machines/stellio: a new whitehouse router that uses clanService/router from cnx-network

inventories/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./personal-computer.nix
     ./emmie.nix
+    ./router.nix
   ];
   clan = {
     inventory = {
@@ -16,7 +17,10 @@
           "deneb"
           "bosona"
         ];
-        w = [ "sirius" ];
+        w = [
+          "sirius"
+          "stellio"
+        ];
         b4l = [
           "rigel"
           "rana"
@@ -520,6 +524,7 @@
             almach.settings = {
               exporters.smartctl = { };
             };
+            stellio.settings.exporters.smartctl = { };
           };
         };
 

inventories/router.nix

@@ -0,0 +1,91 @@
+# Site gateways: the `router` clan service from cnx-network-clan (see
+# flake.nix input `cnx-network`, and that repo's modules/clan/router/README.md).
+# One instance for the fleet; each site adds its gateway machine with the
+# site's port / VLAN layout. `clan vars generate <gw>` then prompts for the
+# PPPoE username/password.
+{ lib, ... }:
+let
+  # Admin mesh = the site's ZeroTier network. The service only opens SSH,
+  # metrics and iperf3 to this prefix, so the gateway must also be a peer of
+  # the same network (tag membership in default.nix). Prefix derivation as in
+  # cnx-network's modules/mesh-hosts.nix: fd + 8-byte network id + 0x9993,
+  # /88 covers every peer.
+  meshSubnet =
+    instance:
+    let
+      networkId = lib.fileContents ../vars/shared/zerotier-network-${instance}/network-id/value;
+      full = "fd" + networkId + "9993";
+      hextet = i: builtins.substring (i * 4) 4 full;
+    in
+    "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
+in
+{
+  clan.inventory.instances.router = {
+    module = {
+      name = "router";
+      input = "cnx-network";
+    };
+
+    roles.default.settings.mesh.subnet = meshSubnet "w-network";
+
+    # stellio: GL.iNet Flint 2 (GL-MT6000, MT7986a). Ports as named by the
+    # device tree in matthew-hardware: eth1 = the 2.5G "WAN" port, lan1 = the
+    # 2.5G LAN port, lan2-lan5 = the 1G LAN ports (DSA on the MT7531 switch).
+    roles.default.machines.stellio.settings = {
+      site = "white-house";
+      siteId = 8;
+
+      # PPPoE on the ISP's VLAN 10, as on the liminix router it replaces
+      # (routers/white-house); set to null if the ISP runs PPPoE untagged.
+      wan.interface = "end1";
+      wan.vlanId = 10;
+
+      # lan1 (2.5G): untagged mgmt port for on-site recovery. lan2-lan4 (1G):
+      # untagged client ports on lan. lan5 is the pre-cutover staging uplink:
+      # DHCP client into the old LAN (routers/white-house), SSH only, no VLAN
+      # membership; set stagingPort = null at cutover.
+      accessPorts = {
+        lan1 = "mgmt";
+        lan2 = "lan";
+        lan3 = "lan";
+        lan4 = "lan";
+      };
+      stagingPort = "lan5";
+
+      # Both MT7976 radios serve lan as an untagged access port, one SSID per
+      # band named like the GL-AR750 it stands in for ("GL-AR750" on 2.4 GHz,
+      # "GL-AR750-5" on 5 GHz) so clients roam over unchanged. Passphrases
+      # are the `wifi-GL-AR750-passphrase` / `wifi-GL-AR750-5-passphrase`
+      # vars prompts. Channels as on the old router. Check the band mapping
+      # with `iw phy` (mt7986: phy0/wlan0 = 2.4 GHz, phy1/wlan1 = 5 GHz).
+      wifi = {
+        enable = true;
+        countryCode = "TH";
+        networks = {
+          "GL-AR750".vlan = "lan";
+          "GL-AR750-5".vlan = "lan";
+        };
+        radios = {
+          wlan0 = {
+            band = "2g";
+            channel = 2;
+            wifi6 = true;
+            networks = [ "GL-AR750" ];
+          };
+          wlan1 = {
+            band = "5g";
+            channel = 36;
+            wifi6 = true;
+            networks = [ "GL-AR750-5" ];
+          };
+        };
+      };
+
+      # 10.1.<id>.0/24, router .1, DHCP pool .100-.199.
+      vlans = {
+        mgmt.id = 10;
+        lan.id = 20;
+      };
+    };
+  };
+}