37 lines
1.4 KiB
Nix
37 lines
1.4 KiB
Nix
# TP-Link Omada SDN controller for sites with Omada APs/switches. There is no
|
|
# nixpkgs package, so it runs as a podman container (mbentley/omada-controller,
|
|
# the de-facto standard image). Host networking because device adoption relies
|
|
# on L2 broadcast discovery (UDP 29810) on the mgmt VLAN; the default-deny
|
|
# input firewall keeps its ports unreachable from WAN and non-mgmt VLANs.
|
|
{ settings }:
|
|
{ config, lib, ... }:
|
|
let
|
|
cfg = settings;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.omada.enable {
|
|
virtualisation.podman.enable = true;
|
|
virtualisation.oci-containers = {
|
|
backend = "podman";
|
|
containers.omada = {
|
|
image = "docker.io/mbentley/omada-controller:5.15";
|
|
extraOptions = [ "--network=host" ];
|
|
environment.TZ = config.time.timeZone;
|
|
volumes = [
|
|
"/var/lib/omada/data:/opt/tplink/EAPController/data"
|
|
"/var/lib/omada/logs:/opt/tplink/EAPController/logs"
|
|
];
|
|
};
|
|
};
|
|
|
|
# Admin UI (8043) also reachable over the mesh, like Grafana on control.
|
|
networking.firewall.extraInputRules = ''
|
|
ip6 saddr ${cfg.mesh.subnet} tcp dport 8043 accept comment "omada ui over the mesh"
|
|
'';
|
|
|
|
# Controller state (adopted devices, site config, cert) — declared as clan
|
|
# state so a borgbackup client can pick it up; backup wiring is a later step.
|
|
clan.core.state.omada.folders = [ "/var/lib/omada" ];
|
|
};
|
|
}
|