hosts/losurdo/networking.nix

   1 { pkgs, lib, config, hostName, ... }:
   2 with builtins;
   3 let
   4   inherit (config) networking;
   5   netIface       = "enp5s0";
   6   lanIPv4        = "192.168.1.215";
   7   lanNet         = "192.168.1.0/24";
   8   lanIPv4Gateway = "192.168.1.1";
   9 in
  10 {
  11 imports = [
  12   networking/nftables.nix
  13   networking/ssh.nix
  14   networking/wireguard/intranet.nix
  15   networking/wireguard/extranet.nix
  16   #networking/tor.nix
  17   networking/nsupdate.nix
  18   networking/wireless.nix
  19   networking/openvpn.nix
  20 ];
  21
  22 boot.initrd.network = {
  23   enable = true;
  24   flushBeforeStage2 = true;
  25   # This will automatically load the zfs password prompt on login
  26   # and kill the other prompt so boot can continue
  27   # The pkill zfs kills the zfs load-key from the console
  28   # allowing the boot to continue.
  29   postCommands = ''
  30     echo >>/root/.profile "zfs load-key ${hostName} && pkill zfs"
  31   '';
  32   # Retry DHCP forever (because in case of power failure,
  33   # the router may take longer to boot).
  34   # Beware that this is not interruptible with Ctrl-C
  35   udhcpc.extraArgs = [ "--retries=0" ];
  36 };
  37
  38 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
  39    a 91.216.110.35/32 becomes a 91.216.110.35/8
  40 boot.kernelParams = map
  41   (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
  42   [ { clientIP = netIPv4; serverIP = "";
  43       gatewayIP = networking.defaultGateway.address;
  44       netmask = "255.255.255.255";
  45       hostname = ""; device = networking.defaultGateway.interface;
  46       autoconf = "off";
  47     }
  48     { clientIP = lanIPv4; serverIP = "";
  49       gatewayIP = "";
  50       netmask = "255.255.255.0";
  51       hostname = ""; device = "enp2s0";
  52       autoconf = "off";
  53     }
  54   ];
  55 */
  56 /* DIY network config, but a right one */
  57 /*
  58 boot.initrd.preLVMCommands = ''
  59   set -x
  60
  61   # IPv4 lan
  62   ip link set ${netIface} up
  63   ip address add ${lanIPv4}/32 dev ${netIface}
  64   ip route add ${lanIPv4Gateway} dev ${netIface}
  65   ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
  66     # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
  67   ip route add default via ${lanIPv4Gateway} dev ${netIface}
  68
  69   # IPv6 net
  70   #ip -6 address add ''${lanIPv6} dev ${netIface}
  71   #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
  72   #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}
  73
  74   ip -4 address
  75   ip -4 route
  76   #ip -6 address
  77   #ip -6 route
  78
  79   set +x
  80 '';
  81 */
  82 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  83 #boot.initrd.kernelModules = [ "ipv6" ];
  84
  85 # Useless without an out-of-band access, and unsecure
  86 # (though / may still be encrypted at this point).
  87 # boot.kernelParams = [ "boot.shell_on_fail" ];
  88
  89 /*
  90 # Disable IPv6 entirely until it's available
  91 boot.kernel.sysctl = {
  92   "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
  93 };
  94 */
  95
  96 networking = {
  97   hostName = hostName;
  98   domain = "sourcephile.fr";
  99
 100   useDHCP = false;
 101   enableIPv6 = true;
 102   /*
 103   defaultGateway = {
 104     address = lanIPv4Gateway;
 105     interface = "${netIface}";
 106   };
 107   defaultGateway6 = {
 108     address = lanIPv6Gateway;
 109     interface = "${netIface}";
 110   };
 111   */
 112   #nameservers = [ ];
 113 };
 114
 115 networking.nftables.ruleset = ''
 116   table inet filter {
 117     chain input {
 118       iifname ${netIface} goto input-net
 119     }
 120     chain output {
 121       oifname ${netIface} jump output-net
 122       oifname ${netIface} log level warn prefix "output-net: " counter drop
 123     }
 124     chain output-net {
 125       ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
 126     }
 127   }
 128   table inet nat {
 129     chain postrouting {
 130       oifname ${netIface} masquerade
 131     }
 132   }
 133 '';
 134 boot.kernel.sysctl."net.ipv6.conf.${netIface}.addr_gen_mode" = 1;
 135 /*
 136 security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
 137 # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
 138 system.activationScripts.ipv6 = ''
 139   ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
 140 '';
 141 */
 142 networking.interfaces.${netIface} = {
 143   useDHCP = true;
 144   /*
 145   ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
 146
 147   ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
 148   ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
 149                      { address = "fe80::1"; prefixLength = 10; }
 150                    ];
 151   ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
 152   */
 153 };
 154 environment.systemPackages = [
 155   pkgs.iodine
 156 ];
 157 }