294 lines
10 KiB
Nix
294 lines
10 KiB
Nix
{ ... }:
|
|
{
|
|
_class = "clan.service";
|
|
manifest.name = "gw-router";
|
|
manifest.description = "A gateway router service to configure most of a router features";
|
|
manifest.readme = "A gateway router service to configure most of a router features";
|
|
manifest.categories = [ "System" ];
|
|
|
|
roles.default = {
|
|
description = "Site gateway router role";
|
|
|
|
interface =
|
|
{ lib, config, ... }:
|
|
let
|
|
vlanModule =
|
|
{ ... }:
|
|
{
|
|
options = {
|
|
id = lib.mkOption {
|
|
type = lib.types.ints.between 1 4094;
|
|
description = "802.1Q VLAN id.";
|
|
};
|
|
address = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "10.0.10.1";
|
|
description = "Router address on this VLAN.";
|
|
};
|
|
prefixLength = lib.mkOption {
|
|
type = lib.types.ints.between 8 30;
|
|
default = 24;
|
|
};
|
|
subnet = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "10.0.10.0/24";
|
|
description = "The VLAN's network in CIDR form (must contain `address`).";
|
|
};
|
|
dhcp = {
|
|
enable = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
};
|
|
pool = {
|
|
from = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "10.0.10.100";
|
|
};
|
|
to = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "10.0.10.199";
|
|
};
|
|
};
|
|
leaseTime = lib.mkOption {
|
|
type = lib.types.ints.positive;
|
|
default = 86400;
|
|
description = ''
|
|
Lease validity in seconds. Lower it for high-churn networks,
|
|
e.g. public-WiFi guest VLANs (3600-7200), so the pool recycles.
|
|
'';
|
|
};
|
|
fixedIPs = lib.mkOption {
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule {
|
|
options = {
|
|
hwAddress = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "aa:bb:cc:dd:ee:ff";
|
|
description = "Client MAC address.";
|
|
};
|
|
ipAddress = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Fixed address handed to this client (inside the VLAN's subnet, outside the pool).";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
default = { };
|
|
description = "Static DHCP leases; the attribute name becomes the client's hostname.";
|
|
};
|
|
};
|
|
allowWAN = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Whether clients on this VLAN may reach the internet.";
|
|
};
|
|
};
|
|
};
|
|
in
|
|
{
|
|
options = {
|
|
wan = {
|
|
interface = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Physical WAN port the PPPoE session runs on.";
|
|
};
|
|
|
|
vlanId = lib.mkOption {
|
|
type = lib.types.nullOr (lib.types.ints.between 1 4094);
|
|
default = null;
|
|
description = ''
|
|
802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
|
|
null for untagged PPPoE directly on the port. Unrelated to the LAN
|
|
VLANs — this tag exists only on the WAN port.
|
|
'';
|
|
};
|
|
|
|
macAddress = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
example = "aa:bb:cc:dd:ee:ff";
|
|
description = ''
|
|
Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
|
|
pinned (cloned from the old router). null keeps the hardware MAC.
|
|
'';
|
|
};
|
|
|
|
pppInterface = lib.mkOption {
|
|
type = lib.types.str;
|
|
internal = true;
|
|
readOnly = true;
|
|
default = if config.wan.vlanId == null then config.wan.interface else "wan-vlan";
|
|
description = "Interface pppd dials on (the WAN port or its ISP VLAN).";
|
|
};
|
|
};
|
|
|
|
vlans = lib.mkOption {
|
|
type = lib.types.attrsOf (lib.types.submodule vlanModule);
|
|
description = "VLANs setup for this router";
|
|
};
|
|
|
|
trunkPorts = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
description = "LAN ports carrying all VLANs tagged (incl. any 10G SFP+ ports).";
|
|
};
|
|
|
|
accessPorts = lib.mkOption {
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule {
