nilsandClaude Sonnet 5.5
dcef7665b4
router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd, a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time assertions against lock-out and interface conflicts. tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots the same topology in tmux with one console pane per VM and the driver REPL. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
31 lines
788 B
Nix
31 lines
788 B
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.router;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.enable {
|
|
networking.useNetworkd = true;
|
|
networking.useDHCP = false;
|
|
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
systemd.network.networks = {
|
|
"10-wan" = {
|
|
matchConfig.Name = cfg.wan.interface;
|
|
networkConfig.DHCP = "ipv4";
|
|
# The router runs its own resolver; never adopt the ISP's DNS for the host.
|
|
dhcpV4Config.UseDNS = false;
|
|
};
|
|
} // lib.mapAttrs' (
|
|
name: lan:
|
|
lib.nameValuePair "20-lan-${name}" {
|
|
matchConfig.Name = lan.interface;
|
|
address = [ "${lan.ipv4.address}/${toString lan.ipv4.prefixLength}" ];
|
|
networkConfig.ConfigureWithoutCarrier = true;
|
|
}
|
|
) cfg.lans;
|
|
};
|
|
}
|