liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

bordervm-configuration.nix (3620B)

      1 { config, pkgs, lib, ... }:
      2 let
      3   cfg = config.bordervm;
      4   inherit (lib) mkOption mkEnableOption mdDoc types optional optionals;
      5 in {
      6   options.bordervm = {
      7     l2tp = {
      8       host = mkOption {
      9         description = mdDoc ''
     10           Hostname or IP address of an L2TP LNS that this VM
     11           will connect to when it receives a PPPoE connection request
     12         '';
     13         type = types.str;
     14         example = "l2tp.example.org";
     15       };
     16       port = mkOption {
     17         description = mdDoc ''
     18           Port number, if non-standard, of the LNS.
     19         '';
     20         type = types.int;
     21         default = 1701;
     22       };
     23     };
     24     ethernet = {
     25       pci = {
     26         enable = mkEnableOption "passthru PCI ethernet";
     27         id = mkOption {
     28           description = ''
     29             Host PCI ID (as shown by `lspci`) of the ethernet adaptor
     30             to be used by the VM. This uses VFIO and requires setup
     31             on the emulation host before it will work!
     32           '';
     33           type = types.str;
     34           example = "04:00.0";
     35         };
     36       };
     37       usb = {
     38         enable = mkEnableOption "passthru USB ethernet";
     39         vendor = mkOption {
     40           type = types.str;
     41           example = "0x0bda";
     42         };
     43         product = mkOption {
     44           type = types.str;
     45           example = "0x8153";
     46         };
     47       };
     48     };
     49   };
     50   imports = [
     51     <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix>
     52   ];
     53   config = {
     54     boot.kernelParams = [
     55       "loglevel=9"
     56     ];
     57     systemd.services.pppoe =
     58       let conf = pkgs.writeText "kpppoed.toml"
     59         ''
     60       interface_name = "eth1"
     61       services = [ "myservice" ]
     62       lns_ipaddr = "${cfg.l2tp.host}:${builtins.toString cfg.l2tp.port}"
     63       ac_name = "kpppoed-1.0"
     64     '';
     65       in  {
     66         wantedBy = [ "multi-user.target" ];
     67         after = [ "network-online.target" ];
     68         serviceConfig = {
     69           ExecStart = "${pkgs.go-l2tp}/bin/kpppoed -config ${conf}";
     70         };
     71       };
     72     systemd.services.tufted = {
     73       wantedBy = [ "multi-user.target" ];
     74       serviceConfig = {
     75         ExecStart = "${pkgs.tufted}/bin/tufted /home/liminix/liminix";
     76       };
     77     };
     78     services.openssh.enable = true;
     79     systemd.services.sshd.wantedBy = pkgs.lib.mkForce [ "multi-user.target" ];
     80 
     81     virtualisation = {
     82       qemu = {
     83         networkingOptions = [];
     84         options = [] ++
     85           optional cfg.ethernet.pci.enable
     86             "-device vfio-pci,host=${cfg.ethernet.pci.id}" ++
     87           optionals cfg.ethernet.usb.enable [
     88             "-device usb-ehci,id=ehci"
     89             "-device usb-host,bus=ehci.0,vendorid=${cfg.ethernet.usb.vendor},productid=${cfg.ethernet.usb.product}"
     90           ] ++ [
     91             "-nographic"
     92             "-serial mon:stdio"
     93           ];
     94       };
     95       sharedDirectories = {
     96         liminix = {
     97           source = builtins.toString ./.;
     98           target = "/home/liminix/liminix";
     99         };
    100       };
    101     };
    102     environment.systemPackages =
    103       let wireshark-nogui = pkgs.wireshark.override { withQt = false ; };
    104           in with pkgs; [
    105             tcpdump
    106             wireshark-nogui
    107             socat
    108             tufted
    109             iptables
    110             usbutils
    111           ];
    112     security.sudo.wheelNeedsPassword = false;
    113     networking = {
    114       hostName = "border";
    115       firewall = { enable = false; };
    116       interfaces.eth1 = {
    117         useDHCP = false;
    118         ipv4.addresses = [ { address = "10.0.0.1"; prefixLength = 24;}];
    119       };
    120     };
    121     users.users.liminix = {
    122       isNormalUser = true;
    123       uid = 1000;
    124       extraGroups = [ "wheel"];
    125     };
    126     services.getty.autologinUser = "liminix";
    127   };
    128 }