nilsandClaude Sonnet 5.5
dcef7665b4
router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd, a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time assertions against lock-out and interface conflicts. tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots the same topology in tmux with one console pane per VM and the driver REPL. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
32 lines
868 B
Nix
32 lines
868 B
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.router;
|
|
lans = lib.attrValues cfg.lans;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = lans != [ ];
|
|
message = "router: at least one LAN must be defined.";
|
|
}
|
|
{
|
|
assertion = lib.any (l: l.allowManagement) lans;
|
|
message = "router: no LAN has allowManagement = true; you would be locked out of the router.";
|
|
}
|
|
{
|
|
assertion = !(lib.elem cfg.wan.interface (map (l: l.interface) lans));
|
|
message = "router: the WAN interface `${cfg.wan.interface}` is also used by a LAN.";
|
|
}
|
|
{
|
|
assertion =
|
|
let
|
|
ifaces = map (l: l.interface) lans;
|
|
in
|
|
lib.length ifaces == lib.length (lib.unique ifaces);
|
|
message = "router: two LANs share the same interface.";
|
|
}
|
|
];
|
|
};
|
|
}
|