nixos-servers/nixos/modules/networking/default.nix

{ lib, config, ... }:
let cfg = config.lab.networking;
in {
  imports = [ ./dmz ];

  options.lab.networking = {
    allowDMZConnectivity = lib.mkOption {
      default = false;
      type = lib.types.bool;
      description = ''
        Whether to create a networking interface on the DMZ bridge.
      '';
    };

    staticDMZIpv4Address = lib.mkOption {
      default = "";
      type = lib.types.str;
      description = ''
        Assign a static IPv4 on the DMZ interface.
      '';
    };
  };

  config = {
    networking = {
      domain = "hyp";
      # TODO: Enabling the firewall makes connectivity of LAN -> DMZ impossible...
      firewall.enable = false;
      useDHCP = false;
    };

    systemd.network = {
      enable = true;

      netdevs = {
        "20-vlandmz" = {
          vlanConfig.Id = 30;

          netdevConfig = {
            Kind = "vlan";
            Name = "vlandmz";
          };
        };

        "20-bridgedmz" = {
          netdevConfig = {
            Kind = "bridge";
            Name = "bridgedmz";
            # TODO: This does not seem to work? Unsure what the problem is.
            # We don't necessary need this though: we simply use DNS as the host.
            # MACAddress = lib.mkIf cfg.allowDMZConnectivity "CA:FE:C0:FF:EE:0A";
            # MACAddress = "ca:fe:c0:ff:ee:0a";
          };
        };
      };

      networks = {
        "30-main-nic" = {
          matchConfig.Name = "en*";
          vlan = [ "vlandmz" ];

          networkConfig = {
            DHCP = "yes";
          };
        };

        "40-vlandmz" = {
          matchConfig.Name = "vlandmz";
          linkConfig.RequiredForOnline = "enslaved";

          networkConfig = {
            IPv6AcceptRA = false;
            LinkLocalAddressing = "no";
            Bridge = "bridgedmz";
          };
        };

        "40-bridgedmz" = {
          matchConfig.Name = "bridgedmz";
          linkConfig.RequiredForOnline = "carrier";

          networkConfig = {
            IPv6AcceptRA = false;
            LinkLocalAddressing = "no";
            DHCP = lib.mkIf cfg.allowDMZConnectivity "yes";
            Address = lib.mkIf (cfg.staticDMZIpv4Address != "") cfg.staticDMZIpv4Address;
          };
        };
      };
    };
  };
}