infrastructure/machines/vault01/networking.nix

{
  pkgs,
  lib,
  meta,
  name,
  ...
}:

let
  inherit (lib) mapAttrs' nameValuePair;

  uplink = {
    ip = "10.120.33.250";
    prefix = 30;

    router = "10.120.33.249";
  };

  mkNetwork =
    name:
    {
      address ? [ ],
      extraNetwork ? { },
      ...
    }:
    nameValuePair "10-${name}" ({ inherit name address; } // extraNetwork);

  mkNetdev =
    name:
    { Id, ... }:
    nameValuePair "10-${name}" {
      netdevConfig = {
        Name = name;
        Kind = "vlan";
      };
      vlanConfig.Id = Id;
    };

  mkUserVlan =
    id:
    let
      # on alloue 10.0.0.0/17 aux thurnés, avec un /27 chacun, on garde 10.0.0.0/27 pour nous (routeur et autres)
      vlan = 4094 - id;
      prefix24nb = (id + 1) / 8;
      prefix27nb = (id + 1 - prefix24nb * 8) * 32;
      netIP = "10.0.${toString prefix24nb}.${toString prefix27nb}";
      servIP = "10.0.${toString prefix24nb}.${toString (prefix27nb + 1)}";
      interfaceName = "vlan-user-${toString vlan}";
    in
    {
      name = interfaceName;
      value = {
        Id = vlan;
        extraNetwork = {
          networkConfig = {
            LinkLocalAddressing = "no";
            DHCPServer = "yes";
          };
          linkConfig.Promiscuous = true;
          addresses = [
            {
              addressConfig = {
                Address = "${servIP}/27";
                AddPrefixRoute = false;
              };
            }
          ];
          routes = [
            {
              routeConfig = {
                Destination = "${netIP}/27";
                Table = "user";
              };
            }
          ];
          routingPolicyRules = [
            {
              routingPolicyRuleConfig = {
                From = "${netIP}/27";
                To = "10.0.0.0/27";
                IncomingInterface = interfaceName;
                Table = "user";
              };
            }
          ];
        };
      };
    };

  vlans = {
    vlan-uplink-cri = {
      Id = 223;
      address = with uplink; [ "${ip}/${builtins.toString prefix}" ];

      extraNetwork.routes = [
        {
          routeConfig = {
            # Get the public ip from the metadata
            PreferredSource = builtins.head meta.network.${name}.addresses.ipv4;
            Gateway = uplink.router;
          };
        }
      ];
    };

    vlan-admin = {
      Id = 3000;
      address = [ "fd26:baf9:d250:8000::1/64" ];
    };

    vlan-admin-ap = {
      Id = 3001;
      address = [ "fd26:baf9:d250:8010::1/60" ];
    };

    vlan-apro = {
      Id = 2000;
      address = [ "10.0.255.1/24" ];

      extraNetwork.networkConfig.DHCPServer = "yes";
    };
  } // builtins.listToAttrs (builtins.genList mkUserVlan 850);
in

{
  systemd = {
    network = {
      config.routeTables."user" = 1000;
      networks = {
        "10-lo" = {
          name = "lo";
          address = [
            "::1/128"
            "127.0.0.1/8"
            "10.0.0.1/27"
          ];
          routes = [
            {
              routeConfig = {
                Destination = "10.0.0.0/27";
                Table = "user";
              };
            }
          ];
          routingPolicyRules = [
            {
              routingPolicyRuleConfig = {
                IncomingInterface = "lo";
                Table = "user";
              };
            }
          ];
        };
        "10-enp67s0f0np0" = {
          name = "enp67s0f0np0";
          linkConfig.Promiscuous = true;
          networkConfig = {
            VLAN = builtins.attrNames vlans;

            LinkLocalAddressing = false;
            LLDP = false;
            EmitLLDP = false;
            IPv6AcceptRA = false;
            IPv6SendRA = false;
          };
        };
      } // (mapAttrs' mkNetwork vlans);

      netdevs = mapAttrs' mkNetdev vlans;
    };

    services = {
      ethtoolConfig = {
        wantedBy = [ "systemd-networkd.service" ];
        after = [ "sys-subsystem-net-devices-enp67s0f0np0.device" ];
        bindsTo = [ "sys-subsystem-net-devices-enp67s0f0np0.device" ];
        script = builtins.concatStringsSep "\n" (
          builtins.map (name: "${lib.getExe pkgs.ethtool} -K enp67s0f0np0 ${name} off") [
            "rxvlan"
            "txvlan"
            "rx-vlan-filter"
            "rx-vlan-offload"
            "tx-vlan-offload"
            "tx-vlan-stag-hw-insert"
          ]
        );
      };

      systemd-networkd.serviceConfig.LimitNOFILE = 4096;
    };
  };

  networking = {
    nftables = {
      enable = true;
      tables.nat = {
        family = "ip";
        content = ''
          chain postrouting {
            type nat hook postrouting priority 100;
            snat ip to 129.199.195.130-129.199.195.158
          }
        '';
      };
    };
    firewall.allowedUDPPorts = [ 67 ];
  };

  boot.kernel.sysctl."net.ipv4.ip_forward" = true;
}