nilsandClaude Opus 5.5
f5909fbdcb
The installer ISO no longer needs a prebuilt system: `router-setup` asks for the disk, the WAN and LAN interfaces, DHCP or PPPoE (optionally on a VLAN), host name, LAN address and a password, writes settings.json and the secrets, builds that router offline (the ISO carries a reference router system whose closure has everything the build needs) and installs it with `router-install --system`. The password is used for the web UI and, hashed, as root's console password (routerSettings sets root's hashedPasswordFile; it applies when the account is created at installation). checks.setup answers router-setup on the console and checks the installed box: its settings, the web UI and console login with that password, and a rebuild that reproduces the installed system. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F
259 lines
8.9 KiB
Nix
259 lines
8.9 KiB
Nix
{
|
|
description = "nixos-router: a NixOS-based distribution for routers/firewalls";
|
|
|
|
inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
|
|
outputs =
|
|
{ self, nixpkgs }:
|
|
let
|
|
systems = [
|
|
"x86_64-linux"
|
|
"aarch64-linux"
|
|
];
|
|
forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
|
|
in
|
|
{
|
|
nixosModules = {
|
|
router = ./modules/router;
|
|
default = self.nixosModules.router;
|
|
# Disk layout contract shared by router-install and target configs.
|
|
installed-layout = ./modules/installer/layout.nix;
|
|
# The installer pieces; `lib.mkInstaller` wires them up.
|
|
installer = ./modules/installer/install-script.nix;
|
|
installer-iso = ./modules/installer/iso.nix;
|
|
# The generic installer's `router-setup` (see lib.setupModule).
|
|
setup = ./modules/installer/setup.nix;
|
|
# Appliance disk image: dm-verity store, volatile root, state on /var.
|
|
image = ./modules/image;
|
|
# Configuration from a settings file (JSON), rebuilt on the device.
|
|
settings = ./modules/settings;
|
|
};
|
|
|
|
# A router built from settings.json; this is what the device's own
|
|
# configuration flake (see mkConfigDir) evaluates.
|
|
lib.mkRouterSystem =
|
|
{
|
|
settings,
|
|
modules ? [ ],
|
|
}:
|
|
nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
self.nixosModules.router
|
|
self.nixosModules.settings
|
|
self.nixosModules.installed-layout
|
|
{
|
|
routerSettings.file = settings;
|
|
# The device rebuilds itself, offline if need be: it needs the
|
|
# sources its configuration flake points to.
|
|
system.extraDependencies = [
|
|
self.outPath
|
|
nixpkgs.outPath
|
|
];
|
|
}
|
|
]
|
|
++ modules;
|
|
};
|
|
|
|
# The configuration directory installed to /var/lib/router/config: a
|
|
# flake pinned to exactly this router source, the settings and an
|
|
# optional local.nix with extra NixOS configuration.
|
|
lib.mkConfigDir =
|
|
{
|
|
pkgs,
|
|
settings,
|
|
local ? null,
|
|
}:
|
|
pkgs.runCommand "router-config" { } ''
|
|
mkdir -p $out
|
|
cp ${self.lib.configFlake pkgs} $out/flake.nix
|
|
cp ${settings} $out/settings.json
|
|
${pkgs.lib.optionalString (local != null) "cp ${local} $out/local.nix"}
|
|
'';
|
|
|
|
# The configuration directory's flake.nix (shared by mkConfigDir and
|
|
# router-setup, so both build exactly the same system).
|
|
lib.configFlake =
|
|
pkgs:
|
|
pkgs.writeText "flake.nix" ''
|
|
{
|
|
inputs.nixos-router.url = "path:${self.outPath}";
|
|
outputs =
|
|
{ nixos-router, ... }:
|
|
{
|
|
nixosConfigurations.router = nixos-router.lib.mkRouterSystem {
|
|
settings = ./settings.json;
|
|
modules = if builtins.pathExists ./local.nix then [ ./local.nix ] else [ ];
|
|
};
|
|
};
|
|
}
|
|
'';
|
|
|
|
# The generic installer: `router-setup` asks for the basics, builds
|
|
# the router offline and installs it; the rest is done in the web UI.
|
|
# nix build .#installer
|
|
# router-setup's configuration: the flake template and the reference
|
|
# system whose closure makes the offline build possible. `local` is an
|
|
# extra module that the installed systems will import as well.
|
|
lib.setupModule =
|
|
{
|
|
local ? null,
|
|
}:
|
|
{ pkgs, ... }:
|
|
{
|
|
imports = [ self.nixosModules.setup ];
|
|
router.setup = {
|
|
flake = self.lib.configFlake pkgs;
|
|
reference =
|
|
(self.lib.mkRouterSystem {
|
|
settings = builtins.toFile "settings.json" (
|
|
builtins.toJSON {
|
|
router = {
|
|
wan.interface = "eth0";
|
|
lans.lan = {
|
|
interface = "eth1";
|
|
internet = true;
|
|
ipv4.address = "192.168.1.1";
|
|
dhcp.pool = {
|
|
start = "192.168.1.100";
|
|
end = "192.168.1.200";
|
|
};
|
|
};
|
|
};
|
|
}
|
|
);
