summaryrefslogtreecommitdiff
path: root/hosts/vidhar/network
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/vidhar/network')
-rw-r--r--hosts/vidhar/network/default.nix83
-rw-r--r--hosts/vidhar/network/dsl.nix217
-rw-r--r--hosts/vidhar/network/pap-secrets26
3 files changed, 326 insertions, 0 deletions
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
new file mode 100644
index 00000000..a32dd2f8
--- /dev/null
+++ b/hosts/vidhar/network/default.nix
@@ -0,0 +1,83 @@
1{ config, lib, pkgs, ... }:
2{
3 imports = [ ./dsl.nix ];
4
5 config = {
6 networking = {
7 hostName = "vidhar";
8 domain = "yggdrasil";
9 search = [ "yggdrasil" ];
10
11 useDHCP = false;
12 useNetworkd = true;
13
14 interfaces."lan" = {
15 ipv4.addresses = [
16 { address = "10.141.0.1"; prefixLength = 24; }
17 ];
18 };
19 interfaces."mgmt" = {
20 ipv4.addresses = [
21 { address = "10.141.1.1"; prefixLength = 24; }
22 ];
23 };
24
25 vlans = {
26 mgmt = {
27 id = 2;
28 interface = "eno2";
29 };
30 lan = {
31 id = 3;
32 interface = "eno2";
33 };
34 };
35
36 firewall.enable = false;
37 nftables = {
38 enable = true;
39 rulesetFile = ./ruleset.nft;
40 };
41 };
42
43 services.resolved = {
44 llmnr = "false";
45 };
46
47 services.dhcpd4 = {
48 enable = true;
49 interfaces = [ "lan" "mgmt" ];
50 extraConfig = ''
51 subnet 10.141.0.0 netmask 255.255.255.0 {
52 range 10.141.0.128 10.141.0.254;
53 option domain-name-servers 10.141.0.1;
54 option broadcast-address 10.141.0.255;
55 option routers 10.141.0.1;
56 option domain-name "yggdrasil";
57 }
58
59 subnet 10.141.1.0 netmask 255.255.255.0 {
60 range 10.141.1.128 10.141.1.254;
61 }
62 '';
63 machines = [
64 {
65 ethernetAddress = "50:d4:f7:f3:0f:7e";
66 hostName = "gauss-ap01";
67 ipAddress = "10.141.0.64";
68 }
69 {
70 ethernetAddress = "60:a4:b7:53:94:b5";
71 hostName = "switch01";
72 ipAddress = "10.141.1.2";
73 }
74 ];
75 };
76 systemd.network.networks = {
77 "eno2" = {
78 matchConfig.Name = "eno2";
79 networkConfig.LinkLocalAddressing = "no";
80 };
81 };
82 };
83}
diff --git a/hosts/vidhar/network/dsl.nix b/hosts/vidhar/network/dsl.nix
new file mode 100644
index 00000000..4f781422
--- /dev/null
+++ b/hosts/vidhar/network/dsl.nix
@@ -0,0 +1,217 @@
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 pppInterface = config.networking.pppInterface;
7in {
8 options = {
9 networking.pppInterface = mkOption {
10 type = types.str;
11 default = "dsl";
12 };
13 };
14
15 config = {
16 networking.vlans = {
17 telekom = {
18 id = 7;
19 interface = "eno2";
20 };
21 };
22
23 services.pppd = {
24 enable = true;
25 peers.telekom.config = ''
26 nodefaultroute
27 ifname ${pppInterface}
28 lcp-echo-failure 1
29 lcp-echo-interval 1
30 maxfail 0
31 mtu 1492
32 mru 1492
33 plugin rp-pppoe.so
34 name telekom
35 user 002576900250551137425220#0001@t-online.de
36 telekom
37 debug
38 '';
39 };
40 systemd.services."pppd-telekom" = {
41 stopIfChanged = true;
42
43 serviceConfig = lib.mkForce {
44 Type = "notify";
45 PIDFile = "/run/pppd/${pppInterface}.pid";
46 ExecStart = "${lib.getBin pkgs.ppp}/sbin/pppd call telekom up_sdnotify nolog +ipv6";
47 Restart = "always";
48 RestartSec = 5;
