depot/ops/nixos/swann/default.nix

830 lines
24 KiB
Nix
Raw Normal View History

2020-11-01 14:25:17 +00:00
# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ depot, lib, pkgs, config, ... }:
2020-11-01 14:25:17 +00:00
let
inherit (depot.ops) secrets;
2022-03-13 17:34:23 +00:00
inherit (lib) mkMerge mkForce;
2020-11-01 14:25:17 +00:00
in {
imports = [
# We include this just so it sets some sysctls and firewall settings.
../lib/bgp.nix
];
2022-03-13 17:34:23 +00:00
config = mkMerge [ {
boot.initrd.availableKernelModules = [
"sd_mod"
"ahci"
"usb_storage"
"usbhid"
];
boot.kernelParams = [ "mitigations=off" ];
2020-11-01 14:25:17 +00:00
2022-03-13 17:34:23 +00:00
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/fc964ef6-e3d0-4472-bc0e-f96f977ebf11";
fsType = "ext4";
};
"/boot" = {
device = "/dev/disk/by-uuid/AB36-5BE4";
fsType = "vfat";
};
2020-11-01 14:25:17 +00:00
};
2022-03-13 17:34:23 +00:00
nix.settings.max-jobs = lib.mkDefault 4;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Networking!
networking = {
# Routing tables:
# bgp (150) -- contains default routes over WG tunnels
# wg-ee (152) -- contains default routes over WG tunnels
# wg-gnet (153) -- contains default routes over WG tunnels
# ee (201) -- table contains a default route via EE
# vm (202) -- table contains a default route via VM
# gnet (203) -- table contains a default route via gnetwork
# main (254) -- basically empty
hostName = "swann"; # Define your hostname.
domain = "int.as205479.net";
nameservers = ["8.8.8.8" "8.8.4.4"];
useNetworkd = true;
interfaces = {
lo = {
ipv4.addresses = [
{ address = "127.0.0.1"; prefixLength = 8; }
{ address = "92.118.30.254"; prefixLength = 32; }
{ address = "92.118.30.253"; prefixLength = 32; }
];
};
en-gnet = {
useDHCP = true;
ipv4.addresses = [
{ address = "192.168.201.2"; prefixLength = 24; }
];
# Additional options configured in networkd.
};
en-ee = {
useDHCP = true;
ipv4.addresses = [
{ address = "192.168.200.2"; prefixLength = 24; }
];
# Additional options configured in networkd.
};
2022-03-30 16:42:37 +00:00
br-internal = {
2022-03-13 17:34:23 +00:00
ipv4.addresses = [
{ address = "192.168.1.1"; prefixLength = 23; }
{ address = "92.118.30.17"; prefixLength = 28; }
];
ipv6.addresses = [
{ address = "2a09:a443::1"; prefixLength = 64; }
{ address = "2a09:a443:1::1"; prefixLength = 48; }
];
};
vl-eduroam = {
ipv4.addresses = [
{ address = "192.168.10.1"; prefixLength = 24; }
];
ipv6.addresses = [
{ address = "2a09:a443:2::1"; prefixLength = 64; }
{ address = "2a09:a443:3::1"; prefixLength = 48; }
];
};
};
2020-11-01 14:25:17 +00:00
};
2022-03-13 17:34:23 +00:00
systemd.network = let
hexToInt = h: (builtins.fromTOML "h = ${h}").h;
physicalNetwork = rtID: wireguardFwmark: extraRules: {
dhcpV4Config.RouteTable = rtID;
ipv6AcceptRAConfig.RouteTable = rtID;
2022-03-13 17:34:23 +00:00
routingPolicyRules = [{
routingPolicyRuleConfig = {
Family = "both";
FirewallMark = hexToInt wireguardFwmark;
Priority = 10000;
Table = rtID;
};
}] ++ extraRules;
};
wireguardNetwork = { linkName, relativePriority, rtID, v4Linknet, v6Linknet }: {
matchConfig.Name = linkName;
routes = let
replaceV4Octet = v4: fn: let
pieces = builtins.match ''(([0-9]+\.){3})([0-9]+)'' v4;
in
"${builtins.elemAt pieces 0}${toString (fn (lib.toInt (builtins.elemAt pieces 2)))}";
replaceV6Octet = v6: fn: let
pieces = builtins.match ''^(([0-9a-f]+:+)+)([0-9a-f]*)$'' v6;
in
"${builtins.elemAt pieces 0}${lib.toHexString (fn (hexToInt "0x${builtins.elemAt pieces 2}"))}";
in [
{
routeConfig = {
Destination = "${v4Linknet}/31";
Table = rtID;
};
}
{
routeConfig = {
Gateway = replaceV4Octet v4Linknet (n: n + 1);
Table = rtID;
};
}
{
routeConfig = {
Destination = "${replaceV6Octet v6Linknet (n: n - 1)}/112";
Table = rtID;
};
}
{
routeConfig = {
Gateway = replaceV6Octet v6Linknet (n: n + 1);
Table = rtID;
};
}
];
networkConfig = {
Address = [
"${v4Linknet}/31"
"${v6Linknet}/112"
];
};
routingPolicyRules = [
(tailscaleRule (relativePriority + 5000) rtID)
