liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

rotuer.nix (3876B)

      1 # This is an example that uses the "gateway" profile to create a
      2 # "typical home wireless router" configuration suitable for a Gl.inet
      3 # gl-ar750 router. It should be fairly simple to edit it for other
      4 # devices: mostly you will need to attend to the number of wlan and lan
      5 # interfaces
      6 
      7 {
      8   config,
      9   pkgs,
     10   lib,
     11   modulesPath,
     12   ...
     13 }:
     14 let
     15   secrets = {
     16     domainName = "fake.liminix.org";
     17     firewallRules = { };
     18   }
     19   // (import ./rotuer-secrets.nix);
     20   svc = config.system.service;
     21   wirelessConfig = {
     22     country_code = "GB";
     23     inherit (secrets) wpa_passphrase;
     24     wmm_enabled = 1;
     25   };
     26 
     27 in
     28 rec {
     29   boot = {
     30     tftp = {
     31       freeSpaceBytes = 3 * 1024 * 1024;
     32       serverip = "10.0.0.1";
     33       ipaddr = "10.0.0.8";
     34     };
     35   };
     36 
     37   imports = [
     38     "${modulesPath}/profiles/gateway.nix"
     39   ];
     40   hostname = "rotuer";
     41 
     42   profile.gateway = {
     43     lan = {
     44       interfaces = with config.hardware.networkInterfaces; [
     45         # EDIT: these are the interfaces exposed by the gl.inet gl-ar750:
     46         # if your device has more or differently named lan interfaces,
     47         # specify them here
     48         wlan
     49         wlan5
     50         lan
     51       ];
     52       inherit (secrets.lan) prefix;
     53       address = {
     54         family = "inet";
     55         address = "${secrets.lan.prefix}.1";
     56         prefixLength = 24;
     57       };
     58       dhcp = {
     59         start = 10;
     60         end = 240;
     61         hosts =
     62           { } // lib.optionalAttrs (builtins.pathExists ./static-leases.nix) (import ./static-leases.nix);
     63         localDomain = "lan";
     64       };
     65     };
     66     wan = {
     67       # wan interface depends on your upstream - could be dhcp, static
     68       # ethernet, a pppoe, ppp over serial, a complicated bonded
     69       # failover ... who knows what else?
     70       interface = svc.pppoe.build {
     71         interface = config.hardware.networkInterfaces.wan;
     72         username = secrets.l2tp.name;
     73         password = secrets.l2tp.password;
     74         bandwidth = 70 * 1000 * 1000;
     75       };
     76       # once the wan has ipv4 connnectivity, should we run dhcp6
     77       # client to potentially get an address range ("prefix
     78       # delegation")
     79       dhcp6.enable = true;
     80     };
     81     firewall = {
     82       enable = true;
     83       rules = secrets.firewallRules;
     84     };
     85     wireless.networks = {
     86       # EDIT: if you have more or fewer wireless radios, here is where
     87       # you need to say so.  hostapd tuning is hardware-specific and
     88       # left as an exercise for the reader :-).
     89 
     90       "${secrets.ssid}" = {
     91         interface = config.hardware.networkInterfaces.wlan;
     92         hw_mode = "g";
     93         channel = "2";
     94         ieee80211n = 1;
     95       }
     96       // wirelessConfig;
     97       "${secrets.ssid}5" = rec {
     98         interface = config.hardware.networkInterfaces.wlan5;
     99         hw_mode = "a";
    100         channel = 36;
    101         ht_capab = "[HT40+]";
    102         vht_oper_chwidth = 1;
    103         vht_oper_centr_freq_seg0_idx = channel + 6;
    104         ieee80211n = 1;
    105         ieee80211ac = 1;
    106       }
    107       // wirelessConfig;
    108     };
    109   };
    110 
    111   services.ntp = svc.ntp.build {
    112     user = "root";
    113     pools = {
    114       "pool.ntp.org" = [ "iburst" ];
    115     };
    116     makestep = {
    117       threshold = 1.0;
    118       limit = 3;
    119     };
    120   };
    121 
    122   services.sshd = svc.ssh.build { };
    123 
    124   users.root = secrets.root;
    125 
    126   defaultProfile.packages = with pkgs; [
    127     min-collect-garbage
    128     nftables
    129     strace
    130     tcpdump
    131     s6
    132   ];
    133 
    134   services.qemu-hyp-route =
    135     let
    136       interface = config.hardware.networkInterfaces.wan;
    137       addr = svc.network.address.build {
    138         inherit interface;
    139         family = "inet";
    140         address = "10.0.0.10";
    141         prefixLength = 24;
    142       };
    143     in
    144     svc.network.route.build {
    145       target = "10.0.0.1";
    146       inherit interface;
    147       via = "10.0.0.10";
    148       metric = 1;
    149       dependencies = [ addr ];
    150     };
    151 
    152 
    153   programs.busybox = {
    154     applets = [
    155       "fdisk"
    156       "sfdisk"
    157     ];
    158     options = {
    159       FEATURE_FANCY_TAIL = "y";
    160     };
    161   };
    162 }