liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

rotuer.nix (3428B)

      1 # This is an example that uses the "gateway" profile to create a
      2 # "typical home wireless router" configuration suitable for a Gl.inet
      3 # gl-ar750 router. It should be fairly simple to edit it for other
      4 # devices: mostly you will need to attend to the number of wlan and lan
      5 # interfaces
      6 
      7 {
      8   config,
      9   pkgs,
     10   lib,
     11   modulesPath,
     12   ...
     13 }:
     14 let
     15   secrets = {
     16     domainName = "fake.liminix.org";
     17     firewallRules = { };
     18   } // (import ./rotuer-secrets.nix);
     19   svc = config.system.service;
     20   wirelessConfig = {
     21     country_code = "GB";
     22     inherit (secrets) wpa_passphrase;
     23     wmm_enabled = 1;
     24   };
     25 
     26 in
     27 rec {
     28   boot = {
     29     tftp = {
     30       freeSpaceBytes = 3 * 1024 * 1024;
     31       serverip = "10.0.0.1";
     32       ipaddr = "10.0.0.8";
     33     };
     34   };
     35 
     36   imports = [
     37     "${modulesPath}/profiles/gateway.nix"
     38   ];
     39   hostname = "rotuer";
     40 
     41   profile.gateway = {
     42     lan = {
     43       interfaces = with config.hardware.networkInterfaces; [
     44         # EDIT: these are the interfaces exposed by the gl.inet gl-ar750:
     45         # if your device has more or differently named lan interfaces,
     46         # specify them here
     47         wlan
     48         wlan5
     49         lan
     50       ];
     51       inherit (secrets.lan) prefix;
     52       address = {
     53         family = "inet";
     54         address = "${secrets.lan.prefix}.1";
     55         prefixLength = 24;
     56       };
     57       dhcp = {
     58         start = 10;
     59         end = 240;
     60         hosts =
     61           { }
     62           // lib.optionalAttrs (builtins.pathExists ./static-leases.nix) (import ./static-leases.nix);
     63         localDomain = "lan";
     64       };
     65     };
     66     wan = {
     67       # wan interface depends on your upstream - could be dhcp, static
     68       # ethernet, a pppoe, ppp over serial, a complicated bonded
     69       # failover ... who knows what else?
     70       interface = svc.pppoe.build {
     71         interface = config.hardware.networkInterfaces.wan;
     72         username = secrets.l2tp.name;
     73         password = secrets.l2tp.password;
     74         bandwidth = 70 * 1000 * 1000;
     75       };
     76       # once the wan has ipv4 connnectivity, should we run dhcp6
     77       # client to potentially get an address range ("prefix
     78       # delegation")
     79       dhcp6.enable = true;
     80     };
     81     firewall = {
     82       enable = true;
     83       rules = secrets.firewallRules;
     84     };
     85     wireless.networks = {
     86       # EDIT: if you have more or fewer wireless radios, here is where
     87       # you need to say so.  hostapd tuning is hardware-specific and
     88       # left as an exercise for the reader :-).
     89 
     90       "${secrets.ssid}" = {
     91         interface = config.hardware.networkInterfaces.wlan;
     92         hw_mode = "g";
     93         channel = "2";
     94         ieee80211n = 1;
     95       } // wirelessConfig;
     96       "${secrets.ssid}5" = rec {
     97         interface = config.hardware.networkInterfaces.wlan5;
     98         hw_mode = "a";
     99         channel = 36;
    100         ht_capab = "[HT40+]";
    101         vht_oper_chwidth = 1;
    102         vht_oper_centr_freq_seg0_idx = channel + 6;
    103         ieee80211n = 1;
    104         ieee80211ac = 1;
    105       } // wirelessConfig;
    106     };
    107   };
    108 
    109   services.ntp = svc.ntp.build {
    110     pools = {
    111       "pool.ntp.org" = [ "iburst" ];
    112     };
    113     makestep = {
    114       threshold = 1.0;
    115       limit = 3;
    116     };
    117   };
    118 
    119   services.sshd = svc.ssh.build { };
    120 
    121   users.root = secrets.root;
    122 
    123   defaultProfile.packages = with pkgs; [
    124     min-collect-garbage
    125     nftables
    126     strace
    127     tcpdump
    128     s6
    129   ];
    130 
    131   programs.busybox = {
    132     applets = [
    133       "fdisk"
    134       "sfdisk"
    135     ];
    136     options = {
    137       FEATURE_FANCY_TAIL = "y";
    138     };
    139   };
    140 }