mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2026-04-14 21:29:12 +02:00
feat[server]: finalize router config
This commit is contained in:
Leon Schwarzäugl
parent
4da9291223
commit
75891c3103
14 changed files with 739 additions and 392 deletions
13
modules/nixos/optional/systemd-networkd-base.nix
Normal file
13
modules/nixos/optional/systemd-networkd-base.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
networking = {
|
||||
useDHCP = lib.mkForce false;
|
||||
useNetworkd = true;
|
||||
dhcpcd.enable = false;
|
||||
renameInterfacesByMac = lib.mapAttrs (_: v: if (v ? mac) then v.mac else "") (
|
||||
config.repo.secrets.local.networking.networks or { }
|
||||
);
|
||||
};
|
||||
|
||||
systemd.network.enable = true;
|
||||
}
|
||||
131
modules/nixos/optional/systemd-networkd-server-home.nix
Normal file
131
modules/nixos/optional/systemd-networkd-server-home.nix
Normal file
|
|
@ -0,0 +1,131 @@
|
|||
{ self, lib, config, globals, ... }:
|
||||
let
|
||||
inherit (globals.general) routerServer;
|
||||
inherit (config.swarselsystems) withMicroVMs isCrypted initrdVLAN;
|
||||
|
||||
isRouter = config.node.name == routerServer;
|
||||
localVLANsList = config.swarselsystems.localVLANs;
|
||||
localVLANs = lib.genAttrs localVLANsList (x: globals.networks.home-lan.vlans.${x});
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
"${self}/modules/nixos/optional/systemd-networkd-server.nix"
|
||||
];
|
||||
config = {
|
||||
assertions = [
|
||||
{
|
||||
assertion = ((localVLANsList != [ ]) && (initrdVLAN != null)) || (localVLANsList == [ ]) || (!isCrypted);
|
||||
message = "This host uses VLANs and disk encryption, thus a VLAN must be specified for initrd or disk encryption must be removed.";
|
||||
}
|
||||
];
|
||||
|
||||
boot.initrd = lib.mkIf (isCrypted && (localVLANsList != [ ]) && (!isRouter)) {
|
||||
availableKernelModules = [ "8021q" ];
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
netdevs."30-vlan-${initrdVLAN}" = {
|
||||
netdevConfig = {
|
||||
Kind = "vlan";
|
||||
Name = "vlan-${initrdVLAN}";
|
||||
};
|
||||
vlanConfig.Id = globals.networks.home-lan.vlans.${initrdVLAN}.id;
|
||||
};
|
||||
networks = {
|
||||
"10-lan" = {
|
||||
matchConfig.Name = "lan";
|
||||
# This interface should only be used from attached vlans.
|
||||
# So don't acquire a link local address and only wait for
|
||||
# this interface to gain a carrier.
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
linkConfig.RequiredForOnline = "carrier";
|
||||
vlan = [ "vlan-${initrdVLAN}" ];
|
||||
};
|
||||
"30-vlan-${initrdVLAN}" = {
|
||||
address = [
|
||||
globals.networks.home-lan.vlans.${initrdVLAN}.hosts.${config.node.name}.cidrv4
|
||||
globals.networks.home-lan.vlans.${initrdVLAN}.hosts.${config.node.name}.cidrv6
|
||||
];
|
||||
matchConfig.Name = "vlan-${initrdVLAN}";
|
||||
networkConfig = {
|
||||
IPv6PrivacyExtensions = "yes";
|
||||
};
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
netdevs = lib.flip lib.concatMapAttrs localVLANs (
|
||||
vlanName: vlanCfg: {
|
||||
"30-vlan-${vlanName}" = {
|
||||
netdevConfig = {
|
||||
Kind = "vlan";
|
||||
Name = "vlan-${vlanName}";
|
||||
};
|
||||
vlanConfig.Id = vlanCfg.id;
|
||||
};
|
||||
# Create a MACVTAP for ourselves too, so that we can communicate with
|
||||
# our guests on the same interface.
|
||||
"40-me-${vlanName}" = lib.mkIf withMicroVMs {
|
||||
netdevConfig = {
|
||||
Name = "me-${vlanName}";
|
||||
Kind = "macvlan";
|
||||
};
|
||||
extraConfig = ''
|
||||
[MACVLAN]
|
||||
Mode=bridge
|
||||
'';
|
||||
};
|
||||
}
|
||||
);
|
||||
networks = {
|
||||
"10-lan" = lib.mkIf (!isRouter) {
|
||||
matchConfig.Name = "lan";
