From 810001bb1313c746b708fae721e9758ca37a363e Mon Sep 17 00:00:00 2001 From: clerie Date: Tue, 8 Dec 2020 18:21:21 +0100 Subject: [PATCH] Add host dn42-il-gw1 --- hosts/dn42-il-gw1/configuration.nix | 268 +++++++++++++++++++ hosts/dn42-il-gw1/hardware-configuration.nix | 23 ++ 2 files changed, 291 insertions(+) create mode 100644 hosts/dn42-il-gw1/configuration.nix create mode 100644 hosts/dn42-il-gw1/hardware-configuration.nix diff --git a/hosts/dn42-il-gw1/configuration.nix b/hosts/dn42-il-gw1/configuration.nix new file mode 100644 index 0000000..5cba525 --- /dev/null +++ b/hosts/dn42-il-gw1/configuration.nix @@ -0,0 +1,268 @@ +{ config, pkgs, lib, ... }: + +{ + imports = + [ + ./hardware-configuration.nix + ../../configuration/common + ../../configuration/proxmox-vm + ../../configuration/dn42 + ../../modules/policyrouting + ]; + + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/vda"; + + networking.hostName = "dn42-il-gw1"; + + networking.useDHCP = false; + networking.interfaces.lo.ipv6.addresses = [ { addresses = "fd56:4902:eca0:1::1"; prefixLength = 64; } ]; + # VM Nat Netz mercury + networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.23"; prefixLength = 24; } ]; + # OSPF Netz + networking.interfaces.ens19 = {}; + # IPv6 Uplink + networking.interfaces.ens20.ipv6.addresses = [ { address = "2001:638:904:ffc9::7"; prefixLength = 64; } ]; + + networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; }; + networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens20"; }; + networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ]; + + networking.wireguard.enable = true; + networking.wireguard.interfaces = { + # n0emis + wg0197 = { + ips = [ + "fe80::42:1/128" + # peer fe80::42:42:1/128 + ]; + listenPort = 50197; + allowedIPsAsRoutes = false; + peers = [ + { + allowedIPs = [ "fe80::/10" "fd00::/8" ]; + endpoint = "himalia.dn42.n0emis.eu:52574"; + publicKey = "ObF+xGC6DdddJer0IUw6nzC0RqzeKWwEiQU0ieowzhg="; + } + ]; + privateKeyFile = "/var/src/secrets/wireguard/wg0197"; + }; + # e1mo + wg0565 = { + ips = [ + "fe80::43:43:1/128" + # peer fe80::43:1/128 + ]; + listenPort = 50565; + allowedIPsAsRoutes = false; + peers = [ + { + allowedIPs = [ "fe80::/10" "fd00::/8" ]; + endpoint = "de-fra1.dn42.net.dont-break.it:22574"; + publicKey = "LjXwHWJXz5koYyVsZ0UjSHr/zpxIUz/dPzucJSFSDUg="; + } + ]; + privateKeyFile = "/var/src/secrets/wireguard/wg0565"; + }; + # fooker + wg1271 = { + ips = [ + "fe80::1/128" + # peer fe80::2/128 + ]; + listenPort = 51271; + allowedIPsAsRoutes = false; + peers = [ + { + allowedIPs = [ "fe80::/10" "fd00::/8" ]; + endpoint = "north.zitadelle.dev.open-desk.net:23425"; + publicKey = "xxPjHWVzePinOOMnuhwGAI3PKY9pvpifIvIbPu3IwQw="; + } + ]; + privateKeyFile = "/var/src/secrets/wireguard/wg1271"; + }; + wg1272 = { + ips = [ + "fe80::1:1/128" + # peer fe80::1:2/128 + ]; + listenPort = 51272; + allowedIPsAsRoutes = false; + peers = [ + { + allowedIPs = [ "fe80::/10" "fd00::/8" ]; + endpoint = "south.zitadelle.dev.open-desk.net:23425"; + publicKey = "Iae2R4B7VVsloKWK8T1j1vLMuxpP4dVDUdzEg/YpAjE="; + } + ]; + privateKeyFile = "/var/src/secrets/wireguard/wg1272"; + }; + # margau + wg1272 = { + ips = [ + "ffde3:4c0d:2836:ff00::21/127" + # peer fde3:4c0d:2836:ff00::20/127 + ]; + listenPort = 51280; + allowedIPsAsRoutes = false; + peers = [ + { + allowedIPs = [ "fe80::/10" "fd00::/8" ]; + endpoint = "wg1.margau.ipv6.church:51830"; + publicKey = "CEge9jdHQArzdniUiWyB3IUZOjGiew3gPmz/MOf4ahU="; + } + ]; + privateKeyFile = "/var/src/secrets/wireguard/wg1280"; + }; + }; + + petabyte.policyrouting = { + enable = true; + rules6 = [ + { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; } + { rule = "from all to all lookup 2342"; prio = 10000; } + { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; } + { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; } + ]; + }; + + services.bird2.enable = true; + services.bird2.config = '' + router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address }; + + ipv6 table ospf6; + ipv6 table bgp6; + + protocol direct { + interface "lo"; + ipv6 { + table ospf6; + }; + } + + protocol static { + ipv6 { + table bgp6; + }; + route fd56:4902:eca0::/48 via "lo"; + route fd56:4902:eca0::/52 via "lo"; + } + + protocol kernel { + ipv6 { + table ospf6; + export filter { + krt_prefsrc=fd56:4902:eca0:1::1; + accept; + }; + import none; + }; + kernel table 1337; + } + + protocol kernel { + ipv6 { + table bgp6; + export filter { + krt_prefsrc=fd56:4902:eca0:1::1; + accept; + }; + import none; + }; + kernel table 2342; + } + + protocol ospf v3 { + ipv6 { + table ospf6; + import all; + export all; + }; + area 0 { + interface "ens19" { + cost 80; + }; + }; + } + + protocol bgp gw5 { + local as 4242422574; + graceful restart on; + neighbor fd56:4902:eca0:5::1 as 4242422574; + source address fd56:4902:eca0:1::1; + ipv6 { + table bgp6; + igp table ospf6; + next hop self; + import keep filtered; + import all; + export all; + }; + } + + protocol bgp gw6 { + local as 4242422574; + graceful restart on; + neighbor fd56:4902:eca0:6::1 as 4242422574; + source address fd56:4902:eca0:1::1; + ipv6 { + table bgp6; + igp table ospf6; + next hop self; + import keep filtered; + import all; + export all; + }; + } + + template bgp bgp_peer { + local as 4242422574; + graceful restart on; + ipv6 { + table bgp6; + next hop self; + import keep filtered; + import filter { + if net ~ [fd00::/8{48,64}] then accept; + reject; + }; + export filter { + if net ~ [fd00::/8{48,64}] then accept; + reject; + }; + }; + } + + protocol bgp peer_0197_himalia from bgp_peer { + neighbor fe80::42:42:1%wg0197 as 4242420197; + source address fe80::42:1; + } + + protocol bgp peer_0565 from bgp_peer { + neighbor fe80::43:1%wg0565 as 4242420565; + source address fd80::43:43:1; + } + + protocol bgp peer_1271_north from bgp_peer { + neighbor fe80::2%wg1271 as 4242421271; + source address fe80::1; + } + + protocol bgp peer_1271_south from bgp_peer { + neighbor fe80::1:2%wg1272 as 4242421271; + source address fe80::1:1; + } + + protocol bgp peer_1280_wg1 from bgp_peer { + neighbor fde3:4c0d:2836:ff00::20%wg1280 as 4242421280; + source address fde3:4c0d:2836:ff00::21; + } + + protocol device { + scan time 10; + } + ''; + + system.stateVersion = "21.03"; +} diff --git a/hosts/dn42-il-gw1/hardware-configuration.nix b/hosts/dn42-il-gw1/hardware-configuration.nix new file mode 100644 index 0000000..b642c6c --- /dev/null +++ b/hosts/dn42-il-gw1/hardware-configuration.nix @@ -0,0 +1,23 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/06c795c2-2a0d-414f-b166-13d887dd050b"; + fsType = "ext4"; + }; + + swapDevices = [ ]; + +}