servers/losurdo/networking.nix

   1 { pkgs, lib, config, nodes, ... }:
   2 with builtins;
   3 let
   4   inherit (builtins.extraBuiltins) pass-to-file;
   5   inherit (config) networking users;
   6   lanIPv4        = "192.168.1.215";
   7   lanNet         = "192.168.1.0/24";
   8   lanIPv4Gateway = "192.168.1.1";
   9 in
  10 {
  11 imports = [
  12   networking/nftables.nix
  13 ];
  14 boot.initrd.network = {
  15   enable = true;
  16   ssh = {
  17     enable = true;
  18     # To prevent ssh from freaking out because a different host key is used,
  19     # a different port for dropbear is useful
  20     # (assuming the same host has also a normal sshd running)
  21     port = 2222;
  22     authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
  23   };
  24   # This will automatically load the zfs password prompt on login
  25   # and kill the other prompt so boot can continue
  26   # The pkill zfs kills the zfs load-key from the console
  27   # allowing the boot to continue.
  28   postCommands = ''
  29     echo >>/root/.profile "zfs load-key -a && pkill zfs"
  30   '';
  31 };
  32
  33 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  34    a 91.216.110.35/32 becomes a 91.216.110.35/8
  35 boot.kernelParams = map
  36   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  37   [ { clientIP = netIPv4; serverIP = "";
  38       gatewayIP = networking.defaultGateway.address;
  39       netmask = "255.255.255.255";
  40       hostname = ""; device = networking.defaultGateway.interface;
  41       autoconf = "off";
  42     }
  43     { clientIP = lanIPv4; serverIP = "";
  44       gatewayIP = "";
  45       netmask = "255.255.255.0";
  46       hostname = ""; device = "enp2s0";
  47       autoconf = "off";
  48     }
  49   ];
  50 */
  51 /* DIY network config, but a right one */
  52 boot.initrd.preLVMCommands = ''
  53   set -x
  54
  55   # IPv4 lan
  56   ip link set enp5s0 up
  57   ip address add ${lanIPv4}/32 dev enp5s0
  58   ip route add ${lanIPv4Gateway} dev enp5s0
  59   ip route add ${lanNet} dev enp5s0 src ${lanIPv4} proto kernel
  60     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  61   ip route add default via ${lanIPv4Gateway} dev enp5s0
  62
  63   # IPv6 net
  64   #ip -6 address add ''${lanIPv6} dev enp5s0
  65   #ip -6 route add ''${lanIPv6Gateway} dev enp5s0
  66   #ip -6 route add default via ''${lanIPv6Gateway} dev enp5s0
  67
  68   ip -4 address
  69   ip -4 route
  70   #ip -6 address
  71   #ip -6 route
  72
  73   set +x
  74
  75   # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  76   # we have to run the postCommands ourselves.
  77   ${config.boot.initrd.network.postCommands}
  78 '';
  79 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  80 #boot.initrd.kernelModules = [ "ipv6" ];
  81
  82 # Useless without an out-of-band access, and unsecure
  83 # (though / may still be encrypted at this point).
  84 # boot.kernelParams = [ "boot.shell_on_fail" ];
  85
  86 # Disable IPv6 entirely until it's available
  87 boot.kernel.sysctl = {
  88   "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
  89 };
  90
  91 networking = rec {
  92   hostName   = "losurdo";
  93   domainBase = "sourcephile";
  94   domain     = "${domainBase}.fr";
  95
  96   useDHCP = false;
  97   defaultGateway = {
  98     address = lanIPv4Gateway;
  99     interface = "enp5s0";
 100   };
 101   /*
 102   defaultGateway6 = {
 103     address = lanIPv6Gateway;
 104     interface = "enp5s0";
 105   };
 106   */
 107   #nameservers = [ ];
 108   nftables.ruleset = ''
 109     add rule inet filter input  iifname "enp5s0" goto net2fw
 110     add rule inet filter output oifname "enp5s0" goto fw2net
 111     add rule inet filter fw2net ip daddr ${lanNet} counter accept comment "LAN"
 112     add rule inet filter fw2net ip daddr 224.0.0.0/4 udp dport 1900 counter accept comment "UPnP"
 113   '';
 114   interfaces.enp5s0 = {
 115     useDHCP = false;
 116     ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 117     ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 118
 119     /*
 120     ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 121                        { address = "fe80::1"; prefixLength = 10; }
 122                      ];
 123     ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 124     */
 125   };
 126   interfaces.wlp4s0 = {
 127     useDHCP = false;
 128   };
 129 };
 130 }