|
|
# A path, not a derivation: the module system would read its attributes.
|
|
modules = pkgs.lib.optional (local != null) "${local}";
|
|
}).config.system.build.toplevel;
|
|
};
|
|
};
|
|
|
|
# The generic installer ISO:
|
|
# nix build .#installer
|
|
nixosConfigurations.installer = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
self.nixosModules.installer-iso
|
|
(self.lib.setupModule { })
|
|
];
|
|
};
|
|
packages.x86_64-linux.installer = self.nixosConfigurations.installer.config.system.build.isoImage;
|
|
|
|
# Installer ISO for a given nixosSystem:
|
|
# nix build .#installer-example (see packages)
|
|
lib.mkInstaller =
|
|
{ configuration }:
|
|
nixpkgs.lib.nixosSystem {
|
|
inherit (configuration.pkgs.stdenv.hostPlatform) system;
|
|
modules = [
|
|
self.nixosModules.installer-iso
|
|
{
|
|
router.installer.system = configuration.config.system.build.toplevel;
|
|
# Reach the live system with the keys that will reach the router.
|
|
users.users.root.openssh.authorizedKeys.keys =
|
|
configuration.config.users.users.root.openssh.authorizedKeys.keys;
|
|
}
|
|
];
|
|
};
|
|
|
|
packages.x86_64-linux.installer-home =
|
|
(self.lib.mkInstaller { configuration = self.nixosConfigurations.home; })
|
|
.config.system.build.isoImage;
|
|
|
|
packages.x86_64-linux.installer-example =
|
|
(self.lib.mkInstaller { configuration = self.nixosConfigurations.example; })
|
|
.config.system.build.isoImage;
|
|
|
|
# A deployable starting point; copy examples/desktop and adapt it.
|
|
nixosConfigurations.example = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
self.nixosModules.router
|
|
./examples/desktop
|
|
];
|
|
};
|
|
|
|
# The home gateway replacing antigua's router role (see examples/home).
|
|
nixosConfigurations.home = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
self.nixosModules.router
|
|
./examples/home
|
|
];
|
|
};
|
|
|
|
# Appliance image (verity store, volatile root) for trying on hardware:
|
|
# nix build .#image -> result/*.raw
|
|
nixosConfigurations.image = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
self.nixosModules.router
|
|
self.nixosModules.image
|
|
./examples/image
|
|
];
|
|
};
|
|
|
|
packages.x86_64-linux.image = self.nixosConfigurations.image.config.system.build.image;
|
|
|
|
# `nix run .#deploy -- <flake-attr> <user@host>`: activate a new
|
|
# configuration with commit-confirm; see scripts/deploy.sh.
|
|
apps.x86_64-linux.deploy =
|
|
let
|
|
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
|
deploy = pkgs.writeShellApplication {
|
|
name = "router-deploy";
|
|
runtimeInputs = with pkgs; [
|
|
nixos-rebuild
|
|
openssh
|
|
coreutils
|
|
];
|
|
text = builtins.readFile ./scripts/deploy.sh;
|
|
};
|
|
in
|
|
{
|
|
type = "app";
|
|
program = "${deploy}/bin/router-deploy";
|
|
};
|
|
|
|
# VM tests need KVM; only wired up for x86_64 until aarch64 CI exists.
|
|
checks.x86_64-linux =
|
|
import ./tests {
|
|
inherit self;
|
|
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
|
}
|
|
// {
|
|
# The example must keep building as a complete system.
|
|
example = self.nixosConfigurations.example.config.system.build.toplevel;
|
|
home = self.nixosConfigurations.home.config.system.build.toplevel;
|
|
};
|
|
|
|
# `nix run .#lab`: boot the basic test topology in tmux, one console pane
|
|
# per VM plus the interactive test-driver REPL.
|
|
apps.x86_64-linux.lab =
|
|
let
|
|
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
|
test = self.checks.x86_64-linux.basic;
|
|
lab = pkgs.writeShellApplication {
|
|
name = "router-lab";
|
|
runtimeInputs = with pkgs; [
|
|
tmux
|
|
util-linux
|
|
gnugrep
|
|
coreutils
|
|
];
|
|
text = import ./tests/lab.nix {
|
|
inherit (pkgs) lib;
|
|
driver = test.driverInteractive;
|
|
nodes = builtins.attrNames test.nodes;
|
|
};
|
|
};
|
|
in
|
|
{
|
|
type = "app";
|
|
program = "${lab}/bin/router-lab";
|
|
};
|
|
|
|
formatter = forAllSystems (pkgs: pkgs.nixfmt);
|
|
};
|
|
}
|