hosts/losurdo/networking.nix

   1 { pkgs, config, hostName, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   netIface = "enp5s0";
   6   lanNet = "192.168.1.0/24";
   7 in
   8 {
   9   imports = [
  10     networking/nftables.nix
  11     #networking/tor.nix
  12     networking/nsupdate.nix
  13     networking/wireless.nix
  14     networking/openvpn.nix
  15   ];
  16
  17   boot.initrd.network = {
  18     enable = true;
  19     flushBeforeStage2 = true;
  20   };
  21   boot.initrd.systemd = {
  22     network.networks = {
  23       "10-${netIface}" = {
  24         name = netIface;
  25         # Start a DHCP Client for IPv4 Addressing/Routing
  26         DHCP = "ipv4";
  27         networkConfig = {
  28           # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
  29           IPv6AcceptRA = true;
  30           IPv6PrivacyExtensions = true;
  31           KeepConfiguration = "dhcp-on-stop";
  32         };
  33       };
  34     };
  35   };
  36
  37   systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
  38   systemd.network = {
  39     enable = true;
  40     wait-online = {
  41       enable = false;
  42     };
  43     networks = {
  44       "10-${netIface}" = {
  45         name = netIface;
  46         # Start a DHCP Client for IPv4 Addressing/Routing
  47         DHCP = "ipv4";
  48         networkConfig = {
  49           # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
  50           IPv6AcceptRA = true;
  51           IPv6PrivacyExtensions = true;
  52           KeepConfiguration = "dhcp-on-stop";
  53         };
  54         linkConfig = {
  55           RequiredForOnline = "no";
  56         };
  57       };
  58     };
  59   };
  60
  61   /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  62      a 91.216.110.35/32 becomes a 91.216.110.35/8
  63     boot.kernelParams = map
  64     (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  65     [ { clientIP = netIPv4; serverIP = "";
  66       gatewayIP = networking.defaultGateway.address;
  67       netmask = "255.255.255.255";
  68       hostname = ""; device = networking.defaultGateway.interface;
  69       autoconf = "off";
  70     }
  71     { clientIP = lanIPv4; serverIP = "";
  72       gatewayIP = "";
  73       netmask = "255.255.255.0";
  74       hostname = ""; device = "enp2s0";
  75       autoconf = "off";
  76     }
  77     ];
  78   */
  79   /* DIY network config, but a right one */
  80   /*
  81     boot.initrd.preLVMCommands = ''
  82     set -x
  83
  84     # IPv4 lan
  85     ip link set ${netIface} up
  86     ip address add ${lanIPv4}/32 dev ${netIface}
  87     ip route add ${lanIPv4Gateway} dev ${netIface}
  88     ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
  89     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  90     ip route add default via ${lanIPv4Gateway} dev ${netIface}
  91
  92     # IPv6 net
  93     #ip -6 address add ''${lanIPv6} dev ${netIface}
  94     #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
  95     #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
  96
  97     ip -4 address
  98     ip -4 route
  99     #ip -6 address
 100     #ip -6 route
 101
 102     set +x
 103     '';
 104   */
 105   # Workaround https://github.com/NixOS/nixpkgs/issues/56822
 106   #boot.initrd.kernelModules = [ "ipv6" ];
 107
 108   # Useless without an out-of-band access, and unsecure
 109   # (though / may still be encrypted at this point).
 110   # boot.kernelParams = [ "boot.shell_on_fail" ];
 111
 112   /*
 113     # Disable IPv6 entirely until it's available
 114     boot.kernel.sysctl = {
 115     "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
 116     };
 117   */
 118
 119   networking = {
 120     hostName = hostName;
 121     domain = "sourcephile.fr";
 122
 123     useDHCP = false;
 124     enableIPv6 = true;
 125   };
 126
 127   networking.nftables.ruleset = ''
 128     table inet filter {
 129       chain input {
 130         iifname ${netIface} goto input-net
 131       }
 132       chain output {
 133         oifname ${netIface} jump output-net
 134         oifname ${netIface} log level warn prefix "output-net: " counter drop
 135       }
 136       chain output-net {
 137         ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
 138       }
 139     }
 140     table inet nat {
 141       chain postrouting {
 142         oifname ${netIface} masquerade
 143       }
 144     }
 145   '';
 146   /*
 147     security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
 148     # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
 149     system.activationScripts.ipv6 = ''
 150     ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
 151     '';
 152   */
 153   environment.systemPackages = [
 154     pkgs.iodine
 155   ];
 156   services.vnstat.enable = true;
 157 }