feat(labcore01): init

Lab's core infra vm, doing only dns64 for now.

machines/labcore01/_configuration.nix

@@ -0,0 +1,16 @@
+{ lib, ... }:
+
+lib.extra.mkConfig {
+  enabledModules = [
+    # List of modules to enable
+  ];
+
+  enabledServices = [
+    # List of services to enable
+    "unbound"
+  ];
+
+  extraConfig = { };
+
+  root = ./.;
+}

machines/labcore01/_hardware-configuration.nix

@@ -0,0 +1,49 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ata_piix"
+        "uhci_hcd"
+        "virtio_pci"
+        "virtio_scsi"
+        "sd_mod"
+        "sr_mod"
+      ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e2536e0b-2f60-467e-b4a4-dcea2a4928ce";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/913D-7694";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/17552e24-22de-4965-a1de-aa635e636f63"; } ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/labcore01/secrets/secrets.nix

@@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "router02" ] [
+  # List of secrets for router02
+]

machines/labcore01/unbound.nix

@@ -0,0 +1,20 @@
+{
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        verbosity = 5;
+        interface = [ "2a0e:e701:1120:1000::f:1" ];
+        access-control = [ "2a0e:e701:1120::/48 allow" ];
+        dns64-prefix = "64:ff9b::/96";
+        do-nat64 = "yes";
+        module-config = "\"dns64 validator iterator\"";
+      };
+    };
+  };
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 53 ];
+    };
+  };
+}

machines/router02/networking.nix

@@ -2,6 +2,7 @@
   systemd.network = {
     config.routeTables = {
       he = 100;
+      mwan = 110;
     };
     networks = {
       "10-ens18" = {
@@ -26,8 +27,8 @@
           Description = "Lan bridge";
         };
         vlan = [
-          "vlan-nat"
-          "vlan-he"
+          "vlan-mwan-siit"
+          "vlan-he-dmz"
         ];
       };
       "50-tun-he" = {
@@ -60,6 +61,12 @@
               Table = "he";
             };
           }
+          {
+            routingPolicyRuleConfig = {
+              To = "2001:470:1f13:187::/64";
+              Table = "he";
+            };
+          }
         ];
       };
       "50-tun-mwan" = {
@@ -69,23 +76,104 @@
           Address = [
             "10.1.1.50/30"
             "2a0b:cbc0:1::216/126"
+            "2a0e:e701:1120::1/64"
           ];
           ConfigureWithoutCarrier = true;
         };
+        routes = [
+          {
+            routeConfig = {
+              Gateway = "2a0b:cbc0:1::215";
+              PreferredSource = "2a0e:e701:1120::1";
             };
-      "60-vlan-nat" = {
-        name = "vlan-nat";
+          }
+          {
+            # Local route
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120::/64";
+            };
+          }
+          {
+            # Default unreachable route for unattributed prefixes of our /48
+            routeConfig = {
+              Table = "mwan";
+              Metric = 9999;
+              Destination = "2a0e:e701:1120::/48";
+              Type = "unreachable";
+            };
+          }
+          {
+            routeConfig = {
+              Table = "mwan";
+              Gateway = "2a0b:cbc0:1::215";
+              PreferredSource = "2a0e:e701:1120::1";
+            };
+          }
+          # IPv4
+          {
+            routeConfig = {
+              Scope = "global";
+              Table = "mwan";
+              Gateway = "10.1.1.49";
+            };
+          }
+        ];
+        routingPolicyRules = [
+          {
+            routingPolicyRuleConfig = {
+              From = "45.13.104.24/29";
+              Table = "mwan";
+            };
+          }
+          {
+            routingPolicyRuleConfig = {
+              To = "45.13.104.24/29";
+              Table = "mwan";
+            };
+          }
+          {
+            routingPolicyRuleConfig = {
+              From = "2a0e:e701:1120::/48";
+              Table = "mwan";
+            };
+          }
+          {
+            routingPolicyRuleConfig = {
+              To = "2a0e:e701:1120::/48";
+              Table = "mwan";
+            };
+          }
+        ];
+      };
+      "60-vlan-mwan-siit" = {
+        name = "vlan-mwan-siit";
         networkConfig = {
-          Description = "Nat IPv4 vers renater";
-          Address = [ "10.3.161.1/24" ];
-          DHCPServer = true;
+          Description = "SIIT-DC vers MilkyWAN";
+          Address = [ "2a0e:e701:1120:1000::1/64" ];
+          IPv6SendRA = "yes";
         };
-        dhcpServerConfig = {
-          PoolOffset = 50;
+        ipv6SendRAConfig = {
+          DNS = [ "2a0e:e701:1120:1000::f:1" ];
         };
+        ipv6Prefixes = [
+          {
+            ipv6PrefixConfig = {
+              Prefix = "2a0e:e701:1120:1000::/64";
             };
-      "60-vlan-he" = {
-        name = "vlan-he";
+          }
+        ];
+        routes = [
+          {
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120:1000::/64";
+            };
+          }
+        ];
+      };
+      "60-vlan-he-dmz" = {
+        name = "vlan-he-dmz";
         networkConfig = {
           Description = "HE DMZ VLAN";
           Address = [ "2001:470:1f13:187::1/64" ];
@@ -107,17 +195,7 @@
             };
           }
         ];
-        routingPolicyRules = [
-          {
-            routingPolicyRuleConfig = {
-              To = "2001:470:1f13:187::/64";
-              Table = "he";
       };
-          }
-        ];
-
-      };
-
     };
     netdevs = {
       "50-tun-he" = {
@@ -141,40 +219,55 @@
           Remote = "80.67.167.30";
         };
       };
-      "60-vlan-nat" = {
+      "60-vlan-mwan-siit" = {
         netdevConfig = {
           Kind = "vlan";
-          Name = "vlan-nat";
+          Name = "vlan-mwan-siit";
         };
-        vlanConfig.Id = 2510;
+        vlanConfig.Id = 2520;
       };
-      "60-vlan-he" = {
+      "60-vlan-he-dmz" = {
         netdevConfig = {
           Kind = "vlan";
-          Name = "vlan-he";
+          Name = "vlan-he-dmz";
         };
         vlanConfig.Id = 2530;
       };
     };
   };
   networking = {
-    nftables = {
-      enable = true;
-      tables.nat = {
-        family = "ip";
-        content = ''
-          chain postrouting {
-            type nat hook postrouting priority 100;
-            ip saddr 10.3.161.0/24 snat to 129.199.146.230;
-          }
-        '';
-      };
-    };
     firewall = {
-      allowedUDPPorts = [ 67 ];
+      allowedUDPPorts = [
+        67
+        53
+      ];
       extraInputRules = ''
         ip protocol gre ip saddr 80.67.167.30 accept;
       '';
+      logReversePathDrops = true;
+      checkReversePath = "loose";
+    };
+  };
+  networking.jool = {
+    enable = true;
+    siit.siitdefault = {
+      global = {
+        manually-enabled = true;
+        pool6 = "2a0e:e701:1120:ffff::/96";
+        rfc6791v4-prefix = "10.243.0.0/24";
+        randomize-rfc6791-addresses = false;
+        lowest-ipv6-mtu = 1500;
+        logging-debug = true;
+      };
+      eamt = [
+        {
+          "ipv4 prefix" = "45.13.104.24/29";
+          "ipv6 prefix" = "2a0e:e701:1120:1000:ffff::45.13.104.24/125";
+        }
+      ];
+      denylist4 = [
+        "129.199.146.230/32" # ENS
+      ];
     };
   };
 
