nilsandClaude Sonnet 5.5
70dddad206
- wan.ipv6.transport = "ppp": IPv6CP in pppd, router advertisements and DHCPv6 prefix delegation on the PPP device, DHCPv6 accepted on the PPP device, IPv6 MSS clamped to MTU-60. Allowed on a shared single-NIC link. A build-time check requires a PPPoE uplink. - IPv4 MSS clamping now only matches IPv4 packets. - The example uses the new box's NIC name (enp2s0). Covered by the onestick VM test (radvd and a minimal DHCPv6-PD responder as the ISP) and assertion cases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
62 lines
2.1 KiB
Nix
62 lines
2.1 KiB
Nix
# A single-NIC desktop PC as the router ("router on a stick").
|
|
#
|
|
# ISP -- ONT/modem -- switch/port --+-- enp2s0 (untagged) LAN 192.168.10.0/24
|
|
# +-- enp2s0.1001 PPPoE uplink (IPv4)
|
|
#
|
|
# The switch port the PC is plugged into must carry VLAN 1001 tagged (towards
|
|
# the ISP) and the LAN untagged. IPv6 is off: without a second link there is no
|
|
# untagged uplink for DHCPv6 to run on.
|
|
#
|
|
# Before the first deployment:
|
|
# 1. Confirm the NIC name (`enp2s0`) with `ip link` on the target box. Disk layout and
|
|
# drivers come from the installer layout, so no hardware scan is needed.
|
|
# 2. Put your SSH public key below (otherwise nobody can log in over the network).
|
|
# 3. Put the PPPoE username below and the password in /var/lib/router/pppoe-password
|
|
# (mode 0600, root); it is read at runtime and never enters the Nix store.
|
|
{ config, lib, ... }:
|
|
{
|
|
imports = [ ../../modules/installer/layout.nix ];
|
|
|
|
# --- Hardware: generic UEFI PC. Disk layout and drivers come from the
|
|
# installer's layout module; adjust only if you do not use `router-install`.
|
|
|
|
networking.hostName = "router";
|
|
system.stateVersion = "25.11";
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHro2zo4L13P2ukShg3JFga5/LYOkKeoOrUiFRJN3j82 nstinnesbeck nils.stinnesbeck@t-systems.com"
|
|
];
|
|
warnings = lib.optional (lib.any (lib.hasInfix "REPLACE") config.users.users.root.openssh.authorizedKeys.keys) ''
|
|
examples/desktop: the SSH key is still the placeholder; remote deployment will not work.
|
|
'';
|
|
|
|
router = {
|
|
enable = true;
|
|
|
|
wan = {
|
|
interface = "enp2s0";
|
|
ipv4 = {
|
|
type = "pppoe";
|
|
pppoe = {
|
|
vlan = 1001;
|
|
username = "CHANGE-ME@isp.example";
|
|
passwordFile = "/var/lib/router/pppoe-password";
|
|
};
|
|
};
|
|
};
|
|
|
|
lans.main = {
|
|
interface = "enp2s0";
|
|
internet = true;
|
|
ipv4.address = "192.168.10.1";
|
|
dhcp.pool = {
|
|
start = "192.168.10.100";
|
|
end = "192.168.10.199";
|
|
};
|
|
};
|
|
|
|
# A deployment that is not confirmed within this time is rolled back.
|
|
rollback.timeout = "5min";
|
|
};
|
|
}
|