Berwn
158252323f
Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense: PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl. username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp, Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk. Fleet baseline rides along: admins sops group is now derived for every machine in clan.nix (secrets encrypt to it from the first vars generate) and time sync is chrony everywhere instead of systemd-timesyncd.
32 lines
941 B
Nix
32 lines
941 B
Nix
# IPv6 on the PPPoE uplink: run networkd's DHCPv6 client on ppp0 to obtain a
|
|
# delegated prefix; each vlan-* interface (default.nix) carves a /64 out of it
|
|
# via DHCPPrefixDelegation and announces it to clients with SLAAC.
|
|
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.cnx.router;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.network.networks."45-ppp0" = {
|
|
matchConfig.Name = "ppp0";
|
|
networkConfig = {
|
|
DHCP = "ipv6";
|
|
# pppd owns the v4 address/route on this link; don't let networkd
|
|
# tear them down.
|
|
KeepConfiguration = "static";
|
|
# Default v6 route comes from the ISP's RA when they send one.
|
|
IPv6AcceptRA = true;
|
|
};
|
|
# Many PPPoE ISPs never send an RA with the M flag; solicit regardless.
|
|
dhcpV6Config.WithoutRA = "solicit";
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
|
|
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
|
|
};
|
|
}
|