# Allow picking destination by source IP.
{
routingPolicyRuleConfig = {
Family = "ipv4";
From = v4Linknet;
Priority = 10010;
Table = rtID;
};
}
{
routingPolicyRuleConfig = {
Family = "ipv6";
From = v6Linknet;
Priority = 10010;
Table = rtID;
};
}
{
# Catch-all mop-up rule at the end.
routingPolicyRuleConfig = {
Family = "both";
Priority = relativePriority + 10090;
Table = rtID;
};
}
];
};
2022-03-13 17:34:23 +00:00
tailscaleRule = priority: table: {
# Route Tailscale (fwmark 0x80000) via Wireguard first.
routingPolicyRuleConfig = {
Family = "both";
FirewallMark = hexToInt "0x80000";
Priority = priority;
Table = table;
};
2020-11-01 14:25:17 +00:00
};
2022-03-13 17:34:23 +00:00
in let
routeTables = {
bgp = 150;
wg-ee = 152;
wg-gnet = 153;
ee = 201;
gnet = 203;
2022-01-14 19:42:06 +00:00
};
2022-03-13 17:34:23 +00:00
in {
enable = true;
config.routeTables = routeTables;
networks."50-wg-tuvok-ee" = wireguardNetwork {
linkName = "wg-tuvok-ee";
relativePriority = 3;
rtID = routeTables.wg-ee;
v4Linknet = "92.118.30.2";
v6Linknet = "2a09:a442::2:1";
2020-11-01 14:25:17 +00:00
};
2022-03-13 17:34:23 +00:00
networks."50-wg-tuvok-gnet" = wireguardNetwork {
linkName = "wg-tuvok-gnet";
relativePriority = 1;
rtID = routeTables.wg-gnet;
v4Linknet = "92.118.30.4";
v6Linknet = "2a09:a442::3:1";
};
2022-03-13 17:34:23 +00:00
networks."40-lo" = {
routingPolicyRules = let
viaMain = priority: to: {
routingPolicyRuleConfig = {
To = to;
Table = "main";
Priority = priority;
};
};
blackhole = fwmark: {
routingPolicyRuleConfig = {
Family = "both";
FirewallMark = hexToInt fwmark;
Priority = 10001;
Type = "unreachable";
};
};
in [
(tailscaleRule 5000 150)
# Blackhole connections that should be routed over individual interfaces.
(blackhole "0xdead")
(blackhole "0xbeef")
(blackhole "0xcafe")
# RFC 1918 via main table.
(viaMain 10020 "192.168.0.0/16")
(viaMain 10021 "10.0.0.0/8")
(viaMain 10022 "172.16.0.0/12")
