From cdd95bd39ce3ed3efc71698aa0adaf2160b4b3d6 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Sat, 13 Jan 2024 15:27:20 -0800 Subject: [PATCH 1/2] nixos/nebula: default to port 0 for hosts other than lighthouse/relay --- nixos/modules/services/networking/nebula.nix | 33 +++++++++++++++++--- nixos/tests/nebula.nix | 6 +++- 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix index e13876172dac..de68f514f5a6 100644 --- a/nixos/modules/services/networking/nebula.nix +++ b/nixos/modules/services/networking/nebula.nix @@ -95,8 +95,15 @@ in }; listen.port = mkOption { - type = types.port; - default = 4242; + type = types.nullOr types.port; + default = null; + defaultText = lib.literalExpression '' + if (config.services.nebula.networks.''${name}.isLighthouse || + config.services.nebula.networks.''${name}.isRelay) then + 4242 + else + 0; + ''; description = lib.mdDoc "Port number to listen on."; }; @@ -174,7 +181,15 @@ in }; listen = { host = netCfg.listen.host; - port = netCfg.listen.port; + port = ( + if netCfg.listen.port == null then + if (netCfg.isLighthouse || netCfg.isRelay) then + 4242 + else + 0 + else + netCfg.listen.port + ); }; tun = { disabled = netCfg.tun.disable; @@ -185,7 +200,15 @@ in outbound = netCfg.firewall.outbound; }; } netCfg.settings; - configFile = format.generate "nebula-config-${netName}.yml" settings; + configFile = format.generate "nebula-config-${netName}.yml" ( + warnIf + ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port < 1) + '' + Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}. + You will experience connectivity issues. + '' + settings + ); in { # Create the systemd service for Nebula. @@ -229,7 +252,7 @@ in # Open the chosen ports for UDP. networking.firewall.allowedUDPPorts = - unique (mapAttrsToList (netName: netCfg: netCfg.listen.port) enabledNetworks); + unique (filter (port: port != null && port > 0) (mapAttrsToList (netName: netCfg: netCfg.listen.port) enabledNetworks)); # Create the service users and groups. users.users = mkMerge (mapAttrsToList (netName: netCfg: diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix index 89b91d89fcb3..6c468153d5b2 100644 --- a/nixos/tests/nebula.nix +++ b/nixos/tests/nebula.nix @@ -10,6 +10,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let environment.systemPackages = [ pkgs.nebula ]; users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; services.openssh.enable = true; + networking.firewall.enable = true; # Implicitly true, but let's make sure. networking.interfaces.eth1.useDHCP = false; services.nebula.networks.smoke = { @@ -17,7 +18,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let ca = "/etc/nebula/ca.crt"; cert = "/etc/nebula/${name}.crt"; key = "/etc/nebula/${name}.key"; - listen = { host = "0.0.0.0"; port = 4242; }; + listen = { + host = "0.0.0.0"; + port = if (config.services.nebula.networks.smoke.isLighthouse || config.services.nebula.networks.smoke.isRelay) then 4242 else 0; + }; }; } extraConfig From 32f56d72667797a5adc555fd1e7c413072dae155 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Sat, 20 Jan 2024 19:28:19 -0800 Subject: [PATCH 2/2] nixos/nebula: fix port resolution for firewall rules --- nixos/modules/services/networking/nebula.nix | 25 ++++++++++---------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix index de68f514f5a6..2f9e41ae9c80 100644 --- a/nixos/modules/services/networking/nebula.nix +++ b/nixos/modules/services/networking/nebula.nix @@ -10,6 +10,15 @@ let format = pkgs.formats.yaml {}; nameToId = netName: "nebula-${netName}"; + + resolveFinalPort = netCfg: + if netCfg.listen.port == null then + if (netCfg.isLighthouse || netCfg.isRelay) then + 4242 + else + 0 + else + netCfg.listen.port; in { # Interface @@ -181,15 +190,7 @@ in }; listen = { host = netCfg.listen.host; - port = ( - if netCfg.listen.port == null then - if (netCfg.isLighthouse || netCfg.isRelay) then - 4242 - else - 0 - else - netCfg.listen.port - ); + port = resolveFinalPort netCfg; }; tun = { disabled = netCfg.tun.disable; @@ -202,10 +203,10 @@ in } netCfg.settings; configFile = format.generate "nebula-config-${netName}.yml" ( warnIf - ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port < 1) + ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port == 0) '' Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}. - You will experience connectivity issues. + You will likely experience connectivity issues: https://nebula.defined.net/docs/config/listen/#listenport '' settings ); @@ -252,7 +253,7 @@ in # Open the chosen ports for UDP. networking.firewall.allowedUDPPorts = - unique (filter (port: port != null && port > 0) (mapAttrsToList (netName: netCfg: netCfg.listen.port) enabledNetworks)); + unique (filter (port: port > 0) (mapAttrsToList (netName: netCfg: resolveFinalPort netCfg) enabledNetworks)); # Create the service users and groups. users.users = mkMerge (mapAttrsToList (netName: netCfg: