1301 lines
37 KiB
Nix
1301 lines
37 KiB
Nix
{
|
|
repoFlake,
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
nodeFlake,
|
|
nodeName,
|
|
localDomainName,
|
|
system,
|
|
...
|
|
}: let
|
|
inherit
|
|
(nodeFlake.inputs)
|
|
nixos-nftables-firewall
|
|
nixos-sbc
|
|
;
|
|
|
|
vlanRangeStart = builtins.head vlanRange;
|
|
vlanRangeEnd = builtins.elemAt vlanRange ((builtins.length vlanRange) - 1);
|
|
vlanRange = builtins.map (vlanid: (lib.strings.toInt vlanid)) (builtins.attrNames vlans);
|
|
vlanRangeWith0 = [0] ++ vlanRange;
|
|
|
|
mkVlanIpv4HostAddr = {
|
|
vlanid,
|
|
host,
|
|
thirdIpv4SegmentMin ? 20,
|
|
cidr ? true,
|
|
}: let
|
|
# reserve the first subnet for vlanid == 0
|
|
# number the other subnets continously from there
|
|
offset =
|
|
if vlanid == 0
|
|
then thirdIpv4SegmentMin
|
|
else thirdIpv4SegmentMin + 1 - vlanRangeStart;
|
|
in
|
|
builtins.concatStringsSep "."
|
|
["192" "168" (toString (vlanid + offset)) "${toString host}${lib.strings.optionalString cidr "/24"}"];
|
|
|
|
defaultVlan = {
|
|
name = "${localDomainName}";
|
|
packet_priority = 0;
|
|
};
|
|
|
|
vlans = {
|
|
"10".name = "mgmt";
|
|
"10".packet_priority = 0;
|
|
|
|
"11".name = "dmz";
|
|
"11".packet_priority = -5;
|
|
|
|
"12".name = "iot";
|
|
"12".packet_priority = -5;
|
|
|
|
"13".name = "office";
|
|
"13".packet_priority = -10;
|
|
|
|
"14".name = "guests";
|
|
"14".packet_priority = 10;
|
|
|
|
"15".name = "iot2";
|
|
"15".packet_priority = -10;
|
|
};
|
|
|
|
vlansByName =
|
|
lib.attrsets.mapAttrs'
|
|
(
|
|
vlanid': attrs:
|
|
lib.attrsets.nameValuePair
|
|
attrs.name
|
|
(attrs
|
|
// {
|
|
id = lib.strings.toInt vlanid';
|
|
id' = vlanid';
|
|
})
|
|
)
|
|
vlans;
|
|
|
|
getVlanDomain = {vlanid}:
|
|
if vlanid == 0
|
|
then defaultVlan.name
|
|
else vlans."${toString vlanid}".name + "." + defaultVlan.name;
|
|
|
|
bridgeInterfaceName = "br-lan";
|
|
mkInterfaceName = {vlanid}:
|
|
if vlanid == 0
|
|
then bridgeInterfaceName
|
|
else "${bridgeInterfaceName}.${toString vlanid}";
|
|
|
|
dmzExposedHost = "sj-srv1.dmz.internal";
|
|
dmzExposedHostIpv4 = mkVlanIpv4HostAddr {
|
|
vlanid = vlansByName.dmz.id;
|
|
host = 99;
|
|
cidr = false;
|
|
};
|
|
# "sj-srv1.dmz.internal";
|
|
in {
|
|
imports = [
|
|
nixos-sbc.nixosModules.default
|
|
nixos-sbc.nixosModules.boards.bananapi.bpir3
|
|
{
|
|
sbc.version = "0.2";
|
|
sbc.bootstrap.rootFilesystem = "btrfs";
|
|
sbc.wireless.wifi.acceptRegulatoryResponsibility = true;
|
|
}
|
|
|
|
repoFlake.inputs.sops-nix.nixosModules.sops
|
|
|
|
../../profiles/common/user.nix
|
|
../../snippets/nix-settings.nix
|
|
|
|
nixos-nftables-firewall.nixosModules.default
|
|
|
|
{
|
|
services.openssh.enable = true;
|
|
services.openssh.settings.PermitRootLogin = "yes";
|
|
|
|
users.commonUsers = {
|
|
enable = true;
|
|
enableNonRoot = false;
|
|
rootPasswordFile = config.sops.secrets.passwords-root.path;
|
|
};
|
|
|
|
sops.defaultSopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
|
sops.defaultSopsFormat = "yaml";
|
|
|
|
sops.secrets.passwords-root.neededForUsers = true;
|
|
|
|
# sops.secrets.wlan0_saePasswordsFile = {};
|
|
sops.secrets.wlan0_wpaPskFile = {};
|
|
}
|
|
];
|
|
|
|
# sops.secrets.ssh_host_ed25519_key = {
|
|
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
|
# format = "yaml";
|
|
|
|
# path = "/etc/ssh/ssh_host_ed25519_key";
|
|
# mode = "0600";
|
|
# };
|
|
# sops.secrets.ssh_host_ed25519_key_pub = {
|
|
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
|
# format = "yaml";
|
|
|
|
# path = "/etc/ssh/ssh_host_ed25519_key.pub";
|
|
# mode = "0600";
|
|
# };
|
|
# sops.secrets.ssh_host_rsa_key = {
|
|
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
|
# format = "yaml";
|
|
|
|
# path = "/etc/ssh/ssh_host_rsa_key";
|
|
# mode = "0600";
|
|
# };
|
|
# sops.secrets.ssh_host_rsa_key_pub = {
|
|
# sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
|
# format = "yaml";
|
|
|
|
# path = "/etc/ssh/ssh_host_rsa_key.pub";
|
|
# mode = "0644";
|
|
# };
|
|
|
|
boot = {
|
|
kernel = {
|
|
sysctl = {
|
|
"net.ipv4.conf.all.forwarding" = true;
|
|
"net.ipv6.conf.all.forwarding" = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = nodeName;
|
|
useNetworkd = true;
|
|
useDHCP = false;
|
|
|
|
# these will be configured via nftables
|
|
nat.enable = lib.mkForce false;
|
|
firewall.enable = lib.mkForce false;
