newedge/liminix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,494 Commits 4 Branches 0 Tags
0ae5689a407563e150ab2159ee76becd35cb9090
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Barlow 0ae5689a40 support maps in firewallgen 2025-03-21 21:19:18 +00:00
Daniel Barlow 45047dc023 squahs falls back 2025-03-21 21:09:05 +00:00
Daniel Barlow 3673804b93 think 2025-03-21 21:08:17 +00:00
Daniel Barlow be03e9e8c8 service outputs falls back to properties (untested) 2025-03-18 18:38:04 +00:00
Daniel Barlow 4e51977ae0 provide properties attr to services 
properties are similar to outputs, but are different in that they are
fixed values (do not change) and are present even when the service is
down

if the attribute is present and an attrset, this will write the
equivalent recursive directory structure to $out/.properties/
 2025-03-12 23:35:56 +00:00
Daniel Barlow 2b0972ed73 svc.open accepts a /nix/store folder not an outputs folder 
this mostly makes things simpler
 2025-03-11 00:21:44 +00:00
Daniel Barlow f22237a3b3 doc: filter src attribute to not rebuild as much 2025-03-10 23:08:37 +00:00
Daniel Barlow 9dc0f25587 min-copy-clocure test: ensure sshd up before starting 
this test goes wrong intermittently in CI, see if this makes it more
reliable
 2025-03-09 21:37:13 +00:00
Daniel Barlow 9ab77a7d7e remove unused function 2025-03-09 20:44:35 +00:00
Daniel Barlow c6918fec00 firewall: use extraText for zone set contents 
* the lua necessary is quite wordy, but it's less of a hack than
post-processing the rules file with pseudo-sed to get rid of `elements
= { }` lines

* also switch from stop/starting the firewall service to using a
signal, so that we don't go briefly offline every time a new interface
appears
 2025-03-09 20:42:02 +00:00
Daniel Barlow d4e46dbe28 secrets/subscriber don't depend on the services we're watching 
this means a watched service can stop and start without killing
the subscriber, and that we can watch for services that don't
yet exist
 2025-03-09 20:35:40 +00:00
Daniel Barlow d1f87a56e0 secrets/subscriber: use correct numbers for signals to s6-svc 2025-03-09 20:34:29 +00:00
Daniel Barlow 8c39b47cae output-template: allow splicing statements instead of expression 
if the text inside the delimiters begins with ; (a semicolon) then
the rest of it is expected to be one or more Lua statements. It needs
to say `return "foo"` to interpolate anything, as there is no
implicit return of the value of the last statement
 2025-03-05 22:38:48 +00:00
Daniel Barlow 2c7a16d792 firewallgen: add extraText param to set 
anything in here is added verbatim to the set definition
 2025-03-05 22:36:35 +00:00
Daniel Barlow d6b06abb63 delet second copy of output-template 2025-03-02 21:34:02 +00:00
Daniel Barlow 6b32aa569e think 2025-03-02 21:21:45 +00:00
Daniel Barlow 234d1bd87e basic unit tests for output-template 2025-03-02 21:14:46 +00:00
Daniel Barlow c38f180fb7 output-template expose table module 2025-03-02 21:14:16 +00:00
Daniel Barlow 9a8b22997c output-template: pass the tests 2025-03-02 21:09:32 +00:00
Daniel Barlow c32d09bd83 output-template: run the tests 2025-03-02 21:09:11 +00:00
Daniel Barlow 6649ebeccd firewall: use watch-outputs to track changes in zone->interface map 
includes a horrible hack to work around (claimed (by me)) deficiencies
in the nftables parser
 2025-02-28 00:43:20 +00:00
Daniel Barlow 929226ed9e delete commented code 2025-02-27 20:55:30 +00:00
Daniel Barlow a98f026210 think 2025-02-27 20:54:44 +00:00
Daniel Barlow f4dc001b71 check firewall zones in pppoe test 2025-02-25 23:32:05 +00:00
Daniel Barlow 024c018262 run the output-template test 2025-02-22 00:10:19 +00:00
Daniel Barlow e1293e3778 think 2025-02-21 23:22:39 +00:00
Daniel Barlow 0c406058e9 remove acceotance of udp sport 5 on wan 
this was added for replies to dns queries but isn't needed for
that purpose as connection tracking does that anyway
 2025-02-12 21:54:01 +00:00
Daniel Barlow 19d441333c remove duplicate rule 2025-02-10 23:50:07 +00:00
Daniel Barlow a726c09ae4 improve explanaton of reverse path filtering rule 
thanks RoS for the references :-)
 2025-02-10 23:48:29 +00:00
Daniel Barlow 7e2b0068e6 nixfmt-rfc-style 
There is nothing in this commit except for the changes made by
nix-shell -p nixfmt-rfc-style --run "nixfmt ."

