647 lines
18 KiB
Nix
647 lines
18 KiB
Nix
{
|
|
hardware,
|
|
config,
|
|
lib,
|
|
# outputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
/*
|
|
NOTE: My goal is to be able to apply most of the common tweaks to the router
|
|
either live on the system for ad-hoc changes (such as forwarding a port for a
|
|
multiplayer game) or to tweak these values just below without reaching deeper
|
|
into the modules' implementation of these configuration values
|
|
NOTE: I could turn this into a cool NixOS module?
|
|
TODO: review https://francis.begyn.be/blog/nixos-home-router
|
|
TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
|
|
*/
|
|
hosts = {
|
|
dragon = {
|
|
ip = "192.168.0.10";
|
|
};
|
|
bald = {
|
|
ip = "192.168.0.11";
|
|
additionalHosts = [
|
|
"ourcraft.lyte.dev"
|
|
];
|
|
};
|
|
beefcake = {
|
|
ip = "192.168.0.9";
|
|
additionalHosts = [
|
|
".beefcake.lan"
|
|
"a.lyte.dev"
|
|
"atuin.h.lyte.dev"
|
|
"audio.lyte.dev"
|
|
"bw.lyte.dev"
|
|
"files.lyte.dev"
|
|
"finances.h.lyte.dev"
|
|
"git.lyte.dev"
|
|
"grafana.h.lyte.dev"
|
|
"idm.h.lyte.dev"
|
|
"matrix.lyte.dev"
|
|
"nextcloud.h.lyte.dev"
|
|
"nix.h.lyte.dev"
|
|
"onlyoffice.h.lyte.dev"
|
|
"paperless.h.lyte.dev"
|
|
"prometheus.h.lyte.dev"
|
|
"video.lyte.dev"
|
|
"vpn.h.lyte.dev"
|
|
];
|
|
};
|
|
};
|
|
in
|
|
{
|
|
system.stateVersion = "24.11";
|
|
|
|
# hardware
|
|
boot = {
|
|
loader = {
|
|
efi.canTouchEfiVariables = true;
|
|
systemd-boot.enable = true;
|
|
};
|
|
initrd.availableKernelModules = [ "xhci_pci" ];
|
|
initrd.kernelModules = [ ];
|
|
kernelModules = [ "kvm-intel" ];
|
|
extraModulePackages = [ ];
|
|
};
|
|
|
|
fileSystems."/" = {
|
|
device = "/dev/disk/by-uuid/6ec80156-62e0-4f6f-b6eb-e2f588f88802";
|
|
fsType = "btrfs";
|
|
options = [ "subvol=root" ];
|
|
};
|
|
fileSystems."/nix" = {
|
|
device = "/dev/disk/by-uuid/6ec80156-62e0-4f6f-b6eb-e2f588f88802";
|
|
fsType = "btrfs";
|
|
options = [ "subvol=nix" ];
|
|
};
|
|
fileSystems."/home" = {
|
|
device = "/dev/disk/by-uuid/6ec80156-62e0-4f6f-b6eb-e2f588f88802";
|
|
fsType = "btrfs";
|
|
options = [ "subvol=home" ];
|
|
};
|
|
fileSystems."/boot" = {
|
|
device = "/dev/disk/by-uuid/7F78-7AE8";
|
|
fsType = "vfat";
|
|
options = [
|
|
"fmask=0022"
|
|
"dmask=0022"
|
|
];
|
|
};
|
|
powerManagement.cpuFreqGovernor = "performance";
|
|
|
|
imports = with hardware; [
|
|
common-cpu-intel
|
|
common-pc-ssd
|
|
];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
iftop
|
|
];
|
|
|
|
sops = {
|
|
defaultSopsFile = ../secrets/router/secrets.yml;
|
|
age = {
|
|
sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
keyFile = "/var/lib/sops-nix/key.txt";
|
|
generateKey = true;
|
|
};
|
|
secrets = {
|
|
netlify-ddns-password = {
|
|
mode = "0400";
|
|
};
|
|
};
|
|
};
|
|
services.deno-netlify-ddns-client = {
|
|
passwordFile = config.sops.secrets.netlify-ddns-password.path;
|
|
};
|
|
|
|
lyte = {
|
|
shell.enable = true;
|
|
router = {
|
|
