update overall module structure, remove host-specific config files
- update flake.nix to reflect new structure - update modules/default.nix imports - update modules/network.nix and wireguard.nix - remove config/configuration.nix and hardware-configuration.nix - remove modules/access.nix from this module's scope
This commit is contained in:
@@ -1,63 +1,188 @@
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
hostname = "tunnels";
|
||||
domain = "example.com";
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
resolvers = [ "9.9.9.9" "2620:fe::fe" ];
|
||||
with lib;
|
||||
|
||||
egress = {
|
||||
interface = "eth0";
|
||||
|
||||
ipv4.gateway = "198.51.100.10";
|
||||
ipv4.address = "198.51.100.1/24";
|
||||
|
||||
ipv6.gateway = "fe80::1";
|
||||
ipv6.address = "2001:DB8:10:cafe:dcaf::3210/64";
|
||||
};
|
||||
|
||||
tunnels = [{
|
||||
interface = "wg0";
|
||||
serverPort = 51820;
|
||||
serverAddress = "2001:db8:de:ff0::1/128";
|
||||
clientAddress = "2001:db8:de:ff0::2/128";
|
||||
clientSubnet = "2001:db8:de:f00::/60";
|
||||
serverPrivateKeyFile = "wg0-server-private";
|
||||
clientPublicKeyFile = "wg0-client-public";
|
||||
}];
|
||||
let cfg = config.sixnix;
|
||||
in {
|
||||
options.sixnix = {
|
||||
enable = mkEnableOption "sixnix networking configuration";
|
||||
|
||||
networking.hostName = hostname;
|
||||
networking.domain = domain;
|
||||
|
||||
# Enable systemd-networkd
|
||||
systemd.network.enable = true;
|
||||
networking.useNetworkd = true;
|
||||
|
||||
# Tools for monitoring/key generation
|
||||
environment.systemPackages = with pkgs; [ wireguard-tools tcpdump ];
|
||||
|
||||
# Configure Ethernet interface (eth0)
|
||||
systemd.network.networks."10-egress" = {
|
||||
matchConfig.Name = egress.interface;
|
||||
networkConfig = {
|
||||
DHCP = "no";
|
||||
IPv6AcceptRA = "no";
|
||||
IPv6PrivacyExtensions = "yes";
|
||||
IPv6Forwarding = "yes";
|
||||
hostname = mkOption {
|
||||
type = types.str;
|
||||
description = "Server hostname";
|
||||
};
|
||||
|
||||
address = [ egress.ipv4.address egress.ipv6.address ];
|
||||
gateway = [ egress.ipv4.gateway egress.ipv6.gateway ];
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
default = "notwork.in";
|
||||
description = "Domain name";
|
||||
};
|
||||
|
||||
dns = resolvers;
|
||||
interface = mkOption {
|
||||
type = types.str;
|
||||
default = "enp0s3";
|
||||
description = "Network interface name";
|
||||
};
|
||||
|
||||
dns = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "9.9.9.9" "2620:fe::fe" ];
|
||||
description = "DNS resolvers for systemd-networkd";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "IPv4 address with CIDR (documentation only - using DHCP)";
|
||||
};
|
||||
|
||||
gateway = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "IPv4 gateway (documentation only - using DHCP)";
|
||||
};
|
||||
};
|
||||
|
||||
ipv6 = {
|
||||
address = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "IPv6 address with CIDR (documentation only - using SLAAC)";
|
||||
};
|
||||
|
||||
gateway = mkOption {
|
||||
type = types.str;
|
||||
default = "fe80::1";
|
||||
description = "IPv6 gateway (documentation only - using SLAAC)";
|
||||
};
|
||||
};
|
||||
|
||||
bgp = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Enable BGP/FRR for shared IP failover";
|
||||
};
|
||||
|
||||
peers = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
example = [ "2001:db8::1" "2001:db8::2" "2001:db8::3" "2001:db8::4" ];
|
||||
description = "List of BGP peer addresses (e.g., Linode route servers)";
|
||||
};
|
||||
|
||||
advertisedSubnets = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
example = [ "2001:db8:1234::/56" ];
|
||||
