liminix-fork/examples/rotuer.nix

277 lines
7 KiB
Nix
Raw Normal View History

# This is not part of Liminix per se. This is my "scratchpad"
# configuration for the device I'm testing with.
#
# Parts of it do do things that Liminix eventually needs to do, but
# don't look in here for solutions - just for identifying the
# problems.
{ config, pkgs, lib, ... } :
let
secrets = import ./rotuer-secrets.nix;
inherit (pkgs.liminix.networking)
address
interface
route;
inherit (pkgs.liminix.services) oneshot longrun bundle target;
inherit (pkgs)
dropbear
ifwait
2023-04-23 19:22:39 +02:00
writeText
writeFennelScript
2023-03-03 21:07:39 +01:00
serviceFns;
2023-07-20 12:28:45 +02:00
svc = config.system.service;
in rec {
boot = {
tftp = {
freeSpaceBytes = 3 * 1024 * 1024;
serverip = "10.0.0.1";
ipaddr = "10.0.0.8";
};
};
imports = [
2023-04-23 13:58:51 +02:00
../modules/wlan.nix
../modules/standard.nix
../modules/ppp
2023-07-14 23:53:25 +02:00
../modules/dnsmasq
../modules/firewall
2023-07-16 18:50:06 +02:00
../modules/hostapd
];
2023-04-23 13:58:51 +02:00
rootfsType = "jffs2";
2023-05-20 23:34:57 +02:00
hostname = "rotuer";
kernel = {
config = {
BRIDGE = "y";
};
};
2023-07-20 12:28:45 +02:00
services.hostap = svc.hostapd {
2023-07-16 18:50:06 +02:00
interface = config.hardware.networkInterfaces.wlan_24;
params = {
ssid = "liminix";
country_code = "GB";
hw_mode="g";
channel = "2";
wmm_enabled = 1;
ieee80211n = 1;
inherit (secrets) wpa_passphrase;
auth_algs = 1; # 1=wpa2, 2=wep, 3=both
wpa = 2; # 1=wpa, 2=wpa2, 3=both
wpa_key_mgmt = "WPA-PSK";
wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
rsn_pairwise = "CCMP"; # auth for wpa2
};
};
2023-07-20 12:28:45 +02:00
services.hostap5 = svc.hostapd {
2023-07-16 18:50:06 +02:00
interface = config.hardware.networkInterfaces.wlan_5;
2023-03-01 23:24:58 +01:00
params = rec {
ssid = "liminix_5";
country_code = "GB";
hw_mode="a";
channel = 36;
ht_capab = "[HT40+]";
vht_oper_chwidth = 1;
vht_oper_centr_freq_seg0_idx = channel + 6;
ieee80211ac = 1;
wmm_enabled = 1;
inherit (secrets) wpa_passphrase;
auth_algs = 1; # 1=wpa2, 2=wep, 3=both
wpa = 2; # 1=wpa, 2=wpa2, 3=both
wpa_key_mgmt = "WPA-PSK";
wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
rsn_pairwise = "CCMP"; # auth for wpa2
};
};
services.int =
let iface = interface {
type = "bridge";
device = "int";
};
in address iface {
family = "inet4"; address ="10.8.0.1"; prefixLength = 16;
};
2023-03-01 23:24:58 +01:00
services.bridge =
let
primary = services.int;
addif = dev: oneshot {
name = "add-${dev.device}-to-bridge";
up = "${ifwait}/bin/ifwait -v ${dev.device} running && ip link set dev ${dev.device} master ${primary.device}";
down = "ip link set dev ${dev} nomaster";
dependencies = [ primary dev ];
};
in bundle {
name = "bridge-members";
contents = with config.hardware.networkInterfaces; map addif [
wlan_24 lan wlan_5
2023-03-01 23:24:58 +01:00
];
};
2023-04-23 19:22:39 +02:00
services.ntp =
let config = writeText "chrony.conf" ''
pool pool.ntp.org iburst
dumpdir /run/chrony
makestep 1.0 3
'';
in longrun {
name = "ntp";
run = "${pkgs.chrony}/bin/chronyd -f ${config} -d";
};
services.sshd = longrun {
name = "sshd";
# env -i clears the environment so we don't pass anything weird to
# ssh sessions. Dropbear params are
# -e pass environment to child
# -E log to stderr
# -R create hostkeys if needed
# -P pid-file
# -F don't fork into background
run = ''