# and the linknets.
(viaMain 10023 "92.118.30.0/24")
(viaMain 10024 "2a09:a442::1:0/112")
(viaMain 10025 "2a09:a442::2:0/112")
(viaMain 10026 "2a09:a442::3:0/112")
{
# Catch-all "go via WG"
routingPolicyRuleConfig = {
Family = "both";
Priority = 10080;
Table = routeTables.bgp;
};
}
];
};
2022-03-13 17:34:23 +00:00
networks."40-en-ee" = (physicalNetwork routeTables.ee "0xdead" [{
routingPolicyRuleConfig = {
2022-03-13 17:34:23 +00:00
# add-on.ee.co.uk goes via EE.
To = "82.192.97.153/32";
Table = routeTables.ee;
Priority = 10031;
};
2022-03-13 17:34:23 +00:00
} {
routingPolicyRuleConfig = {
# as does anything from 192.168.200.0/24.
From = "192.168.200.0/24";
Table = routeTables.ee;
Priority = 10031;
};
}]) // {
linkConfig.RequiredForOnline = "no";
};
networks."40-en-gnet" = (physicalNetwork routeTables.gnet "0xcafe" []);
2022-03-30 16:42:37 +00:00
networks."40-br-internal" = {
networkConfig.VLAN = [ "vl-eduroam" ];
};
networks."40-en-int-eth" = {
matchConfig.Name = "en-int-eth";
networkConfig.Bridge = "br-internal";
};
networks."40-en-int-sfp" = {
matchConfig.Name = "en-int-sfp";
networkConfig.Bridge = "br-internal";
};
2022-03-13 17:34:23 +00:00
netdevs = let
wireguard = { name, listenPort, privateKey, endpoint, publicKey, fwmark }: {
netdevConfig = {
Name = name;
Kind = "wireguard";
Description = "WireGuard tunnel ${name}";
};
2022-03-13 17:34:23 +00:00
wireguardConfig = {
ListenPort = listenPort;
PrivateKeyFile = pkgs.writeText "${name}" privateKey;
# TODO: PrivateKeyFile
FirewallMark = hexToInt fwmark;
RouteTable = "off";
};
2022-03-13 17:34:23 +00:00
wireguardPeers = [{
wireguardPeerConfig = {
Endpoint = endpoint;
PublicKey = publicKey;
AllowedIPs = [
"0.0.0.0/0"
"::/0"
];
};
}];
};
tuvokWireguard = args: wireguard (args // {
privateKey = secrets.wireguard.tuvok-swann.swann.privateKey;
publicKey = secrets.wireguard.tuvok-swann.tuvok.publicKey;
});
in {
"40-wg-tuvok-ee" = tuvokWireguard {
name = "wg-tuvok-ee";
listenPort = 51821;
endpoint = "[2a09:a441::f00f]:51821";
fwmark = "0xdead";
};
"40-wg-tuvok-gnet" = tuvokWireguard {
name = "wg-tuvok-gnet";
listenPort = 51822;
endpoint = "92.118.28.252:51822";
fwmark = "0xcafe";
};
2022-03-30 16:42:37 +00:00
"20-br-internal" = {
netdevConfig = {
Name = "br-internal";
Kind = "bridge";
Description = "Bridge br-internal";
};
extraConfig = ''
[Bridge]
VLANFiltering=true
MulticastQuerier=true
MulticastSnooping=true
STP=true
VLANProtocol=802.1q
MulticastIGMPVersion=3
'';
};
"25-vl-eduroam" = {
netdevConfig = {
Name = "vl-eduroam";
Kind = "vlan";
Description = "Eduroam VLAN on br-internal";
};
vlanConfig = {
Id = 100;
};
};
2022-03-13 17:34:23 +00:00
};
};
2022-03-30 16:42:37 +00:00
services.mstpd.enable = true;
2022-03-13 17:34:23 +00:00
my.ip.tailscale = "100.102.224.95";
2022-09-01 23:22:16 +00:00
my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:6266:e05f";
2022-03-13 17:34:23 +00:00
services.udev.extraRules = ''
ATTR{address}=="e4:3a:6e:16:07:63", DRIVERS=="?*", NAME="en-ee"
ATTR{address}=="e4:3a:6e:16:07:64", DRIVERS=="?*", NAME="en-gnet"
2022-03-30 16:42:37 +00:00
ATTR{address}=="e4:3a:6e:16:07:67", DRIVERS=="?*", NAME="en-int-eth"
ATTR{address}=="e4:3a:6e:16:08:bc", DRIVERS=="?*", NAME="en-int-sfp"
2022-03-13 17:34:23 +00:00
'';
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = "1";
"net.ipv6.conf.default.forwarding" = "1";
"net.ipv6.conf.all.forwarding" = "1";
"net.ipv6.conf.en-ee.accept_ra" = "2";
"net.ipv6.conf.en-gnet.accept_ra" = "2";
};
networking.nat = {
enable = true;
2022-03-30 16:42:37 +00:00
internalInterfaces = ["br-internal"];
2022-04-15 22:42:05 +00:00
externalInterface = "en-gnet";
2022-03-13 17:34:23 +00:00
extraCommands = ''
