Stuff
This commit is contained in:
parent
2b34c907b7
commit
bebdd082d2
1 changed files with 212 additions and 172 deletions
168
nixos/router.nix
168
nixos/router.nix
|
|
@ -1,12 +1,15 @@
|
|||
{
|
||||
lib,
|
||||
# outputs,
|
||||
# config,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
# NOTE: I could turn this into a cool NixOS module?
|
||||
# TODO: review https://francis.begyn.be/blog/nixos-home-router
|
||||
# TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
|
||||
hostname = "router";
|
||||
domain = "h.lyte.dev";
|
||||
ip = "192.168.0.1";
|
||||
cidr = "${ip}/16";
|
||||
netmask = "255.255.0.0"; # see cidr
|
||||
|
|
@ -14,8 +17,16 @@
|
|||
min = "192.168.0.5";
|
||||
max = "192.168.0.250";
|
||||
};
|
||||
wan_if = "wan0";
|
||||
lan_if = "lan0";
|
||||
interfaces = {
|
||||
wan = {
|
||||
name = "wan0";
|
||||
mac = "00:01:2e:82:73:59";
|
||||
};
|
||||
lan = {
|
||||
name = "lan0";
|
||||
mac = "00:01:2e:82:73:5a";
|
||||
};
|
||||
};
|
||||
hosts = {
|
||||
dragon = {
|
||||
identifier = "dragon";
|
||||
|
|
@ -28,6 +39,18 @@
|
|||
ip = "192.168.0.9";
|
||||
};
|
||||
};
|
||||
sysctl-entries = {
|
||||
"net.ipv4.conf.all.forwarding" = true;
|
||||
"net.ipv6.conf.all.forwarding" = true;
|
||||
|
||||
# TODO: may want to disable this once it's working
|
||||
# "net.ipv6.conf.all.accept_ra" = 0;
|
||||
# "net.ipv6.conf.all.autoconf" = 0;
|
||||
# "net.ipv6.conf.all.use_tempaddr" = 0;
|
||||
|
||||
# "net.ipv6.conf.${wan_if}.accept_ra" = 2;
|
||||
# "net.ipv6.conf.${wan_if}.autoconf" = 1;
|
||||
};
|
||||
in {
|
||||
imports = [
|
||||
{
|
||||
|
|
@ -51,21 +74,89 @@ in {
|
|||
|
||||
boot = {
|
||||
kernel = {
|
||||
sysctl = {
|
||||
"net.ipv4.conf.all.forwarding" = true;
|
||||
"net.ipv6.conf.all.forwarding" = true;
|
||||
sysctl = sysctl-entries;
|
||||
};
|
||||
};
|
||||
|
||||
# TODO: may want to disable this once it's working
|
||||
# "net.ipv6.conf.all.accept_ra" = 0;
|
||||
# "net.ipv6.conf.all.autoconf" = 0;
|
||||
# "net.ipv6.conf.all.use_tempaddr" = 0;
|
||||
environment = {
|
||||
systemPackages = with pkgs; [
|
||||
wpa_supplicant
|
||||
inetutils
|
||||
btop
|
||||
htop
|
||||
bottom
|
||||
dog
|
||||
];
|
||||
};
|
||||
|
||||
"net.ipv6.conf.wan0.accept_ra" = 2;
|
||||
"net.ipv6.conf.wan0.autoconf" = 1;
|
||||
networking = {
|
||||
hostName = hostname;
|
||||
domain = domain;
|
||||
useDHCP = false;
|
||||
|
||||
extraHosts = ''
|
||||
127.0.0.1 localhost
|
||||
127.0.0.2 ${hostname}.${domain} ${hostname}
|
||||
${ip} ${hostname}.${domain} ${hostname}
|
||||
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
ff02::1 ip6-allnodes
|
||||
kkkkk ff02::2 ip6-allrouters
|
||||
'';
|
||||
|
||||
firewall.enable = true;
|
||||
firewall.allowedTCPPorts = [
|
||||
2201
|
||||
22
|
||||
];
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
wait-online.anyInterface = true;
|
||||
networks = {
|
||||
"30-${interfaces.lan.name}" = {
|
||||
matchConfig.MACAddress = "${interfaces.lan.mac}";
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
networkConfig = {
|
||||
ConfigureWithoutCarrier = true;
|
||||
};
|
||||
};
|
||||
"10-${interfaces.wan.name}" = {
|
||||
matchConfig.MACAddress = "${interfaces.wan.mac}";
|
||||
networkConfig = {
|
||||
DHCP = true;
|
||||
DNSOverTLS = true;
|
||||
DNSSEC = true;
|
||||
IPv6PrivacyExtensions = false;
|
||||
IPForward = true;
|
||||
};
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
|
||||
|
||||
services.openssh.listenAddresses = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 2201;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 22;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = 2201;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
# # services.fail2ban.enable = true;
|
||||
# services.radvd = {
|
||||
# enable = false;
|
||||
|
|
@ -181,35 +272,6 @@ in {
|
|||
# };
|
||||
# };
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
wpa_supplicant
|
||||
inetutils
|
||||
];
|
||||
|
||||
networking = {
|
||||
hostName = "router";
|
||||
domain = "h.lyte.dev";
|
||||
useDHCP = true;
|
||||
wireless.enable = true;
|
||||
|
||||
# useDHCP = true;
|
||||
# nat.enable = true; # TODO: maybe replace some of the nftables stuff with this module?
|
||||
|
||||
extraHosts = ''
|
||||
127.0.0.1 localhost
|
||||
${ip} router.h.lyte.dev router
|
||||
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
'';
|
||||
|
||||
firewall.enable = true;
|
||||
firewall.allowedTCPPorts = [
|
||||
2201
|
||||
22
|
||||
];
|
||||
|
||||
# nftables = {
|
||||
# enable = false;
|
||||
# flushRuleset = true;
|
||||
|
|
@ -345,29 +407,7 @@ in {
|
|||
# static domain_name_servers=${ip}
|
||||
# '';
|
||||
# };
|
||||
};
|
||||
|
||||
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
|
||||
|
||||
services.openssh.listenAddresses = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 2201;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 22;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = 2201;
|
||||
}
|
||||
{
|
||||
addr = "[::]";
|
||||
port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
# };
|
||||
# systemd.network = {
|
||||
# enable = false;
|
||||
# networks = {
|
||||
|
|
|
|||
Loading…
Reference in a new issue