sys: unify gate and vpn into a globally-addressable IPv6-only network

1 files changed, 62 insertions, 77 deletions

diff --git a/sys/nspawn/dmz.nix b/sys/nspawn/dmz.nix
index f1f1cc8..3fe0335 100644
--- a/sys/nspawn/dmz.nix
+++ b/sys/nspawn/dmz.nix
@@ -3,6 +3,8 @@ with lib; let
   cfg = config.local.nspawn.dmz;
   inherit (config.local) mailHost;
 
+  dmzNet = config.local.nets.${cfg.netName};
+
   hassPort = config.services.home-assistant.config.http.server_port;
   hassEnable = config.local.home-assistant.enable;
 
@@ -13,17 +15,18 @@ in
   options.local.nspawn.dmz = {
     enable = mkEnableOption "DMZ services in a container";
 
-    net = mkOption {
+    netName = mkOption {
       type = types.str;
     };
 
-    net6 = mkOption {
+    net = mkOption {
       type = types.str;
+      readOnly = true;
     };
 
-    # Solo para IPv4
-    netBits = mkOption {
-      type = types.enum [ 30 ];
+    net6 = mkOption {
+      type = types.str;
+      readOnly = true;
     };
 
     dmzAddr = mkOption {
@@ -69,87 +72,69 @@ in
       mailHost.mdaListen = cfg.hostAddr;
       conduit.listenAddress = mkIf conduitEnable cfg.hostAddr;
 
-      nspawn.dmz =
-        let
-          incrementIpv4 = bytes: (incrementIpv4' bytes).tail;
-
-          incrementIpv4' = bytes:
-            let
-              next = incrementIpv4' (tail bytes);
-              byteInc = (head bytes) + next.carry;
-            in
-            if bytes == [ ]
-            then { tail = [ ]; carry = 1; }
-            else if byteInc < 256
-            then { tail = [ byteInc ] ++ next.tail; carry = 0; }
-            else { tail = [ 0 ] ++ next.tail; carry = 1; };
-
-          joinIpv4 = bytes: concatStringsSep "." (map toString bytes);
-          hostBytes = incrementIpv4 (map toInt (splitString "." cfg.net));
-        in
-        {
-          dmzAddr = joinIpv4 (incrementIpv4 hostBytes);
-          hostAddr = joinIpv4 hostBytes;
-          hostAddr6 = throwIf (! hasSuffix "::" cfg.net6) "Invalid IPv6 /64: ${cfg.net6}" "${cfg.net6}1";
-
-          system =
-            let
-              containerModule = { ... }: {
-                #TODO: urgente: bloquear puertos de dovecot a non-postfix con iptables
-                config = {
-                  local = {
-                    preset.dmz = {
-                      enable = true;
-                      container = true;
-                    };
+      nspawn.dmz = {
+        dmzAddr = dmzNet.hosts.dmz.v4.address;
+        hostAddr = dmzNet.hosts.host.v4.address;
+        hostAddr6 = dmzNet.hosts.host.v6.address;
+
+        system =
+          let
+            containerModule = { ... }: {
+              #TODO: urgente: bloquear puertos de dovecot a non-postfix con iptables
+              config = {
+                local = {
+                  preset.dmz = {
+                    enable = true;
+                    container = true;
+                  };
 
-                    mta = {
-                      mdaAddr = mailHost.mdaListen;
-                      inherit (mailHost) saslPort lmtpPort;
-                    };
+                  mta = {
+                    mdaAddr = mailHost.mdaListen;
+                    inherit (mailHost) saslPort lmtpPort;
+                  };
 
-                    web.sites = {
-                      home = {
-                        enable = hassEnable;
-                        proxyUrl = "http://${cfg.hostAddr}:${toString hassPort}";
-                      };
+                  web.sites = {
+                    home = {
+                      enable = hassEnable;
+                      proxyUrl = "http://${cfg.hostAddr}:${toString hassPort}";
+                    };
 
-                      matrix = {
-                        enable = conduitEnable;
-                        proxyUrl = "http://${cfg.hostAddr}:${toString conduitPort}";
-                      };
+                    matrix = {
+                      enable = conduitEnable;
+                      proxyUrl = "http://${cfg.hostAddr}:${toString conduitPort}";
                     };
                   };
+                };
 
-                  nixpkgs = {
-                    pkgs = mkDefault pkgs;
-                    localSystem = mkDefault pkgs.stdenv.hostPlatform;
-                  };
+                nixpkgs = {
+                  pkgs = mkDefault pkgs;
+                  localSystem = mkDefault pkgs.stdenv.hostPlatform;
+                };
 
-                  services.nginx.virtualHosts = {
-                    "${config.local.domains.imap.main}".locations."^~ /.well-known/acme-challenge/" = {
-                      root = "/var/lib/acme/acme-challenge";
+                services.nginx.virtualHosts = {
+                  "${config.local.domains.imap.main}".locations."^~ /.well-known/acme-challenge/" = {
+                    root = "/var/lib/acme/acme-challenge";
 
-                      extraConfig = ''
-                        auth_basic off;
-                        auth_request off;
-                      '';
-                    };
+                    extraConfig = ''
+                      auth_basic off;
+                      auth_request off;
+                    '';
                   };
                 };
               };
-            in
-            # Tomado de la definición de pkgs.nixos junto con definición de nixpkgs.{pkgs,localSystem} arriba
-            import "${flakes.nixpkgs}/nixos/lib/eval-config.nix" {
-              modules = [
-                ../.
-                containerModule
-              ];
-
-              system = null;
-              specialArgs = { inherit flakes; };
             };
-        };
+          in
+          # Tomado de la definición de pkgs.nixos junto con definición de nixpkgs.{pkgs,localSystem} arriba
+          import "${flakes.nixpkgs}/nixos/lib/eval-config.nix" {
+            modules = [
+              ../.
+              containerModule
+            ];
+
+            system = null;
+            specialArgs = { inherit flakes; };
+          };
+      };
     };
 
     services = {
@@ -187,10 +172,10 @@ in
         };
 
         networkConfig = {
-          Address = [ "${cfg.hostAddr}/${toString cfg.netBits}" "${cfg.hostAddr6}/64" ];
+          Address = [ dmzNet.hosts.host.v4.cidr dmzNet.hosts.host.v6.cidr ];
           LinkLocalAddressing = "yes";
           DHCPServer = "yes";
-          IPMasquerade = "both";
+          IPMasquerade = "ipv4";
           LLDP = "yes";
           EmitLLDP = "customer-bridge";
           IPv6SendRA = "yes";
@@ -206,7 +191,7 @@ in
           {
             ipv6PrefixConfig = {
               Assign = "yes";
-              Prefix = "${cfg.net6}/64";
+              Prefix = dmzNet.v6.cidr;
             };
           }
         ];