commit 8b2fcb5336ea8ef99582a7615a348b496d5c5f7e
parent 43f1fb230b9348781366c88c1945a8e2ab472f7d
Author: Daniel Barlow <dan@telent.net>
Date: Fri, 10 Mar 2023 14:38:13 +0000
move non-normative examples into a subdirectory
Diffstat:
3 files changed, 174 insertions(+), 174 deletions(-)
diff --git a/examples/extneder.nix b/examples/extneder.nix
@@ -0,0 +1,174 @@
+# This is not part of Liminix per se. This is a "scratchpad"
+# configuration for a device I'm testing with.
+#
+# Parts of it do do things that Liminix eventually needs to do, but
+# don't look in here for solutions - just for identifying the
+# problems.
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}: let
+ secrets = import ./extneder-secrets.nix;
+ inherit
+ (pkgs.liminix.networking)
+ address
+ udhcpc
+ hostapd
+ interface
+ route
+ ;
+ inherit (pkgs.liminix.services) oneshot longrun bundle target;
+ inherit (pkgs.pseudofile) dir symlink;
+ inherit (pkgs) dropbear ifwait serviceFns
+ ;
+in rec {
+ boot = {
+ tftp = {
+ enable = true;
+ serverip = "192.168.8.148";
+ ipaddr = "192.168.8.251";
+ };
+ };
+
+ imports = [
+ ./modules/wlan.nix
+ ./modules/tftpboot.nix
+ # ./modules/flashable.nix
+ ];
+
+ hostname = "extneder";
+
+ kernel = {
+ config = {
+
+ NETFILTER_XT_MATCH_CONNTRACK = "y";
+
+ IP6_NF_IPTABLES = "y"; # do we still need these
+ IP_NF_IPTABLES = "y"; # if using nftables directly
+
+ # these are copied from rotuer and need review
+ IP_NF_NAT = "y";
+ IP_NF_TARGET_MASQUERADE = "y";
+ NETFILTER = "y";
+ NETFILTER_ADVANCED = "y";
+ NETFILTER_XTABLES = "y";
+
+ NFT_COMPAT = "y";
+ NFT_CT = "y";
+ NFT_LOG = "y";
+ NFT_MASQ = "y";
+ NFT_NAT = "y";
+ NFT_REJECT = "y";
+ NFT_REJECT_INET = "y";
+
+ NF_CONNTRACK = "y";
+ NF_NAT = "y";
+ NF_NAT_MASQUERADE = "y";
+ NF_TABLES = "y";
+ NF_TABLES_INET = "y";
+ NF_TABLES_IPV4 = "y";
+ NF_TABLES_IPV6 = "y";
+ };
+ };
+
+ services.hostap = hostapd (config.hardware.networkInterfaces.wlan) {
+ params = {
+ country_code = "GB";
+ hw_mode = "g";
+ wmm_enabled = 1;
+ ieee80211n = 1;
+ inherit (secrets) ssid channel wpa_passphrase;
+ auth_algs = 1; # 1=wpa2, 2=wep, 3=both
+ wpa = 2; # 1=wpa, 2=wpa2, 3=both
+ wpa_key_mgmt = "WPA-PSK";
+ wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
+ rsn_pairwise = "CCMP"; # auth for wpa2
+ };
+ };
+
+ services.int = interface {
+ type = "bridge";
+ device = "int";
+ };
+
+ services.dhcpc = (udhcpc services.int {
+ dependencies = [ config.services.hostname ];
+ }) // { device = "int"; };
+
+ services.bridge = let
+ primary = services.int;
+ addif = dev:
+ oneshot {
+ name = "add-${dev.device}-to-bridge";
+ up = "${ifwait}/bin/ifwait -v ${dev.device} running && ip link set dev ${dev.device} master ${primary.device}";
+ down = "ip link set dev ${dev} nomaster";
+ dependencies = [primary dev];
+ };
+ in
+ bundle {
+ name = "bridge-members";
+ contents = with config.hardware.networkInterfaces;
+ map addif [
+ lan
+ wlan
+ ];
+ };
+
+ services.sshd = longrun {
+ name = "sshd";
+ run = ''
+ mkdir -p /run/dropbear
+ ${dropbear}/bin/dropbear -E -P /run/dropbear.pid -R -F
+ '';
+ };
+
+ services.resolvconf = oneshot rec {
+ dependencies = [ services.dhcpc ];
+ name = "resolvconf";
+ # CHECK: https://udhcp.busybox.net/README.udhcpc says
+ # 'A list of DNS server' but doesn't say what separates the
+ # list members. Assuming it's a space or other IFS character
+ up = ''
+ . ${serviceFns}
+ ( in_outputs ${name}
+ for i in $(output ${services.dhcpc} dns); do
+ echo "nameserver $i" > resolv.conf
+ done
+ )
+ '';
+ down = ''
+ rm -rf /run/service-state/${name}/
+ '';
+ };
+ filesystem = dir {
+ etc = dir {
+ "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
+ };
+ };
+
+ services.defaultroute4 = route {
+ name = "defaultroute";
+ via = "$(output ${services.dhcpc} router)";
+ target = "default";
+ dependencies = [services.dhcpc];
+ };
+
+ services.default = target {
+ name = "default";
+ contents =
+ let links = config.hardware.networkInterfaces;
+ in with config.services; [
+ links.lo links.eth links.wlan
+ int
+ bridge
+ hostap
+ defaultroute4
+ resolvconf
+ sshd
+ ];
+ };
+ users.root.passwd = lib.mkForce secrets.root_password;
+ defaultProfile.packages = with pkgs; [nftables strace tcpdump swconfig];
+}
diff --git a/rotuer.nix b/examples/rotuer.nix
diff --git a/extneder.nix b/extneder.nix
@@ -1,174 +0,0 @@
-# This is not part of Liminix per se. This is a "scratchpad"
-# configuration for a device I'm testing with.