If this has mucked up your open branches then sorry about that. You
can probably nixfmt them to match before merging
 2025-02-10 21:55:08 +00:00
dan 13cc5a8992 Merge pull request 'support firewall zones: don't hardcode interface names in rules' (#16) from firescape into main 
Reviewed-on: https://gti.telent.net/dan/liminix/pulls/16
 2025-02-10 21:23:15 +00:00
Daniel Barlow 3f889c7119 default firewall zones in gateway profile 2025-02-10 21:21:08 +00:00
Daniel Barlow 7f17125039 firewall: update zones with interface names as they appear 2025-02-10 21:21:08 +00:00
Daniel Barlow 4bb081ffcf export anoia.svc:fileno so it can be used with event loops 2025-02-10 21:21:08 +00:00
Daniel Barlow 6587813577 WIP add zones to firewall module 
- zones are an attrset of name -> [interface-service]

- the firewall will create empty "ifname" sets for each zone name
 in each address family (ip, ip6)

- then watch the interface services, and add the "ifname" outputs
to the corresponding sets when they appear

This commit only adds the empty sets
 2025-02-10 21:21:08 +00:00
Daniel Barlow 1d780de0f1 add (very basic) set support in firewallgen 
and add sets for lan/wan/dmz/guest interface names to default
firewall rules
 2025-02-10 21:17:43 +00:00
Daniel Barlow 8cf602da91 think 2025-02-10 21:17:43 +00:00
Daniel Barlow c92aacc6fd firewall rules: use @lan and @wan sets instead of ifnames 
we don't have anything yet to create or populate the sets
 2025-02-06 09:22:41 +00:00
Daniel Barlow eff255fe12 boot.expect: sleep more, for gl-ar750 
the bootloader on gl-ar750 loses characters if we shovel them too fast
 2025-02-05 20:35:04 +00:00
Daniel Barlow 453baede61 rt3200: add installer compatibility note 2025-02-05 20:35:04 +00:00
dan 2295ed3110 Merge pull request 'OpenWrt One device support' (#13) from raboof/liminix:openwrt-one into main 
Reviewed-on: https://gti.telent.net/dan/liminix/pulls/13
 2025-01-08 13:57:39 +00:00
Daniel Barlow f77da6f14c remove remaining refs to kexecboot 2025-01-05 17:22:30 +00:00
Daniel Barlow 61eaaa82eb drivel 2025-01-05 17:17:44 +00:00
Daniel Barlow 95dd1a1fab add missing code-block 2025-01-05 15:45:04 +00:00
Daniel Barlow 2f9b0f12f9 switch uid 2025-01-05 12:57:51 +00:00
Daniel Barlow 9fd9b8b878 rt3200 kconfig for 6.6.x 
* DMA stuff needed for wired ethernet

* DSA MDIO _probably_ (based on guessing from openwrt dmesg) needed
for wired ethernet

* some or all of NVMEM so that wireless drivers can read their eeprom
 2025-01-05 00:16:03 +00:00
Daniel BarlowandArnout Engelen 26f206d0e1 phram dtb reserved-memory needs no-map 
c.f. https://gti.telent.net/dan/liminix/commit/69429404abaf365ed649a2863830c1909f3626b2