|
||||
# This interface should only be used from attached vlans.
|
||||
# So don't acquire a link local address and only wait for
|
||||
# this interface to gain a carrier.
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
linkConfig.RequiredForOnline = "carrier";
|
||||
vlan = (map (name: "vlan-${name}") (builtins.attrNames localVLANs));
|
||||
};
|
||||
# Remaining macvtap interfaces should not be touched.
|
||||
"90-macvtap-ignore" = lib.mkIf withMicroVMs {
|
||||
matchConfig.Kind = "macvtap";
|
||||
linkConfig.ActivationPolicy = "manual";
|
||||
linkConfig.Unmanaged = "yes";
|
||||
};
|
||||
}
|
||||
// lib.flip lib.concatMapAttrs localVLANs (
|
||||
vlanName: vlanCfg:
|
||||
let
|
||||
me = {
|
||||
address = [
|
||||
vlanCfg.hosts.${config.node.name}.cidrv4
|
||||
vlanCfg.hosts.${config.node.name}.cidrv6
|
||||
];
|
||||
gateway = lib.optionals (vlanName == "services") [ vlanCfg.hosts.${routerServer}.ipv4 vlanCfg.hosts.${routerServer}.ipv6 ];
|
||||
matchConfig.Name = "${if withMicroVMs then "me" else "vlan"}-${vlanName}";
|
||||
networkConfig.IPv6PrivacyExtensions = "yes";
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
"30-vlan-${vlanName}" = if (!withMicroVMs) then me else {
|
||||
matchConfig.Name = "vlan-${vlanName}";
|
||||
# This interface should only be used from attached macvlans.
|
||||
# So don't acquire a link local address and only wait for
|
||||
# this interface to gain a carrier.
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
networkConfig.MACVLAN = "me-${vlanName}";
|
||||
linkConfig.RequiredForOnline = if isRouter then "no" else "carrier";
|
||||
};
|
||||
"40-me-${vlanName}" = lib.mkIf withMicroVMs (lib.mkDefault me);
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,28 +1,30 @@
|
|||
{ lib, config, globals, ... }:
|
||||
{ self, lib, config, globals, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) isCrypted localVLANs;
|
||||
inherit (globals.general) routerServer;
|
||||
|
||||
isRouter = config.node.name == routerServer;
|
||||
ifName = config.swarselsystems.server.localNetwork;
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
useDHCP = lib.mkForce false;
|
||||
useNetworkd = true;
|
||||
dhcpcd.enable = false;
|
||||
renameInterfacesByMac = lib.mapAttrs (_: v: if (v ? mac) then v.mac else "") (
|
||||
config.repo.secrets.local.networking.networks or { }
|
||||
);
|
||||
};
|
||||
boot.initrd.systemd.network = {
|
||||
imports = [
|
||||
"${self}/modules/nixos/optional/systemd-networkd-base.nix"
|
||||
];
|
||||
|
||||
boot.initrd.systemd.network = lib.mkIf (isCrypted && ((localVLANs == [ ]) || isRouter)) {
|
||||
enable = true;
|
||||
networks."10-${config.swarselsystems.server.localNetwork}" = config.systemd.network.networks."10-${config.swarselsystems.server.localNetwork}";
|
||||
networks."10-${ifName}" = config.systemd.network.networks."10-${ifName}";
|
||||
};
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
wait-online.enable = false;
|
||||
networks =
|
||||
let
|
||||
netConfig = config.repo.secrets.local.networking;
|
||||
in
|
||||
{
|
||||
"10-${config.swarselsystems.server.localNetwork}" = {