# Send PS5 RTMP to totoro instead.
# See DHCP static lease.
iptables -w -t nat -A nixos-nat-pre --src 92.118.30.18 -p tcp --dport 1935 -j DNAT --to-destination 192.168.1.40
# NAT packets going over EE plain.
iptables -w -t nat -A nixos-nat-post -m mark --mark 1 -o en-ee -j MASQUERADE
# NAT packets going over GNetwork plain.
iptables -w -t nat -A nixos-nat-post -m mark --mark 1 -o en-gnet -j MASQUERADE
# SNAT packets we're sending over tunnels.
iptables -w -t nat -A nixos-nat-post -m mark --mark 1 -o wg-tuvok-ee -j SNAT --to-source 92.118.30.254
iptables -w -t nat -A nixos-nat-post -m mark --mark 1 -o wg-tuvok-gnet -j SNAT --to-source 92.118.30.254
# eduroam
# > mark incoming eduroam packets
iptables -w -t nat -A nixos-nat-pre -i vl-eduroam -j MARK --set-mark 2
# > NAT packets going out directly.
iptables -w -t nat -A nixos-nat-post -m mark --mark 2 -o en-ee -j MASQUERADE
iptables -w -t nat -A nixos-nat-post -m mark --mark 2 -o en-gnet -j MASQUERADE
# > NAT packets going over tunnels.
iptables -w -t nat -A nixos-nat-post -m mark --mark 2 -o wg-tuvok-ee -j SNAT --to-source 92.118.30.253
iptables -w -t nat -A nixos-nat-post -m mark --mark 2 -o wg-tuvok-gnet -j SNAT --to-source 92.118.30.253
'';
};
services.dhcpd4 = {
enable = true;
2022-03-30 16:42:37 +00:00
interfaces = ["br-internal" "vl-eduroam"];
2022-03-13 17:34:23 +00:00
authoritative = true;
extraConfig = ''
shared-network int {
default-lease-time 3600;
max-lease-time 86400;
option interface-mtu 1420; # Wireguard
subnet 192.168.1.0 netmask 255.255.255.0 {
option subnet-mask 255.255.255.0;
option routers 192.168.1.1;
option domain-name-servers 192.168.1.1;
option domain-name "house.as205479.net";
range 192.168.1.100 192.168.1.200;
}
subnet 92.118.30.16 netmask 255.255.255.240 {
option subnet-mask 255.255.255.240;
option routers 92.118.30.17;
option domain-name-servers 92.118.30.17;
option domain-name "house-ext.as205479.net";
}
}
2022-03-13 17:34:23 +00:00
subnet 192.168.10.0 netmask 255.255.255.0 {
option subnet-mask 255.255.255.0;
option routers 192.168.10.1;
option domain-name-servers 192.168.10.1;
option domain-name "eduroam.as205479.net";
default-lease-time 600;
max-lease-time 3600;
option interface-mtu 1420; # Wireguard
range 192.168.10.100 192.168.10.200;
}
'';
machines = [
{
2022-03-13 17:34:23 +00:00
hostName = "totoro";
ethernetAddress = "40:8d:5c:1f:e8:68";
ipAddress = "192.168.1.40";
}
{
2022-03-13 17:34:23 +00:00
hostName = "totoro-pfsense";
ethernetAddress = "52:54:00:cf:cd:94";
ipAddress = "192.168.1.41";
}
{
2022-03-13 17:34:23 +00:00
hostName = "kvm";
ethernetAddress = "00:0d:5d:1b:14:ba";
ipAddress = "192.168.1.50";
}
{
2022-03-13 17:34:23 +00:00
hostName = "printer-xerox";
ethernetAddress = "9c:93:4e:ad:1f:7b";
ipAddress = "192.168.1.51";
}
{
2022-03-13 17:34:23 +00:00
hostName = "ps5";
ethernetAddress = "bc:33:29:26:01:5c";
