";
+    };
+  };
+in {
+  virtualisation.vmVariant = {
+    addons.virtualisation.isTestVM = true; 
+    fileSystems."/" = {
+      device = "none";
+      fsType = "tmpfs";
+      options = [
+        "defaults"
+        "size=2G"
+        "mode=755"
+      ];
+    };
+   virtualization = {
+      forwardPorts = [
+        (tcpFromHost 80 8080)
+        (tcpFromHost 22 8022)
+      ]; 
+      virtualisation = {
+        memorySize = 2048; # Use 2048MiB memory.
+        cores = 3;
+        graphics = true;
+      };
+    };
+  }; 
+}
diff --git a/hosts/test_vm/default.nix b/hosts/test_vm/default.nix
index 6dd2fc1..14ca75b 100644
--- a/hosts/test_vm/default.nix
+++ b/hosts/test_vm/default.nix
@@ -5,7 +5,7 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  networking.hostName = "cookie_vm"; # Define your hostname.
+  networking.hostName = "omega-relay"; # Define your hostname.
   networking.networkmanager.enable = true;
   programs.nix-ld.enable = true;