mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2026-04-14 21:29:12 +02:00
feat[server]: finalize router config
This commit is contained in:
Leon Schwarzäugl
parent
4da9291223
commit
75891c3103
14 changed files with 739 additions and 392 deletions
|
|
@ -4,6 +4,9 @@ let
|
|||
subnetMask = globals.networks.${config.swarselsystems.server.netConfigName}.subnetMask4;
|
||||
gatewayIp = globals.hosts.${config.node.name}.defaultGateway4;
|
||||
|
||||
inherit (globals.general) routerServer;
|
||||
isRouter = config.node.name == routerServer;
|
||||
|
||||
hostKeyPathBase = "/etc/secrets/initrd/ssh_host_ed25519_key";
|
||||
hostKeyPath =
|
||||
if config.swarselsystems.isImpermanence then
|
||||
|
|
@ -42,7 +45,7 @@ in
|
|||
};
|
||||
|
||||
boot = lib.mkIf (!config.swarselsystems.isClient) {
|
||||
kernelParams = lib.mkIf (!config.swarselsystems.isCloud) [
|
||||
kernelParams = lib.mkIf (!config.swarselsystems.isCloud && ((config.swarselsystems.localVLANs == [ ]) || isRouter)) [
|
||||
"ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
|
||||
];
|
||||
initrd = {
|
||||
|
|
|
|||
|
|
@ -1,49 +1,40 @@
|
|||
{ lib, config, globals, confLib, ... }:
|
||||
let
|
||||
inherit (confLib.gen { name = "kea"; dir = "/var/lib/private/kea"; }) serviceName serviceDir;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
environment.persistence."/persist".directories = lib.mkIf config.swarselsystems.isImpermanence [
|
||||
{ directory = serviceDir; mode = "0700"; }
|
||||
];
|
||||
|
||||
services.kea.dhcp4 = {
|
||||
dhcpX = intX:
|
||||
let
|
||||
x = builtins.toString intX;
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
settings = {
|
||||
lease-database = {
|
||||
name = "/var/lib/kea/dhcp4.leases";
|
||||
name = "/var/lib/kea/dhcp${x}.leases";
|
||||
persist = true;
|
||||
type = "memfile";
|
||||
};
|
||||
valid-lifetime = 86400;
|
||||
renew-timer = 3600;
|
||||
interfaces-config = {
|
||||
# XXX: BUG: why does this bind other macvtaps?
|
||||
interfaces = map (name: "me-${name}") (builtins.attrNames globals.networks.home-lan.vlans);
|
||||
service-sockets-max-retries = -1;
|
||||
};
|
||||
subnet4 = lib.flip lib.mapAttrsToList globals.networks.home-lan.vlans (
|
||||
"subnet${x}" = lib.flip lib.mapAttrsToList globals.networks.home-lan.vlans (
|
||||
vlanName: vlanCfg: {
|
||||
inherit (vlanCfg) id;
|
||||
interface = "me-${vlanName}";
|
||||
subnet = vlanCfg.cidrv4;
|
||||
subnet = vlanCfg."cidrv${x}";
|
||||
pools = [
|
||||
{
|
||||
pool = "${lib.net.cidr.host 20 vlanCfg.cidrv4} - ${lib.net.cidr.host (-6) vlanCfg.cidrv4}";
|
||||
pool = "${lib.net.cidr.host 20 vlanCfg."cidrv${x}"} - ${lib.net.cidr.host (-6) vlanCfg."cidrv${x}"}";
|
||||
}
|
||||
];
|
||||
option-data =
|
||||
[
|
||||
lib.optional (intX == 4)
|
||||
{
|
||||
name = "routers";
|
||||
data = vlanCfg.hosts.hintbooth.ipv4; # FIXME: how to advertise v6 address also?
|
||||
}
|
||||
];
|
||||
data = vlanCfg.hosts.hintbooth."ipv${x}"; # FIXME: how to advertise v6 address also?
