nilsandClaude Sonnet 5.5
dcef7665b4
router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd, a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time assertions against lock-out and interface conflicts. tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots the same topology in tmux with one console pane per VM and the driver REPL. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
30 lines
729 B
Nix
30 lines
729 B
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.router;
|
|
lans = lib.attrValues cfg.lans;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.enable {
|
|
services.unbound = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
interface = [ "127.0.0.1" ] ++ map (l: l.ipv4.address) lans;
|
|
# LAN addresses are assigned by networkd, possibly after Unbound starts.
|
|
ip-freebind = true;
|
|
access-control = [
|
|
"127.0.0.0/8 allow"
|
|
] ++ map (l: "${l.ipv4.subnet} allow") lans;
|
|
};
|
|
} // lib.optionalAttrs (cfg.dns.forwarders != [ ]) {
|
|
forward-zone = [
|
|
{
|
|
name = ".";
|
|
forward-addr = cfg.dns.forwarders;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|