|
||||
"10-${ifName}" = lib.mkIf (isRouter || (localVLANs == [ ])) {
|
||||
address = [
|
||||
"${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv4}"
|
||||
"${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv6}"
|
||||
|
|
|
|||
|
|
@ -1,116 +0,0 @@
|
|||
{ lib, config, globals, ... }:
|
||||
{
|
||||
|
||||
systemd.network = {
|
||||
wait-online.anyInterface = true;
|
||||
netdevs = {
|
||||
"10-veth" = {
|
||||
netdevConfig = {
|
||||
Kind = "veth";
|
||||
Name = "veth-br";
|
||||
};
|
||||
peerConfig = {
|
||||
Name = "veth-int";
|
||||
};
|
||||
};
|
||||
"20-br" = {
|
||||
netdevConfig = {
|
||||
Kind = "bridge";
|
||||
Name = "br";
|
||||
};
|
||||
};
|
||||
} // lib.flip lib.concatMapAttrs globals.networks.home-lan.vlans (
|
||||
vlanName: vlanCfg: {
|
||||
"30-vlan-${vlanName}" = {
|
||||
netdevConfig = {
|
||||
Kind = "vlan";
|
||||
Name = "vlan-${vlanName}";
|
||||
};
|
||||
vlanConfig.Id = vlanCfg.id;
|
||||
};
|
||||
"40-me-${vlanName}" = {
|
||||
netdevConfig = {
|
||||
Name = "me-${vlanName}";
|
||||
Kind = "macvlan";
|
||||
};
|
||||
extraConfig = ''
|
||||
[MACVLAN]
|
||||
Mode=bridge
|
||||
'';
|
||||
};
|
||||
}
|
||||
);
|
||||
networks = {
|
||||
"40-br" = {
|
||||
matchConfig.Name = "br";
|
||||
bridgeConfig = { };
|
||||
linkConfig = {
|
||||
ActivationPolicy = "always-up";
|
||||
RequiredForOnline = "no";
|
||||
};
|
||||
networkConfig = {
|
||||
ConfigureWithoutCarrier = true;
|
||||
LinkLocalAddressing = "no";
|
||||
};
|
||||
};
|
||||
"15-veth-br" = {
|
||||
matchConfig.Name = "veth-br";
|
||||
|
||||
linkConfig = {
|
||||
RequiredForOnline = "no";
|
||||
};
|
||||
|
||||
networkConfig = {
|
||||
Bridge = "br";
|
||||
};
|
||||
};
|
||||
"15-veth-int" = {
|
||||
matchConfig.Name = "veth-int";
|
||||
|
||||
linkConfig = {
|
||||
ActivationPolicy = "always-up";
|
||||
RequiredForOnline = "no";
|
||||
};
|
||||
|
||||
networkConfig = {
|
||||
ConfigureWithoutCarrier = true;
|
||||
LinkLocalAddressing = "no";
|
||||
};
|
||||
|
||||
vlan = map (name: "vlan-${name}") (builtins.attrNames globals.networks.home-lan.vlans);
|
||||
};
|
||||
"90-macvtap-ignore" = {
|
||||
matchConfig.Kind = "macvtap";
|
||||
linkConfig.ActivationPolicy = "manual";
|
||||
linkConfig.Unmanaged = "yes";
|
||||
};
|
||||
} // lib.flip lib.concatMapAttrs globals.networks.home-lan.vlans (
|
||||
vlanName: vlanCfg: {
|
||||
"30-vlan-${vlanName}" = {
|
||||
matchConfig.Name = "vlan-${vlanName}";
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
networkConfig.MACVLAN = "me-${vlanName}";
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
};
|
||||
"40-me-${vlanName}" = {
|
||||
address = [
|
||||
vlanCfg.hosts.${config.node.name}.cidrv4
|
||||
vlanCfg.hosts.${config.node.name}.cidrv6
|
||||
];
|
||||
matchConfig.Name = "me-${vlanName}";
|
||||
networkConfig = {
|
||||
IPv4Forwarding = "yes";
|
||||
IPv6PrivacyExtensions = "yes";
|
||||
IPv6SendRA = true;
|
||||
IPv6AcceptRA = false;
|
||||
};
|
||||
ipv6Prefixes = [
|
||||
{ Prefix = vlanCfg.cidrv6; }
|
||||
];
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue