blob: 5f96ffbdbc525bd040724541f51c5312c8d65039 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
{ config, lib, ... }:
with lib;
let
trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str;
in {
config = {
systemd.network = {
netdevs = {
bifrost = {
netdevConfig = {
Name = "bifrost";
Kind = "wireguard";
};
wireguardConfig = {
PrivateKeyFile = "/run/credentials/systemd-networkd.service/bifrost.priv";
ListenPort = 51822;
};
wireguardPeers = [
{ wireguardPeerConfig = {
AllowedIPs = [ "::/0" ];
PublicKey = trim (readFile ../../../surtr/bifrost/surtr.pub);
PersistentKeepalive = 5;
Endpoint = "2a03:4000:52:ada:::51822";
};
}
];
};
};
networks = {
bifrost = {
name = "bifrost";
matchConfig = {
Name = "bifrost";
};
address = ["2a03:4000:52:ada:4:1::/96"];
routes = [
{ routeConfig = {
Destination = "2a03:4000:52:ada:4::/80";
};
}
{ routeConfig = {
Gateway = "2a03:4000:52:ada:4::";
GatewayOnLink = true;
Table = "bifrost";
};
}
{ routeConfig = {
Destination = "2a03:4000:52:ada:4::/80";
GatewayOnLink = true;
Table = "bifrost";
};
}
{ routeConfig = {
Destination = "2a03:4000:52:ada:4:1::/96";
GatewayOnLink = true;
Table = "bifrost";
};
}
];
routingPolicyRules = [
{ routingPolicyRuleConfig = {
Table = "bifrost";
From = "2a03:4000:52:ada:4:1::/96";
Priority = 1;
};
}
];
linkConfig = {
RequiredForOnline = false;
};
networkConfig = {
LLMNR = false;
MulticastDNS = false;
};
};
};
config.routeTables.bifrost = 1026;
};
systemd.services."systemd-networkd".serviceConfig.LoadCredential = [
"bifrost.priv:${config.sops.secrets.bifrost.path}"
];
sops.secrets.bifrost = {
format = "binary";
sopsFile = ./vidhar.priv;
};
systemd.services."bifrost-dscp" = {
wantedBy = ["sys-subsystem-net-devices-bifrost.device"];
after = ["sys-subsystem-net-devices-bifrost.device"];
bindsTo = ["sys-subsystem-net-devices-bifrost.device"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.preserve-dscp}/bin/preserve-dscp bifrost ens3";
ExecStop = "${pkgs.preserve-dscp}/bin/preserve-dscp bifrost ens3 --unload";
};
};
};
}
|
