From bbd7f096a4dffe6c4f94e26639c5229482e90066 Mon Sep 17 00:00:00 2001 From: "Simon R. - fantomitechno" Date: Tue, 30 Jun 2026 11:54:22 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20My=20port=20planning?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- IPAM.md | 80 ++++++++++++++++++++++++++++---- README.md | 4 +- hosts/fant0mib0t/default.nix | 3 ++ modules/caddy/common | 16 ------- modules/caddy/conseil | 40 ++++++++++------ modules/caddy/fant0mib0t | 89 ++++++++++++++++++++++++++++++++++-- modules/matrix.nix | 2 +- modules/nas/copyparty.nix | 9 ++-- modules/nas/default.nix | 6 +-- modules/nas/s3.nix | 4 +- 10 files changed, 198 insertions(+), 55 deletions(-) delete mode 100644 modules/caddy/common diff --git a/IPAM.md b/IPAM.md index ff4e5bc..1b3eb68 100644 --- a/IPAM.md +++ b/IPAM.md @@ -2,17 +2,77 @@ ## VLANs -| VID | NAME | PREFIX | ACESS | PERMISSIONS | -| -- | -- | -- | -- | -- | -| 10 | ADMIN | `172.16.10.0/24` | Ethernet with 802.1X | Internet without restrictions, SSH to servers | -| 20 | SERVERS | `172.16.20.0/24` | specific ethernet ports | Internet without restrictions | -| 100 | GUEST | `172.16.100.0/24` | Ethernet and WiFi | Restricted to HTTP and HTTPS | +| VID | NAME | PREFIX | ACESS | PERMISSIONS | +| --- | ------- | ----------------- | ----------------------- | --------------------------------------------- | +| 10 | ADMIN | `172.16.10.0/24` | Ethernet with 802.1X | Internet without restrictions, SSH to servers | +| 20 | SERVERS | `172.16.20.0/24` | specific ethernet ports | Internet without restrictions | +| 100 | GUEST | `172.16.100.0/24` | Ethernet and WiFi | Restricted to HTTP and HTTPS | ## IPs -| hostname | address(es) | -| :-- | -- | +| hostname | address(es) | +| :----------------- | ----------------------------------------------------- | | OpnSense-DeLoreane | `172.16.10.1/24`, `172.16.20.1/24`, `172.16.100.1/24` | -| SG500X-Argo3 | `172.16.10.2/24`, `172.16.20.2/24`, `172.16.100.2/24` | -| conseil | `172.16.20.10/24` | -| fant0mib0t | `172.16.20.20/24` | \ No newline at end of file +| SG500X-Argo3 | `172.16.10.2/24`, `172.16.20.2/24`, `172.16.100.2/24` | +| Conseil | `172.16.20.10/24` | +| fant0mib0t | `172.16.20.20/24` | + +## Ports & DNS + +There is 4 domains that are in use: + +- `fantomitechno.dev` and `renoux.dev` that are domains used for public services and are available over the internet +- `fantom.home` which is not a real domain (it only exists via my router), this one is used for local services I, as a user, uses +- `fantom.internal` another local domain, this one used only for communication between different devices + +All DNS entries are registered by OpnSense-DeLoreane to point to each machines (using their 172.16.20.0/24 IP if they are on multiple networks). + +All public DNS entries are also registered on Cloudflare with a CNAME entry to `rack.fantomitechno.dev` which points to my public IP. + +| Ranges | Description | +| :----- | :------------- | +| 10XX | Websites | +| 20XX | Communications | +| 40XX | Storages | + +### OpnSense-DeLoreane + +| Port Number | Service | DNS entry | +| :---------- | :------- | :------------------- | +| 443 | OpnSense | `router.fantom.home` | + +### SG500X-Argo3 + +| Port Number | Service | DNS entry | +| :---------- | :----------- | :------------------- | +| 443 | Cisco Web UI | `switch.fantom.home` | + +### Conseil + +Global DNS: `conseil.renoux.dev` + +| Port Number | Service | DNS entry | +| :--------------- | :--------------- | :------------------------ | +| 22 | OpenSSH | | +| 80, 443 | Caddy | | +| 4000, 4001, 4002 | NFS | | +| 4010 | Garage S3 API | `s3.fantom.internal` | +| 4011 | Garage S3 Web UI | `s3.fantom.home` | +| 4020 | Copyparty | `files.fantomitechno.dev` | + +### fant0mib0t + +Global DNS: `fant0mib0t.renoux.dev` + +| Port Number | Service | DNS entry | +| :---------- | :------------------------------ | :-------------------------------------------- | +| 22 | OpenSSH | | +| 80, 443 | Caddy | | +| 2000 | Matrix | `matrix.fantomitechno.dev` | +| 2010 | Tranquill PDS | `pds.fantomitechno.dev` | +| 4000 | Tangled Knot | `knot.fantomitechno.dev` | +| 4010 | Tangled Spindle | `spindle.fantomitechno.dev` | +| 4020, 4021 | Cryptpad | `drive.renoux.dev`, `drive.s.renoux.dev` | +| 4030 | Kiwix | `kiwix.fantomitechno.dev`, `kiwix.renoux.dev` | +| | (redirection to Wikipedia .zim) | `wikipedia.renoux.dev` | +| 4040 | Immich | `photo.renoux.dev` | diff --git a/README.md b/README.md index 0d85d00..05f7bc2 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ nix build --no-link --print-out-paths ".#installer" ## Rebuild and switch on an existing configuration ```sh -rebuild +rebuild # or cd /home/fantomitechno/dotfiles && sudo nixos-rebuild switch --flake ``` @@ -37,4 +37,4 @@ For this you'll need the hostname to be set to an already existing configuration - `lux_wallpapere_v1.png`, `lux_wallpapere_v2.png` and `folly_wlalaper.png`: AlexxWinters\_ ([crd.co](https://alexxswinters.carrd.co/)) - `red_and_yellow.jpg`: Undertale: Red And Yellow by Sinix and more ([gmjlt](https://gamejolt.com/games/undertale-red-yellow/877387)) - `sol_rue.jpg`: (Extended Version of) OneShot by Future Cat Games ([stm](https://store.steampowered.com/app/420530/OneShot/)) -- `undertale_yellow.png`: Undertale Yellow by Team Undertale Yellow ([gmjlt](https://gamejolt.com/games/UndertaleYellow/136925)) \ No newline at end of file +- `undertale_yellow.png`: Undertale Yellow by Team Undertale Yellow ([gmjlt](https://gamejolt.com/games/UndertaleYellow/136925)) diff --git a/hosts/fant0mib0t/default.nix b/hosts/fant0mib0t/default.nix index 87dd86b..f623fff 100644 --- a/hosts/fant0mib0t/default.nix +++ b/hosts/fant0mib0t/default.nix @@ -6,12 +6,15 @@ { imports = [ ./hardware-configuration.nix + ./nfs.nix + ../server.nix ] ++ builtins.map (i: ../../modules/${i}) ([ "caddy" "radius" "tangled" + "matrix.nix" ]); # Bootloader diff --git a/modules/caddy/common b/modules/caddy/common deleted file mode 100644 index d65ee63..0000000 --- a/modules/caddy/common +++ /dev/null @@ -1,16 +0,0 @@ -{ - email simon@renoux.dev -} - -(logging) { - log { - output file /var/log/{args[0]}.log - format console - # level error - } -} - -@local_net client_ip 172.16.0.0/12 -@server_net client_ip 172.16.20.0/24 -@admin_net client_ip 172.16.10.0/24 -@guest_net client_ip 172.16.100.0/24 diff --git a/modules/caddy/conseil b/modules/caddy/conseil index 8141f8e..e7e3ce6 100644 --- a/modules/caddy/conseil +++ b/modules/caddy/conseil @@ -1,32 +1,46 @@ -import common +{ + email simon@renoux.dev +} + +(logging) { + log { + output file /var/log/{args[0]}.log + format console + # level error + } +} + +@local_net client_ip 172.16.0.0/12 +@server_net client_ip 172.16.20.0/24 +@admin_net client_ip 172.16.10.0/24 +@guest_net client_ip 172.16.100.0/24 conseil.renoux.dev { respond "Welcome!" } - -files.fantomitechno.dev { - import logging copyparty - reverse_proxy 127.0.0.1:3210 { +# Storage +http://s3.fantom.internal { + import logging garage + abort not @server_net + reverse_proxy 127.0.0.1:4010 { header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} } } - -s3.fantom.internal { +http://s3.fantom.home { import logging garage - abort not @server_net - reverse_proxy 127.0.0.1:3900 { + abort not @local_net + reverse_proxy 127.0.0.1:4011 { header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} } } -s3.fantom.home { - import logging garage - abort not @local_net - reverse_proxy 127.0.0.1:3901 { +files.fantomitechno.dev { + import