|
|
|
|
# Use the nftables firewall instead of the base nixos scripted rules.
|
|
# This flake provides a similar utility to the base nixos scripting.
|
|
# https://github.com/thelegy/nixos-nftables-firewall/tree/main
|
|
|
|
# TODO: configure packet_priority for VLANs (see https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_priority, https://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_metainformation#packet_priority)
|
|
nftables = {
|
|
enable = true;
|
|
stopRuleset = "";
|
|
|
|
chains = {
|
|
prerouting = {
|
|
"exposeHost" = {
|
|
after = ["hook"];
|
|
rules = let
|
|
wanInterfaces = builtins.concatStringsSep ", " config.networking.nftables.firewall.zones.wan.interfaces;
|
|
in [
|
|
"iifname { ${wanInterfaces} } tcp dport 220 redirect to 22"
|
|
"iifname { ${wanInterfaces} } dnat ip to ${dmzExposedHostIpv4}"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
firewall = {
|
|
enable = true;
|
|
zones =
|
|
{
|
|
lan.interfaces = [(mkInterfaceName {vlanid = 0;})];
|
|
vlan.interfaces = builtins.map (vlanid: (mkInterfaceName {inherit vlanid;})) vlanRange;
|
|
# lan.ipv4Addresses = ["192.168.0.0/16"];
|
|
wan.interfaces = ["wan" "lan0"];
|
|
vpn.interfaces = ["wg0" "wg1" "wg2"];
|
|
}
|
|
//
|
|
# generate a zone for each vlan
|
|
lib.attrsets.mapAttrs
|
|
(key: value: {
|
|
interfaces = [(mkInterfaceName {vlanid = value.id;})];
|
|
})
|
|
vlansByName;
|
|
rules = let
|
|
ipv6IcmpTypes = [
|
|
"destination-unreachable"
|
|
"echo-reply"
|
|
"echo-request"
|
|
"packet-too-big"
|
|
"parameter-problem"
|
|
"time-exceeded"
|
|
|
|
# Without the nd-* ones ipv6 will not work.
|
|
"nd-neighbor-solicit"
|
|
"nd-router-advert"
|
|
"nd-neighbor-advert"
|
|
];
|
|
ipv4IcmpTypes = [
|
|
"destination-unreachable"
|
|
"echo-reply"
|
|
"echo-request"
|
|
"source-quench"
|
|
"time-exceeded"
|
|
"router-advertisement"
|
|
];
|
|
allowIcmpLines = [
|
|
"ip protocol icmp icmp type { ${builtins.concatStringsSep ", " ipv4IcmpTypes} } accept"
|
|
"ip6 nexthdr icmpv6 icmpv6 type { ${builtins.concatStringsSep ", " ipv6IcmpTypes} } accept"
|
|
];
|
|
in {
|
|
fw = {
|
|
from = ["fw"];
|
|
verdict = "accept";
|
|
};
|
|
|
|
office-to-dmz = {
|
|
from = ["office"];
|
|
to = ["dmz"];
|
|
verdict = "accept";
|
|
};
|
|
|
|
lan-to-fw = {
|
|
from = ["lan"];
|
|
to = ["fw" "lan"];
|
|
verdict = "accept";
|
|
};
|
|
|
|
lan-to-wan = {
|
|
from = ["lan"];
|
|
to = ["wan"];
|
|
verdict = "accept";
|
|
};
|
|
|
|
vlan-to-wan = {
|
|
from = ["vlan"];
|
|
to = ["wan"];
|
|
verdict = "accept";
|
|
};
|
|
|
|
vlan-to-fw = {
|
|
allowedUDPPortRanges = [
|
|
{
|
|
from = 53;
|
|
to = 53;
|
|
}
|
|
{
|
|
from = 67;
|
|
to = 68;
|
|
}
|
|
{
|
|
from = 5201;
|
|
to = 5201;
|
|
}
|
|
];
|
|
allowedTCPPortRanges = [
|
|
{
|
|
from = 22;
|
|
to = 22;
|
|
}
|
|
{
|
|
from = 53;
|
|
to = 53;
|
|
}
|
|
{
|
|
from = 5201;
|
|
to = 5201;
|
|
}
|
|
];
|
|
from = ["vlan"];
|
|
to = ["fw"];
|
|
extraLines =
|
|
allowIcmpLines
|
|
++ [
|
|
"drop"
|
|
];
|
|
};
|
|
|
|
to-wan-nat = {
|
|
from = ["lan" "vlan"];
|
|
to = ["wan"];
|
|
masquerade = true;
|
|
verdict = "accept";
|
|
};
|
|
|
|
wan-to-dmz = {
|
|
from = ["wan"];
|
|
to = ["dmz"];
|
|
verdict = "accept";
|
|
};
|
|
|
|
wan-to-fw = {
|
|
from = ["wan"];
|
|
to = ["fw"];
|
|
allowedTCPPortRanges = [
|
|
{
|
|
from = 22;
|
|
to = 22;
|
|
}
|
|
];
|
|
extraLines =
|
|
allowIcmpLines
|
|
++ [
|
|
"drop"
|
|
];
|
|
};
|
|
|
|
to-vpn-nat = {
|
|
from = ["lan" "vlan"];
|
|
to = ["vpn"];
|
|
masquerade = false;
|
|
verdict = "accept";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
