- wireguard.<n>.sourceAddresses: source for router-originated traffic
into a tunnel without an address of its own (PreferredSource on the
routes); checked at build time.
- examples/home: antigua's routing role ported to the router module
(PPPoE with IPv6 inside the session, LAN with ULA and reservation,
local DNS and forward zones, the freifunk/family/mobile tunnels with
explicit zone rules, ddclient following the PPP device).
nixosConfigurations.home, packages.installer-home and a flake check
that builds it.
- PLAN.md: the remaining antigua gaps and the open question about
services that stay behind the router.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
DNS and DHCP (needed to replace a dnsmasq-based router):
- router.dns.domain/hosts/overrides/forwardZones: authoritative local
domain, split-horizon host records with reverse entries, wildcard
overrides and per-zone forwarders (private zones skip DNSSEC).
- lans.<n>.dhcp.reservations: Kea host reservations, published in DNS.
- Tunnels with dns = true admit what their peers route, so a
site-to-site peer without a transfer address can use the resolver.
Installer:
- router-install wipes a disk, creates an ESP and an ext4 root and
installs a prebuilt system with its secrets; nothing is built on the
box. installed-layout is the shared disk layout contract.
- lib.mkInstaller builds an ISO for a given nixosSystem;
packages.installer-example is the example's ISO.
Covered by the dns and installer VM tests (the latter installs onto an
empty disk and boots it under UEFI), wireguard DNS and assertion cases.
PLAN.md records the remaining gaps for replacing the hand-written router.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
router.wireguard.<name> configures tunnels through networkd: road warrior
(listening, dual-stack), site-to-site (no transfer network) and provider
dial-out with masquerade. A tunnel has a zone like a LAN, so inter-zone rules
apply; management, DNS and internet are opt-in. Peers' allowedIPs become
routes (destination-based routing; default-route tunnels are rejected).
Tunnels have a kill switch (default on): forwarded packets for their
allowedIPs are dropped if they would leave via an uplink, before the
established-accept so flows that used the tunnel are cut too.
Private keys stay outside the Nix store and are passed to the unprivileged
systemd-networkd with LoadCredential, so key files can be root-only.
Assertions cover CIDR/key/endpoint formats, duplicate allowedIPs, overlaps
with LAN subnets, port and device clashes, and rule destinations inside
tunnel networks. A five-VM `wireguard` check covers road warrior, site-to-site,
the provider tunnel with an IPv6 transfer net, zone rules and the kill switch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
nilsandClaude Sonnet 5.5