-#
-# Parts of it do do things that Liminix eventually needs to do, but
-# don't look in here for solutions - just for identifying the
-# problems.
-{
- config,
- pkgs,
- lib,
- ...
-}: let
- secrets = import ./extneder-secrets.nix;
- inherit
- (pkgs.liminix.networking)
- address
- udhcpc
- hostapd
- interface
- route
- ;
- inherit (pkgs.liminix.services) oneshot longrun bundle target;
- inherit (pkgs.pseudofile) dir symlink;
- inherit (pkgs) dropbear ifwait serviceFns
- ;
-in rec {
- boot = {
- tftp = {
- enable = true;
- serverip = "192.168.8.148";
- ipaddr = "192.168.8.251";
- };
- };
-
- imports = [
- ./modules/wlan.nix
- ./modules/tftpboot.nix
- ./modules/flashable.nix
- ];
-
- hostname = "extneder";
-
- kernel = {
- config = {
-
- NETFILTER_XT_MATCH_CONNTRACK = "y";
-
- IP6_NF_IPTABLES = "y"; # do we still need these
- IP_NF_IPTABLES = "y"; # if using nftables directly
-
- # these are copied from rotuer and need review
- IP_NF_NAT = "y";
- IP_NF_TARGET_MASQUERADE = "y";
- NETFILTER = "y";
- NETFILTER_ADVANCED = "y";
- NETFILTER_XTABLES = "y";
-
- NFT_COMPAT = "y";
- NFT_CT = "y";
- NFT_LOG = "y";
- NFT_MASQ = "y";
- NFT_NAT = "y";
- NFT_REJECT = "y";
- NFT_REJECT_INET = "y";
-
- NF_CONNTRACK = "y";
- NF_NAT = "y";
- NF_NAT_MASQUERADE = "y";
- NF_TABLES = "y";
- NF_TABLES_INET = "y";
- NF_TABLES_IPV4 = "y";
- NF_TABLES_IPV6 = "y";
- };
- };
-
- services.hostap = hostapd (config.hardware.networkInterfaces.wlan) {
- params = {
- country_code = "GB";
- hw_mode = "g";
- wmm_enabled = 1;
- ieee80211n = 1;
- inherit (secrets) ssid channel wpa_passphrase;
- auth_algs = 1; # 1=wpa2, 2=wep, 3=both
- wpa = 2; # 1=wpa, 2=wpa2, 3=both
- wpa_key_mgmt = "WPA-PSK";
- wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
- rsn_pairwise = "CCMP"; # auth for wpa2
- };
- };
-
- services.int = interface {
- type = "bridge";
- device = "int";
- };
-
- services.dhcpc = (udhcpc services.int {
- dependencies = [ config.services.hostname ];
- }) // { device = "int"; };
-
- services.bridge = let
- primary = services.int;
- addif = dev:
- oneshot {
- name = "add-${dev.device}-to-bridge";
- up = "${ifwait}/bin/ifwait -v ${dev.device} running && ip link set dev ${dev.device} master ${primary.device}";
- down = "ip link set dev ${dev} nomaster";
- dependencies = [primary dev];
- };
- in
- bundle {
- name = "bridge-members";
- contents = with config.hardware.networkInterfaces;
- map addif [
- lan
- wlan
- ];
- };
-
- services.sshd = longrun {
- name = "sshd";
- run = ''
- mkdir -p /run/dropbear
- ${dropbear}/bin/dropbear -E -P /run/dropbear.pid -R -F
- '';
- };
-
- services.resolvconf = oneshot rec {
- dependencies = [ services.dhcpc ];
- name = "resolvconf";
- # CHECK: https://udhcp.busybox.net/README.udhcpc says
- # 'A list of DNS server' but doesn't say what separates the
- # list members. Assuming it's a space or other IFS character
- up = ''
- . ${serviceFns}
- ( in_outputs ${name}
- for i in $(output ${services.dhcpc} dns); do
- echo "nameserver $i" > resolv.conf
- done
- )
- '';
- down = ''
- rm -rf /run/service-state/${name}/
- '';
- };
- filesystem = dir {
- etc = dir {
- "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
- };
- };
-
- services.defaultroute4 = route {
- name = "defaultroute";
- via = "$(output ${services.dhcpc} router)";
- target = "default";
- dependencies = [services.dhcpc];
- };
-
- services.default = target {
- name = "default";
- contents =
- let links = config.hardware.networkInterfaces;
- in with config.services; [
- links.lo links.eth links.wlan
- int
- bridge
- hostap
- defaultroute4
- resolvconf
- sshd
- ];
- };
- users.root.passwd = lib.mkForce secrets.root_password;
- defaultProfile.packages = with pkgs; [nftables strace tcpdump swconfig];
-}
