]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/networking.nix
nix: daily GC on mermet
[sourcephile-nix.git] / machines / mermet / networking.nix
1 { pkgs, lib, config, machineName, ipv4, machines, ... }:
2 with builtins;
3 let
4 inherit (config) networking users;
5 netIPv4 = ipv4;
6 netIPv4Gateway = "80.67.180.134";
7 #netIPv6 = "2001:912:400:104::35";
8 #netIPv6Gateway = "2001:912:400:104::1";
9 lanIPv4 = "192.168.1.214";
10 lanNet = "192.168.1.0/24";
11 lanIPv4Gateway = "192.168.1.1";
12 in
13 {
14 imports = [
15 networking/nftables.nix
16 networking/ssh.nix
17 networking/wireguard.nix
18 ];
19 boot.initrd.network = {
20 enable = true;
21 ssh = {
22 enable = true;
23 # To prevent ssh from freaking out because a different host key is used,
24 # a different port for dropbear is useful
25 # (assuming the same host has also a normal sshd running)
26 port = 2222;
27 authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
28 };
29 # This will automatically load the zfs password prompt on login
30 # and kill the other prompt so boot can continue
31 # The pkill zfs kills the zfs load-key from the console
32 # allowing the boot to continue.
33 postCommands = ''
34 echo >>/root/.profile "zfs load-key rpool && pkill zfs"
35 '';
36 };
37
38 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
39 a 91.216.110.35/32 becomes a 91.216.110.35/8
40 boot.kernelParams = map
41 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
42 [ { clientIP = netIPv4; serverIP = "";
43 gatewayIP = networking.defaultGateway.address;
44 netmask = "255.255.255.255";
45 hostname = ""; device = networking.defaultGateway.interface;
46 autoconf = "off";
47 }
48 { clientIP = lanIPv4; serverIP = "";
49 gatewayIP = "";
50 netmask = "255.255.255.0";
51 hostname = ""; device = "enp2s0";
52 autoconf = "off";
53 }
54 ];
55 */
56 /* DIY network config, but a right one */
57 boot.initrd.preLVMCommands = ''
58 set -x
59
60 # IPv4 net
61 ip link set enp1s0 up
62 ip address add ${netIPv4}/32 dev enp1s0
63 ip route add ${netIPv4Gateway} dev enp1s0
64 ip route add default via ${netIPv4Gateway} dev enp1s0
65
66 # IPv4 lan
67 ip link set enp2s0 up
68 ip address add ${lanIPv4}/32 dev enp2s0
69 ip route add ${lanIPv4Gateway} dev enp2s0
70 ip route add ${lanNet} dev enp2s0 src ${lanIPv4} proto kernel
71 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
72
73 # IPv6 net
74 #ip -6 address add ''${netIPv6} dev enp1s0
75 #ip -6 route add ''${netIPv6Gateway} dev enp1s0
76 #ip -6 route add default via ''${netIPv6Gateway} dev enp1s0
77
78 ip -4 address
79 ip -4 route
80 #ip -6 address
81 #ip -6 route
82
83 set +x
84
85 # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
86 # we have to run the postCommands ourselves.
87 ${config.boot.initrd.network.postCommands}
88 '';
89
90 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
91 #boot.initrd.kernelModules = [ "ipv6" ];
92
93 # Useless without an out-of-band access, and unsecure
94 # (though / may still be encrypted at this point).
95 # boot.kernelParams = [ "boot.shell_on_fail" ];
96
97 # Disable IPv6 entirely until it's available
98 boot.kernel.sysctl = {
99 "net.ipv6.conf.enp1s0.disable_ipv6" = 1;
100 };
101
102 services.knot.extraConfig = lib.mkBefore ''
103 server:
104 listen: ${netIPv4}@53
105 #listen: ::@53
106 '';
107
108 networking = {
109 hostName = machineName;
110 domain = "sourcephile.fr";
111
112 useDHCP = false;
113 defaultGateway = {
114 address = netIPv4Gateway;
115 interface = "enp1s0";
116 };
117 /*
118 defaultGateway6 = {
119 address = netIPv6Gateway;
120 interface = "enp1s0";
121 };
122 */
123 #nameservers = [ ];
124 nftables.ruleset = ''
125 add rule inet filter input iifname "enp1s0" goto net2fw
126 add rule inet filter output oifname "enp1s0" jump fw2net
127 add rule inet filter output oifname "enp1s0" log level warn prefix "fw2net: " counter drop
128
129 add rule inet filter input iifname "enp2s0" goto lan2fw
130 add rule inet filter output oifname "enp2s0" goto fw2lan
131 '';
132 interfaces.enp1s0 = {
133 useDHCP = false;
134 ipv4.addresses = [ { address = netIPv4; prefixLength = 32; } ];
135 ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
136
137 /*
138 ipv6.addresses = [ { address = netIPv6; prefixLength = 64; }
139 { address = "fe80::1"; prefixLength = 10; }
140 ];
141 ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
142 */
143 };
144 interfaces.enp2s0 = {
145 useDHCP = false;
146 ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
147 /*
148 # FIXME: remove this /1 hack when the machine will be racked at PTT
149 ipv4.routes = [ { address = "0.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
150 { address = "128.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
151 ];
152 */
153 /*
154 ipv6.addresses = [ { address = "fe80::1"; prefixLength = 10; } ];
155 ipv6.routes = [ ];
156 */
157 };
158 interfaces.enp3s0 = {
159 useDHCP = false;
160 };
161 };
162 }