sops.secrets.wg0-privatekey = {
|
|
mode = "440";
|
|
group = "systemd-network";
|
|
};
|
|
sops.secrets.wg1-privatekey = {
|
|
mode = "440";
|
|
group = "systemd-network";
|
|
};
|
|
sops.secrets.wg0-peer0-psk = {
|
|
mode = "440";
|
|
group = "systemd-network";
|
|
};
|
|
sops.secrets.wg1-peer0-psk = {
|
|
mode = "440";
|
|
group = "systemd-network";
|
|
};
|
|
|
|
systemd.network = {
|
|
wait-online.anyInterface = true;
|
|
netdevs = let
|
|
router0-ifog_wg0Endpoint = "${repoFlake.colmena.router0-ifog.deployment.targetHost}:${
|
|
builtins.toString
|
|
repoFlake
|
|
.nixosConfigurations
|
|
.router0-ifog
|
|
.config
|
|
.systemd
|
|
.network
|
|
.netdevs
|
|
.wg0
|
|
.wireguardConfig
|
|
.ListenPort
|
|
}";
|
|
|
|
router0-ifog_wg1Endpoint = "${repoFlake.colmena.router0-ifog.deployment.targetHost}:${
|
|
builtins.toString
|
|
repoFlake
|
|
.nixosConfigurations
|
|
.router0-ifog
|
|
.config
|
|
.systemd
|
|
.network
|
|
.netdevs
|
|
.wg1
|
|
.wireguardConfig
|
|
.ListenPort
|
|
}";
|
|
|
|
router0-hosthatch_wg0Endpoint = "${repoFlake.colmena.router0-hosthatch.deployment.targetHost}:${
|
|
builtins.toString
|
|
repoFlake
|
|
.nixosConfigurations
|
|
.router0-hosthatch
|
|
.config
|
|
.systemd
|
|
.network
|
|
.netdevs
|
|
.wg0
|
|
.wireguardConfig
|
|
.ListenPort
|
|
}";
|
|
in
|
|
{
|
|
# Create the bridge interface
|
|
"20-${bridgeInterfaceName}" = {
|
|
netdevConfig = {
|
|
Kind = "bridge";
|
|
Name = bridgeInterfaceName;
|
|
};
|
|
|
|
extraConfig = ''
|
|
[Bridge]
|
|
STP=yes
|
|
VLANFiltering=yes
|
|
VLANProtocol=802.1q
|
|
DefaultPVID=0
|
|
'';
|
|
};
|
|
|
|
wg0 = {
|
|
enable = true;
|
|
netdevConfig = {
|
|
Name = "wg0";
|
|
Kind = "wireguard";
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = builtins.toString config.sops.secrets.wg0-privatekey.path;
|
|
FirewallMark = 100;
|
|
};
|
|
wireguardPeers = [
|
|
{
|
|
wireguardPeerConfig = {
|
|
AllowedIPs = [
|
|
# this allows all traffic to be routed through this interface
|
|
"0.0.0.0/0"
|
|
|
|
# # alternatively, specific destinations could be allowed
|
|
|
|
# # remote peer wg addr
|
|
# "10.0.0.0/32"
|
|
|
|
# "1.1.1.1/32"
|
|
# # ifconfig.co.
|
|
# "172.67.168.106"
|
|
# "104.21.54.91"
|
|
];
|
|
PersistentKeepalive = 15;
|
|
PresharedKeyFile = builtins.toString config.sops.secrets.wg0-peer0-psk.path;
|
|
PublicKey = "/RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=";
|
|
Endpoint = router0-ifog_wg0Endpoint;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
wg1 = {
|
|
enable = true;
|
|
netdevConfig = {
|
|
Name = "wg1";
|
|
Kind = "wireguard";
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = builtins.toString config.sops.secrets.wg1-privatekey.path;
|
|
FirewallMark = 101;
|
|
};
|
|
wireguardPeers = [
|
|
{
|
|
wireguardPeerConfig = {
|
|
AllowedIPs = [
|
|
# this allows all traffic to be routed through this interface
|
|
"0.0.0.0/0"
|
|
];
|
|
PersistentKeepalive = 15;
|
|
PresharedKeyFile = builtins.toString config.sops.secrets.wg1-peer0-psk.path;
|
|
PublicKey = "/RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=";
|
|
Endpoint = router0-ifog_wg1Endpoint;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
wg2 = {
|
|
enable = true;
|
|
netdevConfig = {
|
|
Name = "wg2";
|
|
Kind = "wireguard";
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = builtins.toString config.sops.secrets.wg0-privatekey.path;
|
|
FirewallMark = 102;
|
|
};
|
|
wireguardPeers = [
|
|
{
|
|
wireguardPeerConfig = {
|
|
AllowedIPs = [
|
|
# this allows all traffic to be routed through this interface
|
|
"0.0.0.0/0"