Co-authored-by: Arnout Engelen <arnout@bzzt.net>
 2025-01-04 23:50:44 +00:00
Daniel Barlow 8cd068ea68 belkin rt3200: set tftp loadAddress to match u-boot 
the old value of 0x4007ff28 was originally copied from something
upstreamy but I have no record of what. 0x48000000 is $loadaddr
in u-boot so let's use that instead
 2025-01-04 23:48:19 +00:00
Daniel Barlow 350ddde260 add pkgs.openwrt_24_10 
is needed by Belkin RT3200 and might also be handy for OpenWrt One?

this is very copy-pastey, will tidy it up after it
stops being a moving target
 2025-01-03 23:52:08 +00:00
Daniel Barlow 13cb8d3692 sort imports 2025-01-03 15:41:22 +00:00
Daniel Barlow 62b7aea8ab add btrfs.nix to outputs imports 2025-01-03 15:40:33 +00:00
Daniel Barlow 76e3fd9a55 add rt3200 to CI 2025-01-03 15:39:08 +00:00
Daniel Barlow 92284fa9ba mtdimage can't be a default import 
it adds kernel config that depend on openwrt patches,
which aren't used/needed on all devices
 2025-01-03 00:19:17 +00:00
Daniel Barlow a2bb55e885 oops fix syntax error 2025-01-03 00:07:00 +00:00
Daniel Barlow 74027b44d7 extract log persistence config from s6 to new module 
because it frobs kernel config, it breaks levitate
as levitate evalModules doesn't include the kernel
 2025-01-02 23:56:49 +00:00
Daniel Barlow ea5370b3f4 import mtdimage in outputs 2025-01-02 23:37:07 +00:00
Daniel Barlow 55ed365920 turris omnia: default rootfs and bootloader settings 2025-01-02 23:36:15 +00:00
Daniel Barlow aa2160dd05 logtap: fix indentation 
spaces not tabs
 2025-01-02 22:45:00 +00:00
Daniel Barlow df414b796f drivel 2025-01-02 22:19:49 +00:00
Daniel Barlow 7377f7ceb2 implement mechanism for reverting from update.sh 2025-01-02 22:19:49 +00:00
dan 49432aeda5 Merge pull request 'Fix typo: Buildiing -> Building' (#15) from raboof/liminix:typo into main 
Reviewed-on: https://gti.telent.net/dan/liminix/pulls/15
Reviewed-by: dan <dan@telent.net>
 2025-01-02 14:46:36 +00:00
Daniel Barlow cc94ef57fa in rc.init copy log from previous boot to place of safety 2025-01-01 18:22:45 +00:00
Daniel Barlow fd28f0ce04 rt3200 needs pmsg-size set in its dts for persistent logging 2025-01-01 14:11:22 +00:00
Daniel Barlow 497307588f automate ubimage instructions a little 2025-01-01 12:38:08 +00:00
Daniel Barlow 788169586f /boot is a directory, copy files instead of replacing it with symlink 
for the record, u-boot doesn't like having /boot/fit -> ../nix/store/..../fit
symlinks so we don't use symlinks inside /boot either
 2025-01-01 12:29:25 +00:00
Daniel Barlow 3af9e86624 rt3200: replace bootcmd variable 
the default is to boot to recovery if there's anything in pstore, but
this doesn't interact well with persstent logging
 2025-01-01 11:56:54 +00:00
Daniel Barlow 28d39cd66d provide etc/kconfig in updater output 
this is for debugging/documentation purposes and isn't copied to the
device
 2025-01-01 11:55:33 +00:00
Daniel Barlow 9dd169d500 add "config" output to kernel derivation 2025-01-01 11:54:46 +00:00
Daniel Barlow 2e513eb4a7 example sni proxy using nginx 2024-12-29 23:34:15 +00:00
Daniel Barlow f2e4e77d73 firewall: don't use oifname in input rules 
because it's empty, these are input rules for the local machine
 2024-12-29 23:17:31 +00:00
Daniel Barlow 48dfbe0c01 add nginx-small : nginx with finegrained configure options 2024-12-29 20:47:03 +00:00
