hosts/mermet/networking.nix

   1 { lib, config, hostName, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   netIface = "enp1s0";
   6   netIPv4 = "80.67.180.129";
   7   netIPv4Gateway = "80.67.180.134";
   8   #netIPv6        = "2001:912:400:104::35";
   9   #netIPv6Gateway = "2001:912:400:104::1";
  10   lanIface = "enp2s0";
  11   lanIPv4 = "192.168.1.214";
  12   lanNet = "192.168.1.0/24";
  13   lanIPv4Gateway = "192.168.1.1";
  14 in
  15 {
  16   imports = [
  17     networking/nftables.nix
  18   ];
  19
  20   _module.args.ipv4 = netIPv4;
  21
  22   /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  23      a 91.216.110.35/32 becomes a 91.216.110.35/8
  24     boot.kernelParams = map
  25     (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  26     [ { clientIP = netIPv4; serverIP = "";
  27       gatewayIP = networking.defaultGateway.address;
  28       netmask = "255.255.255.255";
  29       hostname = ""; device = networking.defaultGateway.interface;
  30       autoconf = "off";
  31     }
  32     { clientIP = lanIPv4; serverIP = "";
  33       gatewayIP = "";
  34       netmask = "255.255.255.0";
  35       hostname = ""; device = "${lanIface}";
  36       autoconf = "off";
  37     }
  38     ];
  39   */
  40   /* DIY network config, but a right one */
  41   boot.initrd.preLVMCommands = ''
  42     set -x
  43
  44     # IPv4 net
  45     ip link set ${netIface} up
  46     ip address add ${netIPv4}/32 dev ${netIface}
  47     ip route add ${netIPv4Gateway} dev ${netIface}
  48     ip route add default via ${netIPv4Gateway} dev ${netIface}
  49
  50     # IPv4 lan
  51     ip link set ${lanIface} up
  52     ip address add ${lanIPv4}/32 dev ${lanIface}
  53     ip route add ${lanIPv4Gateway} dev ${lanIface}
  54     ip route add ${lanNet} dev ${lanIface} src ${lanIPv4} proto kernel
  55       # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  56
  57     # IPv6 net
  58     #ip -6 address add ''${netIPv6} dev ${netIface}
  59     #ip -6 route add ''${netIPv6Gateway} dev ${netIface}
  60     #ip -6 route add default via ''${netIPv6Gateway} dev ${netIface}
  61
  62     ip -4 address
  63     ip -4 route
  64     #ip -6 address
  65     #ip -6 route
  66
  67     set +x
  68
  69     # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  70     # we have to run the postCommands ourselves.
  71     ${config.boot.initrd.network.postCommands}
  72   '';
  73
  74   # Useless without an out-of-band access, and unsecure
  75   # (though / may still be encrypted at this point).
  76   # boot.kernelParams = [ "boot.shell_on_fail" ];
  77
  78   # Disable IPv6 entirely until it's available
  79   boot.kernel.sysctl = {
  80     "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
  81   };
  82
  83   services.knot.settingsFreeform.server.listen = [
  84     "${netIPv4}@53"
  85   ];
  86
  87   networking = {
  88     hostName = hostName;
  89     domain = "sourcephile.fr";
  90
  91     useDHCP = false;
  92     defaultGateway = {
  93       address = netIPv4Gateway;
  94       interface = "${netIface}";
  95     };
  96     /*
  97       defaultGateway6 = {
  98       address = netIPv6Gateway;
  99       interface = "${netIface}";
 100       };
 101     */
 102     #nameservers = [ ];
 103     nftables.ruleset = lib.mkAfter ''
 104       table inet filter {
 105         chain input {
 106           iifname ${netIface} goto input-net
 107           iifname ${lanIface} goto input-lan
 108         }
 109         chain output {
 110           oifname ${netIface} jump output-net
 111           oifname ${netIface} log level warn prefix "output-net: " counter drop
 112           oifname ${lanIface} goto output-lan
 113         }
 114       }
 115     '';
 116     interfaces.${netIface} = {
 117       useDHCP = false;
 118       ipv4.addresses = [{ address = netIPv4; prefixLength = 32; }];
 119       ipv4.routes = [{ address = networking.defaultGateway.address; prefixLength = 32; }];
 120
 121       /*
 122         ipv6.addresses = [ { address = netIPv6; prefixLength = 64; }
 123                        { address = "fe80::1"; prefixLength = 10; }
 124                      ];
 125         ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 126       */
 127     };
 128     interfaces.${lanIface} = {
 129       useDHCP = false;
 130       ipv4.addresses = [{ address = lanIPv4; prefixLength = 24; }];
 131       /*
 132         # FIXME: remove this /1 hack when the host will be racked at PTT
 133         ipv4.routes    = [ { address = "0.0.0.0";   prefixLength = 1; via = "192.168.1.1"; }
 134                        { address = "128.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
 135                        ];
 136       */
 137       /*
 138         ipv6.addresses = [ { address = "fe80::1"; prefixLength = 10; } ];
 139         ipv6.routes    = [ ];
 140       */
 141     };
 142     interfaces.enp3s0 = {
 143       useDHCP = false;
 144     };
 145   };
 146
 147   services.vnstat.enable = true;
 148 }