|
|
options = {
|
|
vlanId = lib.mkOption {
|
|
type = lib.types.int;
|
|
description = "Untagged traffic in from the device gets tagged VLANs inside the bridge, and VLANs traffic going back out to the device gets untagged, so the device itself never has to know VLANs exist.";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
description = ''
|
|
Ports acting as untagged access ports on a single VLAN (port name ->
|
|
VLAN id). Frames are untagged on the wire; the bridge tags them with
|
|
the VLAN's PVID. Use for an always-available on-site mgmt port.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
perInstance =
|
|
{ settings, ... }:
|
|
{
|
|
nixosModule =
|
|
{
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
vlanIf = name: "vlan=${name}";
|
|
in
|
|
{
|
|
|
|
networking.useNetworkd = true;
|
|
networking.useDHCP = false;
|
|
systemd.network.enable = true;
|
|
|
|
systemd.network.netdevs = {
|
|
"20-br0" = {
|
|
netdevConfig = {
|
|
Name = "br0";
|
|
Kind = "bridge";
|
|
};
|
|
bridgeConfig = {
|
|
VLANFiltering = true;
|
|
};
|
|
};
|
|
}
|
|
// lib.optionalAttrs (settings.wan.vlanId != null) {
|
|
"15-wan-lan" = {
|
|
netdevConfig = {
|
|
Name = "wan-vlan";
|
|
Kind = "vlan";
|
|
};
|
|
vlanConfig.Id = settings.wan.vlanId;
|
|
};
|
|
}
|
|
// lib.mapAttrs' (
|
|
name: vlan:
|
|
lib.nameValuePair "30-${vlanIf name}" {
|
|
netdevConfig = {
|
|
Name = vlanIf name;
|
|
Kind = "vlan";
|
|
};
|
|
vlanConfig.Id = vlan.id;
|
|
}
|
|
) settings.vlans;
|
|
|
|
systemd.network.networks =
|
|
let
|
|
allVLANs = lib.mapAttrsToList (_: vlan: { VLAN = vlan.id; }) settings.vlans;
|
|
in
|
|
{
|
|
"10-wan" = {
|
|
matchConfig.Name = settings.wan.interface;
|
|
networkConfig.LinkLocalAddressing = "no";
|
|
vlan = lib.optional (settings.wan.vlanId != null) "wan-wlan";
|
|
linkConfig = {
|
|
RequiredForOnline = "carrier";
|
|
}
|
|
// lib.optionalAttrs (settings.wan.macAddress != null) {
|
|
MACAddress = settings.wan.macAddress;
|
|
};
|
|
};
|
|
}
|
|
// lib.optionalAttrs (settings.wan.vlanId != null) {
|
|
"15-wan-lan" = {
|
|
matchConfig.Name = "wan-vlan";
|
|
networkConfig.LinkLocalAddressing = "no";
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
}
|
|
// {
|
|
"20-br0" = {
|
|
matchConfig.Name = "br0";
|
|
networkConfig.LinkLocalAddressing = "no";
|
|
vlan = lib.mapAttrsToList (name: _: vlanIf name) settings.vlans;
|
|
bridgeVLANs = allVLANs;
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
}
|
|
// lib.listToAttrs (
|
|
map (port: {
|
|
name = "25-trunk-${port}";
|
|
value = {
|
|
matchConfig.Name = port;
|
|
networkConfig.Bridge = "br0";
|
|
bridgeVLANs = allVLANs;
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
}) settings.trunkPorts
|
|
)
|
|
// lib.mapAttrs' (
|
|
iface: port:
|
|
lib.nameValuePair "20-access-${iface}" {
|
|
matchConfig.Name = port;
|
|
networkConfig.Bridge = "br0";
|
|
bridgeVLANs = [
|
|
{
|
|
VLAN = port.vlanId;
|
|
PVID = port.vlanId;
|
|
EgressUntagged = port.vlanId;
|
|
}
|
|
];
|
|
linkConfig.RequiredForOnline = "no";
|
|
}
|
|
) settings.accessPorts
|
|
// lib.mapAttrs' (
|
|
name: vlan:
|
|
lib.nameValuePair "40-${vlanIf name}" {
|
|
matchConfig.Name = vlanIf name;
|
|
address = [ "${vlan.address}/${toString vlan.prefixLength}" ];
|
|
networkConfig = {
|
|
IPv6AcceptRA = false;
|
|
IPv6SendRA = true;
|
|
DHCPPrefixDelegation = true;
|
|
};
|
|
dhcpPrefixDelegationConfig.SubnetId = "auto";
|
|
linkConfig.RequiredForOnline = "no";
|
|
}
|
|
) settings.vlans;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
tcpdump
|
|
mtr
|
|
ethtool
|
|
conntrack-tools
|
|
knot-dns
|
|
iftop
|
|
librespeed-cli
|
|
];
|
|
|
|
};
|
|
};
|
|
};
|
|
|
|
imports = [ ./pppoe.nix ];
|
|
}
|