infrastructure/machines/vault01/networking.nix

{
  pkgs,
  lib,
  meta,
  name,
  ...
}:

let
  inherit (lib) mapAttrs' nameValuePair;

  uplink = {
    ip = "10.120.33.250";
    prefix = 30;

    router = "10.120.33.249";
  };

  mkNetwork =
    name:
    {
      address,
      extraNetwork ? { },
      ...
    }:
    nameValuePair "10-${name}" ({ inherit name address; } // extraNetwork);

  mkNetdev =
    name:
    { Id, ... }:
    nameValuePair "10-${name}" {
      netdevConfig = {
        Name = name;
        Kind = "vlan";
      };
      vlanConfig.Id = Id;
    };

  mkUserVlan =
    {
      vlan,
      netIP,
      servIP,
      prefixLength,
      interfaceName,
      ...
    }:
    {
      name = interfaceName;
      value = {
        Id = vlan;
        address = [ ];
        extraNetwork = {
          networkConfig = {
            LinkLocalAddressing = "no";
            DHCPServer = "yes";
          };
          linkConfig = {
            Promiscuous = true;
          };
          addresses = [
            {
              addressConfig = {
                Address = "${servIP}/${toString prefixLength}";
                AddPrefixRoute = false;
              };
            }
          ];
          routes = [
            {
              routeConfig = {
                Destination = "${netIP}/${toString prefixLength}";
                Table = "user";
              };
            }
          ];
          routingPolicyRules = [
            {
              routingPolicyRuleConfig = {
                From = "${netIP}/${toString prefixLength}";
                To = "10.0.0.0/27";
                IncomingInterface = interfaceName;
                Table = "user";
              };
            }
          ];
        };
      };
    };

  vlans = {
    vlan-uplink-cri = {
      Id = 223;
      address = with uplink; [ "${ip}/${builtins.toString prefix}" ];

      extraNetwork.routes = [
        {
          routeConfig = {
            # Get the public ip from the metadata
            PreferredSource = builtins.head meta.network.${name}.addresses.ipv4;
            Gateway = uplink.router;
          };
        }
      ];
    };

    vlan-admin = {
      Id = 3000;
      address = [ "fd26:baf9:d250:8000::1/64" ];
    };

    vlan-admin-ap = {
      Id = 3001;
      address = [ "fd26:baf9:d250:8010::1/60" ];
    };

    vlan-apro = {
      Id = 2000;
      address = [ "10.0.255.1/24" ];

      extraNetwork.networkConfig.DHCPServer = "yes";
    };
  } // builtins.listToAttrs (map mkUserVlan (import ./user_vlans.nix));
in

{
  systemd = {
    network = {
      config.routeTables."user" = 1000;
      networks = {
        "10-lo" = {
          name = "lo";
          address = [
            "::1/128"
            "127.0.0.1/8"
            "10.0.0.1/27"
          ];
          routes = [
            {
              routeConfig = {
                Destination = "10.0.0.0/27";
                Table = "user";
              };
            }
          ];
          routingPolicyRules = [
            {
              routingPolicyRuleConfig = {
                IncomingInterface = "lo";
                Table = "user";
              };
            }
          ];
        };
        "10-enp67s0f0np0" = {
          name = "enp67s0f0np0";
          linkConfig.Promiscuous = true;
          networkConfig = {
            VLAN = builtins.attrNames vlans;

            LinkLocalAddressing = false;
            LLDP = false;
            EmitLLDP = false;
            IPv6AcceptRA = false;
            IPv6SendRA = false;
          };
        };
      } // (mapAttrs' mkNetwork vlans);

      netdevs = mapAttrs' mkNetdev vlans;
    };

    services = {
      ethtoolConfig = {
        wantedBy = [ "systemd-networkd.service" ];
        after = [ "sys-subsystem-net-devices-enp67s0f0np0.device" ];
        bindsTo = [ "sys-subsystem-net-devices-enp67s0f0np0.device" ];
        script = ''
          ${lib.getExe pkgs.ethtool} -K enp67s0f0np0 rxvlan off
          ${lib.getExe pkgs.ethtool} -K enp67s0f0np0 txvlan off
          ${lib.getExe pkgs.ethtool} -K enp67s0f0np0 rx-vlan-filter off
          ${lib.getExe pkgs.ethtool} -K enp67s0f0np0 rx-vlan-offload off
          ${lib.getExe pkgs.ethtool} -K enp67s0f0np0 tx-vlan-offload off
          ${lib.getExe pkgs.ethtool} -K enp67s0f0np0 tx-vlan-stag-hw-insert off
          echo "Hardware for enp67s0f0np0 configured"
        '';
      };

      systemd-networkd.serviceConfig = {
        LimitNOFILE = 4096;
      };
    };
  };

  networking.firewall.allowedUDPPorts = [ 67 ];
}