|
|
|
|
# # alternatively, specific destinations could be allowed
|
|
|
|
# # remote peer wg addr
|
|
# "10.0.0.0/32"
|
|
|
|
# "1.1.1.1/32"
|
|
# # ifconfig.co.
|
|
# "172.67.168.106"
|
|
# "104.21.54.91"
|
|
];
|
|
PersistentKeepalive = 15;
|
|
PresharedKeyFile = builtins.toString config.sops.secrets.wg0-peer0-psk.path;
|
|
PublicKey = "/RPDdqPzr9iRc7zR0bRkt9aS2QCt+b2K3WbsNg8XamM=";
|
|
Endpoint = router0-hosthatch_wg0Endpoint;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
}
|
|
# generate the vlan devices. these will be tagged on the main bridge
|
|
// builtins.foldl'
|
|
(acc: cur: acc // cur)
|
|
{}
|
|
(
|
|
builtins.map
|
|
({
|
|
vlanid,
|
|
vlanid',
|
|
}: {
|
|
"20-${mkInterfaceName {inherit vlanid;}}" = {
|
|
netdevConfig = {
|
|
Kind = "vlan";
|
|
Name = "${mkInterfaceName {inherit vlanid;}}";
|
|
};
|
|
vlanConfig.Id = vlanid;
|
|
};
|
|
})
|
|
(
|
|
builtins.map
|
|
(vlanid: {
|
|
inherit vlanid;
|
|
vlanid' = builtins.toString vlanid;
|
|
})
|
|
vlanRange
|
|
)
|
|
);
|
|
networks =
|
|
{
|
|
# places options here that should always exist
|
|
"lo" = {
|
|
matchConfig.Name = "lo";
|
|
|
|
# these are roughly equivalent to:
|
|
# ip rule add fwmark 100 priority 0 table 100
|
|
# ip rule add fwmark 100 priority 1 prohibit
|
|
# ip rule add fwmark 101 priority 0 table 101
|
|
# ip rule add fwmark 101 priority 1 prohibit
|
|
routingPolicyRules = [
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
FirewallMark = 100;
|
|
Priority = 30000;
|
|
Table = 100;
|
|
};
|
|
}
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
FirewallMark = 100;
|
|
Priority = 30001;
|
|
Table = 100;
|
|
Type = "prohibit";
|
|
};
|
|
}
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
FirewallMark = 101;
|
|
Priority = 30000;
|
|
Table = 101;
|
|
};
|
|
}
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
FirewallMark = 101;
|
|
Priority = 30001;
|
|
Table = 101;
|
|
Type = "prohibit";
|
|
};
|
|
}
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
FirewallMark = 102;
|
|
Priority = 30000;
|
|
Table = 102;
|
|
};
|
|
}
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
FirewallMark = 102;
|
|
Priority = 30001;
|
|
Table = 102;
|
|
Type = "prohibit";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
# use lan0 as secondary WAN interface
|
|
"10-lan0-wan" = {
|
|
matchConfig.Name = "lan0";
|
|
networkConfig = {
|
|
# start a DHCP Client for IPv4/6 Addressing/Routing
|
|
DHCP = true;
|
|
# accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
|
|
IPv6AcceptRA = true;
|
|
DNSOverTLS = true;
|
|
DNSSEC = true;
|
|
IPv6PrivacyExtensions = false;
|
|
IPForward = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "no";
|
|
|
|
# similar to
|
|
# ip route add default via 172.16.0.1 table 101
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Gateway = "_dhcp4";
|
|
Table = 101;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
"10-wan" = {
|
|
matchConfig.Name = "wan";
|
|
networkConfig = {
|
|
# start a DHCP Client for IPv4/6 Addressing/Routing
|
|
DHCP = true;
|
|
# accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
|
|
IPv6AcceptRA = true;
|
|
DNSOverTLS = true;
|
|
DNSSEC = true;
|
|
IPv6PrivacyExtensions = false;
|
|
IPForward = true;
|
|
};
|
|
# make routing on this interface a dependency for network-online.target
|
|
# linkConfig.RequiredForOnline = "routable";
|
|
linkConfig.RequiredForOnline = "no";
|
|
|
|
# similar to
|
|
# ip route add default via 192.168.0.1 table 100
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Gateway = "_dhcp4";
|
|
Table = 100;
|
|
};
|
|
}
|
|
{
|
|
routeConfig = {
|
|
Gateway = "_dhcp4";
|
|
Table = 102;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
# Connect the bridge ports to the bridge
|
|
"30-lan1" = {
|
|
matchConfig.Name = "lan1";
|
|
networkConfig = {
|
|
Bridge = bridgeInterfaceName;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "enslaved";
|
|
|
|
bridgeVLANs = [
|
|
{
|
|
bridgeVLANConfig = {
|
|
VLAN = vlansByName.dmz.id;
|
|
PVID = vlansByName.dmz.id;
|
|
EgressUntagged = vlansByName.dmz.id;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
"30-lan2" = {
|
|
matchConfig.Name = "lan2";
|
|
networkConfig = {
|
|
Bridge = bridgeInterfaceName;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "enslaved";
|
|
|
|
bridgeVLANs = [
|
|
{
|
|
bridgeVLANConfig = {
|
|
VLAN = vlansByName.office.id;
|
|
PVID = vlansByName.office.id;
|
|
EgressUntagged = vlansByName.office.id;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
"30-lan3" = {
|
|
matchConfig.Name = "lan3";
|
|
networkConfig = {
|
|
Bridge = bridgeInterfaceName;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "enslaved";
|
|
|
|
bridgeVLANs = [
|
|
{
|
|
bridgeVLANConfig = {
|
|
VLAN = "${toString vlanRangeStart}-${toString vlanRangeEnd}";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
# Configure the bridge for its desired function
|
