1
0
nixfiles/hosts/carbon/ppp.nix

61 lines
1.6 KiB
Nix
Raw Normal View History

2024-07-14 00:06:41 +02:00
{ config, pkgs, utils, ... }:
{
services.pppd = {
enable = true;
peers.dtagdsl = {
config = ''
plugin pppoe.so net-dsl
user "''${PPPD_DTAGDSL_USERNAME}"
ifname ppp-dtagdsl
persist
maxfail 0
holdoff 5
noipdefault
lcp-echo-interval 20
lcp-echo-failure 3
2024-08-13 12:46:02 +02:00
mtu 1492
2024-07-14 00:06:41 +02:00
hide-password
defaultroute
+ipv6
debug
'';
};
};
environment.etc."ppp/peers/dtagdsl".enable = false;
systemd.services."pppd-dtagdsl".serviceConfig = let
preStart = ''
mkdir -p /etc/ppp/peers
# Created files only readable by root
umask u=rw,g=,o=
# Copy config and substitute username
rm -f /etc/ppp/peers/dtagdsl
${pkgs.envsubst}/bin/envsubst -i "${config.environment.etc."ppp/peers/dtagdsl".source}" > /etc/ppp/peers/dtagdsl
# Copy login secrets
rm -f /etc/ppp/pap-secrets
cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/pap-secrets
rm -f /etc/ppp/chap-secrets
cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/chap-secrets
'';
preStartFile = utils.systemdUtils.lib.makeJobScript "pppd-dtagdsl-pre-start" preStart;
in {
2024-07-14 00:06:41 +02:00
EnvironmentFile = config.sops.secrets.pppd-dtagdsl-username.path;
ExecStartPre = [
# "+" marks script to be executed without priviledge restrictions
"+${preStartFile}"
2024-07-14 00:06:41 +02:00
];
};
clerie.firewall.extraForwardMangleCommands = ''
2024-09-23 17:00:33 +02:00
ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
'';
2024-07-14 00:06:41 +02:00
}