liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

configuration.nix (4329B)

      1 # this is, temporarily (as of april 2026), a copy of examples/rotuer.nix
      2 # without the external dependencies
      3 
      4 {
      5   config,
      6   pkgs,
      7   lib,
      8   modulesPath,
      9   ...
     10 }:
     11 let
     12   secrets = {
     13     domainName = "fake.liminix.org";
     14     firewallRules = { };
     15     ssid = "NCSC free wifi";
     16     wpa_passphrase = "my horse my horse";
     17     lan = {
     18       prefix = "10.9.8";
     19     };
     20     l2tp = {
     21       name = "hello";
     22       password = "jeff wayne";
     23     };
     24     root =  {
     25       #  mkpasswd -m sha512crypt
     26       passwd = "$6$6pt0mpbgcB7kC2RJ$kSBoCYGyi1.qxt7dqmexLj1l8E6oTZJZmfGyJSsMYMW.jlsETxdgQSdv6ptOYDM7DHAwf6vLG0pz3UD31XBfC1";
     27       openssh.authorizedKeys.keys = [ ];
     28     };
     29   };
     30 
     31   svc = config.system.service;
     32   wirelessConfig = {
     33     country_code = "GB";
     34     inherit (secrets) wpa_passphrase;
     35     wmm_enabled = 1;
     36   };
     37 
     38 in
     39 rec {
     40   boot = {
     41     tftp = {
     42       freeSpaceBytes = 3 * 1024 * 1024;
     43       serverip = "10.0.0.1";
     44       ipaddr = "10.0.0.8";
     45     };
     46   };
     47 
     48   imports = [
     49     "${modulesPath}/profiles/gateway.nix"
     50   ];
     51   hostname = "rotuer";
     52 
     53   profile.gateway = {
     54     lan = {
     55       interfaces = with config.hardware.networkInterfaces; [
     56         # EDIT: these are the interfaces exposed by the gl.inet gl-ar750:
     57         # if your device has more or differently named lan interfaces,
     58         # specify them here
     59         wlan
     60         wlan5
     61         lan
     62       ];
     63       inherit (secrets.lan) prefix;
     64       address = {
     65         family = "inet";
     66         address = "${secrets.lan.prefix}.1";
     67         prefixLength = 24;
     68       };
     69       dhcp = {
     70         start = 10;
     71         end = 240;
     72         hosts =
     73           { } // lib.optionalAttrs (builtins.pathExists ./static-leases.nix) (import ./static-leases.nix);
     74         localDomain = "lan";
     75       };
     76     };
     77     wan = {
     78       # wan interface depends on your upstream - could be dhcp, static
     79       # ethernet, a pppoe, ppp over serial, a complicated bonded
     80       # failover ... who knows what else?
     81       interface = svc.pppoe.build {
     82         interface = config.hardware.networkInterfaces.wan;
     83         username = secrets.l2tp.name;
     84         password = secrets.l2tp.password;
     85         bandwidth = 70 * 1000 * 1000;
     86       };
     87       # once the wan has ipv4 connnectivity, should we run dhcp6
     88       # client to potentially get an address range ("prefix
     89       # delegation")
     90       dhcp6.enable = true;
     91     };
     92     firewall = {
     93       enable = true;
     94       rules = secrets.firewallRules;
     95     };
     96     wireless.networks = {
     97       # EDIT: if you have more or fewer wireless radios, here is where
     98       # you need to say so.  hostapd tuning is hardware-specific and
     99       # left as an exercise for the reader :-).
    100 
    101       "${secrets.ssid}" = {
    102         interface = config.hardware.networkInterfaces.wlan;
    103         hw_mode = "g";
    104         channel = "2";
    105         ieee80211n = 1;
    106       }
    107       // wirelessConfig;
    108       "${secrets.ssid}5" = rec {
    109         interface = config.hardware.networkInterfaces.wlan5;
    110         hw_mode = "a";
    111         channel = 36;
    112         ht_capab = "[HT40+]";
    113         vht_oper_chwidth = 1;
    114         vht_oper_centr_freq_seg0_idx = channel + 6;
    115         ieee80211n = 1;
    116         ieee80211ac = 1;
    117       }
    118       // wirelessConfig;
    119     };
    120   };
    121 
    122   services.ntp = svc.ntp.build {
    123     user = "root";
    124     pools = {
    125       "pool.ntp.org" = [ "iburst" ];
    126     };
    127     makestep = {
    128       threshold = 1.0;
    129       limit = 3;
    130     };
    131   };
    132 
    133   services.sshd = svc.ssh.build { };
    134 
    135   users.root = secrets.root;
    136 
    137   defaultProfile.packages = with pkgs; [
    138     min-collect-garbage
    139     nftables
    140     strace
    141     tcpdump
    142     s6
    143   ];
    144 
    145   services.qemu-hyp-route =
    146     let
    147       interface = config.hardware.networkInterfaces.wan;
    148       addr = svc.network.address.build {
    149         inherit interface;
    150         family = "inet";
    151         address = "10.0.0.10";
    152         prefixLength = 24;
    153       };
    154     in
    155     svc.network.route.build {
    156       target = "10.0.0.1";
    157       inherit interface;
    158       via = "10.0.0.10";
    159       metric = 1;
    160       dependencies = [ addr ];
    161     };
    162 
    163   logging.shipping = {
    164     enable = true;
    165     command = ''
    166       ${pkgs.s6-networking}/bin/s6-tcpclient 10.0.0.1 9428 ${pkgs.logshippers}/bin/victorialogsend http://loaclhost:9428/insert/jsonline
    167     '';
    168     dependencies = [ services.qemu-hyp-route ];
    169   };
    170 
    171   programs.busybox = {
    172     applets = [
    173       "fdisk"
    174       "sfdisk"
    175     ];
    176     options = {
    177       FEATURE_FANCY_TAIL = "y";
    178     };
    179   };
    180 }