enable = true;
|
|
hostname = "router";
|
|
domain = "h.lyte.dev";
|
|
interfaces = {
|
|
wan.mac = "00:01:2e:82:73:59";
|
|
lan.mac = "00:01:2e:82:73:5a";
|
|
};
|
|
# the main meat and potatoes for most routers, the firewall configuration
|
|
# TODO: IPv6
|
|
nftables = {
|
|
enable = true;
|
|
checkRuleset = true;
|
|
flushRuleset = true;
|
|
};
|
|
|
|
# NOTE: see flake.nix 'nnf.nixosModules.default'
|
|
/*
|
|
nftables.firewall = let
|
|
me = config.networking.nftables.firewall.localZoneName;
|
|
in {
|
|
enable = true;
|
|
snippets.nnf-common.enable = true;
|
|
|
|
zones = {
|
|
${interfaces.wan.name} = {
|
|
interfaces = [interfaces.wan.name interfaces.lan.name];
|
|
};
|
|
${interfaces.lan.name} = {
|
|
parent = interfaces.wan.name;
|
|
ipv4Addresses = [cidr];
|
|
};
|
|
## banned = {
|
|
## ingressExpression = [
|
|
## "ip saddr @banlist"
|
|
## "ip6 saddr @banlist6"
|
|
## ];
|
|
## egressExpression = [
|
|
## "ip daddr @banlist"
|
|
## "ip6 daddr @banlist6"
|
|
## ];
|
|
## };
|
|
};
|
|
|
|
rules = {
|
|
dhcp = {
|
|
from = "all";
|
|
to = [hosts.beefcake.ip];
|
|
allowedTCPPorts = [67];
|
|
allowedUDPPorts = [67];
|
|
};
|
|
http = {
|
|
from = "all";
|
|
to = [me];
|
|
allowedTCPPorts = [80 443];
|
|
};
|
|
router-ssh = {
|
|
from = "all";
|
|
to = [me];
|
|
allowedTCPPorts = [2201];
|
|
};
|
|
server-ssh = {
|
|
from = "all";
|
|
to = [hosts.beefcake.ip];
|
|
allowedTCPPorts = [22];
|
|
};
|
|
};
|
|
};
|
|
*/
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
# wait-online.anyInterface = true;
|
|
|
|
# configure known names for the network interfaces
|
|
links = {
|
|
"20-${interfaces.wan.name}" = {
|
|
enable = true;
|
|
matchConfig = {
|
|
MACAddress = interfaces.wan.mac;
|
|
};
|
|
linkConfig = {
|
|
Name = interfaces.wan.name;
|
|
};
|
|
};
|
|
"30-${interfaces.lan.name}" = {
|
|
enable = true;
|
|
matchConfig = {
|
|
MACAddress = interfaces.lan.mac;
|
|
};
|
|
linkConfig = {
|
|
Name = interfaces.lan.name;
|
|
};
|
|
};
|
|
};
|
|
|
|
# configure networks for the interfaces
|
|
networks = {
|
|
# LAN configuration is very simple and mostly forwarded between
|
|
# TODO: IPv6
|
|
"50-${interfaces.lan.name}" = {
|
|
matchConfig.Name = "${interfaces.lan.name}";
|
|
linkConfig = {
|
|
RequiredForOnline = "enslaved";
|
|
# Name = interfaces.lan.name;
|
|
};
|
|
|
|
address = [
|
|
cidr
|
|
];
|
|
networkConfig = {
|
|
# Description = "LAN network - connection to switch in house";
|
|
ConfigureWithoutCarrier = true;
|
|
# IPv6AcceptRA = false;
|
|
IPv6SendRA = true;
|
|
DHCPPrefixDelegation = true;
|
|
};
|
|
};
|
|
|
|
/*
|
|
WAN configuration requires DHCP to get addresses
|
|
we also disable some options to be certain we retain as much networking
|
|
control as we reasonably can, such as not letting the ISP determine our
|
|
hostname or DNS configuration
|
|
TODO: IPv6 (prefix delegation)
|
|
*/
|
|
"40-${interfaces.wan.name}" = {
|
|
matchConfig.Name = "${interfaces.wan.name}";
