]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking.nix
mermet: knot: sourcephile.fr: remove Gandi as NS
[sourcephile-nix.git] / hosts / losurdo / networking.nix
1 { pkgs, config, hostName, ... }:
2 with builtins;
3 let
4 inherit (config) networking;
5 netIface = "enp5s0";
6 lanNet = "192.168.1.0/24";
7 in
8 {
9 imports = [
10 networking/nftables.nix
11 #networking/tor.nix
12 networking/nsupdate.nix
13 networking/wireless.nix
14 networking/openvpn.nix
15 ];
16
17 boot.initrd.network = {
18 enable = true;
19 flushBeforeStage2 = true;
20 };
21 boot.initrd.systemd = {
22 network.networks = {
23 "10-${netIface}" = {
24 name = netIface;
25 # Start a DHCP Client for IPv4 Addressing/Routing
26 DHCP = "ipv4";
27 networkConfig = {
28 # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
29 IPv6AcceptRA = true;
30 IPv6PrivacyExtensions = true;
31 KeepConfiguration = "dhcp-on-stop";
32 };
33 };
34 };
35 };
36
37 systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
38 systemd.network = {
39 enable = true;
40 wait-online = {
41 enable = false;
42 };
43 networks = {
44 "10-${netIface}" = {
45 name = netIface;
46 # Start a DHCP Client for IPv4 Addressing/Routing
47 DHCP = "ipv4";
48 networkConfig = {
49 # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
50 IPv6AcceptRA = true;
51 IPv6PrivacyExtensions = true;
52 KeepConfiguration = "dhcp-on-stop";
53 };
54 linkConfig = {
55 RequiredForOnline = "no";
56 };
57 };
58 };
59 };
60
61 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
62 a 91.216.110.35/32 becomes a 91.216.110.35/8
63 boot.kernelParams = map
64 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
65 [ { clientIP = netIPv4; serverIP = "";
66 gatewayIP = networking.defaultGateway.address;
67 netmask = "255.255.255.255";
68 hostname = ""; device = networking.defaultGateway.interface;
69 autoconf = "off";
70 }
71 { clientIP = lanIPv4; serverIP = "";
72 gatewayIP = "";
73 netmask = "255.255.255.0";
74 hostname = ""; device = "enp2s0";
75 autoconf = "off";
76 }
77 ];
78 */
79 /* DIY network config, but a right one */
80 /*
81 boot.initrd.preLVMCommands = ''
82 set -x
83
84 # IPv4 lan
85 ip link set ${netIface} up
86 ip address add ${lanIPv4}/32 dev ${netIface}
87 ip route add ${lanIPv4Gateway} dev ${netIface}
88 ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
89 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
90 ip route add default via ${lanIPv4Gateway} dev ${netIface}
91
92 # IPv6 net
93 #ip -6 address add ''${lanIPv6} dev ${netIface}
94 #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
95 #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
96
97 ip -4 address
98 ip -4 route
99 #ip -6 address
100 #ip -6 route
101
102 set +x
103 '';
104 */
105 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
106 #boot.initrd.kernelModules = [ "ipv6" ];
107
108 # Useless without an out-of-band access, and unsecure
109 # (though / may still be encrypted at this point).
110 # boot.kernelParams = [ "boot.shell_on_fail" ];
111
112 /*
113 # Disable IPv6 entirely until it's available
114 boot.kernel.sysctl = {
115 "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
116 };
117 */
118
119 networking = {
120 hostName = hostName;
121 domain = "sourcephile.fr";
122
123 useDHCP = false;
124 enableIPv6 = true;
125 };
126
127 networking.nftables.ruleset = ''
128 table inet filter {
129 chain input {
130 iifname ${netIface} goto input-net
131 }
132 chain output {
133 oifname ${netIface} jump output-net
134 oifname ${netIface} log level warn prefix "output-net: " counter drop
135 }
136 chain output-net {
137 ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
138 }
139 }
140 table inet nat {
141 chain postrouting {
142 oifname ${netIface} masquerade
143 }
144 }
145 '';
146 /*
147 security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
148 # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
149 system.activationScripts.ipv6 = ''
150 ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
151 '';
152 */
153 environment.systemPackages = [
154 pkgs.iodine
155 ];
156 services.vnstat.enable = true;
157 }