servers/losurdo/production/networking.nix

   1 { pkgs, lib, config, nodes, ... }:
   2 with builtins;
   3 let
   4   inherit (builtins.extraBuiltins) pass pass-to-file;
   5   inherit (config) networking users;
   6   lanIPv4        = "192.168.1.215";
   7   lanNet         = "192.168.1.0/24";
   8   lanIPv4Gateway = "192.168.1.1";
   9 in
  10 {
  11 boot.initrd.network = {
  12   enable = true;
  13   ssh = {
  14      enable = true;
  15      # To prevent ssh from freaking out because a different host key is used,
  16      # a different port for dropbear is useful
  17      # (assuming the same host has also a normal sshd running)
  18      port = 2222;
  19      # The initrd needs a cleartext key and is built on the host,
  20      # hence this key needs to be cleartext on the host.
  21      # Moreover building the initrd means that the key will go into the Nix store,
  22      # of the host, then of the target on deployment,
  23      # because GRUB does not support boot.initrd.secrets
  24      # (only systemd-boot does, but sticking to GRUB is more reassuring).
  25      # In any case, the initrd is sent to a non-encrypted /boot partition
  26      # to be able to start unattended, hence the key will be available
  27      # to anyone who has physically access to the disk where /boot is.
  28      # NOTE: dropbearkey -t ecdsa -f /tmp/dropbear-ecdsa.key
  29      #hostECDSAKey = "../../../sec/tmp/dropbear-ecdsa.key";
  30      hostECDSAKey = pass-to-file "servers/losurdo/dropbear/ecdsa.key"
  31                                  (../../../sec + "/tmp/losurdo-dropbear-ecdsa.key");
  32
  33      # WARNING: dropbear does not support (and will ignore) ssh-ed25519 keys
  34      authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
  35   };
  36   # This will automatically load the zfs password prompt on login
  37   # and kill the other prompt so boot can continue
  38   # The pkill zfs kills the zfs load-key from the console
  39   # allowing the boot to continue.
  40   postCommands = ''
  41     echo >>/root/.profile "zfs load-key -a && pkill zfs"
  42   '';
  43 };
  44
  45 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  46    a 91.216.110.35/32 becomes a 91.216.110.35/8
  47 boot.kernelParams = map
  48   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  49   [ { clientIP = netIPv4; serverIP = "";
  50       gatewayIP = networking.defaultGateway.address;
  51       netmask = "255.255.255.255";
  52       hostname = ""; device = networking.defaultGateway.interface;
  53       autoconf = "off";
  54     }
  55     { clientIP = lanIPv4; serverIP = "";
  56       gatewayIP = "";
  57       netmask = "255.255.255.0";
  58       hostname = ""; device = "enp2s0";
  59       autoconf = "off";
  60     }
  61   ];
  62 */
  63 /* DIY network config, but a right one */
  64 boot.initrd.preLVMCommands = ''
  65   set -x
  66
  67   # IPv4 lan
  68   ip link set enp5s0 up
  69   ip address add ${lanIPv4}/32 dev enp5s0
  70   ip route add ${lanIPv4Gateway} dev enp5s0
  71   ip route add ${lanNet} dev enp5s0 src ${lanIPv4} proto kernel
  72     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  73   ip route add default via ${lanIPv4Gateway} dev enp5s0
  74
  75   # IPv6 net
  76   #ip -6 address add ''${lanIPv6} dev enp5s0
  77   #ip -6 route add ''${lanIPv6Gateway} dev enp5s0
  78   #ip -6 route add default via ''${lanIPv6Gateway} dev enp5s0
  79
  80   ip -4 address
  81   ip -4 route
  82   #ip -6 address
  83   #ip -6 route
  84
  85   set +x
  86
  87   # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  88   # we have to run the postCommands ourselves.
  89   ${config.boot.initrd.network.postCommands}
  90 '';
  91 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  92 #boot.initrd.kernelModules = [ "ipv6" ];
  93
  94 # Useless without an out-of-band access, and unsecure
  95 # (though / may still be encrypted at this point).
  96 # boot.kernelParams = [ "boot.shell_on_fail" ];
  97
  98 # Disable IPv6 entirely until it's available
  99 boot.kernel.sysctl = {
 100   "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
 101 };
 102
 103 networking = {
 104   useDHCP = false;
 105   defaultGateway = {
 106     address = lanIPv4Gateway;
 107     interface = "enp5s0";
 108   };
 109   /*
 110   defaultGateway6 = {
 111     address = lanIPv6Gateway;
 112     interface = "enp5s0";
 113   };
 114   */
 115   #nameservers = [ ];
 116   interfaces.enp5s0 = {
 117     useDHCP = false;
 118     ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 119     ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 120
 121     /*
 122     ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 123                        { address = "fe80::1"; prefixLength = 10; }
 124                      ];
 125     ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 126     */
 127   };
 128   interfaces.wlp4s0 = {
 129     useDHCP = false;
 130   };
 131 };
 132 }