49
50 RuntimeDirectory = "pppd";
51 RuntimeDirectoryPreserve = true;
52 };
53 };
54 sops.secrets."pap-secrets" = {
55 format = "binary";
56 sopsFile = ./pap-secrets;
57 path = "/etc/ppp/pap-secrets";
58 };
59
60 environment.etc = {
61 "ppp/ip-up" = {
62 text = ''
63 #!${pkgs.runtimeShell}
64 ${pkgs.iproute}/bin/ip route add default via "$5" dev "${pppInterface}" metric 512
65 '';
66 mode = "0555";
67 };
68 };
69
70 systemd.network.networks.${pppInterface} = {
71 matchConfig = {
72 Name = pppInterface;
73 };
74 dns = [ "::1" "127.0.0.1" ];
75 domains = [ "~." ];
76 networkConfig = {
77 LinkLocalAddressing = "no";
78 DNSSEC = true;
79 };
80 };
81
82 services.corerad = {
83 enable = true;
84 settings = {
85 interfaces = [
86 { name = pppInterface;
87 monitor = true;
88 verbose = true;
89 }
90 { name = "lan";
91 advertise = true;
92 verbose = true;
93 prefix = [{ prefix = "::/64"; }];
94 route = [{ prefix = "::/0"; }];
95 rdnss = [{ servers = ["::"]; }];
96 dnssl = [{ domain_names = ["yggdrasil"]; }];
97 }
98 ];
99
100 debug = {
101 address = "localhost:9430";
102 prometheus = true;
103 };
104 };
105 };
106 services.ndppd = {
107 enable = true;
108 proxies = {
109 ${pppInterface} = {
110 router = true;
111 rules.lan = {
112 method = "iface";
113 interface = "lan";
114 network = "::/0";
115 };
116 };
117 };
118 };
119 boot.kernel.sysctl = {
120 "net.ipv6.conf.all.forwarding" = true;
121 "net.ipv6.conf.default.forwarding" = true;
122 "net.ipv4.conf.all.forwarding" = true;
123 "net.ipv4.conf.default.forwarding" = true;
124
125 "net.core.rmem_max" = "4194304";
126 "net.core.wmem_max" = "4194304";
127 };
128 systemd.services."pppd-telekom" = {
129 bindsTo = [ "sys-subsystem-net-devices-telekom.device" ];
130 after = [ "sys-subsystem-net-devices-telekom.device" ];
131 };
132 systemd.services."dhcpcd-${pppInterface}" = {
133 wantedBy = [ "multi-user.target" "network-online.target" "pppd-telekom.service" ];
134 bindsTo = [ "pppd-telekom.service" "sys-subsystem-net-devices-${pppInterface}.device" ];
135 after = [ "pppd-telekom.service" "sys-subsystem-net-devices-${pppInterface}.device" ];
136 wants = [ "network.target" ];
137 before = [ "network-online.target" ];
138
139 path = with pkgs; [ dhcpcd nettools openresolv ];
140 unitConfig.ConditionCapability = "CAP_NET_ADMIN";
141
142 stopIfChanged = true;
143
144 preStart = ''
145 i=0
146
147 while [[ -z "$(${pkgs.iproute2}/bin/ip -6 addr show dev ${pppInterface} scope link)" ]]; do
148 ${pkgs.coreutils}/bin/sleep 0.1
149 i=$((i + 1))
150 if [[ "$i" -ge 10 ]]; then
151 exit 1
152 fi
153 done
154 '';
155
156 serviceConfig = let
157 dhcpcdConf = pkgs.writeText "dhcpcd.conf" ''
158 duid
159 vendorclassid
160 ipv6only
161
162 nooption domain_name_servers, domain_name, domain_search
163 option classless_static_routes
164 option interface_mtu
165
166 option host_name
167 option rapid_commit
168 require dhcp_server_identifier
169 slaac private
170
171 nohook resolv.conf
172 ipv6ra_autoconf
173 iaid 1195061668
174 ipv6rs # enable routing solicitation for WAN adapter
175 ia_pd 1 lan/0/64/0 # request a PD and assign it to the LAN
176
177 reboot 0