|
||||
};
|
||||
# Advertise DNS server for VLANS that have internet access
|
||||
# ++
|
||||
# lib.optional
|
||||
|
|
@ -62,7 +53,8 @@ in
|
|||
hostCfg:
|
||||
lib.optional (hostCfg.mac != null) {
|
||||
hw-address = hostCfg.mac;
|
||||
ip-address = hostCfg.ipv4;
|
||||
ip-address = lib.mkIf (intX == 4) hostCfg."ipv${x}";
|
||||
ip-addresses = lib.mkIf (intX == 6) [ hostCfg."ipv${x}" ];
|
||||
}
|
||||
)
|
||||
);
|
||||
|
|
@ -70,7 +62,21 @@ in
|
|||
);
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options = {
|
||||
swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
environment.persistence."/persist".directories = lib.mkIf config.swarselsystems.isImpermanence [
|
||||
{ directory = serviceDir; mode = "0700"; }
|
||||
];
|
||||
|
||||
services.kea = {
|
||||
dhcp4 = dhcpX 4;
|
||||
dhcp6 = dhcpX 6;
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
let
|
||||
netConfig = config.repo.secrets.local.networking;
|
||||
netPrefix = "${if config.swarselsystems.isCloud then config.node.name else "home"}";
|
||||
# netName = "${netPrefix}-${config.swarselsystems.server.localNetwork}";
|
||||
in
|
||||
{
|
||||
options = {
|
||||
|
|
@ -28,11 +27,6 @@ in
|
|||
|
||||
swarselsystems.server.localNetwork = netConfig.localNetwork or "";
|
||||
|
||||
# globals.networks.${netName}.hosts.${config.node.name} = {
|
||||
# inherit (netConfig.networks.${netConfig.localNetwork}) id;
|
||||
# mac = netConfig.networks.${netConfig.localNetwork}.mac or null;
|
||||
# };
|
||||
|
||||
globals.networks = lib.mapAttrs'
|
||||
(netName: _:
|
||||
lib.nameValuePair "${netPrefix}-${netName}" {
|
||||
|
|
@ -45,7 +39,8 @@ in
|
|||
netConfig.networks;
|
||||
|
||||
globals.hosts.${config.node.name} = {
|
||||
inherit (config.repo.secrets.local.networking) defaultGateway4;
|
||||
defaultGateway4 = netConfig.defaultGateway4 or null;
|
||||
defaultGateway6 = netConfig.defaultGateway6 or null;
|
||||
wanAddress4 = netConfig.wanAddress4 or null;
|
||||
wanAddress6 = netConfig.wanAddress6 or null;
|
||||
isHome = if (netPrefix == "home") then true else false;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,14 @@
|
|||
{ lib, config, globals, ... }:
|
||||
let
|
||||
serviceName = "router";
|
||||
bridgeVLANs = lib.mapAttrsToList
|
||||
(_: vlan: {
|
||||
VLAN = vlan.id;
|
||||
})
|
||||
globals.networks.home-lan.vlans;
|
||||
selectVLANs = vlans: map (vlan: { VLAN = globals.networks.home-lan.vlans.${vlan}.id; }) vlans;
|
||||
lan5VLANs = selectVLANs [ "home" "devices" "guests" ];
|
||||
lan4VLANs = selectVLANs [ "home" "services" ];
|
||||
in
|
||||
{
|
||||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
|
|
@ -93,7 +101,68 @@ in
|
|||
|
||||
systemd.network = {
|
||||
wait-online.anyInterface = true;
|
||||
|
||||
netdevs = {
|
||||
"10-veth" = {
|
||||
netdevConfig = {
|
||||
Kind = "veth";
|
||||
Name = "veth-br";
|
||||
};
|
||||
peerConfig = {
|
||||
Name = "veth-int";
|
||||
};
|
||||
};
|
||||
"20-br" = {
|
||||
netdevConfig = {
|
||||
Kind = "bridge";
|
||||
Name = "br";
|
||||
};
|
||||
bridgeConfig = {
|
||||
