feat(labcore01): init

Lab's core infra vm, doing only dns64 for now.

machines/krz01/networking.nix

@@ -8,16 +8,42 @@
         };
       };
 
-      "10-vmbr0" = {
+      "50-vmbr0" = {
         matchConfig.Name = "vmbr0";
         linkConfig.RequiredForOnline = "routable";
       };
+
+      "50-vmbr1" = {
+        matchConfig.Name = "vmbr1";
+        linkConfig.RequiredForOnline = "routable";
+        bridgeVLANs = [
+          {
+            VLAN = [
+              "2510" # NAT
+              "2501" # Managment
+              "2520" # MW DMZ
+              "2530" # HE DMZ
+            ];
+          }
+        ];
+      };
     };
 
-    netdevs."vmbr0" = {
-      netdevConfig = {
-        Name = "vmbr0";
-        Kind = "bridge";
+    netdevs = {
+      "50-vmbr0" = {
+        netdevConfig = {
+          Name = "vmbr0";
+          Kind = "bridge";
+        };
+      };
+      "50-vmbr1" = {
+        netdevConfig = {
+          Name = "vmbr1";
+          Kind = "bridge";
+        };
+        bridgeConfig = {
+          VLANFiltering = true;
+        };
       };
     };
   };

machines/labcore01/_configuration.nix

@@ -0,0 +1,16 @@
+{ lib, ... }:
+
+lib.extra.mkConfig {
+  enabledModules = [
+    # List of modules to enable
+  ];
+
+  enabledServices = [
+    # List of services to enable
+    "unbound"
+  ];
+
+  extraConfig = { };
+
+  root = ./.;
+}

machines/labcore01/_hardware-configuration.nix

@@ -0,0 +1,49 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ata_piix"
+        "uhci_hcd"
+        "virtio_pci"
+        "virtio_scsi"
+        "sd_mod"
+        "sr_mod"
+      ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e2536e0b-2f60-467e-b4a4-dcea2a4928ce";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/913D-7694";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/17552e24-22de-4965-a1de-aa635e636f63"; } ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/labcore01/secrets/secrets.nix

@@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "router02" ] [
+  # List of secrets for router02
+]

machines/labcore01/unbound.nix

@@ -0,0 +1,20 @@
+{
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        verbosity = 5;
+        interface = [ "2a0e:e701:1120:1000::f:1" ];
+        access-control = [ "2a0e:e701:1120::/48 allow" ];
+        dns64-prefix = "64:ff9b::/96";
+        do-nat64 = "yes";
+        module-config = "\"dns64 validator iterator\"";
+      };
+    };
+  };
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 53 ];
+    };
+  };
+}

