34 lines
1.4 KiB
Nix
34 lines
1.4 KiB
Nix
# Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
|
|
# The router itself (ports, VLANs, features) is the `router` service instance
|
|
# in clan.nix; only machine-local bits live here.
|
|
{ config, lib, ... }:
|
|
{
|
|
imports = [ ../../modules/monitoring/exporters.nix ];
|
|
|
|
clan.core.sops.defaultGroups = [ "admins" ];
|
|
|
|
# Until the install generates facter.json (which normally provides this).
|
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
|
|
# ZFS (disko.nix) needs a stable machine-unique hostId; derive it from the
|
|
# hostname so every gateway gets one for free when copied for a new site.
|
|
networking.hostId = builtins.substring 0 8 (
|
|
builtins.hashString "sha256" config.networking.hostName
|
|
);
|
|
|
|
# STAGING (remove at cutover, and restore enp3s0 to trunkPorts in clan.nix):
|
|
# DHCP-client uplink into the existing OPNsense LAN so the box has internet +
|
|
# mesh while it runs alongside the old router. Default-deny firewall on this
|
|
# interface (it's in no VLAN zone); PPPoE simply retries until the WAN port
|
|
# is cabled. Do NOT connect the trunk ports to the production switch while
|
|
# staging — Kea on tag 10 would fight the OPNsense LAN DHCP in one broadcast
|
|
# domain.
|
|
systemd.network.networks."05-staging" = {
|
|
matchConfig.Name = "enp3s0";
|
|
networkConfig.DHCP = "ipv4";
|
|
};
|
|
|
|
time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
|
|
services.chrony.enable = true;
|
|
}
|