]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/networking.nix
private: use shared files
[sourcephile-nix.git] / hosts / mermet / networking.nix
1 { pkgs, lib, config, hostName, ipv4, hosts, ... }:
2 with builtins;
3 let
4 inherit (config) networking users;
5 netIface = "enp1s0";
6 netIPv4 = ipv4;
7 netIPv4Gateway = "80.67.180.134";
8 #netIPv6 = "2001:912:400:104::35";
9 #netIPv6Gateway = "2001:912:400:104::1";
10 lanIface = "enp2s0";
11 lanIPv4 = "192.168.1.214";
12 lanNet = "192.168.1.0/24";
13 lanIPv4Gateway = "192.168.1.1";
14 in
15 {
16 imports = [
17 networking/nftables.nix
18 networking/ssh.nix
19 networking/wireguard.nix
20 ];
21
22 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
23 a 91.216.110.35/32 becomes a 91.216.110.35/8
24 boot.kernelParams = map
25 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
26 [ { clientIP = netIPv4; serverIP = "";
27 gatewayIP = networking.defaultGateway.address;
28 netmask = "255.255.255.255";
29 hostname = ""; device = networking.defaultGateway.interface;
30 autoconf = "off";
31 }
32 { clientIP = lanIPv4; serverIP = "";
33 gatewayIP = "";
34 netmask = "255.255.255.0";
35 hostname = ""; device = "${lanIface}";
36 autoconf = "off";
37 }
38 ];
39 */
40 /* DIY network config, but a right one */
41 boot.initrd.preLVMCommands = ''
42 set -x
43
44 # IPv4 net
45 ip link set ${netIface} up
46 ip address add ${netIPv4}/32 dev ${netIface}
47 ip route add ${netIPv4Gateway} dev ${netIface}
48 ip route add default via ${netIPv4Gateway} dev ${netIface}
49
50 # IPv4 lan
51 ip link set ${lanIface} up
52 ip address add ${lanIPv4}/32 dev ${lanIface}
53 ip route add ${lanIPv4Gateway} dev ${lanIface}
54 ip route add ${lanNet} dev ${lanIface} src ${lanIPv4} proto kernel
55 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
56
57 # IPv6 net
58 #ip -6 address add ''${netIPv6} dev ${netIface}
59 #ip -6 route add ''${netIPv6Gateway} dev ${netIface}
60 #ip -6 route add default via ''${netIPv6Gateway} dev ${netIface}
61
62 ip -4 address
63 ip -4 route
64 #ip -6 address
65 #ip -6 route
66
67 set +x
68
69 # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
70 # we have to run the postCommands ourselves.
71 ${config.boot.initrd.network.postCommands}
72 '';
73
74 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
75 # TODO: the issue is now closed
76 #boot.initrd.kernelModules = [ "ipv6" ];
77
78 # Useless without an out-of-band access, and unsecure
79 # (though / may still be encrypted at this point).
80 # boot.kernelParams = [ "boot.shell_on_fail" ];
81
82 # Disable IPv6 entirely until it's available
83 boot.kernel.sysctl = {
84 "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
85 };
86
87 services.knot.extraConfig = lib.mkBefore ''
88 server:
89 listen: ${netIPv4}@53
90 #listen: ::@53
91 '';
92
93 networking = {
94 hostName = hostName;
95 domain = "sourcephile.fr";
96
97 useDHCP = false;
98 defaultGateway = {
99 address = netIPv4Gateway;
100 interface = "${netIface}";
101 };
102 /*
103 defaultGateway6 = {
104 address = netIPv6Gateway;
105 interface = "${netIface}";
106 };
107 */
108 #nameservers = [ ];
109 nftables.ruleset = lib.mkAfter ''
110 table inet filter {
111 chain input {
112 iifname ${netIface} goto input-net
113 iifname ${lanIface} goto input-lan
114 }
115 chain output {
116 oifname ${netIface} jump output-net
117 oifname ${netIface} log level warn prefix "output-net: " counter drop
118 oifname ${lanIface} goto output-lan
119 }
120 }
121 '';
122 interfaces.${netIface} = {
123 useDHCP = false;
124 ipv4.addresses = [ { address = netIPv4; prefixLength = 32; } ];
125 ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
126
127 /*
128 ipv6.addresses = [ { address = netIPv6; prefixLength = 64; }
129 { address = "fe80::1"; prefixLength = 10; }
130 ];
131 ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
132 */
133 };
134 interfaces.${lanIface} = {
135 useDHCP = false;
136 ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
137 /*
138 # FIXME: remove this /1 hack when the host will be racked at PTT
139 ipv4.routes = [ { address = "0.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
140 { address = "128.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
141 ];
142 */
143 /*
144 ipv6.addresses = [ { address = "fe80::1"; prefixLength = 10; } ];
145 ipv6.routes = [ ];
146 */
147 };
148 interfaces.enp3s0 = {
149 useDHCP = false;
150 };
151 };
152 }