nilsandClaude Sonnet 5.5
6015ee2e6d
LANs can sit on an 802.1Q VLAN (`vlan` on a trunk `interface`); networkd creates the device and brings the trunk up. LANs belong to a named `zone` (default: their own name). Traffic inside a zone is forwarded freely, traffic between zones is denied unless a `router.firewall.rules` entry allows it (protocol, ports, optional destination inside the target zone). Internet access is now opt-in per LAN (`internet`, default false), replacing the previous allow-out default. Assertions reject unknown zones, bad destinations, duplicate devices, over-long device names and a WAN trunk. Kea subnet IDs now come from the network address so adding LANs does not renumber them and orphan persistent leases. Tests: a five-VM `vlans` check (untagged + two VLANs, shared zone, one-way rules, per-host destination restriction), new assertion cases, parseNet unit tests, and shared test tooling in tests/common.nix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
23 lines
562 B
Nix
23 lines
562 B
Nix
# Pieces shared by the VM tests.
|
|
{
|
|
# `fail` in a test script also passes on "command not found", so make sure
|
|
# the tools the scripts rely on are really there.
|
|
tools =
|
|
{ pkgs, ... }:
|
|
{
|
|
environment.systemPackages = with pkgs; [
|
|
dnsutils
|
|
netcat-openbsd
|
|
curl
|
|
tcpdump
|
|
];
|
|
};
|
|
|
|
# `driverInteractive` uses the full QEMU, which would open a window per VM;
|
|
# `nix run .#lab` wants the consoles in the terminal instead.
|
|
interactiveDefaults.virtualisation.qemu.options = [
|
|
"-display"
|
|
"none"
|
|
];
|
|
}
|