]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking.nix
mermet: postgresql: tweak settings
[sourcephile-nix.git] / hosts / losurdo / networking.nix
1 { pkgs, config, hostName, ... }:
2 with builtins;
3 let
4 inherit (config) networking;
5 netIface = "enp5s0";
6 lanNet = "192.168.1.0/24";
7 in
8 {
9 imports = [
10 networking/nftables.nix
11 #networking/tor.nix
12 networking/nsupdate.nix
13 networking/wireless.nix
14 networking/openvpn.nix
15 ];
16
17 boot.initrd.network = {
18 enable = true;
19 flushBeforeStage2 = true;
20 # This will automatically load the zfs password prompt on login
21 # and kill the other prompt so boot can continue
22 # The pkill zfs kills the zfs load-key from the console
23 # allowing the boot to continue.
24 postCommands = ''
25 echo >>/root/.profile "zfs load-key ${hostName} && pkill zfs"
26 '';
27 # Retry DHCP forever (because in case of power failure,
28 # the router may take longer to boot).
29 # Beware that this is not interruptible with Ctrl-C
30 udhcpc.extraArgs = [ "--retries=0" ];
31 };
32
33 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
34 a 91.216.110.35/32 becomes a 91.216.110.35/8
35 boot.kernelParams = map
36 (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
37 [ { clientIP = netIPv4; serverIP = "";
38 gatewayIP = networking.defaultGateway.address;
39 netmask = "255.255.255.255";
40 hostname = ""; device = networking.defaultGateway.interface;
41 autoconf = "off";
42 }
43 { clientIP = lanIPv4; serverIP = "";
44 gatewayIP = "";
45 netmask = "255.255.255.0";
46 hostname = ""; device = "enp2s0";
47 autoconf = "off";
48 }
49 ];
50 */
51 /* DIY network config, but a right one */
52 /*
53 boot.initrd.preLVMCommands = ''
54 set -x
55
56 # IPv4 lan
57 ip link set ${netIface} up
58 ip address add ${lanIPv4}/32 dev ${netIface}
59 ip route add ${lanIPv4Gateway} dev ${netIface}
60 ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
61 # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
62 ip route add default via ${lanIPv4Gateway} dev ${netIface}
63
64 # IPv6 net
65 #ip -6 address add ''${lanIPv6} dev ${netIface}
66 #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
67 #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
68
69 ip -4 address
70 ip -4 route
71 #ip -6 address
72 #ip -6 route
73
74 set +x
75 '';
76 */
77 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
78 #boot.initrd.kernelModules = [ "ipv6" ];
79
80 # Useless without an out-of-band access, and unsecure
81 # (though / may still be encrypted at this point).
82 # boot.kernelParams = [ "boot.shell_on_fail" ];
83
84 /*
85 # Disable IPv6 entirely until it's available
86 boot.kernel.sysctl = {
87 "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
88 };
89 */
90
91 networking = {
92 hostName = hostName;
93 domain = "sourcephile.fr";
94
95 useDHCP = false;
96 enableIPv6 = true;
97 /*
98 defaultGateway = {
99 address = lanIPv4Gateway;
100 interface = "${netIface}";
101 };
102 defaultGateway6 = {
103 address = lanIPv6Gateway;
104 interface = "${netIface}";
105 };
106 */
107 #nameservers = [ ];
108 };
109
110 networking.nftables.ruleset = ''
111 table inet filter {
112 chain input {
113 iifname ${netIface} goto input-net
114 }
115 chain output {
116 oifname ${netIface} jump output-net
117 oifname ${netIface} log level warn prefix "output-net: " counter drop
118 }
119 chain output-net {
120 ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
121 }
122 }
123 table inet nat {
124 chain postrouting {
125 oifname ${netIface} masquerade
126 }
127 }
128 '';
129 boot.kernel.sysctl."net.ipv6.conf.${netIface}.addr_gen_mode" = 1;
130 /*
131 security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
132 # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
133 system.activationScripts.ipv6 = ''
134 ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
135 '';
136 */
137 networking.interfaces.${netIface} = {
138 useDHCP = true;
139 /*
140 ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
141
142 ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
143 ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
144 { address = "fe80::1"; prefixLength = 10; }
145 ];
146 ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
147 */
148 };
149 environment.systemPackages = [
150 pkgs.iodine
151 ];
152 services.vnstat.enable = true;
153 }