@@ -182,5 +275,4 @@
     "net.ipv4.ip_forward" = true;
     "net.ipv6.conf.all.forwarding" = true;
   };
-
 }

meta/network.nix

@@ -21,6 +21,23 @@
     hostId = "bd11e8fc";
     netbirdIp = "100.80.103.206";
   };
+  labcore01 = {
+    interfaces = {
+      ens18 = {
+        ipv6 = [
+          {
+            address = "2a0e:e701:1120:1000::f:1";
+            prefixLength = 64;
+          }
+        ];
+
+        gateways = [ "2a0e:e701:1120:1000::1" ];
+        enableDefaultDNS = true;
+      };
+    };
+
+    hostId = "4a370ef4";
+  };
   router02 = {
     interfaces = { };
 

meta/nodes.nix

@@ -28,7 +28,7 @@
     stateVersion = "24.05";
     nixpkgs = "unstable";
   };
-  router02 = {
+  labcore01 = {
     site = "pav01";
 
     hashedPassword = "$y$j9T$aFhOWa05W7VKeKt3Nc.nA1$uBOvG4wf7/yWjwOxO8NLf9ipCsAkS1.5cD2EJpLx57A";
@@ -36,4 +36,12 @@
     stateVersion = "24.05";
     nixpkgs = "24.05";
   };
+  router02 = {
+    site = "pav01";
+
+    hashedPassword = "$y$j9T$aFhOWa05W7VKeKt3Nc.nA1$uBOvG4wf7/yWjwOxO8NLf9ipCsAkS1.5cD2EJpLx57A";
+
+    stateVersion = "24.05";
+    nixpkgs = "unstable";
+  };
 }