liminix/examples/demo.nix

# This is an example configuration for a "typical" small office/home
# router and wifi access point.

# You need to copy it to another filename and change the configuration
# wherever the text "EDIT" appears - please consult the tutorial
# documentation for details.

{ config, pkgs, lib, ... } :
let
  inherit (pkgs.liminix.services) bundle oneshot longrun;
  inherit (pkgs) serviceFns;
  # EDIT: you can pick your preferred RFC1918 address space
  # for NATted connections, if you don't like this one.
  ipv4LocalNet = "10.8.0";
  svc = config.system.service;

in rec {
  boot = {
    tftp = {
      freeSpaceBytes = 3 * 1024 * 1024;
      serverip = "10.0.0.1";
      ipaddr = "10.0.0.8";
    };
  };

  imports = [
    ../modules/bridge
    ../modules/dhcp6c
    ../modules/dnsmasq
    ../modules/firewall
    ../modules/hostapd
    ../modules/network
    ../modules/ntp
    ../modules/ppp
    ../modules/ssh
    ../modules/vlan
    ../modules/wlan.nix
  ];
  rootfsType = "jffs2";
  hostname = "the-internet"; # EDIT

  services.hostap = svc.hostapd.build {
    interface = config.hardware.networkInterfaces.wlan;
    # EDIT: you will want to change the obvious things
    # here to values of your choice
    params = {
      ssid = "the-internet";
      channel = "1";
      country_code = "GB";
      wpa_passphrase = "not a real wifi password";

      hw_mode="g";
      ieee80211n = 1;
      auth_algs = 1; # 1=wpa2, 2=wep, 3=both
      wpa = 2;       # 1=wpa, 2=wpa2, 3=both
      wpa_key_mgmt = "WPA-PSK";
      wpa_pairwise = "TKIP CCMP";   # auth for wpa (may not need this?)
      rsn_pairwise = "CCMP";        # auth for wpa2
      wmm_enabled = 1;
    };
  };

  services.int = svc.network.address.build {
    interface = svc.bridge.primary.build { ifname = "int"; };
    family = "inet"; address = "${ipv4LocalNet}.1"; prefixLength = 16;
  };

  services.bridge =  svc.bridge.members.build {
    primary = services.int;
    members = with config.hardware.networkInterfaces;
      [ wlan lan ];
  };

  services.ntp = svc.ntp.build {
    pools = { "pool.ntp.org" = ["iburst"]; };
    makestep = { threshold = 1.0; limit = 3; };
  };

  services.sshd = svc.ssh.build { };

  users.root = {
    # EDIT: choose a root password and then use
    # "mkpasswd -m sha512crypt" to determine the hash.
    # It should start wirh $6$.
    passwd = "$6$6HG7WALLQQY1LQDE$428cnouMJ7wVmyK9.dF1uWs7t0z9ztgp3MHvN5bbeo0M4Kqg/u2ThjoSHIjCEJQlnVpDOaEKcOjXAlIClHWN21";
    openssh.authorizedKeys.keys = [
      # EDIT: you can add your ssh pubkey here
      # "ssh-rsa AAAAB3NzaC1....H6hKd user@example.com";
    ];
  };

  services.dns =
    let interface = services.int;
    in svc.dnsmasq.build {
      resolvconf = services.resolvconf;
      inherit interface;
      ranges = [
        "${ipv4LocalNet}.10,${ipv4LocalNet}.249"
        # EDIT: ... maybe. In this example we use "ra-stateless",
        # meaning dnsmasq sends router advertisements with the O and A
        # bits set, and provides a stateless DHCP service. The client
        # will use a SLAAC address, and use DHCP for other
        # configuration information.
        # If you didn't understand the preceding sentence then
        # the default is _probably_ fine, but if you need
        # a DHCP-only IPv6 network or some other different
        # configuration, this is the place to change it.
        "::,constructor:$(output ${interface} ifname),ra-stateless"
      ];
      # EDIT: choose a domain name for the DNS names issued for your
      # DHCP-issued hosts
      domain = "lan.example.com";
    };

  services.wan = svc.pppoe.build {
    interface = config.hardware.networkInterfaces.wan;
    ppp-options = [
      "debug" "+ipv6" "noauth"
      # EDIT: change the strings "chap-username"
      # and "chap-secret" to match the username/password
      # provided by your ISP for PPP logins
      "name" "chap-username"
      "password" "chap-secret"
    ];
  };

  services.resolvconf = oneshot rec {
    dependencies = [ services.wan ];
    name = "resolvconf";
    up = ''
      . ${serviceFns}
      ( in_outputs ${name}
       echo "nameserver $(output ${services.wan} ns1)" > resolv.conf
       echo "nameserver $(output ${services.wan} ns2)" >> resolv.conf
       chmod 0444 resolv.conf
      )
    '';
  };

  filesystem =
    let inherit (pkgs.pseudofile) dir symlink;
    in dir {
      etc = dir {
        "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
      };
    };

  services.defaultroute4 = svc.network.route.build {
    via = "$(output ${services.wan} address)";
    target = "default";
    dependencies = [ services.wan ];
  };

  services.defaultroute6 = svc.network.route.build {
    via = "$(output ${services.wan} ipv6-peer-address)";
    target = "default";
    interface = services.wan;
  };

  services.firewall = svc.firewall.build {
    ruleset = import ./demo-firewall.nix;
  };

  services.packet_forwarding = svc.network.forward.build { };

  # We expect the ISP uses DHCP6 to issue IPv6 addresses. There is a
  # service to request address information in the form of a DHCP
  # lease, and two dependent services that listen for updates to the
  # DHCP address information and update the addresses of the WAN and
  # LAN interfaces respectively.

  services.dhcp6c =
    let client = svc.dhcp6c.client.build {
          interface = services.wan;
        };
    in bundle {
      name = "dhcp6c";
      contents = [
        (svc.dhcp6c.prefix.build {
          # if your ISP provides you a real IPv6 prefix for your local
          # network (usually a /64 or /48 or something in between the
          # two), this service subscribes to that "prefix delegation"
          # information, and uses it to assign an address to the LAN
          # device. dnsmasq will notice this address and use it to
          # form the addresses it hands out to devices on the lan
          inherit client;
          interface = services.int;
        })
        (svc.dhcp6c.address.build {
          # if your ISP provides you a regular global IPv6 address,
          # this service subscribes to that information and assigns
          # the address to the WAN device.
          inherit client;
          interface = services.wan;
        })
      ];
    };

  defaultProfile.packages = with pkgs; [
    min-collect-garbage
  ];
}