hosts/losurdo/networking.nix

   1 { pkgs, config, hostName, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   netIface = "enp5s0";
   6   lanNet = "192.168.1.0/24";
   7 in
   8 {
   9   imports = [
  10     networking/nftables.nix
  11     #networking/tor.nix
  12     networking/nsupdate.nix
  13     networking/wireless.nix
  14     networking/openvpn.nix
  15   ];
  16
  17   boot.initrd.network = {
  18     enable = true;
  19     flushBeforeStage2 = true;
  20     # This will automatically load the zfs password prompt on login
  21     # and kill the other prompt so boot can continue
  22     # The pkill zfs kills the zfs load-key from the console
  23     # allowing the boot to continue.
  24     postCommands = ''
  25       echo >>/root/.profile "zfs load-key ${hostName} && pkill zfs"
  26     '';
  27     # Retry DHCP forever (because in case of power failure,
  28     # the router may take longer to boot).
  29     # Beware that this is not interruptible with Ctrl-C
  30     udhcpc.extraArgs = [ "--retries=0" ];
  31   };
  32
  33   /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  34      a 91.216.110.35/32 becomes a 91.216.110.35/8
  35     boot.kernelParams = map
  36     (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  37     [ { clientIP = netIPv4; serverIP = "";
  38       gatewayIP = networking.defaultGateway.address;
  39       netmask = "255.255.255.255";
  40       hostname = ""; device = networking.defaultGateway.interface;
  41       autoconf = "off";
  42     }
  43     { clientIP = lanIPv4; serverIP = "";
  44       gatewayIP = "";
  45       netmask = "255.255.255.0";
  46       hostname = ""; device = "enp2s0";
  47       autoconf = "off";
  48     }
  49     ];
  50   */
  51   /* DIY network config, but a right one */
  52   /*
  53     boot.initrd.preLVMCommands = ''
  54     set -x
  55
  56     # IPv4 lan
  57     ip link set ${netIface} up
  58     ip address add ${lanIPv4}/32 dev ${netIface}
  59     ip route add ${lanIPv4Gateway} dev ${netIface}
  60     ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
  61     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  62     ip route add default via ${lanIPv4Gateway} dev ${netIface}
  63
  64     # IPv6 net
  65     #ip -6 address add ''${lanIPv6} dev ${netIface}
  66     #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
  67     #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
  68
  69     ip -4 address
  70     ip -4 route
  71     #ip -6 address
  72     #ip -6 route
  73
  74     set +x
  75     '';
  76   */
  77   # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  78   #boot.initrd.kernelModules = [ "ipv6" ];
  79
  80   # Useless without an out-of-band access, and unsecure
  81   # (though / may still be encrypted at this point).
  82   # boot.kernelParams = [ "boot.shell_on_fail" ];
  83
  84   /*
  85     # Disable IPv6 entirely until it's available
  86     boot.kernel.sysctl = {
  87     "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
  88     };
  89   */
  90
  91   networking = {
  92     hostName = hostName;
  93     domain = "sourcephile.fr";
  94
  95     useDHCP = false;
  96     enableIPv6 = true;
  97     /*
  98       defaultGateway = {
  99       address = lanIPv4Gateway;
 100       interface = "${netIface}";
 101       };
 102       defaultGateway6 = {
 103       address = lanIPv6Gateway;
 104       interface = "${netIface}";
 105       };
 106     */
 107     #nameservers = [ ];
 108   };
 109
 110   networking.nftables.ruleset = ''
 111     table inet filter {
 112       chain input {
 113         iifname ${netIface} goto input-net
 114       }
 115       chain output {
 116         oifname ${netIface} jump output-net
 117         oifname ${netIface} log level warn prefix "output-net: " counter drop
 118       }
 119       chain output-net {
 120         ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
 121       }
 122     }
 123     table inet nat {
 124       chain postrouting {
 125         oifname ${netIface} masquerade
 126       }
 127     }
 128   '';
 129   boot.kernel.sysctl."net.ipv6.conf.${netIface}.addr_gen_mode" = 1;
 130   /*
 131     security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
 132     # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
 133     system.activationScripts.ipv6 = ''
 134     ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
 135     '';
 136   */
 137   networking.interfaces.${netIface} = {
 138     useDHCP = true;
 139     /*
 140       ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 141
 142       ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 143       ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 144                      { address = "fe80::1"; prefixLength = 10; }
 145                    ];
 146       ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 147     */
 148   };
 149   environment.systemPackages = [
 150     pkgs.iodine
 151   ];
 152   services.vnstat.enable = true;
 153 }