forked from dan/liminix
1
0
Fork 0
liminix/examples/extneder.nix

137 lines
3.4 KiB
Nix
Raw Normal View History

# This is not part of Liminix per se. This is a "scratchpad"
# configuration for a device I'm testing with.
#
# Parts of it do do things that Liminix eventually needs to do, but
# don't look in here for solutions - just for identifying the
# problems.
{
config,
pkgs,
lib,
...
}: let
2023-03-08 20:37:08 +00:00
secrets = import ./extneder-secrets.nix;
inherit (pkgs.liminix.services) oneshot longrun bundle target;
inherit (pkgs.pseudofile) dir symlink;
2023-08-28 15:08:46 +00:00
inherit (pkgs) dropbear ifwait serviceFns;
svc = config.system.service;
in rec {
boot = {
tftp = {
serverip = "192.168.8.148";
ipaddr = "192.168.8.251";
};
};
imports = [
2023-03-17 11:47:16 +00:00
../modules/wlan.nix
2023-08-31 17:29:45 +00:00
../modules/vlan
2023-08-28 15:08:46 +00:00
../modules/network
../modules/hostapd
../modules/bridge
2023-09-01 16:32:53 +00:00
../modules/ssh
];
2023-03-08 22:11:59 +00:00
hostname = "extneder";
kernel = {
config = {
NETFILTER_XT_MATCH_CONNTRACK = "y";
IP6_NF_IPTABLES = "y"; # do we still need these
IP_NF_IPTABLES = "y"; # if using nftables directly
# these are copied from rotuer and need review.
# we're not running a firewall, so why do we need
# nftables config?
IP_NF_NAT = "y";
IP_NF_TARGET_MASQUERADE = "y";
NETFILTER = "y";
NETFILTER_ADVANCED = "y";
NETFILTER_XTABLES = "y";
NFT_COMPAT = "y";
NFT_CT = "y";
NFT_LOG = "y";
NFT_MASQ = "y";
NFT_NAT = "y";
NFT_REJECT = "y";
NFT_REJECT_INET = "y";
NF_CONNTRACK = "y";
NF_NAT = "y";
NF_NAT_MASQUERADE = "y";
NF_TABLES = "y";
NF_TABLES_INET = "y";
NF_TABLES_IPV4 = "y";
NF_TABLES_IPV6 = "y";
};
};
2023-08-28 15:08:46 +00:00
services.hostap = svc.hostapd.build {
interface = config.hardware.networkInterfaces.wlan;
params = {
country_code = "GB";
hw_mode = "g";
wmm_enabled = 1;
ieee80211n = 1;
2023-03-08 20:37:08 +00:00
inherit (secrets) ssid channel wpa_passphrase;
auth_algs = 1; # 1=wpa2, 2=wep, 3=both
wpa = 2; # 1=wpa, 2=wpa2, 3=both
wpa_key_mgmt = "WPA-PSK";
wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
rsn_pairwise = "CCMP"; # auth for wpa2
};
};
2023-08-31 17:29:45 +00:00
services.int = svc.bridge.primary.build {
ifname = "int";
};
2023-03-08 22:11:59 +00:00
2023-08-28 15:08:46 +00:00
services.dhcpc = svc.network.dhcp.client.build {
interface = services.int;
2023-03-08 22:11:59 +00:00
dependencies = [ config.services.hostname ];
2023-08-28 15:08:46 +00:00
};
2023-08-28 15:08:46 +00:00
services.bridge = svc.bridge.members.build {
primary = services.int;
2023-08-28 15:08:46 +00:00
members = with config.hardware.networkInterfaces; [
lan
wlan
];
};
2023-09-01 16:32:53 +00:00
services.sshd = svc.ssh.build {};
services.resolvconf = oneshot rec {
dependencies = [ services.dhcpc ];
name = "resolvconf";
# CHECK: https://udhcp.busybox.net/README.udhcpc says
# 'A list of DNS server' but doesn't say what separates the
# list members. Assuming it's a space or other IFS character
up = ''
. ${serviceFns}
( in_outputs ${name}
2023-03-07 22:02:55 +00:00
for i in $(output ${services.dhcpc} dns); do
echo "nameserver $i" > resolv.conf
done
)
'';
};
filesystem = dir {
etc = dir {
"resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
};
};
services.defaultroute4 = svc.network.route.build {
via = "$(output ${services.dhcpc} router)";
target = "default";
dependencies = [services.dhcpc];
};
2023-03-08 20:37:08 +00:00
users.root.passwd = lib.mkForce secrets.root_password;
defaultProfile.packages = with pkgs; [nftables strace tcpdump swconfig];
}