Daniel Barlow 6f697db57c remove PSTORE from rt3200 default kconfig 
we have config.logging.persistent.enable at home
 2024-12-29 13:33:55 +00:00
Daniel Barlow fe1ee12e3d swap strchr for strchrnul in dropbear authkeyfile patch 
The strchrnul version was giving weird crashes on aarch64
belkin-rt3200. I haven't figured out why but this one doesn't
 2024-12-29 13:30:21 +00:00
Daniel Barlow 4d273a9469 dropbear would like /etc/shells to exist 2024-12-29 13:27:49 +00:00
Daniel Barlow 40db175b41 complain if user attempting to tftpboot a ubifs 2024-12-29 13:26:45 +00:00
Daniel Barlow ab07212a7e include jffs2 module per default 
it has no effect unless enabled
 2024-12-29 13:26:06 +00:00
Daniel Barlow f5e08ac9d9 rt3200 default to loader.fit 2024-12-29 13:25:26 +00:00
Daniel Barlow 0cb18eabcd boot.expect: improve reliability 
don't depend on seeing u-boot prompt, it's just too easy to get
out of sync
 2024-12-27 18:08:01 +00:00
Daniel Barlow 24151425b8 and fix quoting 2024-12-24 14:29:01 +00:00
Daniel Barlow e06295ed83 rt3200: add fw_setenv commands to update boot_production 2024-12-24 14:19:29 +00:00
Daniel Barlow 608d3e3abf proofread 2024-12-24 14:01:30 +00:00
Daniel Barlow 3e19f1b927 Merge branch 'runciter' 2024-12-24 13:47:27 +00:00
Daniel Barlow 3f6e9b6384 rt3200 defaults to ubifs 2024-12-24 13:46:36 +00:00
Daniel Barlow 294492a176 jiggle imports 2024-12-24 13:46:19 +00:00
Daniel Barlow 67a1cd3718 improve install instructions for belkin rt3200 2024-12-24 13:45:11 +00:00
Daniel Barlow 0ee9c76c33 think 2024-12-24 12:30:15 +00:00
dan 452aaa2f60 Merge pull request 'use Linux kernel sources associated with openwrt by default' (#12) from raboof/liminix:linux-version-with-openwrt into main 
Reviewed-on: https://gti.telent.net/dan/liminix/pulls/12
 2024-12-24 12:24:31 +00:00
dan 52967f746b Merge branch 'main' into linux-version-with-openwrt 2024-12-24 12:24:13 +00:00
Daniel Barlow f3fadd5cd7 think 2024-12-24 12:20:48 +00:00
Daniel Barlow bc20f4c6b7 rt3200 test install 2024-12-23 23:59:52 +00:00
Daniel Barlow 848214d104 add ubivolume output 2024-12-23 22:37:07 +00:00
Daniel Barlow ede8f12d2b declare options.hardware.ubi unconditionally 
this is so it can be defined in device modules even when
ubifs is not included in the configuration
 2024-12-23 22:37:07 +00:00
Daniel Barlow 6cd5b90678 outputs.rootubifs -> ubifs 2024-12-23 22:37:07 +00:00
Daniel Barlow db4f098c02 add fit bootloader 
this is for the belkin rt3200, whose uboot doesn't do
extlinux but can load a fit from a ubifs. It adds the
a kernel+dtb as /boot/fit
 2024-12-23 11:21:58 +00:00
Daniel Barlow 1347937345 rename file 2024-12-23 10:31:22 +00:00
Daniel Barlow a7b5f80674 rename extlinux output to bootfiles 
this is in preparation for introducing other non-extlinux
modules that populate /boot
 2024-12-23 00:09:31 +00:00
Daniel Barlow 5c78338d71 make mtdutils use no-systemd util-linux 2024-12-22 23:24:11 +00:00
Daniel Barlow ed02d02767 bump NEWS 2024-12-22 21:12:36 +00:00
Daniel Barlow f07a38b0fd extract uimage output module into own file 2024-12-22 21:10:07 +00:00
Daniel Barlow ac189f2977 outputs.zimage -> outputs.kernel.zImage 
remove config option/derivation in favour of accessing
as output of the kernel derivation (matches what we do
with e.g. modulesupport)
 2024-12-22 17:27:59 +00:00