]> Git — Sourcephile - sourcephile-nix.git/blob - servers/losurdo/networking.nix
nix: split configuration.nix into alternative toplevels
[sourcephile-nix.git] / servers / losurdo / networking.nix
1 { pkgs, lib, config, nodes, ... }:
2 with builtins;
3 let
4 inherit (builtins.extraBuiltins) pass pass-to-file;
5 inherit (config) networking users;
6 lanIPv4 = "192.168.1.215";
7 lanNet = "192.168.1.0/24";
8 lanIPv4Gateway = "192.168.1.1";
9 in
10 {
11 boot.initrd.network = {
12 enable = true;
13 ssh = {
14 enable = true;
15 # To prevent ssh from freaking out because a different host key is used,
16 # a different port for dropbear is useful
17 # (assuming the same host has also a normal sshd running)
18 port = 2222;
19 # The initrd needs a cleartext key and is built on the host,
20 # hence this key needs to be cleartext on the host.
21 # Moreover building the initrd means that the key will go into the Nix store,
22 # of the host, then of the target on deployment,
23 # because GRUB does not support boot.initrd.secrets
24 # (only systemd-boot does, but sticking to GRUB is more reassuring).
25 # In any case, the initrd is sent to a non-encrypted /boot partition
26 # to be able to start unattended, hence the key will be available
27 # to anyone who has physically access to the disk where /boot is.
28 hostKeys = [
29 (pass-to-file "servers/losurdo/ssh/ecdsa.key"
30 (../../../sec + "/tmp/losurdo.ecdsa.key"))
31 ];
32
33 authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
34 };
35 # This will automatically load the zfs password prompt on login
36 # and kill the other prompt so boot can continue
37 # The pkill zfs kills the zfs load-key from the console
38 # allowing the boot to continue.
39 postCommands = ''
40 echo >>/root/.profile "zfs load-key -a && pkill zfs"
41 '';
42 };
43
44 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
45 a 91.216.110.35/32 becomes a 91.216.110.35/8
46 boot.kernelParams = map
47 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
48 [ { clientIP = netIPv4; serverIP = "";
49 gatewayIP = networking.defaultGateway.address;
50 netmask = "255.255.255.255";
51 hostname = ""; device = networking.defaultGateway.interface;
52 autoconf = "off";
53 }
54 { clientIP = lanIPv4; serverIP = "";
55 gatewayIP = "";
56 netmask = "255.255.255.0";
57 hostname = ""; device = "enp2s0";
58 autoconf = "off";
59 }
60 ];
61 */
62 /* DIY network config, but a right one */
63 boot.initrd.preLVMCommands = ''
64 set -x
65
66 # IPv4 lan
67 ip link set enp5s0 up
68 ip address add ${lanIPv4}/32 dev enp5s0
69 ip route add ${lanIPv4Gateway} dev enp5s0
70 ip route add ${lanNet} dev enp5s0 src ${lanIPv4} proto kernel
71 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
72 ip route add default via ${lanIPv4Gateway} dev enp5s0
73
74 # IPv6 net
75 #ip -6 address add ''${lanIPv6} dev enp5s0
76 #ip -6 route add ''${lanIPv6Gateway} dev enp5s0
77 #ip -6 route add default via ''${lanIPv6Gateway} dev enp5s0
78
79 ip -4 address
80 ip -4 route
81 #ip -6 address
82 #ip -6 route
83
84 set +x
85
86 # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
87 # we have to run the postCommands ourselves.
88 ${config.boot.initrd.network.postCommands}
89 '';
90 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
91 #boot.initrd.kernelModules = [ "ipv6" ];
92
93 # Useless without an out-of-band access, and unsecure
94 # (though / may still be encrypted at this point).
95 # boot.kernelParams = [ "boot.shell_on_fail" ];
96
97 # Disable IPv6 entirely until it's available
98 boot.kernel.sysctl = {
99 "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
100 };
101
102 deployment.targetHost = lanIPv4;
103
104 networking = {
105 hostName = "losurdo";
106 domainBase = "sourcephile";
107 domain = "${config.networking.domainBase}.fr";
108
109 useDHCP = false;
110 defaultGateway = {
111 address = lanIPv4Gateway;
112 interface = "enp5s0";
113 };
114 /*
115 defaultGateway6 = {
116 address = lanIPv6Gateway;
117 interface = "enp5s0";
118 };
119 */
120 #nameservers = [ ];
121 interfaces.enp5s0 = {
122 useDHCP = false;
123 ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
124 ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
125
126 /*
127 ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
128 { address = "fe80::1"; prefixLength = 10; }
129 ];
130 ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
131 */
132 };
133 interfaces.wlp4s0 = {
134 useDHCP = false;
135 };
136 };
137 }