hosts/mermet/networking.nix

   1 { pkgs, lib, config, hostName, hosts, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking users;
   5   netIface       = "enp1s0";
   6   netIPv4        = "80.67.180.129";
   7   netIPv4Gateway = "80.67.180.134";
   8   #netIPv6        = "2001:912:400:104::35";
   9   #netIPv6Gateway = "2001:912:400:104::1";
  10   lanIface       = "enp2s0";
  11   lanIPv4        = "192.168.1.214";
  12   lanNet         = "192.168.1.0/24";
  13   lanIPv4Gateway = "192.168.1.1";
  14 in
  15 {
  16 imports = [
  17   networking/nftables.nix
  18   networking/ssh.nix
  19   networking/wireguard.nix
  20 ];
  21
  22 _module.args.ipv4 = netIPv4;
  23
  24 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  25    a 91.216.110.35/32 becomes a 91.216.110.35/8
  26 boot.kernelParams = map
  27   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  28   [ { clientIP = netIPv4; serverIP = "";
  29       gatewayIP = networking.defaultGateway.address;
  30       netmask = "255.255.255.255";
  31       hostname = ""; device = networking.defaultGateway.interface;
  32       autoconf = "off";
  33     }
  34     { clientIP = lanIPv4; serverIP = "";
  35       gatewayIP = "";
  36       netmask = "255.255.255.0";
  37       hostname = ""; device = "${lanIface}";
  38       autoconf = "off";
  39     }
  40   ];
  41 */
  42 /* DIY network config, but a right one */
  43 boot.initrd.preLVMCommands = ''
  44   set -x
  45
  46   # IPv4 net
  47   ip link set ${netIface} up
  48   ip address add ${netIPv4}/32 dev ${netIface}
  49   ip route add ${netIPv4Gateway} dev ${netIface}
  50   ip route add default via ${netIPv4Gateway} dev ${netIface}
  51
  52   # IPv4 lan
  53   ip link set ${lanIface} up
  54   ip address add ${lanIPv4}/32 dev ${lanIface}
  55   ip route add ${lanIPv4Gateway} dev ${lanIface}
  56   ip route add ${lanNet} dev ${lanIface} src ${lanIPv4} proto kernel
  57     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  58
  59   # IPv6 net
  60   #ip -6 address add ''${netIPv6} dev ${netIface}
  61   #ip -6 route add ''${netIPv6Gateway} dev ${netIface}
  62   #ip -6 route add default via ''${netIPv6Gateway} dev ${netIface}
  63
  64   ip -4 address
  65   ip -4 route
  66   #ip -6 address
  67   #ip -6 route
  68
  69   set +x
  70
  71   # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  72   # we have to run the postCommands ourselves.
  73   ${config.boot.initrd.network.postCommands}
  74 '';
  75
  76 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  77 # TODO: the issue is now closed
  78 #boot.initrd.kernelModules = [ "ipv6" ];
  79
  80 # Useless without an out-of-band access, and unsecure
  81 # (though / may still be encrypted at this point).
  82 # boot.kernelParams = [ "boot.shell_on_fail" ];
  83
  84 # Disable IPv6 entirely until it's available
  85 boot.kernel.sysctl = {
  86   "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
  87 };
  88
  89 services.knot.extraConfig = lib.mkBefore ''
  90   server:
  91     listen: ${netIPv4}@53
  92     #listen: ::@53
  93 '';
  94
  95 networking = {
  96   hostName = hostName;
  97   domain = "sourcephile.fr";
  98
  99   useDHCP = false;
 100   defaultGateway = {
 101     address = netIPv4Gateway;
 102     interface = "${netIface}";
 103   };
 104   /*
 105   defaultGateway6 = {
 106     address = netIPv6Gateway;
 107     interface = "${netIface}";
 108   };
 109   */
 110   #nameservers = [ ];
 111   nftables.ruleset = lib.mkAfter ''
 112     table inet filter {
 113       chain input {
 114         iifname ${netIface} goto input-net
 115         iifname ${lanIface} goto input-lan
 116       }
 117       chain output {
 118         oifname ${netIface} jump output-net
 119         oifname ${netIface} log level warn prefix "output-net: " counter drop
 120         oifname ${lanIface} goto output-lan
 121       }
 122     }
 123   '';
 124   interfaces.${netIface} = {
 125     useDHCP = false;
 126     ipv4.addresses = [ { address = netIPv4; prefixLength = 32; } ];
 127     ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 128
 129     /*
 130     ipv6.addresses = [ { address = netIPv6; prefixLength = 64; }
 131                        { address = "fe80::1"; prefixLength = 10; }
 132                      ];
 133     ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 134     */
 135   };
 136   interfaces.${lanIface} = {
 137     useDHCP = false;
 138     ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 139     /*
 140     # FIXME: remove this /1 hack when the host will be racked at PTT
 141     ipv4.routes    = [ { address = "0.0.0.0";   prefixLength = 1; via = "192.168.1.1"; }
 142                        { address = "128.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
 143                        ];
 144     */
 145     /*
 146     ipv6.addresses = [ { address = "fe80::1"; prefixLength = 10; } ];
 147     ipv6.routes    = [ ];
 148     */
 149   };
 150   interfaces.enp3s0 = {
 151     useDHCP = false;
 152   };
 153 };
 154 }