rotuer.nix (6323B)
1 # This is not part of Liminix per se. This is my "scratchpad" 2 # configuration for the device I'm testing with. 3 # 4 # Parts of it do do things that Liminix eventually needs to do, but 5 # don't look in here for solutions - just for identifying the 6 # problems. 7 8 9 { config, pkgs, lib, ... } : 10 let 11 secrets = import ./rotuer-secrets.nix; 12 inherit (pkgs.liminix.networking) 13 address 14 interface 15 route; 16 inherit (pkgs.liminix.services) oneshot longrun bundle target; 17 inherit (pkgs) 18 dropbear 19 ifwait 20 writeText 21 writeFennelScript 22 serviceFns; 23 svc = config.system.service; 24 wirelessConfig = { 25 country_code = "GB"; 26 inherit (secrets) wpa_passphrase; 27 auth_algs = 1; # 1=wpa2, 2=wep, 3=both 28 wpa = 2; # 1=wpa, 2=wpa2, 3=both 29 wpa_key_mgmt = "WPA-PSK"; 30 wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?) 31 rsn_pairwise = "CCMP"; # auth for wpa2 32 wmm_enabled = 1; 33 }; 34 35 in rec { 36 boot = { 37 tftp = { 38 freeSpaceBytes = 3 * 1024 * 1024; 39 serverip = "10.0.0.1"; 40 ipaddr = "10.0.0.8"; 41 }; 42 }; 43 44 imports = [ 45 ../modules/wlan.nix 46 ../modules/standard.nix 47 ../modules/ppp 48 ../modules/dnsmasq 49 ../modules/firewall 50 ../modules/hostapd 51 ../modules/bridge 52 ../modules/ntp 53 ]; 54 rootfsType = "jffs2"; 55 hostname = "rotuer"; 56 57 services.hostap = svc.hostapd.build { 58 interface = config.hardware.networkInterfaces.wlan_24; 59 params = { 60 ssid = "liminix"; 61 hw_mode="g"; 62 channel = "2"; 63 ieee80211n = 1; 64 } // wirelessConfig; 65 }; 66 67 services.hostap5 = svc.hostapd.build { 68 interface = config.hardware.networkInterfaces.wlan_5; 69 params = rec { 70 ssid = "liminix_5"; 71 hw_mode="a"; 72 channel = 36; 73 ht_capab = "[HT40+]"; 74 vht_oper_chwidth = 1; 75 vht_oper_centr_freq_seg0_idx = channel + 6; 76 ieee80211ac = 1; 77 } // wirelessConfig; 78 }; 79 80 services.int = 81 let iface = svc.bridge.primary.build { ifname = "int"; }; 82 in address iface { 83 family = "inet4"; address ="10.8.0.1"; prefixLength = 16; 84 }; 85 86 services.bridge = svc.bridge.members.build { 87 primary = services.int; 88 members = with config.hardware.networkInterfaces; [ 89 wlan_24 lan wlan_5 90 ]; 91 }; 92 93 services.ntp = svc.ntp.build { 94 pools = { "pool.ntp.org" = ["iburst"]; }; 95 makestep = { threshold = 1.0; limit = 3; }; 96 }; 97 98 services.sshd = longrun { 99 name = "sshd"; 100 # env -i clears the environment so we don't pass anything weird to 101 # ssh sessions. Dropbear params are 102 # -e pass environment to child 103 # -E log to stderr 104 # -R create hostkeys if needed 105 # -P pid-file 106 # -F don't fork into background 107 108 run = '' 109 if test -d /persist; then 110 mkdir -p /persist/secrets/dropbear 111 ln -s /persist/secrets/dropbear /run 112 fi 113 PATH=${lib.makeBinPath config.defaultProfile.packages}:/bin 114 exec env -i ENV=/etc/ashrc PATH=$PATH ${dropbear}/bin/dropbear -e -E -R -P /run/dropbear.pid -F 115 ''; 116 }; 117 118 users.root = secrets.root; 119 120 services.dns = 121 let interface = services.int; 122 in svc.dnsmasq.build { 123 resolvconf = services.resolvconf; 124 inherit interface; 125 ranges = [ 126 "10.8.0.10,10.8.0.240" 127 "::,constructor:${interface.device},ra-stateless" 128 ]; 129 domain = "fake.liminix.org"; 130 }; 131 132 services.wan = svc.pppoe { 133 interface = config.hardware.networkInterfaces.wan; 134 ppp-options = [ 135 "debug" "+ipv6" "noauth" 136 "name" secrets.l2tp.name 137 "password" secrets.l2tp.password 138 ]; 139 }; 140 141 services.resolvconf = oneshot rec { 142 dependencies = [ services.wan ]; 143 name = "resolvconf"; 144 up = '' 145 . ${serviceFns} 146 ( in_outputs ${name} 147 echo "nameserver $(output ${services.wan} ns1)" > resolv.conf 148 echo "nameserver $(output ${services.wan} ns2)" >> resolv.conf 149 ) 150 ''; 151 down = '' 152 rm -rf /run/service-state/${name}/ 153 ''; 154 }; 155 156 services.defaultroute4 = route { 157 name = "defaultroute4"; 158 via = "$(output ${services.wan} address)"; 159 target = "default"; 160 dependencies = [ services.wan ]; 161 }; 162 163 services.defaultroute6 = route { 164 name = "defaultroute6"; 165 via = "$(output ${services.wan} ipv6-peer-address)"; 166 target = "default"; 167 dev = "$(output ${services.wan} ifname)"; 168 dependencies = [ services.wan ]; 169 }; 170 171 services.firewall = svc.firewall.build { 172 ruleset = import ./rotuer-firewall.nix; 173 }; 174 175 services.packet_forwarding = 176 let 177 ip4 = "/proc/sys/net/ipv4/conf/all/forwarding"; 178 ip6 = "/proc/sys/net/ipv6/conf/all/forwarding"; 179 in oneshot { 180 name = "let-the-ip-flow"; 181 up = '' 182 echo 1 > ${ip4} 183 echo 1 > ${ip6} 184 ''; 185 down = '' 186 echo 0 > ${ip4}; 187 echo 0 > ${ip6}; 188 ''; 189 dependencies = [ services.firewall ]; 190 }; 191 192 services.dhcp6 = 193 let 194 name = "dhcp6c.wan"; 195 in longrun { 196 inherit name; 197 notification-fd = 10; 198 run = '' 199 export SERVICE_STATE=/run/service-state/${name} 200 ${pkgs.odhcp6c}/bin/odhcp6c -s ${pkgs.odhcp-script} -e -v -p /run/${name}.pid -P 48 $(output ${services.wan} ifname) 201 ) 202 ''; 203 dependencies = [ services.wan ]; 204 }; 205 206 services.acquire-lan-prefix = 207 let script = pkgs.callPackage ./acquire-delegated-prefix.nix { }; 208 in longrun { 209 name = "acquire-lan-prefix"; 210 run = "${script} /run/service-state/dhcp6c.wan ${services.int.device}"; 211 dependencies = [ services.dhcp6 ]; 212 }; 213 214 services.acquire-wan-address = 215 let script = pkgs.callPackage ./acquire-wan-address.nix { }; 216 in longrun { 217 name = "acquire-wan-address"; 218 run = "${script} /run/service-state/dhcp6c.wan $(output ${services.wan} ifname)"; 219 dependencies = [ services.dhcp6 ]; 220 }; 221 222 services.default = target { 223 name = "default"; 224 contents = with config.services; [ 225 config.hardware.networkInterfaces.lo 226 config.hardware.networkInterfaces.lan 227 int 228 bridge 229 hostap 230 hostap5 231 ntp 232 defaultroute4 233 defaultroute6 234 packet_forwarding 235 dns 236 resolvconf 237 sshd 238 config.services.hostname 239 dhcp6 240 acquire-lan-prefix 241 acquire-wan-address 242 ]; 243 }; 244 defaultProfile.packages = with pkgs; [ 245 min-collect-garbage 246 ]; 247 }