liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

extneder.nix (4184B)

      1 # This is not part of Liminix per se. This is a "scratchpad"
      2 # configuration for a device I'm testing with.
      3 #
      4 # Parts of it do do things that Liminix eventually needs to do, but
      5 # don't look in here for solutions - just for identifying the
      6 # problems.
      7 {
      8   config,
      9   pkgs,
     10   lib,
     11   ...
     12 }: let
     13   secrets = import ./extneder-secrets.nix;
     14   inherit
     15     (pkgs.liminix.networking)
     16     address
     17     udhcpc
     18     hostapd
     19     interface
     20     route
     21   ;
     22   inherit (pkgs.liminix.services) oneshot longrun bundle target;
     23   inherit (pkgs.pseudofile) dir symlink;
     24   inherit (pkgs) dropbear ifwait serviceFns
     25     ;
     26 in rec {
     27   boot = {
     28     tftp = {
     29       serverip = "192.168.8.148";
     30       ipaddr = "192.168.8.251";
     31     };
     32   };
     33 
     34   imports = [
     35     ../modules/wlan.nix
     36     ../modules/standard.nix
     37   ];
     38 
     39   hostname = "extneder";
     40 
     41   kernel = {
     42     config = {
     43 
     44       NETFILTER_XT_MATCH_CONNTRACK = "y";
     45 
     46       IP6_NF_IPTABLES = "y"; # do we still need these
     47       IP_NF_IPTABLES = "y"; # if using nftables directly
     48 
     49       # these are copied from rotuer and need review
     50       IP_NF_NAT = "y";
     51       IP_NF_TARGET_MASQUERADE = "y";
     52       NETFILTER = "y";
     53       NETFILTER_ADVANCED = "y";
     54       NETFILTER_XTABLES = "y";
     55 
     56       NFT_COMPAT = "y";
     57       NFT_CT = "y";
     58       NFT_LOG = "y";
     59       NFT_MASQ = "y";
     60       NFT_NAT = "y";
     61       NFT_REJECT = "y";
     62       NFT_REJECT_INET = "y";
     63 
     64       NF_CONNTRACK = "y";
     65       NF_NAT = "y";
     66       NF_NAT_MASQUERADE = "y";
     67       NF_TABLES = "y";
     68       NF_TABLES_INET = "y";
     69       NF_TABLES_IPV4 = "y";
     70       NF_TABLES_IPV6 = "y";
     71     };
     72   };
     73 
     74   services.hostap = hostapd (config.hardware.networkInterfaces.wlan) {
     75     params = {
     76       country_code = "GB";
     77       hw_mode = "g";
     78       wmm_enabled = 1;
     79       ieee80211n = 1;
     80       inherit (secrets) ssid channel wpa_passphrase;
     81       auth_algs = 1; # 1=wpa2, 2=wep, 3=both
     82       wpa = 2; # 1=wpa, 2=wpa2, 3=both
     83       wpa_key_mgmt = "WPA-PSK";
     84       wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
     85       rsn_pairwise = "CCMP"; # auth for wpa2
     86     };
     87   };
     88 
     89   services.int = interface {
     90     type = "bridge";
     91     device = "int";
     92   };
     93 
     94   services.dhcpc = (udhcpc services.int {
     95     dependencies = [ config.services.hostname ];
     96   }) // { device = "int"; };
     97 
     98   services.bridge = let
     99     primary = services.int;
    100     addif = dev:
    101       oneshot {
    102         name = "add-${dev.device}-to-bridge";
    103         up = "${ifwait}/bin/ifwait -v ${dev.device} running && ip link set dev ${dev.device} master ${primary.device}";
    104         down = "ip link set dev ${dev} nomaster";
    105         dependencies = [primary dev];
    106       };
    107   in
    108     bundle {
    109       name = "bridge-members";
    110       contents = with config.hardware.networkInterfaces;
    111         map addif [
    112           lan
    113           wlan
    114         ];
    115     };
    116 
    117   services.sshd = longrun {
    118     name = "sshd";
    119     run = ''
    120       mkdir -p /run/dropbear
    121       ${dropbear}/bin/dropbear -E -P /run/dropbear.pid -R -F
    122     '';
    123   };
    124 
    125   services.resolvconf = oneshot rec {
    126     dependencies = [ services.dhcpc ];
    127     name = "resolvconf";
    128     # CHECK: https://udhcp.busybox.net/README.udhcpc says
    129     # 'A list of DNS server' but doesn't say what separates the
    130     # list members. Assuming it's a space or other IFS character
    131     up = ''
    132       . ${serviceFns}
    133       ( in_outputs ${name}
    134       for i in $(output ${services.dhcpc} dns); do
    135         echo "nameserver $i" > resolv.conf
    136       done
    137       )
    138     '';
    139     down = ''
    140       rm -rf /run/service-state/${name}/
    141     '';
    142   };
    143   filesystem = dir {
    144     etc = dir {
    145       "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
    146     };
    147   };
    148 
    149   services.defaultroute4 = route {
    150     name = "defaultroute";
    151     via = "$(output ${services.dhcpc} router)";
    152     target = "default";
    153     dependencies = [services.dhcpc];
    154   };
    155 
    156   services.default = target {
    157     name = "default";
    158     contents =
    159       let links = config.hardware.networkInterfaces;
    160       in with config.services; [
    161         links.lo links.eth links.wlan
    162         int
    163         bridge
    164         hostap
    165         defaultroute4
    166         resolvconf
    167         sshd
    168       ];
    169   };
    170   users.root.passwd = lib.mkForce secrets.root_password;
    171   defaultProfile.packages = with pkgs; [nftables strace tcpdump swconfig];
    172 }