|
"40-${bridgeInterfaceName}" = {
|
|
matchConfig.Name = bridgeInterfaceName;
|
|
bridgeConfig = {};
|
|
address = [
|
|
(mkVlanIpv4HostAddr {
|
|
vlanid = 0;
|
|
host = 1;
|
|
})
|
|
];
|
|
networkConfig = {
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
# Don't wait for it as it also would wait for wlan and DFS which takes around 5 min
|
|
linkConfig.RequiredForOnline = "no";
|
|
linkConfig.ActivationPolicy = "always-up";
|
|
|
|
bridgeVLANs = [
|
|
{
|
|
bridgeVLANConfig = {
|
|
VLAN = "${toString vlanRangeStart}-${toString vlanRangeEnd}";
|
|
};
|
|
}
|
|
];
|
|
|
|
vlan = (
|
|
builtins.map
|
|
(vlanid: (mkInterfaceName {inherit vlanid;}))
|
|
vlanRange
|
|
);
|
|
};
|
|
|
|
"50-wg0" = {
|
|
enable = true;
|
|
matchConfig.Name = "wg0";
|
|
address = [
|
|
"10.0.0.1/31"
|
|
];
|
|
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
# test the set uprouting to a specific IP
|
|
Destination = "${repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost}/32";
|
|
MultiPathRoute = "10.0.0.0 1";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
"50-wg1" = {
|
|
enable = true;
|
|
matchConfig.Name = "wg1";
|
|
address = [
|
|
"10.0.0.3/31"
|
|
];
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Destination = "${repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost}/32";
|
|
MultiPathRoute = "10.0.0.2 1";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
"50-wg2" = {
|
|
enable = true;
|
|
matchConfig.Name = "wg2";
|
|
address = [
|
|
"10.0.1.1/31"
|
|
];
|
|
|
|
routes = [
|
|
# TODO: add a testing route here
|
|
];
|
|
};
|
|
}
|
|
# configuration for the hostapd dynamic interfaces
|
|
# * netdev type vlan
|
|
# * host address for vlan
|
|
# * vlan config for wlan interface
|
|
// builtins.foldl'
|
|
(acc: cur: acc // cur)
|
|
{}
|
|
(builtins.map
|
|
({
|
|
vlanid,
|
|
vlanid',
|
|
}: {
|
|
# configure the tagged vlan device with an address and vlan filtering.
|
|
# dnsmasq is configured to serve the respective /24 range on each tagged device.
|
|
# this device only receives traffic for the given vlanid and sends tagged traffic to the bridge.
|
|
"41-${mkInterfaceName {inherit vlanid;}}" = {
|
|
matchConfig.Name = "${mkInterfaceName {inherit vlanid;}}";
|
|
address = [
|
|
(mkVlanIpv4HostAddr {
|
|
inherit vlanid;
|
|
host = 1;
|
|
})
|
|
];
|
|
networkConfig = {
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
|
|
linkConfig.RequiredForOnline = "no";
|
|
linkConfig.ActivationPolicy = "always-up";
|
|
|
|
bridgeVLANs = [
|
|
{
|
|
bridgeVLANConfig = {
|
|
VLAN = vlanid;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
# configure the wlan interface as a bridge member that
|
|
# * only gets traffic for vid 15
|
|
# * untags traffic after receiving it
|
|
# * tags traffic that comes out of it
|
|
"41-wlan0.${vlanid'}" = {
|
|
matchConfig.Name = "wlan0.${vlanid'}";
|
|
networkConfig = {
|
|
Bridge = bridgeInterfaceName;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
|
|
linkConfig.RequiredForOnline = "no";
|
|
|
|
bridgeVLANs = [
|
|
{
|
|
bridgeVLANConfig = {
|
|
VLAN = vlanid;
|
|
PVID = vlanid;
|
|
EgressUntagged = vlanid;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
"50-${mkInterfaceName {inherit vlanid;}}" = {
|
|
matchConfig.Name = "${mkInterfaceName {inherit vlanid;}}";
|
|
address = [
|
|
(mkVlanIpv4HostAddr {
|
|
inherit vlanid;
|
|
host = 1;
|
|
})
|
|
];
|
|
networkConfig = {
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
})
|
|
(
|
|
builtins.map
|
|
(vlanid: {
|
|
inherit vlanid;
|
|
vlanid' = builtins.toString vlanid;
|
|
})
|
|
vlanRange
|
|
));
|
|
};
|
|
|
|
# wireless access point
|
|
services.hostapd = {
|
|
enable = true;
|
|
# package = nodeFlake.packages.${system}.hostapd_patched;
|
|
radios = let
|
|
# generated with https://miniwebtool.com/mac-address-generator/
|
|
mkBssid = i: "34:56:ce:0f:ed:4${toString i}";
|
|
in {
|
|
wlan0 = {
|
|
band = "2g";
|
|
countryCode = "CH";
|
|
channel = 0; # ACS
|
|
|
|
# use 'iw phy#1 info' to determine your VHT capabilities
|
|
wifi4 = {
|
|
enable = true;
|
|
capabilities = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935"];
|
|
};
|
|
networks = {
|
|
wlan0 = let
|
|
iface = "wlan0";
|
|
in {
|
|
ssid = "mlsia";
|
|
bssid = mkBssid 0;
|
|
|
|
authentication.mode =
|
|
"wpa2-sha256"
|
|
# "wpa3-sae-transition"
|
|
# "wpa3-sae"
|
|
;
|
|
|
|
authentication.wpaPskFile = config.sops.secrets."${iface}_wpaPskFile".path;
|
|
|
|
# TODO: unfortunately SAE passwords don't work per VLAN like PSKs do
|
|
# authentication.saePasswordsFile = config.sops.secrets."${iface}_saePasswordsFile".path;
|
|
|
|
# see https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf for reference
|
|
settings = {
|
|
# bridge = bridgeInterfaceName;
|
|
|
|
# wpa_psk_file = config.sops.secrets.wlan0_wpaPskFile.path;
|
|
# not yet supported on hostapd 2.10
|
|
