The networking base that ties the rest of the homelab together. Every
workload across every nixos-homelab-* repo declares allowIngress/
allowEgress on its workload
macros
-- this repo's cilium module is what actually enforces them as network
policy; without it they're just labels. It also provides the CNI itself,
inbound and outbound VPNs, routable IP pools, and DNS management.
See the Cilium network policies docs for the custom
resource kinds this repo's kubetree.cilium module adds, and
the options reference for the full list of module options.
{
inputs = {
...
homelab-networking = {
url = "github:nixos-homelab/networking";
inputs.nixpkgs.follows = "nixpkgs";
};
...
};
}{ inputs, ... }:
{
imports = [ inputs.homelab-networking.nixosModules.cilium ];
config.homelab.cilium.enable = true;
}- cilium: the Cilium CNI, plus the LoadBalancer
IP pool it hands out from -- see the Cilium network policies docs for
the
NetpolMacro/toPortsFlattenedresource kinds it also adds. - routed-ippool: a routable IPv4 pool for LoadBalancer services, routed to the cluster from the LAN.
- client-vpn: the inbound WireGuard gateway -- named access groups,
each scoped to specific services or full cluster access, for remote
kubectl/service access. - privacy-vpn: an outbound WireGuard tunnel to an external VPN
provider, for routing a workload's egress traffic through it (e.g.
homelab-media'srtorrent). - external-dns: external-dns, managing DNS records for cluster services automatically.
- unifi: Unifi Network Controller, for managing Ubiquiti networking gear.
- netutils: a debugging container with common networking tools, for troubleshooting from inside the cluster.