nilsandClaude Sonnet 5.5
b5429ad876
DNS and DHCP (needed to replace a dnsmasq-based router): - router.dns.domain/hosts/overrides/forwardZones: authoritative local domain, split-horizon host records with reverse entries, wildcard overrides and per-zone forwarders (private zones skip DNSSEC). - lans.<n>.dhcp.reservations: Kea host reservations, published in DNS. - Tunnels with dns = true admit what their peers route, so a site-to-site peer without a transfer address can use the resolver. Installer: - router-install wipes a disk, creates an ESP and an ext4 root and installs a prebuilt system with its secrets; nothing is built on the box. installed-layout is the shared disk layout contract. - lib.mkInstaller builds an ISO for a given nixosSystem; packages.installer-example is the example's ISO. Covered by the dns and installer VM tests (the latter installs onto an empty disk and boots it under UEFI), wireguard DNS and assertion cases. PLAN.md records the remaining gaps for replacing the hand-written router. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
62 lines
2.1 KiB
Nix
62 lines
2.1 KiB
Nix
# A single-NIC desktop PC as the router ("router on a stick").
|
|
#
|
|
# ISP -- ONT/modem -- switch/port --+-- eno1 (untagged) LAN 192.168.10.0/24
|
|
# +-- eno1.1001 PPPoE uplink (IPv4)
|
|
#
|
|
# The switch port the PC is plugged into must carry VLAN 1001 tagged (towards
|
|
# the ISP) and the LAN untagged. IPv6 is off: without a second link there is no
|
|
# untagged uplink for DHCPv6 to run on.
|
|
#
|
|
# Before the first deployment:
|
|
# 1. Check the NIC name (`eno1`) with `ip link` on the target box. Disk layout and
|
|
# drivers come from the installer layout, so no hardware scan is needed.
|
|
# 2. Put your SSH public key below (otherwise nobody can log in over the network).
|
|
# 3. Put the PPPoE username below and the password in /var/lib/router/pppoe-password
|
|
# (mode 0600, root); it is read at runtime and never enters the Nix store.
|
|
{ config, lib, ... }:
|
|
{
|
|
imports = [ ../../modules/installer/layout.nix ];
|
|
|
|
# --- Hardware: generic UEFI PC. Disk layout and drivers come from the
|
|
# installer's layout module; adjust only if you do not use `router-install`.
|
|
|
|
networking.hostName = "router";
|
|
system.stateVersion = "25.11";
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHro2zo4L13P2ukShg3JFga5/LYOkKeoOrUiFRJN3j82 nstinnesbeck nils.stinnesbeck@t-systems.com"
|
|
];
|
|
warnings = lib.optional (lib.any (lib.hasInfix "REPLACE") config.users.users.root.openssh.authorizedKeys.keys) ''
|
|
examples/desktop: the SSH key is still the placeholder; remote deployment will not work.
|
|
'';
|
|
|
|
router = {
|
|
enable = true;
|
|
|
|
wan = {
|
|
interface = "eno1";
|
|
ipv4 = {
|
|
type = "pppoe";
|
|
pppoe = {
|
|
vlan = 1001;
|
|
username = "CHANGE-ME@isp.example";
|
|
passwordFile = "/var/lib/router/pppoe-password";
|
|
};
|
|
};
|
|
};
|
|
|
|
lans.main = {
|
|
interface = "eno1";
|
|
internet = true;
|
|
ipv4.address = "192.168.10.1";
|
|
dhcp.pool = {
|
|
start = "192.168.10.100";
|
|
end = "192.168.10.199";
|
|
};
|
|
};
|
|
|
|
# A deployment that is not confirmed within this time is rolled back.
|
|
rollback.timeout = "5min";
|
|
};
|
|
}
|