# sae_password_file = config.sops.secrets.wlan0_saePasswordsFile.path;
|
|
|
|
# enables debug logging
|
|
logger_stdout_level = lib.mkForce 0;
|
|
logger_stdout = -1;
|
|
# logger_syslog_level= lib.mkForce 0;
|
|
|
|
# resources on vlan tagging
|
|
# https://wireless.wiki.kernel.org/en/users/Documentation/hostapd#dynamic_vlan_tagging
|
|
# https://forum.openwrt.org/t/individual-per-passphrase-wifi-vlans-using-wpa-psk-file-no-radius-required/161696/4
|
|
|
|
dynamic_vlan = 1;
|
|
|
|
# this option currently requires a patch to hostapd
|
|
vlan_no_bridge = 1;
|
|
|
|
/*
|
|
not used due to the above vlan_no_bridge setting
|
|
vlan_tagged_interface = bridgeInterfaceName;
|
|
vlan_naming = 1;
|
|
vlan_bridge = "br-${iface}.";
|
|
*/
|
|
|
|
vlan_file = let
|
|
generated =
|
|
builtins.map
|
|
(
|
|
vlanid: "${builtins.toString vlanid} ${iface}.${builtins.toString vlanid}"
|
|
)
|
|
vlanRange;
|
|
|
|
wildcard = [
|
|
# Optional wildcard entry matching all VLAN IDs. The first # in the interface
|
|
# name will be replaced with the VLAN ID. The network interfaces are created
|
|
# (and removed) dynamically based on the use.
|
|
# see https://w1.fi/cgit/hostap/tree/hostapd/hostapd.vlan
|
|
"* ${iface}.#"
|
|
];
|
|
|
|
file =
|
|
pkgs.writeText "hostapd.vlan"
|
|
(builtins.concatStringsSep "\n" (generated ++ wildcard));
|
|
filePath = toString file;
|
|
in
|
|
filePath;
|
|
|
|
wpa_key_mgmt = lib.mkForce (builtins.concatStringsSep " " [
|
|
"WPA-PSK"
|
|
|
|
# TODO: the printer can't connect when this is on
|
|
# "WPA-PSK-SHA256"
|
|
|
|
# unfortunately SAE doesn't support VLAN passwords in the way i'd like to use them
|
|
# "SAE"
|
|
]);
|
|
|
|
# wpa_psk_radius = 0;
|
|
wpa_pairwise = "CCMP";
|
|
wmm_enabled = 1;
|
|
|
|
# IEEE 802.11i (authentication) related configuration
|
|
# Encrypt management frames to protect against deauthentication and similar attacks
|
|
ieee80211w = 0;
|
|
sae_require_mfp = 0;
|
|
# sae_groups = "19 20 21";
|
|
|
|
# [ENABLE-TLSv1.3] = enable TLSv1.3 (experimental - disabled by default)
|
|
tls_flags = "[ENABLE-TLSv1.3]";
|
|
|
|
ieee8021x = 0;
|
|
eap_server = 0;
|
|
};
|
|
};
|
|
|
|
# wlan0-1 = {
|
|
# ssid = "mlsia-testing";
|
|
# authentication = {
|
|
# mode = "wpa3-sae-transition";
|
|
# };
|
|
|
|
# bssid = mkBssid 1;
|
|
# settings = {
|
|
# bridge = bridgeInterfaceName;
|
|
# };
|
|
# };
|
|
|
|
# wlan0-1 = {
|
|
# ssid = "justtestingwifi-wpa3";
|
|
# authentication = {
|
|
# mode = "wpa3-sae";
|
|
# saePasswordsFile = config.sops.secrets.wlan0_1_saePasswordFile.path;
|
|
# };
|
|
|
|
# bssid = mkBssid 1;
|
|
# settings = {
|
|
# bridge = bridgeInterfaceName;
|
|
# };
|
|
# };
|
|
|
|
# Uncomment when needed otherwise remove
|
|
# wlan0-1 = {
|
|
# ssid = "koteczkowo3";
|
|
# authentication = {
|
|
# mode = "none"; # this is overriden by settings
|
|
# };
|
|
# managementFrameProtection = "optional";
|
|
# bssid = "e6:02:43:07:00:00";
|
|
# settings = {
|
|
# bridge = bridgeInterfaceName;
|
|
# wpa = lib.mkForce 2;
|
|
# wpa_key_mgmt = "WPA-PSK";
|
|
# wpa_pairwise = "CCMP";
|
|
# wpa_psk_file = config.sops.secrets.legacyWifiPassword.path;
|
|
# };
|
|
# };
|
|
};
|
|
};
|
|
|
|
# wlan1 = {
|
|
# band = "5g";
|
|
# # channels with 160 MHz width in Poland: 36, 52, 100 i 116
|
|
# channel = 0; # ACS
|
|
# countryCode = "PL";
|
|
|
|
# # use 'iw phy#1 info' to determine your VHT capabilities
|
|
# wifi4 = {
|
|
# enable = true;
|
|
# capabilities = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935"];
|
|
# };
|
|
# wifi5 = {
|
|
# enable = true;
|
|
# operatingChannelWidth = "160";
|
|
# capabilities = ["RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-4" "BF-ANTENNA-4" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"];
|
|
# };
|
|
# wifi6 = {
|
|
# enable = true;
|
|
# singleUserBeamformer = true;
|
|
# singleUserBeamformee = true;
|
|
# multiUserBeamformer = true;
|
|
# operatingChannelWidth = "160";
|
|
# };
|
|
# settings = {
|
|
# # these two are mandatory for wifi 5 & 6 to work
|
|
# vht_oper_centr_freq_seg0_idx = 50;
|
|
# he_oper_centr_freq_seg0_idx = 50;
|
|
|
|
# # The "tx_queue_data2_burst" parameter in Linux refers to the burst size for
|
|
# # transmitting data packets from the second data queue of a network interface.
|
|
# # It determines the number of packets that can be sent in a burst.
|
|
# # Adjusting this parameter can impact network throughput and latency.
|
|
# tx_queue_data2_burst = 2;
|
|
|
|
# # The "he_bss_color" parameter in Wi-Fi 6 (802.11ax) refers to the BSS Color field in the HE (High Efficiency) MAC header.
|
|
# # BSS Color is a mechanism introduced in Wi-Fi 6 to mitigate interference and improve network efficiency in dense deployment scenarios.
|
|
# # It allows multiple overlapping Basic Service Sets (BSS) to differentiate and coexist in the same area without causing excessive interference.
