hydra: no longer needed

[sourcephile-nix.git] / machines / losurdo / networking.nix

diff --git a/machines/losurdo/networking.nix b/machines/losurdo/networking.nix
index cb8ee20068f64662572600c2bd4388155ffb0f4a..7f2bb678b559ef989295d2b0bdca980f02e2e7a4 100644 (file)
--- a/machines/losurdo/networking.nix
+++ b/machines/losurdo/networking.nix
@@ -1,8 +1,8 @@
 { pkgs, lib, config, machineName, ... }:
 with builtins;
 let
-  inherit (builtins.extraBuiltins) pass-to-file;
-  inherit (config) networking users;
+  inherit (config) networking;
+  inherit (config.security) gnupg;
   lanIPv4        = "192.168.1.215";
   lanNet         = "192.168.1.0/24";
   lanIPv4Gateway = "192.168.1.1";
@@ -10,23 +10,25 @@ in
 {
 imports = [
   networking/nftables.nix
+  networking/ssh.nix
+  networking/wireguard/intranet.nix
+  networking/wireguard/extranet.nix
+  networking/tor.nix
+  networking/nsupdate.nix
+  networking/upnpc.nix
+  networking/wireless.nix
+  networking/openvpn.nix
 ];
+
 boot.initrd.network = {
   enable = true;
-  ssh = {
-    enable = true;
-    # To prevent ssh from freaking out because a different host key is used,
-    # a different port for dropbear is useful
-    # (assuming the same host has also a normal sshd running)
-    port = 2222;
-    authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
-  };
+  flushBeforeStage2 = true;
   # This will automatically load the zfs password prompt on login
   # and kill the other prompt so boot can continue
   # The pkill zfs kills the zfs load-key from the console
   # allowing the boot to continue.
   postCommands = ''
-    echo >>/root/.profile "zfs load-key -a && pkill zfs"
+    echo >>/root/.profile "zfs load-key ${machineName} && pkill zfs"
   '';
 };
 
@@ -49,6 +51,7 @@ boot.kernelParams = map
   ];
 */
 /* DIY network config, but a right one */
+/*
 boot.initrd.preLVMCommands = ''
   set -x
 
@@ -71,11 +74,8 @@ boot.initrd.preLVMCommands = ''
   #ip -6 route
 
   set +x
-
-  # Since boot.initrd.network's preLVMCommands won't set hasNetwork=1
-  # we have to run the postCommands ourselves.
-  ${config.boot.initrd.network.postCommands}
 '';
+*/
 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
 #boot.initrd.kernelModules = [ "ipv6" ];
 
@@ -83,48 +83,57 @@ boot.initrd.preLVMCommands = ''
 # (though / may still be encrypted at this point).
 # boot.kernelParams = [ "boot.shell_on_fail" ];
 
+/*
 # Disable IPv6 entirely until it's available
 boot.kernel.sysctl = {
   "net.ipv6.conf.enp5s0.disable_ipv6" = 1;
 };
+*/
 
 networking = {
   hostName = machineName;
   domain = "sourcephile.fr";
-  
+
   useDHCP = false;
+  enableIPv6 = true;
+  /*
   defaultGateway = {
     address = lanIPv4Gateway;
     interface = "enp5s0";
   };
-  /*
   defaultGateway6 = {
     address = lanIPv6Gateway;
     interface = "enp5s0";
   };
   */
   #nameservers = [ ];
-  nftables.ruleset = ''
-    add rule inet filter input  iifname "enp5s0" goto net2fw
-    add rule inet filter output oifname "enp5s0" jump fw2net
-    add rule inet filter output oifname "enp5s0" log level warn prefix \"fw2net: \" counter drop
-    add rule inet filter fw2net ip daddr ${lanNet} counter accept comment "LAN"
-    add rule inet filter fw2net ip daddr 224.0.0.0/4 udp dport 1900 counter accept comment "UPnP"
-  '';
-  interfaces.enp5s0 = {
-    useDHCP = false;
-    ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
-    ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
+};
 
-    /*
-    ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
-                       { address = "fe80::1"; prefixLength = 10; }
-                     ];
-    ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
-    */
-  };
-  interfaces.wlp4s0 = {
-    useDHCP = false;
-  };
+networking.nftables.ruleset = ''
+  add rule inet filter input  iifname "enp5s0" goto net2fw
+  add rule inet filter output oifname "enp5s0" jump fw2net
+  add rule inet filter output oifname "enp5s0" log level warn prefix "fw2net: " counter drop
+  add rule inet filter fw2net ip daddr ${lanNet} log level info prefix "fw2net: lan: " counter accept comment "LAN"
+  add rule inet nat postrouting oifname "enp5s0" masquerade
+'';
+boot.kernel.sysctl."net.ipv6.conf.enp5s0.addr_gen_mode" = 1;
+/*
+security.gnupg.secrets."ipv6/enp5s0/stable_secret" = {};
+# This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
+system.activationScripts.ipv6 = ''
+  ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.enp5s0.stable_secret="$(cat ${gnupg.secrets."ipv6/enp5s0/stable_secret".path})"
+'';
+*/
+networking.interfaces.enp5s0 = {
+  useDHCP = true;
+  /*
+  ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
+
+  ipv4.routes    = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
+  ipv6.addresses = [ { address = lanIPv6; prefixLength = 64; }
+                     { address = "fe80::1"; prefixLength = 10; }
+                   ];
+  ipv6.routes    = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
+  */
 };
 }