mirror of
https://github.com/mdlayher/homelab.git
synced 2024-12-14 11:47:32 +00:00
144 lines
3.4 KiB
Nix
144 lines
3.4 KiB
Nix
{ lib, ... }:
|
|
|
|
let
|
|
vars = import ./lib/vars.nix;
|
|
|
|
# Produces the configuration for a LAN interface.
|
|
mkInterface = (ifi: {
|
|
ipv4.addresses = [{
|
|
address = "${ifi.ipv4}";
|
|
prefixLength = 24;
|
|
}];
|
|
ipv6.addresses = [{
|
|
address = "${ifi.ipv6.ula}";
|
|
prefixLength = 64;
|
|
}];
|
|
tempAddress = "disabled";
|
|
});
|
|
|
|
mkPeer = (peer: {
|
|
publicKey = peer.public_key;
|
|
allowedIPs = peer.allowed_ips;
|
|
});
|
|
|
|
in {
|
|
# LAN interface.
|
|
networking = {
|
|
hostName = "routnerr-2";
|
|
nameservers = with vars.localhost; [ "${ipv4}" "${ipv6}" ];
|
|
|
|
dhcpcd = {
|
|
enable = true;
|
|
# Do not remove interface configuration on shutdown.
|
|
persistent = true;
|
|
allowInterfaces = [ "${vars.interfaces.wan0.name}" ];
|
|
extraConfig = with vars.interfaces; ''
|
|
noipv6rs
|
|
interface ${wan0.name}
|
|
ipv6rs
|
|
# DHCPv6-PD.
|
|
ia_na 0
|
|
ia_pd 1/::/56 ${enp2s0.name}/0/64 ${lab0.name}/2/64 ${guest0.name}/9/64 ${lan0.name}/10/64 ${corp0.name}/30/64 ${iot0.name}/66/64 ${tengb0.name}/110/64
|
|
|
|
# IPv4 DHCP ISP settings overrides.
|
|
static domain_name_servers=${vars.localhost.ipv4}
|
|
static domain_search=
|
|
static domain_name=
|
|
'';
|
|
};
|
|
|
|
iproute2 = {
|
|
enable = true;
|
|
rttablesExtraConfig = ''
|
|
10 wwan0
|
|
'';
|
|
};
|
|
|
|
interfaces = with vars.interfaces; {
|
|
# WAN interface: allow dhcpcd and NM to coexist.
|
|
${wan0.name}.useDHCP = true;
|
|
|
|
# LAN interfaces.
|
|
${enp2s0.name} = mkInterface enp2s0;
|
|
${lan0.name} = mkInterface lan0;
|
|
${corp0.name} = mkInterface corp0;
|
|
${lab0.name} = mkInterface lab0;
|
|
${guest0.name} = mkInterface guest0;
|
|
${iot0.name} = mkInterface iot0;
|
|
${tengb0.name} = mkInterface tengb0;
|
|
};
|
|
|
|
vlans = with vars.interfaces; {
|
|
${lab0.name} = {
|
|
id = 2;
|
|
interface = "${enp2s0.name}";
|
|
};
|
|
${guest0.name} = {
|
|
id = 9;
|
|
interface = "${enp2s0.name}";
|
|
};
|
|
${lan0.name} = {
|
|
id = 10;
|
|
interface = "${enp2s0.name}";
|
|
};
|
|
${corp0.name} = {
|
|
id = 30;
|
|
interface = "${enp2s0.name}";
|
|
};
|
|
${iot0.name} = {
|
|
id = 66;
|
|
interface = "${enp2s0.name}";
|
|
};
|
|
${tengb0.name} = {
|
|
id = 100;
|
|
interface = "${enp2s0.name}";
|
|
};
|
|
};
|
|
|
|
wireguard = with vars.wireguard; {
|
|
enable = true;
|
|
interfaces = {
|
|
${name} = {
|
|
listenPort = 51820;
|
|
ips = with subnet; [
|
|
"${ipv4}"
|
|
"${ipv6.gua}"
|
|
"${ipv6.ula}"
|
|
"${ipv6.lla}"
|
|
];
|
|
privateKeyFile = "/var/lib/wireguard/${name}.key";
|
|
peers = lib.forEach peers mkPeer;
|
|
};
|
|
};
|
|
};
|
|
|
|
nat.enable = false;
|
|
firewall.enable = false;
|
|
|
|
# Use NM/MM only to manage the LTE modem.
|
|
networkmanager = {
|
|
enable = true;
|
|
dns = "none";
|
|
unmanaged = [ "*,except:type:gsm" ];
|
|
};
|
|
};
|
|
|
|
# Bring up MM and exporter with NM.
|
|
systemd.services.ModemManager = {
|
|
enable = true;
|
|
wantedBy = [ "NetworkManager.service" ];
|
|
};
|
|
|
|
# Enable WireGuard Prometheus exporter and set up peer key/name mappings.
|
|
# TODO: nixify the configuration.
|
|
services.wireguard_exporter = {
|
|
enable = true;
|
|
config = ''
|
|
${lib.concatMapStrings (peer: ''
|
|
[[peer]]
|
|
public_key = "${peer.public_key}"
|
|
name = "${peer.name}"
|
|
'') vars.wireguard.peers}
|
|
'';
|
|
};
|
|
}
|