|
|
networkConfig = {
|
|
Description = "WAN network - connection to fiber ISP jack";
|
|
DHCP = true;
|
|
/*
|
|
IPv6AcceptRA = true;
|
|
IPv6PrivacyExtensions = true;
|
|
IPForward = true;
|
|
*/
|
|
};
|
|
dhcpV6Config = {
|
|
/*
|
|
ForceDHCPv6PDOtherInformation = true;
|
|
UseHostname = false;
|
|
UseDNS = false;
|
|
UseNTP = false;
|
|
*/
|
|
PrefixDelegationHint = "::/56";
|
|
};
|
|
dhcpV4Config = {
|
|
Hostname = hostname;
|
|
UseHostname = false;
|
|
UseDNS = false;
|
|
UseNTP = false;
|
|
UseSIP = false;
|
|
UseRoutes = false;
|
|
UseGateway = true;
|
|
};
|
|
linkConfig = {
|
|
RequiredForOnline = "routable";
|
|
# Name = interfaces.wan.name;
|
|
};
|
|
ipv6AcceptRAConfig = {
|
|
DHCPv6Client = "always";
|
|
UseDNS = false;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.resolved.enable = false;
|
|
|
|
/*
|
|
dnsmasq serves as our DHCP and DNS server
|
|
almost all the configuration should be derived from the values at the top of
|
|
this file
|
|
*/
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
listen-address = "::,127.0.0.1,${ip}";
|
|
port = 53;
|
|
|
|
/*
|
|
dhcp-authoritative = true;
|
|
dnssec = true;
|
|
*/
|
|
enable-ra = true;
|
|
|
|
server = [
|
|
"1.1.1.1"
|
|
"9.9.9.9"
|
|
"8.8.8.8"
|
|
];
|
|
|
|
domain-needed = true;
|
|
bogus-priv = true;
|
|
no-resolv = true;
|
|
|
|
cache-size = "10000";
|
|
|
|
dhcp-range = with dhcp_lease_space; [
|
|
"${interfaces.lan.name},${min},${max},${netmask},24h"
|
|
"::,constructor:${interfaces.lan.name},ra-stateless,ra-names,4h"
|
|
];
|
|
except-interface = interfaces.wan.name;
|
|
interface = interfaces.lan.name;
|
|
dhcp-host =
|
|
[
|
|
]
|
|
++ (lib.attrsets.mapAttrsToList (
|
|
name:
|
|
{
|
|
ip,
|
|
identifier ? name,
|
|
time ? "12h",
|
|
...
|
|
}:
|
|
"${name},${ip},${identifier},${time}"
|
|
) hosts);
|
|
|
|
address =
|
|
[
|
|
"/${hostname}.${domain}/${ip}"
|
|
]
|
|
++ (lib.lists.flatten (
|
|
lib.attrsets.mapAttrsToList (
|
|
name:
|
|
{
|
|
ip,
|
|
additionalHosts ? [ ],
|
|
identifier ? name,
|
|
time ? "12h",
|
|
}:
|
|
[
|
|
"/${name}.${domain}/${ip}"
|
|
(lib.lists.forEach additionalHosts (h: "/${h}/${ip}"))
|
|
]
|
|
) hosts
|
|
));
|
|
|
|
# local domains
|
|
local = "/lan/";
|
|
domain = "lan";
|
|
expand-hosts = true;
|
|
|
|
# don't use /etc/hosts as this would advertise surfer as localhost
|
|
no-hosts = true;
|
|
};
|
|
};
|
|
|
|
/*
|
|
since the home network reserves port 22 for ssh to the big server and to
|
|
gitea, the router uses port 2201 for ssh
|
|
*/
|
|
services.openssh.listenAddresses = [
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 2201;
|
|
}
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 22;
|
|
}
|
|
{
|
|
addr = "[::]";
|
|
port = 2201;
|
|
}
|
|
{
|
|
addr = "[::]";
|
|
port = 22;
|
|
}
|
|
];
|
|
|
|
services.fail2ban.enable = true;
|
|
|
|
/*
|
|
NOTE: everything from here on is deprecated or old stuff
|
|
|
|
TODO: may not be strictly necessary for IPv6?