if test -d /persist; then
mkdir -p /persist/secrets/dropbear
ln -s /persist/secrets/dropbear /run
fi
PATH=${lib.makeBinPath config.defaultProfile.packages}:/bin
exec env -i ENV=/etc/ashrc PATH=$PATH ${dropbear}/bin/dropbear -e -E -R -P /run/dropbear.pid -F
'';
};
2023-05-20 23:48:30 +02:00
users.root = secrets.root;
services.dns =
let interface = services.int;
2023-07-20 12:28:45 +02:00
in svc.dnsmasq {
resolvconf = services.resolvconf;
inherit interface;
ranges = [
"10.8.0.10,10.8.0.240"
"::,constructor:${interface.device},ra-stateless"
];
domain = "fake.liminix.org";
};
services.wan =
let iface = config.hardware.networkInterfaces.wan;
2023-07-20 12:28:45 +02:00
in svc.pppoe {
interface = iface;
ppp-options = [
"debug" "+ipv6" "noauth"
"name" secrets.l2tp.name
"password" secrets.l2tp.password
];
};
services.resolvconf = oneshot rec {
dependencies = [ services.wan ];
name = "resolvconf";
up = ''
. ${serviceFns}
( in_outputs ${name}
echo "nameserver $(output ${services.wan} ns1)" > resolv.conf
echo "nameserver $(output ${services.wan} ns2)" >> resolv.conf
)
'';
down = ''
rm -rf /run/service-state/${name}/
'';
};
services.defaultroute4 = route {
name = "defaultroute4";
via = "$(output ${services.wan} address)";
target = "default";
dependencies = [ services.wan ];
};
services.defaultroute6 = route {
name = "defaultroute6";
via = "$(output ${services.wan} ipv6-peer-address)";
target = "default";
dev = "$(output ${services.wan} ifname)";
dependencies = [ services.wan ];
};
2023-07-20 12:28:45 +02:00
services.firewall = svc.firewall {
2023-07-16 18:04:01 +02:00
ruleset = import ./rotuer-firewall.nix;
};
services.packet_forwarding =
2023-06-28 23:31:01 +02:00
let
ip4 = "/proc/sys/net/ipv4/conf/all/forwarding";
ip6 = "/proc/sys/net/ipv6/conf/all/forwarding";
in oneshot {
name = "let-the-ip-flow";
up = ''
2023-06-28 23:31:01 +02:00
echo 1 > ${ip4}
echo 1 > ${ip6}
'';
down = ''
echo 0 > ${ip4};
echo 0 > ${ip6};
'';
dependencies = [ services.firewall ];
};
services.dhcp6 =
let
name = "dhcp6c.wan";
in longrun {
inherit name;
2023-05-26 19:36:44 +02:00
notification-fd = 10;
run = ''
export SERVICE_STATE=/run/service-state/${name}
2023-06-30 21:02:03 +02:00
${pkgs.odhcp6c}/bin/odhcp6c -s ${pkgs.odhcp-script} -e -v -p /run/${name}.pid -P 48 $(output ${services.wan} ifname)
)
'';
dependencies = [ services.wan ];
};
services.acquire-lan-prefix =
let script = pkgs.callPackage ./acquire-delegated-prefix.nix { };
in longrun {
name = "acquire-lan-prefix";
run = "${script} /run/service-state/dhcp6c.wan ${services.int.device}";
dependencies = [ services.dhcp6 ];
};
services.acquire-wan-address =
let script = pkgs.callPackage ./acquire-wan-address.nix { };
in longrun {
name = "acquire-wan-address";
run = "${script} /run/service-state/dhcp6c.wan $(output ${services.wan} ifname)";
dependencies = [ services.dhcp6 ];
};
services.default = target {
name = "default";
2023-05-20 23:34:57 +02:00
contents = with config.services; [
config.hardware.networkInterfaces.lo
config.hardware.networkInterfaces.lan
2023-03-01 23:24:58 +01:00
int
bridge
hostap
2023-03-01 23:24:58 +01:00
hostap5
2023-04-23 19:22:39 +02:00
ntp
defaultroute4
defaultroute6
packet_forwarding
dns
resolvconf
sshd
2023-05-20 23:34:57 +02:00
config.services.hostname
dhcp6
acquire-lan-prefix
acquire-wan-address
];
};
2023-06-20 21:13:59 +02:00
defaultProfile.packages = with pkgs; [
min-collect-garbage
];
}