liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

turris.nix (2902B)

      1 { config, pkgs, lib, lim, ... } :
      2 let
      3   inherit (pkgs) serviceFns;
      4   svc = config.system.service;
      5 
      6 in rec {
      7   imports = [
      8     ../modules/network
      9     ../modules/ssh
     10     ../modules/vlan
     11     ../modules/wlan.nix
     12     ../modules/hostapd
     13     ../modules/bridge
     14 
     15     ../modules/ext4fs.nix
     16     ../modules/tftpboot.nix
     17   ];
     18 
     19   rootfsType = "ext4";
     20 
     21   boot.tftp = {
     22     # IP addresses to use in the boot monitor when flashing/ booting
     23     # over TFTP. If you are flashing using the stock firmware's Web UI
     24     # then these dummy values are fine
     25     ipaddr = "10.0.0.8"; # my address
     26     serverip = "10.0.0.1"; # build machine or other tftp server
     27     loadAddress = lim.parseInt "0x40000800";
     28   };
     29 
     30   hostname = "omnia";
     31 
     32   services.hostap =
     33     let secrets = {
     34           ssid = "not-the-internet";
     35           channel = 4;
     36           wpa_passphrase = "diamond dogs";
     37         };
     38     in svc.hostapd.build {
     39       interface = config.hardware.networkInterfaces.wlan;
     40       params = {
     41         country_code = "GB";
     42         hw_mode = "g";
     43         wmm_enabled = 1;
     44         ieee80211n = 1;
     45         inherit (secrets) ssid channel wpa_passphrase;
     46         auth_algs = 1; # 1=wpa2, 2=wep, 3=both
     47         wpa = 2; # 1=wpa, 2=wpa2, 3=both
     48         wpa_key_mgmt = "WPA-PSK";
     49         wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
     50         rsn_pairwise = "CCMP"; # auth for wpa2
     51       };
     52     };
     53 
     54   services.hostap5 =
     55     let secrets = {
     56           ssid = "not-the-internet";
     57           channel = 36;
     58           wpa_passphrase = "diamond dogs";
     59         };
     60     in svc.hostapd.build {
     61       interface = config.hardware.networkInterfaces.wlan5;
     62       params = {
     63         country_code = "GB";
     64         hw_mode = "a";
     65 
     66         ht_capab = "[HT40+]";
     67         vht_oper_chwidth = 1;
     68         vht_oper_centr_freq_seg0_idx = secrets.channel + 6;
     69         ieee80211ac = 1;
     70 
     71         wmm_enabled = 1;
     72         inherit (secrets) ssid channel wpa_passphrase;
     73         auth_algs = 1; # 1=wpa2, 2=wep, 3=both
     74         wpa = 2; # 1=wpa, 2=wpa2, 3=both
     75         wpa_key_mgmt = "WPA-PSK";
     76         wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
     77         rsn_pairwise = "CCMP"; # auth for wpa2
     78       };
     79     };
     80 
     81   services.int = svc.bridge.primary.build {
     82     ifname = "int";
     83   };
     84 
     85   services.dhcpc = svc.network.dhcp.client.build {
     86     interface = services.int;
     87     dependencies = [ config.services.hostname ];
     88   };
     89 
     90   services.bridge = svc.bridge.members.build {
     91     primary = services.int;
     92     members = with config.hardware.networkInterfaces; [
     93       lan
     94       wlan
     95     ];
     96   };
     97 
     98   services.sshd = svc.ssh.build { };
     99 
    100   users.root = {
    101     # the password is "secret". Use mkpasswd -m sha512crypt to
    102     # create this hashed password string
    103     passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
    104   };
    105 
    106   defaultProfile.packages = with pkgs; [
    107     figlet pciutils
    108   ];
    109 }