|
|
TODO: also may not even be the best implementation?
|
|
services.radvd = {
|
|
enable = false;
|
|
## NOTE: this config is just the default arch linux config I think and may
|
|
## need tweaking? this is what I had on the arch linux router, though :shrug:
|
|
config = ''
|
|
interface lo
|
|
{
|
|
AdvSendAdvert on;
|
|
MinRtrAdvInterval 3;
|
|
MaxRtrAdvInterval 10;
|
|
AdvDefaultPreference low;
|
|
AdvHomeAgentFlag off;
|
|
|
|
prefix 2001:db8:1:0::/64
|
|
{
|
|
AdvOnLink on;
|
|
AdvAutonomous on;
|
|
AdvRouterAddr off;
|
|
};
|
|
|
|
prefix 0:0:0:1234::/64
|
|
{
|
|
AdvOnLink on;
|
|
AdvAutonomous on;
|
|
AdvRouterAddr off;
|
|
Base6to4Interface ppp0;
|
|
AdvPreferredLifetime 120;
|
|
AdvValidLifetime 300;
|
|
};
|
|
|
|
route 2001:db0:fff::/48
|
|
{
|
|
AdvRoutePreference high;
|
|
AdvRouteLifetime 3600;
|
|
};
|
|
|
|
RDNSS 2001:db8::1 2001:db8::2
|
|
{
|
|
AdvRDNSSLifetime 30;
|
|
};
|
|
|
|
DNSSL branch.example.com example.com
|
|
{
|
|
AdvDNSSLLifetime 30;
|
|
};
|
|
};
|
|
'';
|
|
};
|
|
|
|
TODO: old config, should be deleted ASAP
|
|
services.dnsmasq = {
|
|
enable = false;
|
|
settings = {
|
|
# server endpoints
|
|
listen-address = "::1,127.0.0.1,${ip}";
|
|
port = "53";
|
|
|
|
# DNS cache entries
|
|
cache-size = "10000";
|
|
|
|
# local domain entries
|
|
local = "/lan/";
|
|
domain = "lan";
|
|
expand-hosts = true;
|
|
|
|
dhcp-authoritative = true;
|
|
|
|
conf-file = "/usr/share/dnsmasq/trust-anchors.conf";
|
|
dnssec = true;
|
|
|
|
except-interface = "${wan_if}";
|
|
interface = "${lan_if}";
|
|
|
|
enable-ra = true;
|
|
|
|
# dhcp-option = "121,${cidr},${ip}";
|
|
|
|
dhcp-range = [
|
|
"lan,${dhcp_lease_space.min},${dhcp_lease_space.max},${netmask},10m"
|
|
"tag:${lan_if},::1,constructor:${lan_if},ra-names,12h"
|
|
];
|
|
|
|
dhcp-host = [
|
|
"${hosts.dragon.host},${hosts.dragon.ip},12h"
|
|
"${hosts.beefcake.host},${hosts.beefcake.ip},12h"
|
|
];
