Stuff

nixos/router.nix

@@ -1,12 +1,15 @@
 {
   lib,
   # outputs,
-  # config,
+  config,
   pkgs,
   ...
 }: let
   # NOTE: I could turn this into a cool NixOS module?
   # TODO: review https://francis.begyn.be/blog/nixos-home-router
+  # TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
+  hostname = "router";
+  domain = "h.lyte.dev";
   ip = "192.168.0.1";
   cidr = "${ip}/16";
   netmask = "255.255.0.0"; # see cidr
@@ -14,8 +17,16 @@
     min = "192.168.0.5";
     max = "192.168.0.250";
   };
-  wan_if = "wan0";
+  interfaces = {
-  lan_if = "lan0";
+    wan = {
+      name = "wan0";
+      mac = "00:01:2e:82:73:59";
+    };
+    lan = {
+      name = "lan0";
+      mac = "00:01:2e:82:73:5a";
+    };
+  };
   hosts = {
     dragon = {
       identifier = "dragon";
@@ -28,6 +39,18 @@
       ip = "192.168.0.9";
     };
   };
+  sysctl-entries = {
+    "net.ipv4.conf.all.forwarding" = true;
+    "net.ipv6.conf.all.forwarding" = true;
+
+    # TODO: may want to disable this once it's working
+    # "net.ipv6.conf.all.accept_ra" = 0;
+    # "net.ipv6.conf.all.autoconf" = 0;
+    # "net.ipv6.conf.all.use_tempaddr" = 0;
+
+    # "net.ipv6.conf.${wan_if}.accept_ra" = 2;
+    # "net.ipv6.conf.${wan_if}.autoconf" = 1;
+  };
 in {
   imports = [
     {
@@ -51,21 +74,89 @@ in {
 
   boot = {
     kernel = {
-      sysctl = {
+      sysctl = sysctl-entries;
-        "net.ipv4.conf.all.forwarding" = true;
+    };
-        "net.ipv6.conf.all.forwarding" = true;
+  };
 
-        # TODO: may want to disable this once it's working
+  environment = {
-        # "net.ipv6.conf.all.accept_ra" = 0;
+    systemPackages = with pkgs; [
-        # "net.ipv6.conf.all.autoconf" = 0;
+      wpa_supplicant
-        # "net.ipv6.conf.all.use_tempaddr" = 0;
+      inetutils
+      btop
+      htop
+      bottom
+      dog
+    ];
+  };
 
-        "net.ipv6.conf.wan0.accept_ra" = 2;
+  networking = {
-        "net.ipv6.conf.wan0.autoconf" = 1;
+    hostName = hostname;
+    domain = domain;
+    useDHCP = false;
+
+    extraHosts = ''
+            127.0.0.1 localhost
+            127.0.0.2 ${hostname}.${domain} ${hostname}
+            ${ip} ${hostname}.${domain} ${hostname}
+
+            ::1 localhost ip6-localhost ip6-loopback
+            ff02::1 ip6-allnodes
+      kkkkk      ff02::2 ip6-allrouters
+    '';
+
+    firewall.enable = true;
+    firewall.allowedTCPPorts = [
+      2201
+      22
+    ];
+  };
+
+  systemd.network = {
+    enable = true;
+    wait-online.anyInterface = true;
+    networks = {
+      "30-${interfaces.lan.name}" = {
+        matchConfig.MACAddress = "${interfaces.lan.mac}";
+        linkConfig.RequiredForOnline = "enslaved";
+        networkConfig = {
+          ConfigureWithoutCarrier = true;
+        };
+      };
+      "10-${interfaces.wan.name}" = {
+        matchConfig.MACAddress = "${interfaces.wan.mac}";
+        networkConfig = {
+          DHCP = true;
+          DNSOverTLS = true;
+          DNSSEC = true;
+          IPv6PrivacyExtensions = false;
+          IPForward = true;
+        };
+        linkConfig.RequiredForOnline = "routable";
       };
     };
   };
 
+  systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
+
+  services.openssh.listenAddresses = [
+    {
+      addr = "0.0.0.0";
+      port = 2201;
+    }
+    {
+      addr = "0.0.0.0";
+      port = 22;
+    }
+    {
+      addr = "[::]";
+      port = 2201;
+    }
+    {
+      addr = "[::]";
+      port = 22;
+    }
+  ];
+
   # # services.fail2ban.enable = true;
   # services.radvd = {
   #   enable = false;
@@ -181,35 +272,6 @@ in {
   #   };
   # };
 
-  environment.systemPackages = with pkgs; [
-    wpa_supplicant
-    inetutils
-  ];
-
-  networking = {
-    hostName = "router";
-    domain = "h.lyte.dev";
-    useDHCP = true;
-    wireless.enable = true;
-
-    # useDHCP = true;
-    # nat.enable = true; # TODO: maybe replace some of the nftables stuff with this module?
-
-    extraHosts = ''
-      127.0.0.1 localhost
-      ${ip} router.h.lyte.dev router
-
-      ::1 localhost ip6-localhost ip6-loopback
-      ff02::1 ip6-allnodes
-      ff02::2 ip6-allrouters
-    '';
-
-    firewall.enable = true;
-    firewall.allowedTCPPorts = [
-      2201
-      22
-    ];
-
   # nftables = {
   #   enable = false;
   #   flushRuleset = true;
@@ -345,29 +407,7 @@ in {
   #     	static domain_name_servers=${ip}
   #   '';
   # };
-  };
+  # };
-
-  systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
-
-  services.openssh.listenAddresses = [
-    {
-      addr = "0.0.0.0";
-      port = 2201;
-    }
-    {
-      addr = "0.0.0.0";
-      port = 22;
-    }
-    {
-      addr = "[::]";
-      port = 2201;
-    }
-    {
-      addr = "[::]";
-      port = 22;
-    }
-  ];
-
   # systemd.network = {
   #   enable = false;
   #   networks = {