nixos-servers/nixos/modules/networking/default.nix

165 lines
3.8 KiB
Nix
Raw Normal View History

{ lib, config, ... }:
let cfg = config.lab.networking;
in {
2024-01-07 22:06:27 +00:00
imports = [ ./dmz ];
options.lab.networking = {
allowDMZConnectivity = lib.mkOption {
default = false;
type = lib.types.bool;
description = ''
2024-01-14 14:20:32 +00:00
Whether to allow networking on the DMZ bridge interface.
'';
};
2024-01-14 14:20:32 +00:00
staticDMZIPv4Address = lib.mkOption {
default = "";
type = lib.types.str;
description = ''
2024-01-14 14:20:32 +00:00
Assign a static IPv4 address on the DMZ interface.
'';
};
staticDMZIPv6Address = lib.mkOption {
default = "";
type = lib.types.str;
description = ''
Assign a static IPv6 address on the DMZ interface.
'';
};
publicIPv4 = lib.mkOption {
type = lib.types.str;
description = ''
Public IPv4 address of our home.
'';
};
dockerSwarmInternalIPv4 = lib.mkOption {
type = lib.types.str;
description = ''
Internal IPv4 address of the Docker Swarm.
'';
};
2024-01-14 16:59:32 +00:00
dockerSwarmIPv6 = lib.mkOption {
type = lib.types.str;
description = ''
Globally routable IPv6 address of the Docker Swarm.
'';
};
dmzRouterIPv4 = lib.mkOption {
type = lib.types.str;
description = ''
The router's IPv4 address on the DMZ network.
'';
};
2024-01-14 14:20:32 +00:00
dmzServicesIPv4 = lib.mkOption {
type = lib.types.str;
description = ''
The IPv4 address of the interface serving DHCP and DNS on the DMZ network.
'';
};
dmzServicesIPv6 = lib.mkOption {
type = lib.types.str;
description = ''
2024-01-14 14:20:32 +00:00
The IPv6 address of the interface serving DHCP and DNS on the DMZ network.
'';
};
dmzBridgeName = lib.mkOption {
default = "bridgedmz";
type = lib.types.str;
description = ''
The name of the DMZ bridge.
'';
};
mainNicNamePattern = lib.mkOption {
default = "en*";
type = lib.types.str;
description = ''
Pattern to match the name of this machine's main NIC.
'';
};
2023-12-30 14:20:16 +00:00
};
config = {
networking = {
domain = "hyp";
firewall = {
enable = true;
checkReversePath = false;
};
nftables.enable = true;
useDHCP = false;
};
systemd.network = {
enable = true;
2023-12-30 14:20:16 +00:00
netdevs = {
"20-vlandmz" = {
vlanConfig.Id = 30;
2023-12-30 14:20:16 +00:00
netdevConfig = {
Kind = "vlan";
Name = "vlandmz";
};
2023-12-30 14:20:16 +00:00
};
"20-bridgedmz" = {
netdevConfig = {
Kind = "bridge";
Name = cfg.dmzBridgeName;
};
2023-12-30 14:20:16 +00:00
};
};
networks = {
"30-main-nic" = {
matchConfig.Name = cfg.mainNicNamePattern;
vlan = [ "vlandmz" ];
2023-12-30 14:20:16 +00:00
networkConfig = {
DHCP = "yes";
};
2023-12-30 14:20:16 +00:00
};
"40-vlandmz" = {
matchConfig.Name = "vlandmz";
linkConfig.RequiredForOnline = "enslaved";
2023-12-30 14:20:16 +00:00
networkConfig = {
IPv6AcceptRA = false;
LinkLocalAddressing = "no";
Bridge = cfg.dmzBridgeName;
};
2023-12-30 14:20:16 +00:00
};
"40-bridgedmz" = {
matchConfig.Name = cfg.dmzBridgeName;
linkConfig.RequiredForOnline = "carrier";
2023-12-30 14:20:16 +00:00
networkConfig = {
2024-01-13 16:33:14 +00:00
IPv6AcceptRA = cfg.allowDMZConnectivity;
LinkLocalAddressing = if cfg.allowDMZConnectivity then "ipv6" else "no";
2024-01-14 16:59:32 +00:00
DHCP = lib.mkIf (cfg.allowDMZConnectivity && cfg.staticDMZIPv4Address == "") "yes";
2024-01-14 14:20:32 +00:00
Address = lib.lists.optional (cfg.staticDMZIPv4Address != "") cfg.staticDMZIPv4Address
++ lib.lists.optional (cfg.staticDMZIPv6Address != "") cfg.staticDMZIPv6Address;
};
2023-12-30 14:20:16 +00:00
};
2024-01-17 20:28:15 +00:00
"40-vms" = {
matchConfig.Name = "vm-*";
networkConfig.Bridge = cfg.dmzBridgeName;
};
2023-12-30 14:20:16 +00:00
};
};
};
}