diff options
| -rw-r--r-- | config/networking/default.nix | 87 | ||||
| -rw-r--r-- | config/networking/nat.nix | 21 | ||||
| -rw-r--r-- | config/networking/services/ap.nix (renamed from config/networking/hostapd.nix) | 0 | ||||
| -rw-r--r-- | config/networking/services/default.nix | 5 | ||||
| -rw-r--r-- | config/networking/services/dhcp.nix | 18 | ||||
| -rw-r--r-- | config/networking/services/dns.nix | 18 |
6 files changed, 87 insertions, 62 deletions
diff --git a/config/networking/default.nix b/config/networking/default.nix index 330ba3b..aa6a829 100644 --- a/config/networking/default.nix +++ b/config/networking/default.nix @@ -3,24 +3,24 @@ { config, lib, pkgs, secrets, ... }: let - ifaces = config.personal.networking.interfaces; - publicSubnet = "192.168.1"; - privateSubnet = "192.168.2"; + cfg = config.personal.networking; in { - imports = [ ./hostapd.nix ]; + imports = [ ./nat.nix ./services ]; options.personal.networking = { - interfaces = let - makeInterfaceOption = type: - lib.mkOption { - type = lib.types.str; - description = "Network device for the ${type} interface."; - example = "enp4s0"; - }; - in { - eth = makeInterfaceOption "ethernet"; - wlp2ghz = makeInterfaceOption "2 GHz WiFi"; - wlp5ghz = makeInterfaceOption "5 GHz WiFi"; + interfaces = lib.mkOption { + type = with lib.types; attrsOf str; + description = "Reusable names for network devices."; + example = { + eth = "enp4s0"; + }; + }; + subnets = lib.mkOption { + type = with lib.types; attrsOf str; + description = "Reusable names for subnets."; + example = { + private = "192.168.1"; + }; }; }; @@ -33,6 +33,10 @@ in { wlp2ghz = "wlp5s0"; wlp5ghz = "wlp1s0"; }; + subnets = { + public = "192.168.1"; + private = "192.168.2"; + }; }; networking = { @@ -40,66 +44,25 @@ in { domain = "local"; defaultGateway = { - address = "${publicSubnet}.1"; - interface = ifaces.eth; + address = "${cfg.subnets.public}.1"; + interface = cfg.interfaces.eth; }; dhcpcd.enable = false; interfaces = { - "${ifaces.eth}" = { + "${cfg.interfaces.eth}" = { ipv4.addresses = [{ - address = "${publicSubnet}.2"; + address = "${cfg.subnets.public}.2"; prefixLength = 24; }]; }; - "${ifaces.wlp5ghz}" = { + "${cfg.interfaces.wlp5ghz}" = { ipv4.addresses = [{ - address = "${privateSubnet}.1"; + address = "${cfg.subnets.private}.1"; prefixLength = 24; }]; }; }; - - nat = { - enable = true; - externalInterface = ifaces.eth; - internalInterfaces = [ - # ifaces.wlp2ghz - ifaces.wlp5ghz - ]; - }; - - firewall.interfaces."${ifaces.wlp5ghz}" = { - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 ]; - }; - }; - - services.dhcpd4 = { - enable = true; - extraConfig = '' - option subnet-mask 255.255.255.0; - option routers ${privateSubnet}.1; - option domain-name-servers ${privateSubnet}.1, 9.9.9.9; - subnet ${privateSubnet}.0 netmask 255.255.255.0 { - range ${privateSubnet}.10 ${privateSubnet}.99; - } - ''; - interfaces = [ ifaces.wlp5ghz ]; - }; - - services.unbound = { - enable = true; - settings = { - server = { - interface = [ "127.0.0.1" "${privateSubnet}.1" ]; - access-control = [ - "0.0.0.0/0 refuse" - "127.0.0.0/8 allow" - "${privateSubnet}.0/24 allow" - ]; - }; - }; }; }; } diff --git a/config/networking/nat.nix b/config/networking/nat.nix new file mode 100644 index 0000000..33e8ca7 --- /dev/null +++ b/config/networking/nat.nix @@ -0,0 +1,21 @@ +{ config, ... }: + +let cfg = config.personal.networking; +in { + boot.kernel.sysctl = { + "net.ipv4.conf.all.forwarding" = true; + }; + + networking = { + nat = { + enable = true; + externalInterface = cfg.interfaces.eth; + internalInterfaces = [ + # cfg.interfaces.wlp2ghz + cfg.interfaces.wlp5ghz + ]; + }; + + firewall.enable = false; + }; +} diff --git a/config/networking/hostapd.nix b/config/networking/services/ap.nix index f5f399b..f5f399b 100644 --- a/config/networking/hostapd.nix +++ b/config/networking/services/ap.nix diff --git a/config/networking/services/default.nix b/config/networking/services/default.nix new file mode 100644 index 0000000..ffc56cf --- /dev/null +++ b/config/networking/services/default.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + imports = [ ./dhcp.nix ./dns.nix ./ap.nix ]; +} diff --git a/config/networking/services/dhcp.nix b/config/networking/services/dhcp.nix new file mode 100644 index 0000000..f4b1f61 --- /dev/null +++ b/config/networking/services/dhcp.nix @@ -0,0 +1,18 @@ +{ config, ... }: + +let cfg = config.personal.networking; +in { + services.dhcpd4 = { + enable = true; + extraConfig = '' + option subnet-mask 255.255.255.0; + option routers ${cfg.subnets.private}.1; + option domain-name-servers ${cfg.subnets.public}.1, 9.9.9.9; + subnet ${cfg.subnets.private}.0 netmask 255.255.255.0 { + range ${cfg.subnets.private}.10 ${cfg.subnets.private}.99; + } + ''; + interfaces = [ cfg.interfaces.wlp5ghz ]; + }; + +} diff --git a/config/networking/services/dns.nix b/config/networking/services/dns.nix new file mode 100644 index 0000000..beed1e7 --- /dev/null +++ b/config/networking/services/dns.nix @@ -0,0 +1,18 @@ +{ config, ... }: + +let cfg = config.personal.networking; +in { + services.unbound = { + enable = true; + settings = { + server = { + interface = [ "127.0.0.1" "${cfg.subnets.private}.1" ]; + access-control = [ + "0.0.0.0/0 refuse" + "127.0.0.0/8 allow" + "${cfg.subnets.private}.0/24 allow" + ]; + }; + }; + }; +} |