|
|
# he_bss_color = 63; # was set to 128 by openwrt but range of possible values in 2.10 is 1-63
|
|
|
|
# # Magic values that were set by openwrt but I didn't bother inspecting every single one
|
|
# he_spr_sr_control = 3;
|
|
# he_default_pe_duration = 4;
|
|
# he_rts_threshold = 1023;
|
|
|
|
# he_mu_edca_qos_info_param_count = 0;
|
|
# he_mu_edca_qos_info_q_ack = 0;
|
|
# he_mu_edca_qos_info_queue_request = 0;
|
|
# he_mu_edca_qos_info_txop_request = 0;
|
|
|
|
# # he_mu_edca_ac_be_aci=0; missing in 2.10
|
|
# he_mu_edca_ac_be_aifsn = 8;
|
|
# he_mu_edca_ac_be_ecwmin = 9;
|
|
# he_mu_edca_ac_be_ecwmax = 10;
|
|
# he_mu_edca_ac_be_timer = 255;
|
|
|
|
# he_mu_edca_ac_bk_aifsn = 15;
|
|
# he_mu_edca_ac_bk_aci = 1;
|
|
# he_mu_edca_ac_bk_ecwmin = 9;
|
|
# he_mu_edca_ac_bk_ecwmax = 10;
|
|
# he_mu_edca_ac_bk_timer = 255;
|
|
|
|
# he_mu_edca_ac_vi_ecwmin = 5;
|
|
# he_mu_edca_ac_vi_ecwmax = 7;
|
|
# he_mu_edca_ac_vi_aifsn = 5;
|
|
# he_mu_edca_ac_vi_aci = 2;
|
|
# he_mu_edca_ac_vi_timer = 255;
|
|
|
|
# he_mu_edca_ac_vo_aifsn = 5;
|
|
# he_mu_edca_ac_vo_aci = 3;
|
|
# he_mu_edca_ac_vo_ecwmin = 5;
|
|
# he_mu_edca_ac_vo_ecwmax = 7;
|
|
# he_mu_edca_ac_vo_timer = 255;
|
|
# };
|
|
# networks = {
|
|
# wlan1 = {
|
|
# ssid = "koteczkowo5";
|
|
# authentication = {
|
|
# mode = "wpa3-sae";
|
|
# saePasswordsFile = config.sops.secrets.wifiPassword.path; # Use saePasswordsFile if possible.
|
|
# };
|
|
# bssid = "36:b9:02:21:08:a2";
|
|
# settings = {
|
|
# bridge = bridgeInterfaceName;
|
|
# };
|
|
# };
|
|
# };
|
|
# };
|
|
};
|
|
};
|
|
|
|
services.resolved.enable = false;
|
|
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
domain-needed = true;
|
|
bogus-priv = true;
|
|
no-resolv = true;
|
|
localise-queries = true;
|
|
|
|
proxy-dnssec = true;
|
|
conntrack = true;
|
|
|
|
# enable for debugging
|
|
# log-debug = true;
|
|
# log-queries = true;
|
|
|
|
# disable negative caching
|
|
no-negcache = true;
|
|
local-ttl = 0;
|
|
dhcp-ttl = 0;
|
|
|
|
dhcp-range = let
|
|
mkDhcpRange = {
|
|
tag,
|
|
vlanid,
|
|
}:
|
|
builtins.concatStringsSep "," [
|
|
tag
|
|
(mkVlanIpv4HostAddr {
|
|
inherit vlanid;
|
|
host = 100;
|
|
cidr = false;
|
|
})
|
|
(mkVlanIpv4HostAddr {
|
|
inherit vlanid;
|
|
host = 199;
|
|
cidr = false;
|
|
})
|
|
"12h"
|
|
];
|
|
in
|
|
builtins.map
|
|
(
|
|
vlanid:
|
|
mkDhcpRange {
|
|
tag = mkInterfaceName {inherit vlanid;};
|
|
inherit vlanid;
|
|
}
|
|
)
|
|
vlanRangeWith0;
|
|
|
|
# TODO: double-check that this works
|
