machines/losurdo/networking.nix

   1 { pkgs, lib, config, machineName, machines, wireguard, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   #lanIPv4        = "192.168.1.215";
   6   lanNet         = "192.168.1.0/24";
   7   #lanIPv4Gateway = "192.168.1.1";
   8 in
   9 {
  10 imports = [
  11   networking/nftables.nix
  12   networking/ssh.nix
  13   networking/wireguard.nix
  14   networking/tor.nix
  15 ];
  16
  17 boot.initrd.network = {
  18   enable = true;
  19   flushBeforeStage2 = true;
  20   # This will automatically load the zfs password prompt on login
  21   # and kill the other prompt so boot can continue
  22   # The pkill zfs kills the zfs load-key from the console
  23   # allowing the boot to continue.
  24   postCommands = ''
  25     echo >>/root/.profile "zfs load-key ${machineName} && pkill zfs"
  26   '';
  27 };
  28
  29 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  30    a 91.216.110.35/32 becomes a 91.216.110.35/8
  31 boot.kernelParams = map
  32   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  33   [ { clientIP = netIPv4; serverIP = "";
  34       gatewayIP = networking.defaultGateway.address;
  35       netmask = "255.255.255.255";
  36       hostname = ""; device = networking.defaultGateway.interface;
  37       autoconf = "off";
  38     }
  39     { clientIP = lanIPv4; serverIP = "";
  40       gatewayIP = "";
  41       netmask = "255.255.255.0";
  42       hostname = ""; device = "enp2s0";
  43       autoconf = "off";
  44     }
  45   ];
  46 */
  47 /* DIY network config, but a right one */
  48 /*
  49 boot.initrd.preLVMCommands = ''
  50   set -x
  51
  52   # IPv4 lan
  53   ip link set enp5s0 up
  54   ip address add ${lanIPv4}/32 dev enp5s0
  55   ip route add ${lanIPv4Gateway} dev enp5s0
  56   ip route add ${lanNet} dev enp5s0 src ${lanIPv4} proto kernel
  57     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  58   ip route add default via ${lanIPv4Gateway} dev enp5s0
  59
  60   # IPv6 net
  61   #ip -6 address add ''${lanIPv6} dev enp5s0
  62   #ip -6 route add ''${lanIPv6Gateway} dev enp5s0
  63   #ip -6 route add default via ''${lanIPv6Gateway} dev enp5s0
  64
  65   ip -4 address
  66   ip -4 route
  67   #ip -6 address
  68   #ip -6 route
  69
  70   set +x
  71
  72   # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  73   # we have to run the postCommands ourselves.
  74   ${config.boot.initrd.network.postCommands}
  75 '';
  76 */
  77 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  78 #boot.initrd.kernelModules = [ "ipv6" ];
  79
  80 # Useless without an out-of-band access, and unsecure
  81 # (though / may still be encrypted at this point).
  82 # boot.kernelParams = [ "boot.shell_on_fail" ];
  83
  84 /*
  85 # Disable IPv6 entirely until it's available
  86 boot.kernel.sysctl = {
  87   "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
  88 };
  89 */
  90
  91 networking = {
  92   hostName = machineName;
  93   domain = "sourcephile.fr";
  94
  95   useDHCP = false;
  96   enableIPv6 = true;
  97   /*
  98   defaultGateway = {
  99     address = lanIPv4Gateway;
 100     interface = "enp5s0";
 101   };
 102   defaultGateway6 = {
 103     address = lanIPv6Gateway;
 104     interface = "enp5s0";
 105   };
 106   */
 107   #nameservers = [ ];
 108 };
 109
 110 networking.nftables.ruleset = ''
 111   add rule inet filter input  iifname "enp5s0" goto net2fw
 112   add rule inet filter output oifname "enp5s0" jump fw2net
 113   add rule inet filter output oifname "enp5s0" log level warn prefix "fw2net: " counter drop
 114   add rule inet filter fw2net ip daddr ${lanNet} log level info prefix "fw2net: lan: " counter accept comment "LAN"
 115 '';
 116 networking.interfaces.enp5s0 = {
 117   useDHCP = true;
 118   #ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 119   #ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 120
 121   /*
 122   ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 123                      { address = "fe80::1"; prefixLength = 10; }
 124                    ];
 125   ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 126   */
 127 };
 128 networking.interfaces.wlp4s0 = {
 129   useDHCP = false;
 130 };
 131 }