machines/losurdo/networking.nix

   1 { pkgs, lib, config, machineName, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   inherit (config.security) gnupg;
   6   #lanIPv4        = "192.168.1.215";
   7   lanNet         = "192.168.1.0/24";
   8   #lanIPv4Gateway = "192.168.1.1";
   9 in
  10 {
  11 imports = [
  12   networking/nftables.nix
  13   networking/ssh.nix
  14   networking/wireguard.nix
  15   networking/tor.nix
  16 ];
  17
  18 boot.initrd.network = {
  19   enable = true;
  20   flushBeforeStage2 = true;
  21   # This will automatically load the zfs password prompt on login
  22   # and kill the other prompt so boot can continue
  23   # The pkill zfs kills the zfs load-key from the console
  24   # allowing the boot to continue.
  25   postCommands = ''
  26     echo >>/root/.profile "zfs load-key ${machineName} && pkill zfs"
  27   '';
  28 };
  29
  30 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  31    a 91.216.110.35/32 becomes a 91.216.110.35/8
  32 boot.kernelParams = map
  33   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  34   [ { clientIP = netIPv4; serverIP = "";
  35       gatewayIP = networking.defaultGateway.address;
  36       netmask = "255.255.255.255";
  37       hostname = ""; device = networking.defaultGateway.interface;
  38       autoconf = "off";
  39     }
  40     { clientIP = lanIPv4; serverIP = "";
  41       gatewayIP = "";
  42       netmask = "255.255.255.0";
  43       hostname = ""; device = "enp2s0";
  44       autoconf = "off";
  45     }
  46   ];
  47 */
  48 /* DIY network config, but a right one */
  49 /*
  50 boot.initrd.preLVMCommands = ''
  51   set -x
  52
  53   # IPv4 lan
  54   ip link set enp5s0 up
  55   ip address add ${lanIPv4}/32 dev enp5s0
  56   ip route add ${lanIPv4Gateway} dev enp5s0
  57   ip route add ${lanNet} dev enp5s0 src ${lanIPv4} proto kernel
  58     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  59   ip route add default via ${lanIPv4Gateway} dev enp5s0
  60
  61   # IPv6 net
  62   #ip -6 address add ''${lanIPv6} dev enp5s0
  63   #ip -6 route add ''${lanIPv6Gateway} dev enp5s0
  64   #ip -6 route add default via ''${lanIPv6Gateway} dev enp5s0
  65
  66   ip -4 address
  67   ip -4 route
  68   #ip -6 address
  69   #ip -6 route
  70
  71   set +x
  72
  73   # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  74   # we have to run the postCommands ourselves.
  75   ${config.boot.initrd.network.postCommands}
  76 '';
  77 */
  78 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  79 #boot.initrd.kernelModules = [ "ipv6" ];
  80
  81 # Useless without an out-of-band access, and unsecure
  82 # (though / may still be encrypted at this point).
  83 # boot.kernelParams = [ "boot.shell_on_fail" ];
  84
  85 /*
  86 # Disable IPv6 entirely until it's available
  87 boot.kernel.sysctl = {
  88   "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
  89 };
  90 */
  91
  92 networking = {
  93   hostName = machineName;
  94   domain = "sourcephile.fr";
  95
  96   useDHCP = false;
  97   enableIPv6 = true;
  98   /*
  99   defaultGateway = {
 100     address = lanIPv4Gateway;
 101     interface = "enp5s0";
 102   };
 103   defaultGateway6 = {
 104     address = lanIPv6Gateway;
 105     interface = "enp5s0";
 106   };
 107   */
 108   #nameservers = [ ];
 109 };
 110
 111 networking.nftables.ruleset = ''
 112   add rule inet filter input  iifname "enp5s0" goto net2fw
 113   add rule inet filter output oifname "enp5s0" jump fw2net
 114   add rule inet filter output oifname "enp5s0" log level warn prefix "fw2net: " counter drop
 115   add rule inet filter fw2net ip daddr ${lanNet} log level info prefix "fw2net: lan: " counter accept comment "LAN"
 116 '';
 117 boot.kernel.sysctl."net.ipv6.conf.enp5s0.addr_gen_mode" = 3;
 118 security.gnupg.secrets."ipv6/enp5s0/stable_secret" = {};
 119 # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
 120 system.activationScripts.ipv6 = ''
 121   ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.enp5s0.stable_secret="$(cat ${gnupg.secrets."ipv6/enp5s0/stable_secret".path})"
 122 '';
 123 networking.interfaces.enp5s0 = {
 124   useDHCP = true;
 125   #ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 126   #ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 127
 128   /*
 129   ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 130                      { address = "fe80::1"; prefixLength = 10; }
 131                    ];
 132   ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 133   */
 134 };
 135 networking.interfaces.wlp4s0 = {
 136   useDHCP = false;
 137 };
 138 }