machines/router02/networking.nix

@@ -1,5 +1,9 @@
 {
   systemd.network = {
+    config.routeTables = {
+      he = 100;
+      mwan = 110;
+    };
     networks = {
       "10-ens18" = {
         name = "ens18";
@@ -11,8 +15,335 @@
           LLDP = true;
           # Only to the switch we are connected to directly, e.g. the hypervisor or the switch.
           EmitLLDP = "nearest-bridge";
+          Tunnel = [
+            "gre-mwan"
+            "sit-he"
+          ];
         };
       };
+      "10-ens19" = {
+        name = "ens19";
+        networkConfig = {
+          Description = "Lan bridge";
+        };
+        vlan = [
+          "vlan-ens-nat"
+          "vlan-mwan-nat64"
+          "vlan-mwan-siit"
+          "vlan-he-dmz"
+        ];
+      };
+      "50-tun-he" = {
+        name = "sit-he";
+        networkConfig = {
+          Description = "HE.NET IPv6 Tunnel (gdd)";
+          Address = [ "2001:470:1f12:187::2/64" ];
+          ConfigureWithoutCarrier = true;
+        };
+        routes = [
+          {
+            routeConfig = {
+              Destination = "::/0";
+              Table = "he";
+              Scope = "global";
+            };
+          }
+          {
+            # Use HE tunnel for router trafic as well
+            routeConfig = {
+              Destination = "::/0";
+              Scope = "global";
+            };
+          }
+        ];
+        routingPolicyRules = [
+          {
+            routingPolicyRuleConfig = {
+              From = "2001:470:1f13:187::/64";
+              Table = "he";
+            };
+          }
+          {
+            routingPolicyRuleConfig = {
+              To = "2001:470:1f13:187::/64";
+              Table = "he";
+            };
+          }
+        ];
+      };
+      "50-tun-mwan" = {
+        name = "gre-mwan";
+        networkConfig = {
+          Description = "Tunnel de livraison GRE IPv4/IPv6 de MilkyWAN";
+          Address = [
+            "10.1.1.50/30"
+            "45.13.104.25/29"
+            "2a0b:cbc0:1::216/126"
+            "2a0e:e701:1120::1/64"
+          ];
+          ConfigureWithoutCarrier = true;
+        };
+        routes = [
+          {
+            routeConfig = {
+              Gateway = "2a0b:cbc0:1::215";
+              PreferredSource = "2a0e:e701:1120::1";
+            };
+          }
+          {
+            # Local route
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120::/64";
+            };
+          }
+          {
+            # Default unreachable route for unattributed prefixes of our /48
+            routeConfig = {
+              Table = "mwan";
+              Metric = 9999;
+              Destination = "2a0e:e701:1120::/48";
+              Type = "unreachable";
+            };
+          }
+          {
+            routeConfig = {
+              Table = "mwan";
+              Gateway = "2a0b:cbc0:1::215";
+              PreferredSource = "2a0e:e701:1120::1";
+            };
+          }
+          # IPv4
+          {
+            routeConfig = {
+              Scope = "global";
+              Gateway = "10.1.1.49";
+              PreferredSource = "45.13.104.25";
+            };
+          }
+        ];
+        routingPolicyRules = [
+          {
+            routingPolicyRuleConfig = {
+              From = "2a0e:e701:1120::/48";
+              Table = "mwan";
+            };
+          }
+          {
+            routingPolicyRuleConfig = {
+              To = "2a0e:e701:1120::/48";
+              Table = "mwan";
+            };
+          }
+        ];
+      };
+      "60-vlan-ens-nat" = {
+        name = "vlan-ens-nat";
+        networkConfig = {
+          # TODO NAT64 ENS => need netns
+          Description = "Nat IPv4 vers renater";
+          Address = [ "10.3.161.1/24" ];
+          DHCPServer = true;
+        };
+        dhcpServerConfig = {
+          PoolOffset = 50;
+        };
+      };
+      "60-vlan-mwan-siit" = {
+        name = "vlan-mwan-siit";
+        networkConfig = {
+          Description = "SIIT-DC vers MilkyWAN";
+          Address = [ "2a0e:e701:1120:1000::1/64" ];
+          IPv6SendRA = "yes";
+        };
+        ipv6SendRAConfig = {
+          DNS = [ "2a0e:e701:1120:1000::f:1" ];
+        };
+        ipv6Prefixes = [
+          {
+            ipv6PrefixConfig = {
+              Prefix = "2a0e:e701:1120:1000::/64";
+            };
+          }
+        ];
+        routes = [
+          {
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120:1000::/64";
+            };
+          }
+        ];
+      };
+      "60-vlan-mwan-nat64" = {
+        name = "vlan-mwan-nat64";
+        networkConfig = {
+          Description = "Nat IPv4 vers MilkyWAN";
+          Address = [ "2a0e:e701:1120:64::/64" ];
+          IPv6SendRA = "yes";
+        };
+        ipv6SendRAConfig = {
+          DNS = [ "2a0e:e701:1120:1000::f:1" ];
+        };
+        ipv6Prefixes = [
+          {
+            ipv6PrefixConfig = {
+              Prefix = "2a0e:e701:1120:64::/64";
+            };
+          }
+        ];
+        routes = [
+          {
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120:64::/64";
+            };
+          }
+        ];
+      };
+      "60-vlan-he-dmz" = {
+        name = "vlan-he-dmz";
+        networkConfig = {
+          Description = "HE DMZ VLAN";
+          Address = [ "2001:470:1f13:187::1/64" ];
+          IPv6SendRA = "yes";
+        };
+        ipv6Prefixes = [
+          {
+            ipv6PrefixConfig = {
+              Prefix = "2001:470:1f13:187::0/64";
+            };
+          }
+        ];
+        routes = [
+          {
+            routeConfig = {
+              Table = "he";
+              Scope = "global";
+              Destination = "2001:470:1f13:187::/64";
+            };
+          }
+        ];
+      };
+    };
+    netdevs = {
+      "50-tun-he" = {
+        netdevConfig = {
+          Kind = "sit";
+          Name = "sit-he";
+        };
+        tunnelConfig = {
+          Local = "129.199.146.230";
+          Remote = "216.66.84.42";
+        };
+      };
+      "50-tun-mwan" = {
+        netdevConfig = {
+          Kind = "gre";
+          Name = "gre-mwan";
+          MTUBytes = "1480";
+        };
+        tunnelConfig = {
+          Local = "129.199.146.230";
+          Remote = "80.67.167.30";
+        };
+      };
+      "60-vlan-ens-nat" = {
+        netdevConfig = {
+          Kind = "vlan";
+          Name = "vlan-ens-nat";
+        };
+        vlanConfig.Id = 2510;
+      };
+      "60-vlan-mwan-nat64" = {
+        netdevConfig = {
+          Kind = "vlan";
+          Name = "vlan-mwan-nat64";
+        };
+        vlanConfig.Id = 2521;
+      };
+      "60-vlan-mwan-siit" = {
+        netdevConfig = {
+          Kind = "vlan";
+          Name = "vlan-mwan-siit";
+        };
+        vlanConfig.Id = 2520;
+      };
+      "60-vlan-he-dmz" = {
+        netdevConfig = {
+          Kind = "vlan";
+          Name = "vlan-he-dmz";
+        };
+        vlanConfig.Id = 2530;
+      };
     };
   };
+  networking = {
+    nftables = {
+      enable = true;
+      tables.nat = {
+        family = "ip";
+        content = ''
+          chain postrouting {
+            type nat hook postrouting priority 100;
+            ip saddr 10.3.161.0/24 snat to 129.199.146.230;
+          }
+        '';
+      };
+    };
+    firewall = {
+      allowedUDPPorts = [
+        67
+        53
+      ];
+      extraInputRules = ''
+        ip protocol gre ip saddr 80.67.167.30 accept;
+      '';
+      logReversePathDrops = true;
+      checkReversePath = "loose";
+    };
+  };
+  networking.jool = {
+    enable = true;
+    nat64.default = {
+      global = {
+        pool6 = "64:ff9b::/96";
+        lowest-ipv6-mtu = 1500;
+        logging-bib = true;
+        logging-session = true;
+      };
+      pool4 =
+        builtins.map
+          (protocol: {
+            prefix = "45.13.104.25/32";
+            inherit protocol;
+          })
+          [
+            "TCP"
+            "UDP"
+            "ICMP"
+          ];
+    };
+    siit.default = {
+      global = {
+        pool6 = "2a0b:e701:1120:ffff::/96";
+        rfc6791v4-prefix = "45.13.104.25/32";
+        lowest-ipv6-mtu = 1500;
+      };
+      eamt = [
+        {
+          "ipv4 prefix" = "45.13.104.24/29";
+          "ipv6 prefix" = "2a0b:e701:1120:1000:ffff::45.13.104.24/125";
+        }
+      ];
+      denylist4 = [
+        "129.199.146.0/24" # ENS
+      ];
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = true;
+    "net.ipv6.conf.all.forwarding" = true;
+  };
 }

