DGNum/infrastructure
9
6
Fork 3
Code Issues 30 Pull requests 32 Projects 1 Releases Packages Wiki Activity Actions

feat: move back router02 and rename it lab-router01

Browse source
This commit is contained in:
sinavir 2025-04-07 13:52:50 +02:00 • committed by Tom Hubrecht
parent 6303da3811
commit f0771ff28d
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
9 changed files with 404 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
machines/nixos/lab-router01/_configuration.nix Normal file
View file

@ -0,0 +1,21 @@
# SPDX-FileCopyrightText: 2024 Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{ lib, ... }:
lib.extra.mkConfig {
enabledModules = [
# List of modules to enable
];
enabledServices = [
# List of services to enable
"networking"
"nginx-sni"
];
extraConfig = { };
root = ./.;
}

49
machines/nixos/lab-router01/_hardware-configuration.nix Normal file
View file

@ -0,0 +1,49 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ lib, modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
initrd = {
availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
kernelModules = [ ];
};
kernelModules = [ ];
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/77ecdf8d-ecda-42ed-aa4f-caa78d5d5e06";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/A044-5792";
fsType = "vfat";
options = [
"fmask=0022"
"dmask=0022"
];
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
# networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

266
machines/nixos/lab-router01/networking.nix Normal file
View file

@ -0,0 +1,266 @@
# SPDX-FileCopyrightText: 2024 Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{
systemd.network = {
config.routeTables = {
he = 100;
mwan = 110;
};
networks = {
"10-ens18" = {
name = "ens18";
networkConfig = {
Description = "ENS uplink";
Address = [
"129.199.146.231/24"
"129.199.146.230/24"
];
Gateway = "129.199.146.254";
LLDP = true;
# Only to the switch we are connected to directly, e.g. the hypervisor or the switch.
EmitLLDP = "nearest-bridge";
Tunnel = [
"gre-mwan"
"sit-he"
];
};
};
"10-ens19" = {
name = "ens19";
networkConfig = {
Description = "Lan bridge";
};
vlan = [
"vlan-mwan-siit"
"vlan-he-dmz"
];
};
"50-tun-he" = {
name = "sit-he";
networkConfig = {
Description = "HE.NET IPv6 Tunnel (maurice)";
Address = [ "2001:470:1f12:2b::2/64" ];
ConfigureWithoutCarrier = true;
};
routes = [
{
Destination = "::/0";
Table = "he";
Scope = "global";
}
{
# Use HE tunnel for router trafic as well
Destination = "::/0";
Scope = "global";
}
];
routingPolicyRules = [
{
routingPolicyRuleConfig = {
From = "2001:470:1f13:2b::/64";
Table = "he";
};
}
{
routingPolicyRuleConfig = {
To = "2001:470:1f13:2b::/64";
Table = "he";
};
}
];
};
"50-tun-mwan" = {
name = "gre-mwan";
networkConfig = {
Description = "Tunnel de livraison GRE IPv4/IPv6 de MilkyWAN";
Address = [
"10.1.1.50/30"
"2a0b:cbc0:1::216/126"
"2a0e:e701:1120::1/64"
];
ConfigureWithoutCarrier = true;
};
routes = [
{
Gateway = "2a0b:cbc0:1::215";
PreferredSource = "2a0e:e701:1120::1";
}
{
# Local route
Table = "mwan";
Destination = "2a0e:e701:1120::/64";
}
{
# Default unreachable route for unattributed prefixes of our /48
Table = "mwan";
Metric = 9999;
Destination = "2a0e:e701:1120::/48";
Type = "unreachable";
}
{
Table = "mwan";
Gateway = "2a0b:cbc0:1::215";
PreferredSource = "2a0e:e701:1120::1";
}
# IPv4
{
Scope = "global";
Table = "mwan";
Gateway = "10.1.1.49";
}
];
routingPolicyRules = [
{
routingPolicyRuleConfig = {
From = "45.13.104.24/29";
Table = "mwan";
};
}
{
routingPolicyRuleConfig = {
To = "45.13.104.24/29";
Table = "mwan";
};
}
{
routingPolicyRuleConfig = {
From = "2a0e:e701:1120::/48";
Table = "mwan";
};
}
{
routingPolicyRuleConfig = {
To = "2a0e:e701:1120::/48";
Table = "mwan";
};
}
];
};
"60-vlan-mwan-siit" = {
name = "vlan-mwan-siit";
networkConfig = {
Description = "SIIT-DC vers MilkyWAN";
Address = [ "2a0e:e701:1120:1000::1/64" ];
IPv6SendRA = "yes";
};
ipv6SendRAConfig = {
DNS = [ "2a0e:e701:1120:1000::f:1" ];
};
ipv6Prefixes = [
{
ipv6PrefixConfig = {
Prefix = "2a0e:e701:1120:1000::/64";
};
}
];
routes = [
{
Table = "mwan";
Destination = "2a0e:e701:1120:1000::/64";
}
];
};
"60-vlan-he-dmz" = {
name = "vlan-he-dmz";
networkConfig = {
Description = "HE DMZ VLAN";
Address = [ "2001:470:1f13:2b::1/64" ];
IPv6SendRA = "yes";
};
ipv6Prefixes = [
{
ipv6PrefixConfig = {
Prefix = "2001:470:1f13:2b::0/64";
};
}
];
routes = [
{
Table = "he";
Scope = "global";
Destination = "2001:470:1f13:2b::/64";
}
];
};
};
netdevs = {
"50-tun-he" = {
netdevConfig = {
Kind = "sit";
Name = "sit-he";
};
tunnelConfig = {
Local = "129.199.146.231";
Remote = "216.66.84.42";
};
};
"50-tun-mwan" = {
netdevConfig = {
Kind = "gre";
Name = "gre-mwan";
MTUBytes = "1480";
};
tunnelConfig = {
Local = "129.199.146.230";
Remote = "80.67.167.30";
};
};
"60-vlan-mwan-siit" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan-mwan-siit";
};
vlanConfig.Id = 2520;
};
"60-vlan-he-dmz" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan-he-dmz";
};
vlanConfig.Id = 2530;
};
};
};
networking = {
firewall = {
allowedUDPPorts = [
67
53
];
extraInputRules = ''
ip protocol gre ip saddr 80.67.167.30 accept;
'';
logReversePathDrops = true;
checkReversePath = "loose";
};
};
networking.jool = {
enable = true;
siit.siitdefault = {
global = {
manually-enabled = true;
pool6 = "2a0e:e701:1120:ffff::/96";
rfc6791v4-prefix = "10.243.0.0/24";
randomize-rfc6791-addresses = false;
lowest-ipv6-mtu = 1500;
logging-debug = true;
};
eamt = [
{
"ipv4 prefix" = "45.13.104.24/29";
"ipv6 prefix" = "2a0e:e701:1120:1000:ffff::45.13.104.24/125";
}
];
denylist4 = [
"129.199.146.230/32" # ENS
];
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = true;
"net.ipv6.conf.all.forwarding" = true;
};
}

18
machines/nixos/lab-router01/nginx-sni.nix Normal file
View file

@ -0,0 +1,18 @@
# SPDX-FileCopyrightText: 2024 Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{
dgn-web.enable = true;
services.nginx = {
sni-proxy = {
preStreamConfig = ''
resolver 127.0.0.53;
'';
enable = true;
# Becareful, jool will not translate ips. Prefer ipv6 proxy target
redirects = {
"kfet.lab.dgnum.eu" = "v6.labcore01.pav01.infra.lab.dgnum.eu:443";
};
};
};
}

8
machines/nixos/lab-router01/secrets/secrets.nix Normal file
View file

@ -0,0 +1,8 @@
# SPDX-FileCopyrightText: 2024 Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys.nix).mkSecrets
[ "lab-router01" ]
[
# List of secrets for lab-router01
]