machines/losurdo/networking.nix

   1 { pkgs, lib, config, machineName, machines, wireguard, ... }:
   2 with builtins;
   3 let
   4   #lanIPv4        = "192.168.1.215";
   5   lanNet         = "192.168.1.0/24";
   6   #lanIPv4Gateway = "192.168.1.1";
   7 in
   8 {
   9 imports = [
  10   networking/nftables.nix
  11   networking/ssh.nix
  12   networking/wireguard.nix
  13 ];
  14
  15 boot.initrd.network = {
  16   enable = true;
  17   flushBeforeStage2 = true;
  18   # This will automatically load the zfs password prompt on login
  19   # and kill the other prompt so boot can continue
  20   # The pkill zfs kills the zfs load-key from the console
  21   # allowing the boot to continue.
  22   postCommands = ''
  23     echo >>/root/.profile "zfs load-key ${machineName} && pkill zfs"
  24   '';
  25 };
  26
  27 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  28    a 91.216.110.35/32 becomes a 91.216.110.35/8
  29 boot.kernelParams = map
  30   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  31   [ { clientIP = netIPv4; serverIP = "";
  32       gatewayIP = networking.defaultGateway.address;
  33       netmask = "255.255.255.255";
  34       hostname = ""; device = networking.defaultGateway.interface;
  35       autoconf = "off";
  36     }
  37     { clientIP = lanIPv4; serverIP = "";
  38       gatewayIP = "";
  39       netmask = "255.255.255.0";
  40       hostname = ""; device = "enp2s0";
  41       autoconf = "off";
  42     }
  43   ];
  44 */
  45 /* DIY network config, but a right one */
  46 /*
  47 boot.initrd.preLVMCommands = ''
  48   set -x
  49
  50   # IPv4 lan
  51   ip link set enp5s0 up
  52   ip address add ${lanIPv4}/32 dev enp5s0
  53   ip route add ${lanIPv4Gateway} dev enp5s0
  54   ip route add ${lanNet} dev enp5s0 src ${lanIPv4} proto kernel
  55     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  56   ip route add default via ${lanIPv4Gateway} dev enp5s0
  57
  58   # IPv6 net
  59   #ip -6 address add ''${lanIPv6} dev enp5s0
  60   #ip -6 route add ''${lanIPv6Gateway} dev enp5s0
  61   #ip -6 route add default via ''${lanIPv6Gateway} dev enp5s0
  62
  63   ip -4 address
  64   ip -4 route
  65   #ip -6 address
  66   #ip -6 route
  67
  68   set +x
  69
  70   # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
  71   # we have to run the postCommands ourselves.
  72   ${config.boot.initrd.network.postCommands}
  73 '';
  74 */
  75 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  76 #boot.initrd.kernelModules = [ "ipv6" ];
  77
  78 # Useless without an out-of-band access, and unsecure
  79 # (though / may still be encrypted at this point).
  80 # boot.kernelParams = [ "boot.shell_on_fail" ];
  81
  82 /*
  83 # Disable IPv6 entirely until it's available
  84 boot.kernel.sysctl = {
  85   "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
  86 };
  87 */
  88
  89 networking = {
  90   hostName = machineName;
  91   domain = "sourcephile.fr";
  92
  93   useDHCP = false;
  94   /*
  95   defaultGateway = {
  96     address = lanIPv4Gateway;
  97     interface = "enp5s0";
  98   };
  99   defaultGateway6 = {
 100     address = lanIPv6Gateway;
 101     interface = "enp5s0";
 102   };
 103   */
 104   #nameservers = [ ];
 105 };
 106
 107 networking.nftables.ruleset = ''
 108   add rule inet filter input  iifname "enp5s0" goto net2fw
 109   add rule inet filter output oifname "enp5s0" jump fw2net
 110   add rule inet filter output oifname "enp5s0" log level warn prefix "fw2net: " counter drop
 111   add rule inet filter fw2net ip daddr ${machines.losurdo.extraArgs.ipv4} counter accept comment "losurdo"
 112   add rule inet filter fw2net ip daddr ${machines.mermet.extraArgs.ipv4} counter accept comment "mermet"
 113   add rule inet filter fw2net ip daddr ${lanNet} counter accept comment "LAN"
 114   add rule inet filter fw2net ip daddr 224.0.0.0/4 udp dport 1900 counter accept comment "UPnP"
 115 '';
 116 networking.interfaces.enp5s0 = {
 117   useDHCP = true;
 118   #ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 119   #ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 120
 121   /*
 122   ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 123                      { address = "fe80::1"; prefixLength = 10; }
 124                    ];
 125   ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 126   */
 127 };
 128 networking.interfaces.wlp4s0 = {
 129   useDHCP = false;
 130 };
 131 }