meta/network.nix

@@ -21,6 +21,23 @@
     hostId = "bd11e8fc";
     netbirdIp = "100.80.103.206";
   };
+  labcore01 = {
+    interfaces = {
+      ens18 = {
+        ipv6 = [
+          {
+            address = "2a0e:e701:1120:1000::f:1";
+            prefixLength = 64;
+          }
+        ];
+
+        gateways = [ "2a0e:e701:1120:1000::1" ];
+        enableDefaultDNS = true;
+      };
+    };
+
+    hostId = "4a370ef4";
+  };
   router02 = {
     interfaces = { };
 

meta/nodes.nix

@@ -28,6 +28,14 @@
     stateVersion = "24.05";
     nixpkgs = "unstable";
   };
+  labcore01 = {
+    site = "pav01";
+
+    hashedPassword = "$y$j9T$aFhOWa05W7VKeKt3Nc.nA1$uBOvG4wf7/yWjwOxO8NLf9ipCsAkS1.5cD2EJpLx57A";
+
+    stateVersion = "24.05";
+    nixpkgs = "24.05";
+  };
   router02 = {
     site = "pav01";
 

npins/sources.json

@@ -49,9 +49,9 @@
         "url": "https://git.dgnum.eu/DGNum/infrastructure"
       },
       "branch": "main",
-      "revision": "c0435e694de19f8adad46fc5d0790d73406da3c2",
+      "revision": "45f2f5905506ad7523bde63ae94d0a3dc19dd604",
       "url": null,
-      "hash": "1f92fbcmi96sdgdwmi5y7wynl09fkcyijbc4bkvd7bjj88z4kgwn"
+      "hash": "171rwwvx4mq01g1c2rhn6v4hyv5c8g2jzzxmff4qz70yzlhs8806"
     },
     "lix": {
       "type": "Git",

patches/default.nix

@@ -1,14 +1,7 @@
-let
-  netboxAgent = {
-    id = "244549";
-    hash = "sha256-SePkKEYQGDj6FpuyxZ+1ASeVPA02mCHf0G5i3koMdNw=";
-  };
-in
-
 {
-  "nixos-24.05" = [ netboxAgent ];
+  "nixos-24.05" = [ ];
 
-  "nixos-unstable" = [ netboxAgent ];
+  "nixos-unstable" = [ ];
 
   "proxmox-nixos" = [ ];
 }