# This is used for DNAT on RTMP, above.
ipAddress = "92.118.30.18";
}
2023-07-11 11:01:00 +00:00
{
hostName = "qvmpc6552";
ethernetAddress = "84:39:be:77:65:52";
ipAddress = "192.168.1.60";
}
];
};
2022-03-13 17:34:23 +00:00
systemd.services.dhcpd4 = {
wants = [ "systemd-networkd-wait-online.service" ];
after = [ "systemd-networkd-wait-online.service" ];
};
2022-03-13 17:34:23 +00:00
networking.firewall = {
2022-03-30 16:42:37 +00:00
interfaces.br-internal = {
2022-03-13 17:34:23 +00:00
allowedTCPPorts = [
8080 6789 # Unifi
53 # DNS
];
allowedUDPPorts = [
3478 10001 # Unifi
53 # DNS
];
};
2022-03-13 17:34:23 +00:00
interfaces.vl-eduroam = {
allowedTCPPorts = [
53 # DNS
];
allowedUDPPorts = [
53 # DNS
];
};
2022-03-13 17:34:23 +00:00
interfaces.en-ee = {
allowedUDPPorts = [
51821
];
};
interfaces.en-gnet = {
allowedUDPPorts = [
51822
];
};
interfaces.wg-tuvok-ee = {
allowedUDPPorts = [
3784 # BFD
];
};
2022-03-13 17:34:23 +00:00
interfaces.wg-tuvok-gnet = {
allowedUDPPorts = [
3784 # BFD
];
};
2022-03-13 17:34:23 +00:00
extraCommands = ''
ip46tables -F FORWARD
ip46tables -N ts-forward || true
ip46tables -A FORWARD -j ts-forward
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1360
ip6tables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1360
ip46tables -A FORWARD -i vl-eduroam -o wg-tuvok-ee -j ACCEPT
ip46tables -A FORWARD -i vl-eduroam -o wg-tuvok-gnet -j ACCEPT
ip46tables -A FORWARD -i vl-eduroam -m state --state NEW,RELATED -j REJECT
'';
};
2021-09-30 16:07:12 +00:00
2022-03-13 17:34:23 +00:00
environment.systemPackages = with pkgs; [
ethtool
2022-03-30 16:42:37 +00:00
(writeShellApplication {
name = "bridge-stp";
runtimeInputs = [ mstpd ];
text = ''
BRIDGES=("br-internal")
for BRIDGE in "''${BRIDGES[@]}"; do
if [[ "$BRIDGE" = "$1" ]]; then
if [[ "$2" = "start" ]]; then
mstpctl addbridge "$BRIDGE"
exit 0
elif [[ "$2" = "stop" ]]; then
mstpctl delbridge "$BRIDGE"
exit 0
fi
exit 1
fi
done
exit 1
'';
})
2022-03-13 17:34:23 +00:00
];
2021-09-30 16:07:12 +00:00
2022-03-13 17:34:23 +00:00
services.coredns = {
enable = true;
config = ''
.:53 {
bind 192.168.1.1 92.118.30.17 192.168.10.1 127.0.0.253 2a09:a443::1 2a09:a443:1::1 2a09:a443:2::1 2a09:a443:3::1
acl {
allow net 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 127.0.0.0/8 100.64.0.0/10 2a09:a443::/32 92.118.30.0/24
