hosts/losurdo/networking.nix

   1 { pkgs, config, hostName, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   netIface = "enp5s0";
   6   lanNet = "192.168.1.0/24";
   7 in
   8 {
   9   imports = [
  10     networking/nftables.nix
  11     #networking/tor.nix
  12     networking/nsupdate.nix
  13     networking/wireless.nix
  14     networking/openvpn.nix
  15   ];
  16
  17   boot.initrd.network = {
  18     enable = true;
  19     flushBeforeStage2 = true;
  20     # This will automatically load the zfs password prompt on login
  21     # and kill the other prompt so boot can continue
  22     # The pkill zfs kills the zfs load-key from the console
  23     # allowing the boot to continue.
  24     postCommands = ''
  25       echo >>/root/.profile "zfs load-key ${hostName} && pkill zfs"
  26     '';
  27     # Retry DHCP forever (because in case of power failure,
  28     # the router may take longer to boot).
  29     # Beware that this is not interruptible with Ctrl-C
  30     udhcpc.extraArgs = [ "--retries=0" ];
  31   };
  32
  33   systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
  34   systemd.network.enable = true;
  35   systemd.network.wait-online = {
  36     enable = false;
  37   };
  38   systemd.network.networks = {
  39     "10-${netIface}" = {
  40       name = netIface;
  41       # Start a DHCP Client for IPv4 Addressing/Routing
  42       DHCP = "ipv4";
  43       networkConfig = {
  44         # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
  45         IPv6AcceptRA = true;
  46         IPv6PrivacyExtensions = true;
  47         KeepConfiguration = "dhcp-on-stop";
  48       };
  49       linkConfig = {
  50         RequiredForOnline = "no";
  51       };
  52     };
  53   };
  54
  55   /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  56      a 91.216.110.35/32 becomes a 91.216.110.35/8
  57     boot.kernelParams = map
  58     (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  59     [ { clientIP = netIPv4; serverIP = "";
  60       gatewayIP = networking.defaultGateway.address;
  61       netmask = "255.255.255.255";
  62       hostname = ""; device = networking.defaultGateway.interface;
  63       autoconf = "off";
  64     }
  65     { clientIP = lanIPv4; serverIP = "";
  66       gatewayIP = "";
  67       netmask = "255.255.255.0";
  68       hostname = ""; device = "enp2s0";
  69       autoconf = "off";
  70     }
  71     ];
  72   */
  73   /* DIY network config, but a right one */
  74   /*
  75     boot.initrd.preLVMCommands = ''
  76     set -x
  77
  78     # IPv4 lan
  79     ip link set ${netIface} up
  80     ip address add ${lanIPv4}/32 dev ${netIface}
  81     ip route add ${lanIPv4Gateway} dev ${netIface}
  82     ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
  83     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  84     ip route add default via ${lanIPv4Gateway} dev ${netIface}
  85
  86     # IPv6 net
  87     #ip -6 address add ''${lanIPv6} dev ${netIface}
  88     #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
  89     #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
  90
  91     ip -4 address
  92     ip -4 route
  93     #ip -6 address
  94     #ip -6 route
  95
  96     set +x
  97     '';
  98   */
  99   # Workaround https://github.com/NixOS/nixpkgs/issues/56822
 100   #boot.initrd.kernelModules = [ "ipv6" ];
 101
 102   # Useless without an out-of-band access, and unsecure
 103   # (though / may still be encrypted at this point).
 104   # boot.kernelParams = [ "boot.shell_on_fail" ];
 105
 106   /*
 107     # Disable IPv6 entirely until it's available
 108     boot.kernel.sysctl = {
 109     "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
 110     };
 111   */
 112
 113   networking = {
 114     hostName = hostName;
 115     domain = "sourcephile.fr";
 116
 117     useDHCP = false;
 118     enableIPv6 = true;
 119     /*
 120       defaultGateway = {
 121       address = lanIPv4Gateway;
 122       interface = "${netIface}";
 123       };
 124       defaultGateway6 = {
 125       address = lanIPv6Gateway;
 126       interface = "${netIface}";
 127       };
 128     */
 129     #nameservers = [ ];
 130   };
 131
 132   networking.nftables.ruleset = ''
 133     table inet filter {
 134       chain input {
 135         iifname ${netIface} goto input-net
 136       }
 137       chain output {
 138         oifname ${netIface} jump output-net
 139         oifname ${netIface} log level warn prefix "output-net: " counter drop
 140       }
 141       chain output-net {
 142         ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
 143       }
 144     }
 145     table inet nat {
 146       chain postrouting {
 147         oifname ${netIface} masquerade
 148       }
 149     }
 150   '';
 151   /*
 152     security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
 153     # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
 154     system.activationScripts.ipv6 = ''
 155     ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
 156     '';
 157   */
 158   environment.systemPackages = [
 159     pkgs.iodine
 160   ];
 161   services.vnstat.enable = true;
 162 }