services/router: init

2026-09-17 08:57:32 +07:00
parent b85d6637f1
commit 60aac6efb2
39 changed files with 1831 additions and 929 deletions
@@ -0,0 +1,93 @@
+# Site gateways: the `router` service instance (modules/clan/router). One
+# instance for the fleet; each site adds its machine with the site's port /
+# VLAN layout under roles.default.machines.<gw>.settings. Everything else
+# (PPPoE, Kea/Blocky, nftables, IPv6-PD, CrowdSec, iperf3, speedtest) follows
+# from the service. Imported by clan.nix.
+{ config, lib, ... }:
+let
+  hosts = import ./modules/hosts.nix;
+  mesh = import ./modules/mesh-hosts.nix {
+    dir = config.directory;
+    inherit lib;
+  };
+in
+{
+  inventory.instances.router = {
+    module = {
+      name = "router";
+      input = "self";
+    };
+
+    # Fleet-wide settings: admin paths (SSH, scrapes, iperf3, Omada UI) are
+    # opened to the mesh; internal proxy names live under
+    # <site><n>.cnx.network with wildcard certs issued via DNS-01 against
+    # ns1 (which must declare the gateway's acme-secret.nix generator).
+    roles.default.settings = {
+      mesh.subnet = mesh.subnet;
+      proxy = {
+        domain = "cnx.network";
+        acme.nameserver = hosts.ns1.ipv4;
+        acme.email = "postmaster@cnx.email";
+      };
+    };
+
+    # Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G. Port roles
+    # use the expected igc names — verify against facter.json after the
+    # first install and adjust if the box enumerates differently.
+    roles.default.machines.gw-cnx-1.settings = {
+      site = "cnx";
+      siteId = 1;
+      wan.interface = "enp1s0";
+      wan.vlanId = null; # this ISP runs PPPoE untagged on the port
+      wan.macAddress = "a8:b8:e0:01:06:87";
+      trunkPorts = [ "enp2s0" ];
+      # STAGING (remove at cutover, move enp3s0 back into trunkPorts):
+      # DHCP-client uplink into the existing OPNsense LAN so the box has
+      # internet + mesh while it runs alongside the old router.
+      stagingPort = "enp3s0";
+      # Dedicated on-site recovery port: untagged mgmt, always available even
+      # if the switch config is broken.
+      accessPorts.enp4s0 = "mgmt";
+      # Replaces the newedge.house OPNsense box; renumbered to the fleet
+      # convention (10.1.<vlanId>.0/24, router .1, pool .100-.199). The old
+      # untagged LAN becomes tagged mgmt — infra switch ports get PVID 10.
+      vlans = {
+        mgmt = {
+          id = 10; # 10.1.10.0/24 — servers, APs, switches, Omada, admin
+          dhcp.reservations.storinator01 = {
+            hwAddress = "7c:c2:55:e0:d6:40";
+            ipAddress = "10.1.10.53";
+          };
+        };
+        lan.id = 20; # 10.1.20.0/24 — trusted clients
+        iot.id = 40; # 10.1.40.0/24
+        voip.id = 50; # 10.1.50.0/24
+        dmz.id = 60; # 10.1.60.0/24
+        unit1.id = 110; # 10.1.110.0/24
+        unit2.id = 120; # 10.1.120.0/24
+        unit3.id = 130; # 10.1.130.0/24
+        unit4.id = 140; # 10.1.140.0/24
+        unit5 = {
+          id = 150; # 10.1.150.0/24
+          dhcp.reservations.newt = {
+            hwAddress = "7c:d3:0a:21:58:0b";
+            ipAddress = "10.1.150.22";
+          };
+        };
+      };
+      # This site runs the Omada controller for its APs/switches.
+      omada.enable = true;
+
+      # Internal reverse proxy: real wildcard cert *.cnx1.cnx.network; Blocky
+      # resolves the names to the router's LAN address for mgmt+lan clients.
+      proxy = {
+        enable = true;
+        services.omada = {
+          # Omada's UI is HTTPS with a self-signed cert on the host network.
+          backend = "https://127.0.0.1:8043";
+          insecureSkipVerify = true;
+        };
+      };
+    };
+  };
+}