liminix

commit 29e61be26cbde3f9ffdec4e0e22ce4d753709fa7
parent 6f1f9d6f20f2c5fd1bf26b206f718716e94c81e5
Author: Daniel Barlow <dan@telent.net>
Date:   Wed,  7 Feb 2024 23:46:16 +0000

rotuer: get lan rfc1918 prefix from secrets

Diffstat:
M
examples/rotuer-secrets.example.nix
 | 
4
++++
M
examples/rotuer.nix
 | 
8
+++++---

2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/examples/rotuer-secrets.example.nix b/examples/rotuer-secrets.example.nix
@@ -11,4 +11,8 @@ rec {
     ];
   };
   root_password = root.passwd;
+  lan = {
+    prefix = "10.8.0"; # "192.168.8";
+  };
+
 }
diff --git a/examples/rotuer.nix b/examples/rotuer.nix
@@ -76,7 +76,7 @@ in rec {
 
   services.int = svc.network.address.build {
     interface = svc.bridge.primary.build { ifname = "int"; };
-    family = "inet"; address ="10.8.0.1"; prefixLength = 16;
+    family = "inet"; address ="${secrets.lan.prefix}.1"; prefixLength = 24;
   };
 
   services.bridge =  svc.bridge.members.build {
@@ -102,7 +102,7 @@ in rec {
       resolvconf = services.resolvconf;
       inherit interface;
       ranges = [
-        "10.8.0.10,10.8.0.240"
+        "${secrets.lan.prefix}.10,${secrets.lan.prefix}.240"
         # ra-stateless: sends router advertisements with the O and A
         # bits set, and provides a stateless DHCP service. The client
         # will use a SLAAC address, and use DHCP for other
@@ -160,7 +160,9 @@ in rec {
   };
 
   services.firewall = svc.firewall.build {
-    ruleset = import ./demo-firewall.nix;
+    ruleset =
+      let defaults = import ./demo-firewall.nix;
+      in lib.recursiveUpdate defaults secrets.firewallRules;
   };
 
   services.packet_forwarding = svc.network.forward.build { };