Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense: PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl. username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp, Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk. Fleet baseline rides along: admins sops group is now derived for every machine in clan.nix (secrets encrypt to it from the first vars generate) and time sync is chrony everywhere instead of systemd-timesyncd.
2026-07-28 17:06:07 +07:00
parent a87b579eb7
commit 158252323f
20 changed files with 857 additions and 31 deletions
@@ -0,0 +1,78 @@
+# Single-disk ZFS layout for the Topton's 256GB mSATA SSD: vfat ESP for boot,
+# the rest a zpool (zstd compression, no atime). Single disk = no redundancy;
+# ZFS buys us compression, snapshots, and checksumming. Requires
+# networking.hostId (set in configuration.nix). The device is a placeholder:
+# boot the installer, read the real id from `ls -l /dev/disk/by-id/`, and fill
+# it in before `clan machines install`. Changing the layout later requires
+# wiping and reinstalling.
+{
+
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.efiInstallAsRemovable = true;
+  boot.loader.grub.enable = true;
+  disko.devices = {
+    disk = {
+      main = {
+        name = "main-gw-cnx-1";
+        device = "/dev/disk/by-id/CHANGE-ME-msata-ssd";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            "boot" = {
+              size = "1M";
+              type = "EF02"; # for grub MBR
+              priority = 1;
+            };
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "rpool";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      rpool = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          compression = "zstd";
+          acltype = "posixacl";
+          xattr = "sa";
+          atime = "off";
+          mountpoint = "none";
+        };
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          # Service state (Omada, Kea leases, CrowdSec db, journald) — its own
+          # dataset so it can be snapshotted/sent independently of the OS.
+          var = {
+            type = "zfs_fs";
+            mountpoint = "/var";
+          };
+        };
+      };
+    };
+  };
+}