liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

turris.nix (2883B)

      1 {
      2   config,
      3   pkgs,
      4   lim,
      5   ...
      6 }:
      7 let
      8   svc = config.system.service;
      9 
     10 in
     11 rec {
     12   imports = [
     13     ../modules/network
     14     ../modules/ssh
     15     ../modules/vlan
     16     ../modules/wlan.nix
     17     ../modules/hostapd
     18     ../modules/bridge
     19 
     20     ../modules/ext4fs.nix
     21     ../modules/tftpboot.nix
     22   ];
     23 
     24   rootfsType = "ext4";
     25 
     26   boot.tftp = {
     27     # IP addresses to use in the boot monitor when flashing/ booting
     28     # over TFTP. If you are flashing using the stock firmware's Web UI
     29     # then these dummy values are fine
     30     ipaddr = "10.0.0.8"; # my address
     31     serverip = "10.0.0.1"; # build machine or other tftp server
     32     loadAddress = lim.parseInt "0x40000800";
     33   };
     34 
     35   hostname = "omnia";
     36 
     37   services.hostap =
     38     let
     39       secrets = {
     40         ssid = "not-the-internet";
     41         channel = 4;
     42         wpa_passphrase = "diamond dogs";
     43       };
     44     in
     45     svc.hostapd.build {
     46       interface = config.hardware.networkInterfaces.wlan;
     47       params = {
     48         country_code = "GB";
     49         hw_mode = "g";
     50         wmm_enabled = 1;
     51         ieee80211n = 1;
     52         inherit (secrets) ssid channel wpa_passphrase;
     53         auth_algs = 1; # 1=wpa2, 2=wep, 3=both
     54         wpa = 2; # 1=wpa, 2=wpa2, 3=both
     55         wpa_key_mgmt = "WPA-PSK";
     56         wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
     57         rsn_pairwise = "CCMP"; # auth for wpa2
     58       };
     59     };
     60 
     61   services.hostap5 =
     62     let
     63       secrets = {
     64         ssid = "not-the-internet";
     65         channel = 36;
     66         wpa_passphrase = "diamond dogs";
     67       };
     68     in
     69     svc.hostapd.build {
     70       interface = config.hardware.networkInterfaces.wlan5;
     71       params = {
     72         country_code = "GB";
     73         hw_mode = "a";
     74 
     75         ht_capab = "[HT40+]";
     76         vht_oper_chwidth = 1;
     77         vht_oper_centr_freq_seg0_idx = secrets.channel + 6;
     78         ieee80211ac = 1;
     79 
     80         wmm_enabled = 1;
     81         inherit (secrets) ssid channel wpa_passphrase;
     82         auth_algs = 1; # 1=wpa2, 2=wep, 3=both
     83         wpa = 2; # 1=wpa, 2=wpa2, 3=both
     84         wpa_key_mgmt = "WPA-PSK";
     85         wpa_pairwise = "TKIP CCMP"; # auth for wpa (may not need this?)
     86         rsn_pairwise = "CCMP"; # auth for wpa2
     87       };
     88     };
     89 
     90   services.int = svc.bridge.primary.build {
     91     ifname = "int";
     92   };
     93 
     94   services.dhcpc = svc.network.dhcp.client.build {
     95     interface = services.int;
     96     dependencies = [ config.services.hostname ];
     97   };
     98 
     99   services.bridge = svc.bridge.members.build {
    100     primary = services.int;
    101     members = with config.hardware.networkInterfaces; [
    102       lan
    103       wlan
    104     ];
    105   };
    106 
    107   services.sshd = svc.ssh.build { };
    108 
    109   users.root = {
    110     # the password is "secret". Use mkpasswd -m sha512crypt to
    111     # create this hashed password string
    112     passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
    113   };
    114 
    115   defaultProfile.packages = with pkgs; [
    116     figlet
    117     pciutils
    118   ];
    119 }