|
dhcp-host = "1c:69:7a:07:08:5f,${dmzExposedHostIpv4},${dmzExposedHost}";
|
|
|
|
expand-hosts = true;
|
|
|
|
# don't use /etc/hosts as this would advertise ${nodeName} as localhost
|
|
no-hosts = true;
|
|
|
|
server = [
|
|
# upstream DNS servers
|
|
|
|
# https://dnsforge.de/
|
|
"176.9.93.198"
|
|
"176.9.1.117"
|
|
"2a01:4f8:151:34aa::198"
|
|
"2a01:4f8:141:316d::117"
|
|
|
|
# cloudflare and google
|
|
# "9.9.9.9" "8.8.8.8" "1.1.1.1"
|
|
];
|
|
|
|
domain =
|
|
[
|
|
"/${getVlanDomain {vlanid = 0;}}/,local"
|
|
]
|
|
++ builtins.map
|
|
(
|
|
vlanid: "${getVlanDomain {inherit vlanid;}},${mkVlanIpv4HostAddr {
|
|
inherit vlanid;
|
|
host = 0;
|
|
cidr = true;
|
|
}},local"
|
|
)
|
|
vlanRangeWith0;
|
|
|
|
# TODO: compare this to using `interface-name`
|
|
dynamic-host =
|
|
[
|
|
]
|
|
++ builtins.map
|
|
(
|
|
vlanid:
|
|
builtins.concatStringsSep "," [
|
|
# "${getVlanDomain{inherit vlanid;}}" "0.0.0.1" (mkInterfaceName {inherit vlanid;})
|
|
"${nodeName}.${getVlanDomain {inherit vlanid;}}"
|
|
"0.0.0.1"
|
|
(mkInterfaceName {inherit vlanid;})
|
|
]
|
|
)
|
|
vlanRangeWith0;
|
|
|
|
dhcp-option-force =
|
|
builtins.map
|
|
(vlanid: "${mkInterfaceName {inherit vlanid;}},option:domain-search,${getVlanDomain {inherit vlanid;}}")
|
|
vlanRangeWith0;
|
|
|
|
# auth-server = [
|
|
# (builtins.concatStringsSep "," [
|
|
# "www.stefanjunker.de"
|
|
# # (mkInterfaceName { vlanid = vlansByName.dmz.id; })
|
|
# # (mkInterfaceName { vlanid = vlansByName.office.id; })
|
|
# ])
|
|
# ];
|
|
|
|
cname = [
|
|
"mailserver.svc.stefanjunker.de,${dmzExposedHost}"
|
|
"www.stefanjunker.de,${dmzExposedHost}"
|
|
"hedgedoc.www.stefanjunker.de,${dmzExposedHost}"
|
|
"jitsi.www.stefanjunker.de,${dmzExposedHost}"
|
|
"lldap.www.stefanjunker.de,${dmzExposedHost}"
|
|
"forgejo.www.stefanjunker.de,${dmzExposedHost}"
|
|
];
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "24.05";
|
|
|
|
# boot.kernelPackages = pkgs.linuxPackages_bpir3_6_6;
|
|
|
|
environment.systemPackages = [
|
|
pkgs.ethtool
|
|
pkgs.neovim
|
|
|
|
pkgs.wireguard-tools
|
|
pkgs.tshark
|
|
pkgs.tmux
|
|
|
|
(pkgs.writeShellScriptBin "dbg-ip" ''
|
|
echo links:
|
|
ip -br -c l
|
|
echo
|
|
echo addresses:
|
|
ip -br -c a
|
|
echo
|
|
echo vlans:
|
|
bridge -c vlan
|
|
'')
|
|
|
|
(pkgs.writeShellScriptBin "dbg-dnsmasq" ''
|
|
# get the rendered in-use config
|
|
pgrep -a dnsmasq | grep -Eo '[^ ]*conf' | xargs cat | grep -Eo '[^=]*conf' | xargs cat
|
|
'')
|
|
];
|
|
}
|