VLANFiltering = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
networks = {
|
||||
"40-br" = {
|
||||
matchConfig.Name = "br";
|
||||
bridgeConfig = { };
|
||||
linkConfig = {
|
||||
ActivationPolicy = "always-up";
|
||||
RequiredForOnline = "no";
|
||||
};
|
||||
networkConfig = {
|
||||
ConfigureWithoutCarrier = true;
|
||||
LinkLocalAddressing = "no";
|
||||
};
|
||||
};
|
||||
"15-veth-br" = {
|
||||
matchConfig.Name = "veth-br";
|
||||
|
||||
linkConfig = {
|
||||
RequiredForOnline = "no";
|
||||
};
|
||||
|
||||
networkConfig = {
|
||||
Bridge = "br";
|
||||
};
|
||||
inherit bridgeVLANs;
|
||||
};
|
||||
"15-veth-int" = {
|
||||
matchConfig.Name = "veth-int";
|
||||
|
||||
linkConfig = {
|
||||
ActivationPolicy = "always-up";
|
||||
RequiredForOnline = "no";
|
||||
};
|
||||
|
||||
networkConfig = {
|
||||
ConfigureWithoutCarrier = true;
|
||||
LinkLocalAddressing = "no";
|
||||
};
|
||||
|
||||
vlan = map (name: "vlan-${name}") (builtins.attrNames globals.networks.home-lan.vlans);
|
||||
};
|
||||
# br
|
||||
"30-lan1" = {
|
||||
matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan1.mac;
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
|
|
@ -101,7 +170,9 @@ in
|
|||
Bridge = "br";
|
||||
ConfigureWithoutCarrier = true;
|
||||
};
|
||||
inherit bridgeVLANs;
|
||||
};
|
||||
# wifi
|
||||
"30-lan2" = {
|
||||
matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan2.mac;
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
|
|
@ -109,7 +180,9 @@ in
|
|||
Bridge = "br";
|
||||
ConfigureWithoutCarrier = true;
|
||||
};
|
||||
inherit bridgeVLANs;
|
||||
};
|
||||
# summers
|
||||
"30-lan3" = {
|
||||
matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan3.mac;
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
|
|
@ -117,7 +190,9 @@ in
|
|||
Bridge = "br";
|
||||
ConfigureWithoutCarrier = true;
|
||||
};
|
||||
inherit bridgeVLANs;
|
||||
};
|
||||
# winters
|
||||
"30-lan4" = {
|
||||
matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan4.mac;
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
|
|
@ -125,7 +200,9 @@ in
|
|||
Bridge = "br";
|
||||
ConfigureWithoutCarrier = true;
|
||||
};
|
||||
bridgeVLANs = lan4VLANs;
|
||||
};
|
||||
# lr
|
||||
"30-lan5" = {
|
||||
matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan5.mac;
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
|
|
@ -133,10 +210,31 @@ in
|
|||
Bridge = "br";
|
||||
ConfigureWithoutCarrier = true;
|
||||
};
|
||||
bridgeVLANs = lan5VLANs;
|
||||
};
|
||||
};
|
||||
};
|
||||
} // lib.flip lib.concatMapAttrs globals.networks.home-lan.vlans (
|
||||
vlanName: vlanCfg: {
|
||||
"40-me-${vlanName}" = lib.mkForce {
|
||||
address = [
|
||||
vlanCfg.hosts.${config.node.name}.cidrv4
|
||||
vlanCfg.hosts.${config.node.name}.cidrv6
|
||||
];
|
||||
matchConfig.Name = "me-${vlanName}";
|
||||
networkConfig = {
|
||||
IPv4Forwarding = "yes";
|
||||
IPv6PrivacyExtensions = "yes";
|
||||
IPv6SendRA = true;
|
||||
IPv6AcceptRA = false;
|
||||
};
|
||||
ipv6Prefixes = [
|
||||
{ Prefix = vlanCfg.cidrv6; }
|
||||
];
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue