Add router-on-a-stick, commit-confirm rollback and an example config

- Allow the WAN link to also carry LANs when the uplink is PPPoE on a VLAN with IPv6 off; only the PPP device counts as an uplink then, so LAN traffic can never match WAN rules. - Add router.rollback: router-arm / router-confirm / router-rollback plus `nix run .#deploy`, a commit-confirm deployment flow. - Wait for the LAN devices instead of the uplink in networkd wait-online, so an unplugged uplink cannot block boot or activation. - Add examples/desktop (single NIC, PPPoE on VLAN 1001) as nixosConfigurations.example, built as a flake check. Covered by the onestick and rollback VM tests and new assertion cases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-27 23:09:09 +01:00
parent 3f8f2f4199
commit 0653b5cf2f
14 changed files with 714 additions and 89 deletions
@@ -0,0 +1,60 @@
+# Commit-confirm: an unconfirmed activation is rolled back by the timer, a
+# confirmed one stays.
+{ self, pkgs }:
+let
+  common = import ./common.nix;
+in
+pkgs.testers.runNixOSTest {
+  name = "router-rollback";
+
+  defaults.imports = [ common.tools ];
+
+  nodes.router =
+    { lib, ... }:
+    {
+      imports = [ self.nixosModules.router ];
+      virtualisation.vlans = [
+        1
+        2
+      ];
+      networking.interfaces.eth1.ipv4.addresses = lib.mkForce [ ];
+      networking.interfaces.eth2.ipv4.addresses = lib.mkForce [ ];
+      router = {
+        enable = true;
+        wan.interface = "eth1";
+        lans.main = {
+          interface = "eth2";
+          internet = true;
+          ipv4.address = "192.168.10.1";
+          dhcp.pool = {
+            start = "192.168.10.100";
+            end = "192.168.10.199";
+          };
+        };
+      };
+      # Stands in for a freshly deployed configuration.
+      specialisation.deployed.configuration.environment.etc."deployed".text = "yes";
+    };
+
+  testScript = ''
+    router.wait_for_unit("multi-user.target")
+    router.wait_for_unit("nftables.service")
+    activate = "/run/current-system/specialisation/deployed/bin/switch-to-configuration test"
+
+    with subtest("an unconfirmed deployment is rolled back"):
+        router.fail("test -e /etc/deployed")
+        router.succeed("router-arm 60s")
+        router.succeed(activate)
+        router.succeed("test -e /etc/deployed")
+        router.wait_until_fails("test -e /etc/deployed", timeout=180)
+        router.wait_for_unit("nftables.service")
+
+    with subtest("a confirmed deployment stays"):
+        router.succeed("router-arm 60s")
+        router.succeed(activate)
+        router.succeed("router-confirm")
+        router.fail("systemctl is-active router-rollback.timer")
+        router.sleep(75)
+        router.succeed("test -e /etc/deployed")
+  '';
+}