178
179 waitip 6
180 '';
181 in {
182 Type = "forking";
183 PIDFile = "/var/run/dhcpcd/${pppInterface}.pid";
184 RuntimeDirectory = "dhcpcd";
185 ExecStart = "@${pkgs.dhcpcd}/sbin/dhcpcd dhcpcd -q --config ${dhcpcdConf} ${pppInterface}";
186 ExecReload = "${pkgs.dhcpcd}/sbin/dhcpcd --rebind ${pppInterface}";
187 Restart = "always";
188 RestartSec = "5";
189 };
190 };
191 systemd.services.ndppd = {
192 wantedBy = [ "dhcpcd-${pppInterface}.service" ];
193 bindsTo = [ "dhcpcd-${pppInterface}.service" ];
194 after = [ "dhcpcd-${pppInterface}.service" ];
195
196 serviceConfig = {
197 Restart = "always";
198 RestartSec = "5";
199 };
200 };
201 systemd.services.corerad = {
202 wantedBy = [ "dhcpcd-${pppInterface}.service" ];
203 bindsTo = [ "dhcpcd-${pppInterface}.service" ];
204 after = [ "dhcpcd-${pppInterface}.service" ];
205
206 serviceConfig = {
207 Restart = lib.mkForce "always";
208 RestartSec = "5";
209 };
210 };
211 users.users.dhcpcd = {
212 isSystemUser = true;
213 group = "dhcpcd";
214 };
215 users.groups.dhcpcd = {};
216 };
217}
diff --git a/hosts/vidhar/network/pap-secrets b/hosts/vidhar/network/pap-secrets
new file mode 100644
index 00000000..a7937caa
--- /dev/null
+++ b/hosts/vidhar/network/pap-secrets
@@ -0,0 +1,26 @@
1{
2 "data": "ENC[AES256_GCM,data:BOyWdys7Oja54Ijv5j+kqufdokQe0onnqw/gVxpNOMf+YI/LlzJscaEtGqPh3ehVtYoSWGumCBPrjdq/zhYq4VV/PCtdeu3MnX1CH2B5bH0mFs0eXcqeGK6NErz/b5nEglv4Z19ig2CUDlbvi8h1zZAEjxTNKhT16ItCtJnBCsIoiMl2QcTTWMyh4a02v3wA1UrOQZvFuCgCHmRoBE6vpREyB23gQdrdKLk7D1LLw5C1aZnzQOhFsgs7bVjOcBnmwTao8ntXxw==,iv:X5FgYkl3DGA/lkRsoc+5XrK3Nlp/ldnFigpXpYNfSJE=,tag:qUH7m9NzuVNnOfr3rRgaOg==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": null,
9 "lastmodified": "2021-11-15T08:30:09Z",
10 "mac": "ENC[AES256_GCM,data:TAgZ4ktdN9sZPMo1UtwjKdTM2QBjLorcm84HYXTGYNNEorPoqrXAWOvyWRLjx+zxzpRuDLBPQHCkjwkVO2CctxnTaWPMwITbYtQqj/5ZxACuAeX8MaSximB8s5MJK2faCuVXEnFehbnnPr5Fs8ZsgHwu2iH6DU8ScLEkgckzGV0=,iv:keUbKwWfoIIBsp5Rsm2lEba1ZHAozQY2YpA6p5qDBiU=,tag:1llGytMGvOjSVYKJXGUmXg==,type:str]",
11 "pgp": [
12 {
13 "created_at": "2021-11-15T07:45:08Z",
14 "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DbYDvGI0HDr0SAQdADLXtluBBuSsm9CIPG1mEJnOJ0IQmCpwQPcU+Bl/zOE8w\nseSG0fcoBnRX7ngWMoJZ7a0G1ARjBql63SJN7OJ8E7OLcMBeaRkjl/F9jRM6gfIJ\n0l4BCu/V/objPnHxlQ9ETKheAjr7aEH+Wuttut1U+a8Ad5kl5/hKtkK5gv+q0WTi\nRBCe8OIKFbkzd8OvvzZlQBBEa4G/2Az2lVYFrxHq0a7XyJOxmnUJWurbsPUK6EMk\n=ksU8\n-----END PGP MESSAGE-----\n",
15 "fp": "A1C7C95E6CAF0A965CB47277BCF50A89C1B1F362"
16 },
17 {
18 "created_at": "2021-11-15T07:45:08Z",
19 "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAf37n8FlEvDjECfajRNxIh+sLj+VZOSYfzt+GovJN1C4w\nQRkd//w4h6CqMcVz3LzNZIn2Pa8lhBLFV2tBfFqZDa80HcBWCtBgDivq8l7onmJm\n0l4BiAv4DzVVjBOZqhBnzla6SmRqAZDwE1WO7gN+R3/7S/0DXUxopjvdFaheLVj9\n/tKup9Dn2n3mr7gCvgvuPIaoJqdJSG5v8rgp1IrFSIlVtLv+ThgCsGCKZ/P9ef56\n=aqGg\n-----END PGP MESSAGE-----\n",
20 "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
21 }
22 ],
23 "unencrypted_suffix": "_unencrypted",
24 "version": "3.7.1"
25 }
26} \ No newline at end of file
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-24 05:33:20 +0000