nixos-router/modules/router/networking.nix

{ config, lib, ... }:
let
  cfg = config.router;
  v6 = cfg.wan.ipv6.enable;
  pppoe = cfg.wan.ipv4.type == "pppoe";
  vlan = cfg.wan.ipv4.pppoe.vlan;
  vlanDevice = "${cfg.wan.interface}.${toString vlan}";

  lans = lib.attrValues cfg.lans;
  vlanLans = lib.filter (l: l.vlan != null) lans;
  # VLAN devices hang off their parent; the parent's own unit must list them.
  vlansOn = parent: map (l: l.device) (lib.filter (l: l.interface == parent) vlanLans);
  untaggedParents = map (l: l.interface) (lib.filter (l: l.vlan == null) lans);
  # Parents that carry only tagged LANs still need a unit to be brought up.
  trunkParents = lib.filter (p: !(lib.elem p untaggedParents)) (
    lib.unique (map (l: l.interface) vlanLans)
  );

  dhcp = if pppoe then (if v6 then "ipv6" else "no") else (if v6 then "yes" else "ipv4");
in
{
  config = lib.mkIf cfg.enable {
    networking.useNetworkd = true;
    networking.useDHCP = false;

    boot.kernel.sysctl = {
      "net.ipv4.conf.all.forwarding" = 1;
      "net.ipv6.conf.all.forwarding" = 1;
    };

    systemd.network.netdevs =
      lib.optionalAttrs (pppoe && vlan != null) {
        "05-wan-pppoe" = {
          netdevConfig = {
            Kind = "vlan";
            Name = vlanDevice;
          };
          vlanConfig.Id = vlan;
        };
      }
      // lib.mapAttrs' (
        name: lan:
        lib.nameValuePair "06-lan-${name}" {
          netdevConfig = {
            Kind = "vlan";
            Name = lan.device;
          };
          vlanConfig.Id = lan.vlan;
        }
      ) (lib.filterAttrs (_: l: l.vlan != null) cfg.lans);

    systemd.network.networks = {
      "10-wan" = {
        matchConfig.Name = cfg.wan.interface;
        networkConfig = {
          DHCP = dhcp;
        }
        // lib.optionalAttrs v6 {
          IPv6AcceptRA = true;
          KeepConfiguration = "yes";
        }
        // lib.optionalAttrs (pppoe && vlan != null) {
          VLAN = [ vlanDevice ];
        };
      }
      // lib.optionalAttrs (!pppoe) {
        # The router runs its own resolver; never adopt the ISP's DNS for the host.
        dhcpV4Config.UseDNS = false;
      }
      // lib.optionalAttrs v6 {
        # The ISP sends RAs (default route) without DHCPv6 flags, so solicit anyway.
        dhcpV6Config = {
          WithoutRA = "solicit";
          UseDelegatedPrefix = true;
          UseDNS = false;
        };
      };
    }
    // lib.optionalAttrs (pppoe && vlan != null) {
      # pppd configures the session; networkd only has to bring the device up.
      "11-wan-pppoe" = {
        matchConfig.Name = vlanDevice;
        networkConfig = {
          LinkLocalAddressing = "no";
          IPv6AcceptRA = false;
        };
      };
    }
    // lib.mapAttrs' (
      name: lan:
      lib.nameValuePair "20-lan-${name}" (
        {
          matchConfig.Name = lan.device;
          address = [ "${lan.ipv4.address}/${toString lan.ipv4.prefixLength}" ];
          networkConfig = {
            ConfigureWithoutCarrier = true;
            # Never accept RAs from the inside.
            IPv6AcceptRA = false;
          }
          // lib.optionalAttrs (lan.vlan == null && vlansOn lan.interface != [ ]) {
            VLAN = vlansOn lan.interface;
          }
          // lib.optionalAttrs lan.ipv6.pd {
            DHCPPrefixDelegation = true;
            IPv6SendRA = true;
          };
        }
        // lib.optionalAttrs lan.ipv6.pd {
          dhcpPrefixDelegationConfig = {
            UplinkInterface = cfg.wan.interface;
            SubnetId = 0;
            Announce = true;
            Assign = true;
          };
          # No RDNSS yet: the global address is unknown at evaluation time.
          ipv6SendRAConfig.EmitDNS = false;
        }
      )
    ) cfg.lans
    // lib.listToAttrs (
      map (
        parent:
        lib.nameValuePair "19-trunk-${parent}" {
          matchConfig.Name = parent;
          networkConfig = {
            LinkLocalAddressing = "no";
            IPv6AcceptRA = false;
            ConfigureWithoutCarrier = true;
            VLAN = vlansOn parent;
          };
        }
      ) trunkParents
    );
  };
}