|
|
|
|
# may need to go in /etc/hosts (networking.extraHosts), too?
|
|
address = [
|
|
"/video.lyte.dev/192.168.0.9"
|
|
"/git.lyte.dev/192.168.0.9"
|
|
"/bw.lyte.dev/192.168.0.9"
|
|
"/files.lyte.dev/192.168.0.9"
|
|
"/vpn.h.lyte.dev/192.168.0.9"
|
|
"/.h.lyte.dev/192.168.0.9"
|
|
];
|
|
|
|
server = [
|
|
"${ip}"
|
|
"8.8.8.8"
|
|
"8.8.4.4"
|
|
"1.1.1.1"
|
|
"1.0.0.1"
|
|
];
|
|
};
|
|
};
|
|
|
|
TODO: old config, should be deleted ASAP
|
|
nftables = {
|
|
enable = false;
|
|
flushRuleset = true;
|
|
|
|
tables = {
|
|
filter = {
|
|
family = "inet";
|
|
content = ''
|
|
chain input {
|
|
# type filter hook input priority filter; policy accept;
|
|
type filter hook input priority 0;
|
|
|
|
# anything from loopback interface
|
|
iifname "lo" accept
|
|
|
|
# accept traffic we originated
|
|
ct state { established, related } counter accept
|
|
ct state invalid counter drop
|
|
|
|
# ICMP
|
|
ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
|
|
ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
|
|
ip protocol icmpv6 counter accept
|
|
ip protocol icmp counter accept
|
|
meta l4proto ipv6-icmp counter accept
|
|
udp dport dhcpv6-client counter accept
|
|
|
|
tcp dport { 64022, 22, 53, 67, 25565 } counter accept
|
|
udp dport { 64020, 22, 53, 67 } counter accept
|
|
|
|
## iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
|
|
## iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
|
|
iifname "${lan_if}" tcp dport { llmnr } counter accept
|
|
iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
|
|
|
|
counter drop
|
|
}
|
|
|
|
# allow all outgoing
|
|
chain output {
|
|
type filter hook output priority 0;
|
|
accept
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0;
|
|
accept
|
|
}
|
|
'';
|
|
};
|
|
|
|
nat = {
|
|
family = "ip";
|
|
content = ''
|
|
set masq_saddr {
|
|
type ipv4_addr
|
|
flags interval
|
|
elements = { ${cidr} }
|
|
}
|
|
|
|
map map_port_ipport {
|
|
type inet_proto . inet_service : ipv4_addr . inet_service
|
|
}
|
|
|
|
chain prerouting {
|
|
iifname ${lan_if} accept
|
|
|
|
type nat hook prerouting priority dstnat + 1; policy accept;
|
|
fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
|
|
|
|
iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
|
|
iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
|
|
|
|
## iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
|
|
## iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
|
|
|
|
## router
|
|
iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
|
|
}
|
|
|
|
chain output {
|
|
type nat hook output priority -99; policy accept;
|
|
ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
|
|
}
|
|
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat + 1; policy accept;
|
|
oifname ${lan_if} masquerade
|
|
ip saddr @masq_saddr masquerade
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
TODO: also want to try to avoid using dhcpcd for IPv6 since systemd-networkd
|
|
should be sufficient?
|
|
dhcpcd = {
|
|
enable = false;
|
|
extraConfig = ''
|
|
duid
|
|
|
|
## No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
|
|
## issues caused by guests with oneplus devices
|
|
noarp
|
|
|
|
persistent
|
|
vendorclassid
|
|
|
|
option domain_name_servers, domain_name, domain_search
|
|
option classless_static_routes
|
|
option interface_mtu
|
|
option host_name
|
|
#option ntp_servers
|
|
|
|
require dhcp_server_identifier
|
|
slaac private
|
|
noipv4ll
|
|
noipv6rs
|
|
|
|
static domain_name_servers=${ip}
|
|
|
|
interface ${wan_if}
|
|
gateway
|
|
ipv6rs
|
|
iaid 1
|
|
## option rapid_commit
|
|
## ia_na 1
|
|
ia_pd 1 ${lan_if}
|
|
|
|
interface ${lan_if}
|
|
static ip_address=${cidr}
|
|
static routers=${ip}
|
|
static domain_name_servers=${ip}
|
|
'';
|
|
};
|
|
*/
|
|
};
|
|
}
|