fix(homelab): use iptables rules to prevent wan access

nix/homelab/helm/helmfile.yaml

@@ -11,6 +11,8 @@ repositories:
     url: https://charts.longhorn.io
   - name: home-assistant
     url: https://pajikos.github.io/home-assistant-helm-chart
+  - name: pihole
+    url: https://mojo2600.github.io/pihole-kubernetes/
 
 releases:
   # Load Balancer
@@ -47,6 +49,13 @@ releases:
       - persistence:
           defaultClassReplicaCount: 1
 
+  - name: pihole
+    namespace: pihole-system
+    chart: pihole/pihole
+    version: 2.35.0
+    values:
+      - values/pihole.yaml
+
   # Minecraft
   - name: minecraft-router
     namespace: minecraft

nix/homelab/helm/values/pihole.yaml

@@ -0,0 +1,17 @@
+persistentVolumeClaim:
+  enabled: true
+
+DNS1:
+  1.1.1.1
+
+serviceWeb:
+  https:
+    enabled: false
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi

nix/homelab/kustomize/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 resources:
   - ./metallb/pool.yaml
   - ./traefik/config.yaml
-  - ./traefik/rfc1918-middleware.yaml
-  - ./traefik/chain.yaml
   - ./cert-manager/config.yaml
   - ./routes/minecraft.yaml
   - ./routes/gitea/ssh.yaml
@@ -14,3 +12,4 @@ resources:
   - ./routes/home-assistant.yaml
   - ./routes/consul-media.yaml
   - ./routes/consul-vaultwarden.yaml
+  - ./routes/pihole.yaml

nix/homelab/kustomize/routes/consul-media.yaml

@@ -36,12 +36,6 @@ spec:
     - backendRefs:
         - name: bazarr
           port: 6767
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain
 ---
 apiVersion: v1
 kind: Service
@@ -81,12 +75,6 @@ spec:
     - backendRefs:
         - name: prowlarr
           port: 9696
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain
 ---
 apiVersion: v1
 kind: Service
@@ -126,12 +114,6 @@ spec:
     - backendRefs:
         - name: radarr
           port: 7878
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain
 ---
 apiVersion: v1
 kind: Service
@@ -171,12 +153,6 @@ spec:
     - backendRefs:
         - name: sonarr
           port: 8989
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain
 ---
 apiVersion: v1
 kind: Service
@@ -216,12 +192,6 @@ spec:
     - backendRefs:
         - name: qbittorrent
           port: 8090
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain
 ---
 apiVersion: v1
 kind: Service
@@ -261,12 +231,6 @@ spec:
     - backendRefs:
         - name: flaresolverr
           port: 8191
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain
 ---
 apiVersion: v1
 kind: Service
@@ -306,9 +270,3 @@ spec:
     - backendRefs:
         - name: jellyfin
           port: 8096
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain

nix/homelab/kustomize/routes/consul-vaultwarden.yaml

@@ -41,9 +41,3 @@ spec:
     - backendRefs:
         - name: vaultwarden
           port: 8000
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain

nix/homelab/kustomize/routes/home-assistant.yaml

@@ -13,9 +13,3 @@ spec:
     - backendRefs:
         - name: home-assistant
           port: 8080
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain

nix/homelab/kustomize/routes/longhorn.yaml

@@ -13,9 +13,3 @@ spec:
     - backendRefs:
         - name: longhorn-frontend
           port: 80
-      filters:
-        - type: ExtensionRef
-          extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: rfc1918-chain

nix/homelab/kustomize/routes/pihole.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: longhorn
+  namespace: pihole-system
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: kube-system
+  hostnames:
+    - "pihole.lucalise.ca"
+  rules:
+    - backendRefs:
+        - name: pihole-web
+          port: 80

nix/homelab/kustomize/traefik/chain.yaml

@@ -1,43 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: rfc1918-chain
-  namespace: home
-spec:
-  chain:
-    middlewares:
-      - name: rfc1918-only
-        namespace: kube-system
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: rfc1918-chain
-  namespace: longhorn-system
-spec:
-  chain:
-    middlewares:
-      - name: rfc1918-only
-        namespace: kube-system
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: rfc1918-chain
-  namespace: media
-spec:
-  chain:
-    middlewares:
-      - name: rfc1918-only
-        namespace: kube-system
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: rfc1918-chain
-  namespace: vaultwarden
-spec:
-  chain:
-    middlewares:
-      - name: rfc1918-only
-        namespace: kube-system

nix/homelab/kustomize/traefik/rfc1918-middleware.yaml

@@ -1,11 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: rfc1918-only
-  namespace: kube-system
-spec:
-  ipAllowList:
-    sourceRange:
-      - "10.0.0.0/8"
-      - "172.16.0.0/12"
-      - "192.168.0.0/16"

nix/homelab/nodes/kube/configuration.nix

@@ -20,6 +20,12 @@
 
   networking.hostName = meta.hostname;
   networking.networkmanager.enable = true;
+  networking.firewall.extraCommands = ''
+    iptables -I INPUT -d 192.168.27.10/32 -s 10.0.0.0/8 -j ACCEPT
+    iptables -I INPUT -d 192.168.27.10/32 -s 172.16.0.0/12 -j ACCEPT
+    iptables -I INPUT -d 192.168.27.10/32 -s 192.168.0.0/16 -j ACCEPT
+    iptables -I INPUT -d 192.168.27.10/32 -j DROP
+  '';
 
   time.timeZone = "America/Vancouver";