nilsandClaude Sonnet 5.5
0653b5cf2f
- Allow the WAN link to also carry LANs when the uplink is PPPoE on a VLAN with IPv6 off; only the PPP device counts as an uplink then, so LAN traffic can never match WAN rules. - Add router.rollback: router-arm / router-confirm / router-rollback plus `nix run .#deploy`, a commit-confirm deployment flow. - Wait for the LAN devices instead of the uplink in networkd wait-online, so an unplugged uplink cannot block boot or activation. - Add examples/desktop (single NIC, PPPoE on VLAN 1001) as nixosConfigurations.example, built as a flake check. Covered by the onestick and rollback VM tests and new assertion cases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
69 lines
2.2 KiB
Nix
69 lines
2.2 KiB
Nix
# A single-NIC desktop PC as the router ("router on a stick").
|
|
#
|
|
# ISP -- ONT/modem -- switch/port --+-- eno1 (untagged) LAN 192.168.10.0/24
|
|
# +-- eno1.1001 PPPoE uplink (IPv4)
|
|
#
|
|
# The switch port the PC is plugged into must carry VLAN 1001 tagged (towards
|
|
# the ISP) and the LAN untagged. IPv6 is off: without a second link there is no
|
|
# untagged uplink for DHCPv6 to run on.
|
|
#
|
|
# Before the first deployment:
|
|
# 1. Replace the hardware section (`nixos-generate-config --show-hardware-config`).
|
|
# 2. Put your SSH public key below (otherwise nobody can log in over the network).
|
|
# 3. Put the PPPoE username below and the password in /var/lib/router/pppoe-password
|
|
# (mode 0600, root); it is read at runtime and never enters the Nix store.
|
|
{ config, lib, ... }:
|
|
{
|
|
# --- Hardware: replace with the generated configuration --------------------
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
fileSystems."/" = {
|
|
device = "/dev/disk/by-label/nixos";
|
|
fsType = "ext4";
|
|
};
|
|
fileSystems."/boot" = {
|
|
device = "/dev/disk/by-label/boot";
|
|
fsType = "vfat";
|
|
};
|
|
# ---------------------------------------------------------------------------
|
|
|
|
networking.hostName = "router";
|
|
system.stateVersion = "25.11";
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAA-REPLACE-WITH-YOUR-PUBLIC-KEY you@workstation"
|
|
];
|
|
warnings = lib.optional (lib.any (lib.hasInfix "REPLACE") config.users.users.root.openssh.authorizedKeys.keys) ''
|
|
examples/desktop: the SSH key is still the placeholder; remote deployment will not work.
|
|
'';
|
|
|
|
router = {
|
|
enable = true;
|
|
|
|
wan = {
|
|
interface = "eno1";
|
|
ipv4 = {
|
|
type = "pppoe";
|
|
pppoe = {
|
|
vlan = 1001;
|
|
username = "CHANGE-ME@isp.example";
|
|
passwordFile = "/var/lib/router/pppoe-password";
|
|
};
|
|
};
|
|
};
|
|
|
|
lans.main = {
|
|
interface = "eno1";
|
|
internet = true;
|
|
ipv4.address = "192.168.10.1";
|
|
dhcp.pool = {
|
|
start = "192.168.10.100";
|
|
end = "192.168.10.199";
|
|
};
|
|
};
|
|
|
|
# A deployment that is not confirmed within this time is rolled back.
|
|
rollback.timeout = "5min";
|
|
};
|
|
}
|