extneder.nix (3445B)
1 # This is not part of Liminix per se. This is a "scratchpad" 2 # configuration for a device I'm testing with. 3 # 4 # Parts of it do do things that Liminix eventually needs to do, but 5 # don't look in here for solutions - just for identifying the 6 # problems. 7 { 8 config, 9 pkgs, 10 lib, 11 ... 12 }: let 13 secrets = import ./extneder-secrets.nix; 14 inherit (pkgs.liminix.services) oneshot longrun bundle target; 15 inherit (pkgs.pseudofile) dir symlink; 16 inherit (pkgs) dropbear ifwait serviceFns; 17 svc = config.system.service; 18 in rec { 19 boot = { 20 tftp = { 21 serverip = "192.168.8.148"; 22 ipaddr = "192.168.8.251"; 23 }; 24 }; 25 26 imports = [ 27 ../modules/wlan.nix 28 ../modules/vlan 29 ../modules/network 30 ../modules/hostapd 31 ../modules/bridge 32 ../modules/ssh 33 ]; 34 35 hostname = "extneder"; 36 37 kernel = { 38 config = { 39 40 NETFILTER_XT_MATCH_CONNTRACK = "y"; 41 42 IP6_NF_IPTABLES = "y"; # do we still need these 43 IP_NF_IPTABLES = "y"; # if using nftables directly 44 45 # these are copied from rotuer and need review. 46 # we're not running a firewall, so why do we need 47 # nftables config? 48 IP_NF_NAT = "y"; 49 IP_NF_TARGET_MASQUERADE = "y"; 50 NETFILTER = "y"; 51 NETFILTER_ADVANCED = "y"; 52 NETFILTER_XTABLES = "y"; 53 54 NFT_COMPAT = "y"; 55 NFT_CT = "y"; 56 NFT_LOG = "y"; 57 NFT_MASQ = "y"; 58 NFT_NAT = "y"; 59 NFT_REJECT = "y"; 60 NFT_REJECT_INET = "y"; 61 62 NF_CONNTRACK = "y"; 63 NF_NAT = "y"; 64 NF_NAT_MASQUERADE = "y"; 65 NF_TABLES = "y"; 66 NF_TABLES_INET = "y"; 67 NF_TABLES_IPV4 = "y"; 68 NF_TABLES_IPV6 = "y"; 69 }; 70 }; 71 72 services.hostap = svc.hostapd.build { 73 interface = config.hardware.networkInterfaces.wlan; 74 params = { 75 country_code = "GB"; 76 hw_mode = "g"; 77 wmm_enabled = 1; 78 ieee80211n = 1; 79 inherit (secrets) ssid channel wpa_passphrase; 80 auth_algs = 1; # 1=wpa2, 2=wep, 3=both 81 wpa = 2; # 1=wpa, 2=wpa2, 3=both 82 wpa_key_mgmt = "WPA-PSK"; 83 wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?) 84 rsn_pairwise = "CCMP"; # auth for wpa2 85 }; 86 }; 87 88 services.int = svc.bridge.primary.build { 89 ifname = "int"; 90 }; 91 92 services.dhcpc = svc.network.dhcp.client.build { 93 interface = services.int; 94 dependencies = [ config.services.hostname ]; 95 }; 96 97 services.bridge = svc.bridge.members.build { 98 primary = services.int; 99 members = with config.hardware.networkInterfaces; [ 100 lan 101 wlan 102 ]; 103 }; 104 105 services.sshd = svc.ssh.build {}; 106 107 services.resolvconf = oneshot rec { 108 dependencies = [ services.dhcpc ]; 109 name = "resolvconf"; 110 # CHECK: https://udhcp.busybox.net/README.udhcpc says 111 # 'A list of DNS server' but doesn't say what separates the 112 # list members. Assuming it's a space or other IFS character 113 up = '' 114 . ${serviceFns} 115 ( in_outputs ${name} 116 for i in $(output ${services.dhcpc} dns); do 117 echo "nameserver $i" > resolv.conf 118 done 119 ) 120 ''; 121 }; 122 filesystem = dir { 123 etc = dir { 124 "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf"; 125 }; 126 }; 127 128 services.defaultroute4 = svc.network.route.build { 129 via = "$(output ${services.dhcpc} router)"; 130 target = "default"; 131 dependencies = [services.dhcpc]; 132 }; 133 134 users.root.passwd = lib.mkForce secrets.root_password; 135 defaultProfile.packages = with pkgs; [nftables strace tcpdump swconfig]; 136 }