description = "List of IPv6 subnets to advertise via BGP";
|
||||
};
|
||||
|
||||
routeMap = mkOption {
|
||||
type = types.enum [ "primary" "secondary" ];
|
||||
description = "BGP route map type (primary/secondary for HA)";
|
||||
};
|
||||
};
|
||||
|
||||
wireguard = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Enable WireGuard configuration";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot.kernel.sysctl = { "net.ipv6.conf.all.forwarding" = 1; };
|
||||
|
||||
imports = [ ./wireguard.nix ];
|
||||
|
||||
wireguard.interfaces = tunnels;
|
||||
config = mkIf cfg.enable {
|
||||
networking.hostName = cfg.hostname;
|
||||
networking.domain = cfg.domain;
|
||||
networking.nftables.enable = true;
|
||||
|
||||
networking.firewall = { allowedUDPPorts = map (x: x.serverPort) tunnels; };
|
||||
# Enable systemd-networkd
|
||||
systemd.network.enable = true;
|
||||
networking.useNetworkd = true;
|
||||
|
||||
}
|
||||
# Tools for monitoring/key generation
|
||||
environment.systemPackages = with pkgs; [ wireguard-tools tcpdump ];
|
||||
|
||||
# Configure network interface - pure SLAAC/DHCP
|
||||
systemd.network.networks."10-egress" = {
|
||||
matchConfig.Name = cfg.interface;
|
||||
networkConfig = {
|
||||
DHCP = "yes"; # Enable both IPv4 and IPv6 DHCP
|
||||
IPv6AcceptRA = "yes";
|
||||
IPv6PrivacyExtensions = "no";
|
||||
IPv6Forwarding = "yes";
|
||||
};
|
||||
|
||||
dns = cfg.dns;
|
||||
};
|
||||
|
||||
# Add blackhole routes for advertised subnets on loopback
|
||||
systemd.network.networks."10-loopback" = mkIf cfg.bgp.enable {
|
||||
matchConfig.Name = "lo";
|
||||
routes = map (subnet: {
|
||||
Destination = subnet;
|
||||
Type = "blackhole";
|
||||
}) cfg.bgp.advertisedSubnets;
|
||||
};
|
||||
|
||||
# Create dummy interface for shared WireGuard endpoint IP (HA setup)
|
||||
systemd.network.netdevs."20-shared-dummy" = mkIf cfg.bgp.enable {
|
||||
netdevConfig = {
|
||||
Kind = "dummy";
|
||||
Name = "shared0";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network.networks."20-shared-dummy" = mkIf cfg.bgp.enable {
|
||||
matchConfig.Name = "shared0";
|
||||
address = [ "2600:3c08:e002:6cff::1/128" ];
|
||||
};
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv6.conf.all.forwarding" = 1;
|
||||
"net.ipv6.conf.${cfg.interface}.accept_ra" = 2;
|
||||
# Accept prefix info
|
||||
"net.ipv6.conf.${cfg.interface}.accept_ra_pinfo" = 1;
|
||||
# Accept default router
|
||||
"net.ipv6.conf.${cfg.interface}.accept_ra_defrtr" = 1;
|
||||
};
|
||||
|
||||
# BGP configuration
|
||||
# Reference: https://techdocs.akamai.com/cloud-computing/docs/configuring-ip-failover-over-bgp-using-frr-advanced
|
||||
services.frr.bgpd.enable = cfg.bgp.enable;
|
||||
services.frr.config = mkIf cfg.bgp.enable (let
|
||||
peerConfig = concatMapStringsSep "\n" (peer: " neighbor ${peer} peer-group RS") cfg.bgp.peers;
|
||||
networkConfig = concatMapStringsSep "\n" (subnet: " network ${subnet} route-map ${cfg.bgp.routeMap}") cfg.bgp.advertisedSubnets;
|
||||
in ''
|
||||
hostname ${cfg.hostname}
|
||||
|
||||
router bgp 65001
|
||||
no bgp ebgp-requires-policy
|
||||
coalesce-time 1000
|
||||
bgp bestpath as-path multipath-relax
|
||||
neighbor RS peer-group
|
||||
neighbor RS remote-as external
|
||||
neighbor RS ebgp-multihop 10
|
||||
neighbor RS capability extended-nexthop
|
||||
${peerConfig}
|
||||
|
||||
address-family ipv6 unicast
|
||||
${networkConfig}
|
||||
redistribute static
|
||||
neighbor RS activate
|
||||
exit-address-family
|
||||
|
||||
route-map primary permit 10
|
||||
set community 65000:1
|
||||
route-map secondary permit 10
|
||||
set community 65000:2
|
||||
|
||||
ipv6 nht resolve-via-default
|
||||
'');
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user