hosts/losurdo/networking.nix

   1 {
   2   pkgs,
   3   config,
   4   hostName,
   5   ...
   6 }:
   7 with builtins;
   8 let
   9   inherit (config) networking;
  10   netIface = "enp5s0";
  11   lanNet = "192.168.1.0/24";
  12 in
  13 {
  14   imports = [
  15     networking/nftables.nix
  16     #networking/tor.nix
  17     networking/nsupdate.nix
  18     networking/wireless.nix
  19     networking/openvpn.nix
  20   ];
  21
  22   boot.initrd.network = {
  23     enable = true;
  24     flushBeforeStage2 = true;
  25   };
  26   boot.initrd.systemd = {
  27     network.networks = {
  28       "10-${netIface}" = {
  29         name = netIface;
  30         # Start a DHCP Client for IPv4 Addressing/Routing
  31         DHCP = "ipv4";
  32         networkConfig = {
  33           # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
  34           IPv6AcceptRA = true;
  35           IPv6PrivacyExtensions = true;
  36           KeepConfiguration = "dhcp-on-stop";
  37         };
  38       };
  39     };
  40   };
  41
  42   systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
  43   systemd.network = {
  44     enable = true;
  45     wait-online = {
  46       enable = false;
  47     };
  48     networks = {
  49       "10-${netIface}" = {
  50         name = netIface;
  51         # Start a DHCP Client for IPv4 Addressing/Routing
  52         DHCP = "ipv4";
  53         networkConfig = {
  54           # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
  55           IPv6AcceptRA = true;
  56           IPv6PrivacyExtensions = true;
  57           KeepConfiguration = "dhcp-on-stop";
  58         };
  59         linkConfig = {
  60           RequiredForOnline = "no";
  61         };
  62       };
  63     };
  64   };
  65
  66   /*
  67     WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  68      a 91.216.110.35/32 becomes a 91.216.110.35/8
  69     boot.kernelParams = map
  70     (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  71     [ { clientIP = netIPv4; serverIP = "";
  72       gatewayIP = networking.defaultGateway.address;
  73       netmask = "255.255.255.255";
  74       hostname = ""; device = networking.defaultGateway.interface;
  75       autoconf = "off";
  76     }
  77     { clientIP = lanIPv4; serverIP = "";
  78       gatewayIP = "";
  79       netmask = "255.255.255.0";
  80       hostname = ""; device = "enp2s0";
  81       autoconf = "off";
  82     }
  83     ];
  84   */
  85   # DIY network config, but a right one
  86   /*
  87     boot.initrd.preLVMCommands = ''
  88     set -x
  89
  90     # IPv4 lan
  91     ip link set ${netIface} up
  92     ip address add ${lanIPv4}/32 dev ${netIface}
  93     ip route add ${lanIPv4Gateway} dev ${netIface}
  94     ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
  95     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  96     ip route add default via ${lanIPv4Gateway} dev ${netIface}
  97
  98     # IPv6 net
  99     #ip -6 address add ''${lanIPv6} dev ${netIface}
 100     #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
 101     #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
 102
 103     ip -4 address
 104     ip -4 route
 105     #ip -6 address
 106     #ip -6 route
 107
 108     set +x
 109     '';
 110   */
 111   # Workaround https://github.com/NixOS/nixpkgs/issues/56822
 112   #boot.initrd.kernelModules = [ "ipv6" ];
 113
 114   # Useless without an out-of-band access, and unsecure
 115   # (though / may still be encrypted at this point).
 116   # boot.kernelParams = [ "boot.shell_on_fail" ];
 117
 118   /*
 119     # Disable IPv6 entirely until it's available
 120     boot.kernel.sysctl = {
 121     "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
 122     };
 123   */
 124
 125   networking = {
 126     hostName = hostName;
 127     domain = "sourcephile.fr";
 128
 129     useDHCP = false;
 130     enableIPv6 = true;
 131   };
 132
 133   networking.nftables.ruleset = ''
 134     table inet filter {
 135       chain input {
 136         iifname ${netIface} goto input-net
 137       }
 138       chain output {
 139         oifname ${netIface} jump output-net
 140         oifname ${netIface} log level warn prefix "output-net: " counter drop
 141       }
 142       chain output-net {
 143         ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
 144       }
 145     }
 146     table inet nat {
 147       chain postrouting {
 148         oifname ${netIface} masquerade
 149       }
 150     }
 151   '';
 152   /*
 153     security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
 154     # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
 155     system.activationScripts.ipv6 = ''
 156     ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
 157     '';
 158   */
 159   environment.systemPackages = [
 160     pkgs.iodine
 161   ];
 162   services.vnstat.enable = true;
 163   systemd.services.vnstat.serviceConfig = {
 164     Restart = "on-failure";
 165     RestartSec = "30s";
 166   };
 167 }