kurogeek
570cc7c74a
Restores the mgmt subnet id the dropped mkForce used, via cnx-network's new per-VLAN option instead of overriding networkd config. Still skipped on AIS's bare /64; unlike the VLAN-id default (10) it also fits a /61-/63 delegation.
98 lines
3.5 KiB
Nix
98 lines
3.5 KiB
Nix
# Site gateways: the `router` clan service from cnx-network-clan (see
|
|
# flake.nix input `cnx-network`, and that repo's modules/clan/router/README.md).
|
|
# One instance for the fleet; each site adds its gateway machine with the
|
|
# site's port / VLAN layout. `clan vars generate <gw>` then prompts for the
|
|
# PPPoE username/password.
|
|
{ lib, ... }:
|
|
let
|
|
# Admin mesh = the site's ZeroTier network. The service only opens SSH,
|
|
# metrics and iperf3 to this prefix, so the gateway must also be a peer of
|
|
# the same network (tag membership in default.nix). Prefix derivation as in
|
|
# cnx-network's modules/mesh-hosts.nix: fd + 8-byte network id + 0x9993,
|
|
# /88 covers every peer.
|
|
meshSubnet =
|
|
instance:
|
|
let
|
|
networkId = lib.fileContents ../vars/shared/zerotier-network-${instance}/network-id/value;
|
|
full = "fd" + networkId + "9993";
|
|
hextet = i: builtins.substring (i * 4) 4 full;
|
|
in
|
|
"${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
|
|
in
|
|
{
|
|
clan.inventory.instances.router = {
|
|
module = {
|
|
name = "router";
|
|
input = "cnx-network";
|
|
};
|
|
|
|
roles.default.settings.mesh.subnet = meshSubnet "w-network";
|
|
|
|
# stellio: GL.iNet Flint 2 (GL-MT6000, MT7986a). Ports as named by the
|
|
# device tree in matthew-hardware: eth1 = the 2.5G "WAN" port, lan1 = the
|
|
# 2.5G LAN port, lan2-lan5 = the 1G LAN ports (DSA on the MT7531 switch).
|
|
roles.default.machines.stellio.settings = {
|
|
site = "white-house";
|
|
siteId = 8;
|
|
|
|
# PPPoE on the ISP's VLAN 10, as on the liminix router it replaces
|
|
# (routers/white-house); set to null if the ISP runs PPPoE untagged.
|
|
wan.interface = "end1";
|
|
wan.vlanId = 10;
|
|
|
|
# lan1 (2.5G): untagged mgmt port for on-site recovery. lan2-lan4 (1G):
|
|
# untagged client ports on lan. lan5 is the pre-cutover staging uplink:
|
|
# DHCP client into the old LAN (routers/white-house), SSH only, no VLAN
|
|
# membership; set stagingPort = null at cutover.
|
|
accessPorts = {
|
|
lan1 = "mgmt";
|
|
lan2 = "lan";
|
|
lan3 = "lan";
|
|
lan4 = "lan";
|
|
};
|
|
stagingPort = "lan5";
|
|
|
|
# Both MT7976 radios serve lan as an untagged access port, one SSID per
|
|
# band named like the GL-AR750 it stands in for ("GL-AR750" on 2.4 GHz,
|
|
# "GL-AR750-5" on 5 GHz) so clients roam over unchanged. Passphrases
|
|
# are the `wifi-GL-AR750-passphrase` / `wifi-GL-AR750-5-passphrase`
|
|
# vars prompts. Channels as on the old router. Check the band mapping
|
|
# with `iw phy` (mt7986: phy0/wlan0 = 2.4 GHz, phy1/wlan1 = 5 GHz).
|
|
wifi = {
|
|
enable = true;
|
|
countryCode = "TH";
|
|
networks = {
|
|
"GL-AR750".vlan = "lan";
|
|
"GL-AR750-5".vlan = "lan";
|
|
};
|
|
radios = {
|
|
wlan0 = {
|
|
band = "2g";
|
|
channel = 2;
|
|
wifi6 = true;
|
|
networks = [ "GL-AR750" ];
|
|
};
|
|
wlan1 = {
|
|
band = "5g";
|
|
channel = 36;
|
|
wifi6 = true;
|
|
networks = [ "GL-AR750-5" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
# 10.1.<id>.0/24, router .1, DHCP pool .100-.199.
|
|
# ipv6SubnetId: which /64 of the DHCPv6-PD prefix the VLAN announces.
|
|
# lan defaults to 0 (whole prefix on AIS's bare /64). mgmt would default
|
|
# to its VLAN id (10); keep it at 1 so it also fits a /61-/63 delegation.
|
|
vlans = {
|
|
mgmt = {
|
|
id = 10;
|
|
ipv6SubnetId = 1;
|
|
};
|
|
lan.id = 20;
|
|
};
|
|
};
|
|
};
|
|
}
|