Berwn
158252323f
Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense: PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl. username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp, Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk. Fleet baseline rides along: admins sops group is now derived for every machine in clan.nix (secrets encrypt to it from the first vars generate) and time sync is chrony everywhere instead of systemd-timesyncd.
42 lines
1.3 KiB
Nix
42 lines
1.3 KiB
Nix
# Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
|
|
# Port roles below use the expected igc names — verify against facter.json
|
|
# after the first install and adjust if the box enumerates differently.
|
|
{ config, lib, ... }:
|
|
{
|
|
imports = [
|
|
../../modules/router
|
|
../../modules/monitoring/exporters.nix
|
|
];
|
|
|
|
# Until the install generates facter.json (which normally provides this).
|
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
|
|
# ZFS (disko.nix) needs a stable machine-unique hostId; derive it from the
|
|
# hostname so every gateway gets one for free when copied for a new site.
|
|
networking.hostId = builtins.substring 0 8 (
|
|
builtins.hashString "sha256" config.networking.hostName
|
|
);
|
|
|
|
cnx.router = {
|
|
enable = true;
|
|
site = "cnx";
|
|
siteId = 1;
|
|
wan.interface = "enp1s0";
|
|
wan.vlanId = 10; # AIS delivers PPPoE tagged on VLAN 10
|
|
trunkPorts = [
|
|
"enp2s0"
|
|
"enp3s0"
|
|
"enp4s0"
|
|
];
|
|
vlans = {
|
|
mgmt.id = 10; # 10.1.10.0/24 — APs, switches, Omada, admin
|
|
lan.id = 20; # 10.1.20.0/24 — trusted clients
|
|
};
|
|
# This site runs the Omada controller for its APs/switches.
|
|
omada.enable = true;
|
|
};
|
|
|
|
time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
|
|
services.chrony.enable = true;
|
|
}
|