block
}
hosts /dev/null {
#216.239.38.120 stadia.google.com stadia.com
fallthrough
}
loadbalance
forward . tls://8.8.8.8 tls://8.8.4.4 {
tls_servername dns.google
}
cache {
success 4096
denial 1024
prefetch 512
}
prometheus :9153
errors
log
2021-09-30 16:07:12 +00:00
}
2022-03-13 17:34:23 +00:00
'';
};
2022-03-13 17:34:23 +00:00
systemd.services.coredns = {
wants = [ "systemd-networkd-wait-online.service" ];
after = [ "systemd-networkd-wait-online.service" ];
};
2022-03-13 17:34:23 +00:00
my.prometheus.additionalExporterPorts.coredns = 9153;
networking.resolvconf.extraConfig = ''
name_servers='127.0.0.253'
'';
2022-03-13 17:34:23 +00:00
services.prometheus.exporters.smokeping = {
enable = true;
hosts = [
"8.8.8.8" # Google Public DNS
"2001:4860:4860::8888"
"youtube.com" "ads.google.com" "google.com"
2022-03-13 17:34:23 +00:00
"1.1.1.1" # Cloudflare DNS
"2606:4700:4700::1111"
2022-03-13 17:34:23 +00:00
"twitter.com"
2020-11-04 21:53:14 +00:00
2022-03-13 17:34:23 +00:00
"store.steampowered.com"
"api.steampowered.com"
2020-11-01 14:25:17 +00:00
# "euw1.api.riotgames.com" # League of Legends EUW
2022-03-13 17:34:23 +00:00
"eu.battle.net"
"185.60.112.157" "185.60.112.158" # Diablo 3/HotS/Hearthstone
"185.60.114.159" # Overwatch
# BFOB TS
"2a01:a500:85:3::2"
"37.9.61.53"
# lukegb01.ring.nlnog.net
"2a09:a441::13"
"92.118.28.13"
];
};
services.bird2 = {
enable = true;
config = ''
router id 92.118.30.254;
protocol kernel {
kernel table 150;
metric 0;
ipv4 {
import none;
export all;
};
};
2022-03-13 17:34:23 +00:00
protocol kernel {
kernel table 150;
metric 0;
ipv6 {
import none;
export all;
};
};
2022-03-13 17:34:23 +00:00
protocol device {};
protocol static export4 {
ipv4 {};
route 0.0.0.0/0 via 92.118.30.1 bfd {
# Virgin Media
preference = 100;
};
route 0.0.0.0/0 via 92.118.30.3 bfd {
# EE
preference = 10;
};
route 0.0.0.0/0 via 92.118.30.5 bfd {
# GNetwork
preference = 200;
};
};
2022-03-13 17:34:23 +00:00
protocol static export6 {
ipv6 {};
route ::/0 via 2a09:a442::1:2 bfd {
# Virgin Media
preference = 100;
krt_prefsrc = 2a09:a443::1;
};
route ::/0 via 2a09:a442::2:2 bfd {
# EE
preference = 10;
krt_prefsrc = 2a09:a443::1;
};
route ::/0 via 2a09:a442::3:2 bfd {
# GNetwork
preference = 200;
krt_prefsrc = 2a09:a443::1;
};