logging copyparty + reverse_proxy 127.0.0.1:4020 { header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} } diff --git a/modules/caddy/fant0mib0t b/modules/caddy/fant0mib0t index 7268fad..991007c 100644 --- a/modules/caddy/fant0mib0t +++ b/modules/caddy/fant0mib0t @@ -1,13 +1,96 @@ -import common +{ + email simon@renoux.dev +} + +(logging) { + log { + output file /var/log/{args[0]}.log + format console + # level error + } +} + +@local_net client_ip 172.16.0.0/12 +@server_net client_ip 172.16.20.0/24 +@admin_net client_ip 172.16.10.0/24 +@guest_net client_ip 172.16.100.0/24 fant0mib0t.renoux.dev { respond "Welcome!" } - +# Communication matrix.fantomitechno.dev { import logging matrix - reverse_proxy 127.0.0.1:6167 { + reverse_proxy 127.0.0.1:2000 { + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Proto {scheme} + } +} + +pds.fantomitechno.dev { + import logging pds + reverse_proxy 127.0.0.1:2010 { + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Proto {scheme} + } +} + +# Storage +knot.fantomitechno.dev { + import logging knot + reverse_proxy 127.0.0.1:4000 { + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Proto {scheme} + } +} + +spindle.fantomitechno.dev { + import logging spindle + reverse_proxy 127.0.0.1:4001 { + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Proto {scheme} + } +} + +hold.fantomitechno.dev { + import logging hold + reverse_proxy 127.0.0.1:4010 { + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Proto {scheme} + } +} + +drive.renoux.dev, drive.s.renoux.dev { + import logging cryptpad + + handle /cryptpad_websocket* { + reverse_proxy 127.0.0.1:4021 + } + + handle { + reverse_proxy 127.0.0.1:44020 { + header_up X-Real-IP {remote_host} + header_up X-Forwarded-For {remote_host} + } + } +} + +kiwix.fantomitechno.dev, kiwix.renoux.dev { + import logging kiwix + reverse_proxy 127.0.0.1:4030 { + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Proto {scheme} + } +} + +wikipedia.renoux.dev { + redir https://kiwix.renoux.dev/viewer#wikipedia_en_all_maxi_2026-02{uri} +} + +photo.renoux.dev { + import logging immich + reverse_proxy 127.0.0.1:4040 { header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} } diff --git a/modules/matrix.nix b/modules/matrix.nix index a68909b..af5b222 100644 --- a/modules/matrix.nix +++ b/modules/matrix.nix @@ -16,7 +16,7 @@ ]; address = "127.0.0.1"; - port = 6167; + port = 2000; }; }; }; diff --git a/modules/nas/copyparty.nix b/modules/nas/copyparty.nix index 3b7f0c6..36a53b9 100644 --- a/modules/nas/copyparty.nix +++ b/modules/nas/copyparty.nix @@ -9,14 +9,12 @@ enable = true; user = "copyparty"; group = "copyparty"; + settings = { i = "172.16.20.10"; p = [ - 3210 - 3211 + 4020 ]; - no-reload = true; - ignored-flag = false; }; accounts = { @@ -27,7 +25,7 @@ volumes = { "/public" = { - # path = "" + path = "/data/public"; access = { r = "*"; @@ -35,6 +33,7 @@ }; flags = { + # scan for new files every 60sec scan = 60; }; }; diff --git a/modules/nas/default.nix b/modules/nas/default.nix index cda73a6..4551969 100644 --- a/modules/nas/default.nix +++ b/modules/nas/default.nix @@ -9,9 +9,9 @@ statdPort = 4000; lockdPort = 4001; mountdPort = 4002; - # exports = '' - # - # ''; + exports = '' + /data 172.16.20.0/24(insecure,rw,sync,crossmnt,fsid=0) 172.16.10.0/24(insecure,rw,sync,crossmnt,fsid=0) + ''; }; networking.firewall = { diff --git a/modules/nas/s3.nix b/modules/nas/s3.nix index f25701d..5f851b6 100644 --- a/modules/nas/s3.nix +++ b/modules/nas/s3.nix @@ -9,12 +9,12 @@ data_dir = "/var/lib/garage/data"; s3_api = { - api_bind_addr = "127.0.0.1:3900"; + api_bind_addr = "127.0.0.1:4010"; s3_region = "garage"; }; s3_web = { - bind_addr = "127.0.0.1:3902"; + bind_addr = "127.0.0.1:4011"; }; }; }; -- 2.54.0