]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/networking.nix
wireguard: setup intranet
[sourcephile-nix.git] / machines / mermet / networking.nix
1 { pkgs, lib, config, machineName, ipv4, machines, ... }:
2 with builtins;
3 let
4 inherit (builtins.extraBuiltins) pass-to-file;
5 inherit (config) networking users;
6 netIPv4 = ipv4;
7 netIPv4Gateway = "80.67.180.134";
8 #netIPv6 = "2001:912:400:104::35";
9 #netIPv6Gateway = "2001:912:400:104::1";
10 lanIPv4 = "192.168.1.214";
11 lanNet = "192.168.1.0/24";
12 lanIPv4Gateway = "192.168.1.1";
13 in
14 {
15 imports = [
16 networking/nftables.nix
17 networking/ssh.nix
18 networking/wireguard.nix
19 ];
20 boot.initrd.network = {
21 enable = true;
22 ssh = {
23 enable = true;
24 # To prevent ssh from freaking out because a different host key is used,
25 # a different port for dropbear is useful
26 # (assuming the same host has also a normal sshd running)
27 port = 2222;
28 authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
29 };
30 # This will automatically load the zfs password prompt on login
31 # and kill the other prompt so boot can continue
32 # The pkill zfs kills the zfs load-key from the console
33 # allowing the boot to continue.
34 postCommands = ''
35 echo >>/root/.profile "zfs load-key -a && pkill zfs"
36 '';
37 };
38
39 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
40 a 91.216.110.35/32 becomes a 91.216.110.35/8
41 boot.kernelParams = map
42 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
43 [ { clientIP = netIPv4; serverIP = "";
44 gatewayIP = networking.defaultGateway.address;
45 netmask = "255.255.255.255";
46 hostname = ""; device = networking.defaultGateway.interface;
47 autoconf = "off";
48 }
49 { clientIP = lanIPv4; serverIP = "";
50 gatewayIP = "";
51 netmask = "255.255.255.0";
52 hostname = ""; device = "enp2s0";
53 autoconf = "off";
54 }
55 ];
56 */
57 /* DIY network config, but a right one */
58 boot.initrd.preLVMCommands = ''
59 set -x
60
61 # IPv4 net
62 ip link set enp1s0 up
63 ip address add ${netIPv4}/32 dev enp1s0
64 ip route add ${netIPv4Gateway} dev enp1s0
65 ip route add default via ${netIPv4Gateway} dev enp1s0
66
67 # IPv4 lan
68 ip link set enp2s0 up
69 ip address add ${lanIPv4}/32 dev enp2s0
70 ip route add ${lanIPv4Gateway} dev enp2s0
71 ip route add ${lanNet} dev enp2s0 src ${lanIPv4} proto kernel
72 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
73
74 # IPv6 net
75 #ip -6 address add ''${netIPv6} dev enp1s0
76 #ip -6 route add ''${netIPv6Gateway} dev enp1s0
77 #ip -6 route add default via ''${netIPv6Gateway} dev enp1s0
78
79 ip -4 address
80 ip -4 route
81 #ip -6 address
82 #ip -6 route
83
84 set +x
85
86 # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
87 # we have to run the postCommands ourselves.
88 ${config.boot.initrd.network.postCommands}
89 '';
90
91 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
92 #boot.initrd.kernelModules = [ "ipv6" ];
93
94 # Useless without an out-of-band access, and unsecure
95 # (though / may still be encrypted at this point).
96 # boot.kernelParams = [ "boot.shell_on_fail" ];
97
98 # Disable IPv6 entirely until it's available
99 boot.kernel.sysctl = {
100 "net.ipv6.conf.enp1s0.disable_ipv6" = 1;
101 };
102
103 services.knot.extraConfig = lib.mkBefore ''
104 server:
105 listen: ${netIPv4}@53
106 #listen: ::@53
107 '';
108
109 networking = {
110 hostName = machineName;
111 domain = "sourcephile.fr";
112
113 useDHCP = false;
114 defaultGateway = {
115 address = netIPv4Gateway;
116 interface = "enp1s0";
117 };
118 /*
119 defaultGateway6 = {
120 address = netIPv6Gateway;
121 interface = "enp1s0";
122 };
123 */
124 #nameservers = [ ];
125 nftables.ruleset = ''
126 add rule inet filter input iifname "enp1s0" goto net2fw
127 add rule inet filter output oifname "enp1s0" goto fw2net
128 add rule inet filter fw2net ip daddr ${machines.losurdo.extraArgs.ipv4} counter accept comment "losurdo"
129
130 add rule inet filter input iifname "enp2s0" goto lan2fw
131 add rule inet filter output oifname "enp2s0" goto fw2lan
132 '';
133 interfaces.enp1s0 = {
134 useDHCP = false;
135 ipv4.addresses = [ { address = netIPv4; prefixLength = 32; } ];
136 ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
137
138 /*
139 ipv6.addresses = [ { address = netIPv6; prefixLength = 64; }
140 { address = "fe80::1"; prefixLength = 10; }
141 ];
142 ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
143 */
144 };
145 interfaces.enp2s0 = {
146 useDHCP = false;
147 ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
148 /*
149 # FIXME: remove this /1 hack when the machine will be racked at PTT
150 ipv4.routes = [ { address = "0.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
151 { address = "128.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
152 ];
153 */
154 /*
155 ipv6.addresses = [ { address = "fe80::1"; prefixLength = 10; } ];
156 ipv6.routes = [ ];
157 */
158 };
159 interfaces.enp3s0 = {
160 useDHCP = false;
161 };
162 };
163 }