# Covering route...
2022-03-30 16:42:37 +00:00
route 2a09:a443::/64 via "br-internal";
route 2a09:a443:1::/48 via "br-internal";
2022-03-13 17:34:23 +00:00
route 2a09:a443:2::/64 via "vl-eduroam";
route 2a09:a443:3::/48 via "vl-eduroam";
route 2a09:a443::/32 unreachable;
};
2022-03-13 17:34:23 +00:00
protocol bfd {
interface "*" {
min rx interval 10ms;
min tx interval 50ms;
idle tx interval 1s;
multiplier 20;
};
neighbor 92.118.30.1;
neighbor 2a09:a442::1:2;
neighbor 92.118.30.3;
neighbor 2a09:a442::2:2;
neighbor 92.118.30.5;
neighbor 2a09:a442::3:2;
};
2022-03-13 17:34:23 +00:00
'';
};
2022-03-13 17:34:23 +00:00
services.radvd = {
enable = true;
config = ''
2022-03-30 16:42:37 +00:00
interface br-internal {
2022-03-13 17:34:23 +00:00
AdvSendAdvert on;
AdvLinkMTU 1420; # Wireguard
AdvManagedFlag on;
2022-03-13 17:34:23 +00:00
RDNSS 2a09:a443::1 {};
DNSSL house.as205479.net {};
prefix 2a09:a443::/64 {
AdvOnLink on;
AdvAutonomous on;
};
prefix 2a09:a443:1::/48 {
AdvOnLink on;
AdvAutonomous off;
};
2021-05-12 18:12:41 +00:00
};
2022-03-13 17:34:23 +00:00
interface vl-eduroam {
AdvSendAdvert on;
AdvLinkMTU 1420; # Wireguard
AdvManagedFlag on;
2022-03-13 17:34:23 +00:00
RDNSS 2a09:a443:2::1 {};
DNSSL eduroam.as205479.net {};
2022-03-13 17:34:23 +00:00
prefix 2a09:a443:2::/64 {
AdvOnLink on;
AdvAutonomous on;
};
prefix 2a09:a443:3::/48 {
AdvOnLink on;
AdvAutonomous off;
};
};
2022-03-13 17:34:23 +00:00
'';
};
services.dhcpd6 = {
enable = true;
2022-03-30 16:42:37 +00:00
interfaces = ["br-internal" "vl-eduroam"];
2022-03-13 17:34:23 +00:00
authoritative = true;
extraConfig = ''
subnet6 2a09:a443:1::/48 {
range6 2a09:a443:1:1::/64;
range6 2a09:a443:1:2::/64 temporary;
prefix6 2a09:a443:1:1000:: 2a09:a443:1:ff00:: /56;
option dhcp6.name-servers 2a09:a443:1::1;
option dhcp6.domain-search "house.as205479.net";
}
subnet6 2a09:a443:3::/48 {
range6 2a09:a443:3:1::/64;
range6 2a09:a443:3:2::/64 temporary;
prefix6 2a09:a443:3:1000:: 2a09:a443:3:ff00:: /56;
option dhcp6.name-servers 2a09:a443:3::1;
option dhcp6.domain-search "eduroam.as205479.net";
}
'';
};
systemd.services.dhcpd6 = {
wants = [ "systemd-networkd-wait-online.service" ];
after = [ "systemd-networkd-wait-online.service" ];
};
systemd.services.prometheus-bird-exporter.serviceConfig.ExecStart = lib.mkForce ''
${depot.pkgs.prometheus-bird-exporter-lfty}/bin/bird_exporter \
-web.listen-address 0.0.0.0:9324 \
-bird.socket /var/run/bird.ctl \
-bird.v2=true \
-format.new=true
'';
2022-03-13 17:34:23 +00:00
systemd.services.ee-scrape-data = let
scriptFile = ./ee-scrape-data.py;
python = pkgs.python3.withPackages (pm: with pm; [
requests
beautifulsoup4
html5lib
]);
in {
enable = true;
serviceConfig = {
Type = "oneshot";
ExecStart = "${python}/bin/python ${scriptFile} /run/prometheus-textfile-exports/ee-scrape-data.prom";
};
};
2022-03-13 17:34:23 +00:00
systemd.timers.ee-scrape-data = {
enable = true;
wantedBy = [ "multi-user.target" ];
timerConfig = {
OnBootSec = "2m";
OnUnitInactiveSec = "1m";
RandomizedDelaySec = "20";
};
};
2022-03-13 17:34:23 +00:00
system.stateVersion = "21.03";
} {
# Minimize writes to storage.
boot.tmp.useTmpfs = true;
2022-03-13 17:34:23 +00:00
services.journald.extraConfig = ''
Storage=volatile
'';
systemd.services.tailscaled.environment.TS_LOGS_DIR = "/var/run/tailscale";
} ];
2020-11-01 14:25:17 +00:00
}