services/router: init

modules/clan/router/iperf.nix

@@ -0,0 +1,22 @@
+# iperf3 server on every gateway, for throughput testing from any LAN segment
+# (e.g. validating AP/switch links: `iperf3 -c 10.<siteId>.<vlan>.1`) and from
+# admin machines over the mesh. Never reachable from the WAN (default-deny).
+{ settings }:
+{ lib, ... }:
+let
+  cfg = settings;
+  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
+in
+{
+  services.iperf3.enable = true;
+
+  networking.firewall.interfaces = lib.genAttrs vlanIfs (_: {
+    allowedTCPPorts = [ 5201 ];
+    allowedUDPPorts = [ 5201 ];
+  });
+
+  networking.firewall.extraInputRules = ''
+    ip6 saddr ${cfg.mesh.subnet} tcp dport 5201 accept comment "iperf3 over the mesh"
+    ip6 saddr ${cfg.mesh.subnet} udp dport 5201 accept comment "iperf3 over the mesh"
+  '';
+}