This repository has no description
3.8 kB
158 lines
1{ lib, pkgs, ... }:
2{
3 # vodafone router drifts out of time
4 services.timesyncd.servers = [
5 "0.pool.ntp.org"
6 "1.pool.ntp.org"
7 "2.pool.ntp.org"
8 "3.pool.ntp.org"
9 ];
10 systemd.network.networks."50-et0" = {
11 matchConfig.Name = "et0";
12 DHCP = "yes";
13 linkConfig = {
14 RequiredForOnline = "routable";
15 };
16 networkConfig = {
17 IPv6AcceptRA = true;
18 IPv6Forwarding = true;
19 };
20 };
21 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
22 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
23 systemd.network.networks."10-int0" = {
24 name = "int0";
25 address = [
26 "10.42.0.1/24"
27 "fd42:7d6a::1/64"
28 ];
29 networkConfig = {
30 IPv4Forwarding = true;
31 IPv6Forwarding = true;
32 ConfigureWithoutCarrier = true;
33 DHCPServer = "yes";
34 IPv6SendRA = true;
35 };
36 # announce ourselves (dnsmasq) as resolver, so *.gg23 resolves for clients
37 dhcpServerConfig = {
38 EmitDNS = true;
39 DNS = "_server_address";
40 EmitDomain = true;
41 Domain = "gg23";
42 };
43 ipv6SendRAConfig = {
44 EmitDNS = true;
45 DNS = [ "fd42:7d6a::1" ];
46 EmitDomains = true;
47 Domains = [ "gg23" ];
48 };
49 ipv6Prefixes = [
50 {
51 ipv6PrefixConfig = {
52 Prefix = "fd42:7d6a::/64";
53 };
54 }
55 ];
56 dhcpServerStaticLeases = [
57 {
58 # printer
59 dhcpServerStaticLeaseConfig = {
60 Address = "10.42.0.4";
61 MACAddress = "94:dd:f8:23:c5:ac";
62 };
63 }
64 {
65 # firetv
66 dhcpServerStaticLeaseConfig = {
67 Address = "10.42.0.11";
68 MACAddress = "84:28:59:f0:d2:a8";
69 };
70 }
71 {
72 # styx (et0), ex-router: snapserver, mosquitto, mycelium peer
73 dhcpServerStaticLeaseConfig = {
74 Address = "10.42.0.3";
75 MACAddress = "3c:7c:3f:7e:e2:39";
76 };
77 }
78 # {
79 # dhcpServerStaticLeaseConfig = {
80 # Address = "10.42.0.10";
81 # MACAddress = "ea:4d:12:94:74:2a";
82 # };
83 # }
84 {
85 dhcpServerStaticLeaseConfig = {
86 Address = "10.42.0.10";
87 MACAddress = "fe:fe:fe:fe:fe:fe";
88 };
89 }
90 ];
91 };
92 networking.networkmanager.unmanaged = [ "int0" ];
93 krebs.iptables.tables.filter.INPUT.rules = [
94 {
95 predicate = "-i int0";
96 target = "ACCEPT";
97 }
98 ];
99 krebs.iptables.tables.filter.FORWARD.rules = [
100 {
101 predicate = "-i int0";
102 target = "ACCEPT";
103 }
104 {
105 predicate = "-o int0";
106 target = "ACCEPT";
107 }
108 {
109 predicate = "-p ipv6-icmp";
110 target = "ACCEPT";
111 v4 = false;
112 }
113 ];
114 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
115 {
116 v6 = false;
117 predicate = "-s 10.42.0.0/24";
118 target = "ACCEPT";
119 }
120 ];
121 krebs.iptables.tables.nat.POSTROUTING.rules = [
122 {
123 v6 = false;
124 predicate = "-s 10.42.0.0/24";
125 target = "MASQUERADE";
126 }
127 {
128 v4 = false;
129 predicate = "-s fd42:7d6a::/64";
130 target = "MASQUERADE";
131 }
132 ];
133
134 networking.domain = "gg23";
135
136 networking.useHostResolvConf = false;
137 services.resolved.settings.Resolve.DNSStubListener = "no";
138 services.dnsmasq = {
139 enable = true;
140 resolveLocalQueries = false;
141
142 settings = {
143 local = "/gg23/";
144 domain = "gg23";
145 expand-hosts = true;
146 listen-address = "10.42.0.1,10.233.0.1";
147 interface = "int0";
148 };
149 };
150
151 environment.systemPackages = [
152 (pkgs.writers.writeDashBin "restart_router" ''
153 ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m OFF
154 sleep 2
155 ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m ON
156 '')
157 ];
158}