]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking.nix
f3: uninstall because broken
[sourcephile-nix.git] / hosts / losurdo / networking.nix
1 { pkgs, lib, config, hostName, ... }:
2 with builtins;
3 let
4 inherit (config) networking;
5 netIface = "enp5s0";
6 lanIPv4 = "192.168.1.215";
7 lanNet = "192.168.1.0/24";
8 lanIPv4Gateway = "192.168.1.1";
9 in
10 {
11 imports = [
12 networking/nftables.nix
13 networking/ssh.nix
14 networking/wireguard/wg-intra.nix
15 networking/wireguard/wg-extra.nix
16 #networking/tor.nix
17 networking/nsupdate.nix
18 networking/wireless.nix
19 networking/openvpn.nix
20 ];
21
22 boot.initrd.network = {
23 enable = true;
24 flushBeforeStage2 = true;
25 # This will automatically load the zfs password prompt on login
26 # and kill the other prompt so boot can continue
27 # The pkill zfs kills the zfs load-key from the console
28 # allowing the boot to continue.
29 postCommands = ''
30 echo >>/root/.profile "zfs load-key ${hostName} && pkill zfs"
31 '';
32 # Retry DHCP forever (because in case of power failure,
33 # the router may take longer to boot).
34 # Beware that this is not interruptible with Ctrl-C
35 udhcpc.extraArgs = [ "--retries=0" ];
36 };
37
38 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
39 a 91.216.110.35/32 becomes a 91.216.110.35/8
40 boot.kernelParams = map
41 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
42 [ { clientIP = netIPv4; serverIP = "";
43 gatewayIP = networking.defaultGateway.address;
44 netmask = "255.255.255.255";
45 hostname = ""; device = networking.defaultGateway.interface;
46 autoconf = "off";
47 }
48 { clientIP = lanIPv4; serverIP = "";
49 gatewayIP = "";
50 netmask = "255.255.255.0";
51 hostname = ""; device = "enp2s0";
52 autoconf = "off";
53 }
54 ];
55 */
56 /* DIY network config, but a right one */
57 /*
58 boot.initrd.preLVMCommands = ''
59 set -x
60
61 # IPv4 lan
62 ip link set ${netIface} up
63 ip address add ${lanIPv4}/32 dev ${netIface}
64 ip route add ${lanIPv4Gateway} dev ${netIface}
65 ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
66 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
67 ip route add default via ${lanIPv4Gateway} dev ${netIface}
68
69 # IPv6 net
70 #ip -6 address add ''${lanIPv6} dev ${netIface}
71 #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
72 #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
73
74 ip -4 address
75 ip -4 route
76 #ip -6 address
77 #ip -6 route
78
79 set +x
80 '';
81 */
82 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
83 #boot.initrd.kernelModules = [ "ipv6" ];
84
85 # Useless without an out-of-band access, and unsecure
86 # (though / may still be encrypted at this point).
87 # boot.kernelParams = [ "boot.shell_on_fail" ];
88
89 /*
90 # Disable IPv6 entirely until it's available
91 boot.kernel.sysctl = {
92 "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
93 };
94 */
95
96 networking = {
97 hostName = hostName;
98 domain = "sourcephile.fr";
99
100 useDHCP = false;
101 enableIPv6 = true;
102 /*
103 defaultGateway = {
104 address = lanIPv4Gateway;
105 interface = "${netIface}";
106 };
107 defaultGateway6 = {
108 address = lanIPv6Gateway;
109 interface = "${netIface}";
110 };
111 */
112 #nameservers = [ ];
113 };
114
115 networking.nftables.ruleset = ''
116 table inet filter {
117 chain input {
118 iifname ${netIface} goto input-net
119 }
120 chain output {
121 oifname ${netIface} jump output-net
122 oifname ${netIface} log level warn prefix "output-net: " counter drop
123 }
124 chain output-net {
125 ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
126 }
127 }
128 table inet nat {
129 chain postrouting {
130 oifname ${netIface} masquerade
131 }
132 }
133 '';
134 boot.kernel.sysctl."net.ipv6.conf.${netIface}.addr_gen_mode" = 1;
135 /*
136 security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
137 # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
138 system.activationScripts.ipv6 = ''
139 ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
140 '';
141 */
142 networking.interfaces.${netIface} = {
143 useDHCP = true;
144 /*
145 ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
146
147 ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
148 ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
149 { address = "fe80::1"; prefixLength = 10; }
150 ];
151 ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
152 */
153 };
154 environment.systemPackages = [
155 pkgs.iodine
156 ];
157 }