clerie/nixfiles
1
0
Fork 0
Code

profiles/dn42-router: Add module for dn42 router

Browse Source
This commit is contained in:
clerie 2025-03-22 17:04:16 +01:00
parent 2e35c7955e
commit 89ec7e8394
2 changed files with 273 additions and 0 deletions
profiles
default.nix
dn42-router
default.nix

1
profiles/default.nix

@ -7,6 +7,7 @@
./common-dns ./common-dns
./common-networking ./common-networking
./cybercluster-vm ./cybercluster-vm
./dn42-router
./fem-net ./fem-net
./hetzner-cloud ./hetzner-cloud
./mercury-vm ./mercury-vm

272
profiles/dn42-router/default.nix Normal file

@ -0,0 +1,272 @@
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.profiles.clerie.dn42-router;
myAsn = 4242422574;
ospf6Table = 1337;
bgp6Table = 2342;
in {
options.profiles.clerie.dn42-router = {
enable = mkEnableOption "DN42 router base config";
loopbackIp = mkOption {
type = types.str;
description = "IPv6 lookback IP";
};
routerId = mkOption {
type = types.str;
description = "IPv6 lookback IP";
};
ospfInterfaces = mkOption {
type = with types; listOf str;
default = [];
};
ibgpPeers = mkOption {
type = with types; listOf (submodule ({ ... }: {
options = {
remoteAddress = mkOption {
type = types.str;
};
peerName = mkOption {
type = types.str;
};
};
}));
default = {};
description = "External bgp peers";
};
bgpPeers = mkOption {
type = with types; listOf (submodule ({ ... }: {
options = {
localAddress = mkOption {
type = types.str;
};
remoteAddress = mkOption {
type = types.str;
};
peerName = mkOption {
type = types.str;
};
remoteAsn = mkOption {
type = types.str;
};
};
}));
default = {};
description = "External bgp peers";
};
wireguardPeers = mkOption {
type = with types; listOf (submodule ({ ... }: {
options = {
interfaceName = mkOption {
type = types.str;
};
localAddress = mkOption {
type = types.str;
};
#localAddressPrefixlen = ;
remoteAddress = mkOption {
type = types.str;
};
#remoteAddressPrefixlen = ;
#localPrivateKey = ;
#remotePublicKey = ;
#localListenPort = ;
#remoteEnpoint = ;
peerName = mkOption {
type = types.str;
};
remoteAsn = mkOption {
type = types.str;
};
};
}));
default = [];
description = "External bgp peers";
};
birdExtraConfig = mkOption {
type = types.str;
default = "";
};
};
config = mkIf config.profiles.clerie.dn42-router.enable {
systemd.network.config.routeTables = {
bgp6 = bgp6Table;
ospf6 = ospf6Table;
};
systemd.network.config.addRouteTablesToIPRoute2 = true;
systemd.network.netdevs."10-lo-dn42" = {
netdevConfig = {
Kind = "dummy";
Name = "lo-dn42";
};
};
systemd.network.networks."10-lo-dn42" = {
matchConfig.Name = "lo-dn42";
address = [ "${ cfg.loopbackIp }/128" ];
linkConfig.RequiredForOnline = "no";
routingPolicyRules = [
{
Priority = 10000;
Family = "ipv6";
To = "fd56:4902:eca0::/48";
Table = "ospf6";
}
{
Priority = 11000;
Family = "ipv6";
Table = "bgp6";
}
{
Priority = 15000;
Family = "ipv6";
From = "fd56:4902:eca0::/48";
Type = "unreachable";
}
{
Priority = 16000;
Family = "ipv6";
To = "fd56:4902:eca0::/48";
Type = "unreachable";
}
{
Priority = 20000;
Family = "both";
Table = "main";
}
];
};
services.bird.enable = true;
services.bird.package = pkgs.bird2;
services.bird.config = ''
router id ${ cfg.routerId };
ipv6 table ospf6;
ipv6 table bgp6;
protocol direct {
interface "lo-dn42";
ipv6 {
table ospf6;
};
}
protocol static {
ipv6 {
table bgp6;
};
route fd56:4902:eca0::/48 via "lo-dn42";
}
protocol kernel {
ipv6 {
table ospf6;
export filter {
krt_prefsrc=${ cfg.loopbackIp };
accept;
};
import none;
};
kernel table ${ toString ospf6Table };
}
protocol kernel {
ipv6 {
table bgp6;
export filter {
krt_prefsrc=${ cfg.loopbackIp };
accept;
};
import none;
};
kernel table ${ toString bgp6Table };
}
protocol device {
scan time 10;
}
protocol ospf v3 {
ipv6 {
table ospf6;
import all;
export all;
};
area 0 {
${ concatMapStringsSep "\n" (interfaceName: ''
interface "${interfaceName}" {
cost 80;
type broadcast;
};
'') cfg.ospfInterfaces}
};
}
template bgp ibgp_peer {
local as ${ toString myAsn };
graceful restart on;
source address ${ cfg.loopbackIp};
ipv6 {
table bgp6;
igp table ospf6;
next hop self;
import keep filtered;
import all;
export all;
};
}
${concatMapStringsSep "\n" ( peerConfig: ''
protocol bgp ${peerConfig.peerName} from ibgp_peer {
neighbor ${peerConfig.remoteAddress} as ${ toString myAsn };
}
'') cfg.ibgpPeers}
template bgp bgp_peer {
local as ${ toString myAsn };
graceful restart on;
ipv6 {
table bgp6;
next hop self;
import keep filtered;
import filter {
if net ~ [fd00::/8{48,64}] then accept;
reject;
};
export filter {
if net ~ [fd00::/8{48,64}] then accept;
reject;
};
};
}
${concatMapStringsSep "\n" ( peerConfig: ''
protocol bgp ${peerConfig.peerName} from bgp_peer {
neighbor ${peerConfig.remoteAddress} as ${peerConfig.remoteAsn};
source address ${peerConfig.localAddress};
}
'') cfg.bgpPeers}
${concatMapStringsSep "\n" ( peerConfig: ''
protocol bgp ${peerConfig.peerName} from bgp_peer {
neighbor ${peerConfig.remoteAddress}%${peerConfig.interfaceName} as ${peerConfig.remoteAsn};
source address ${peerConfig.localAddress};
}
'') cfg.wireguardPeers}
${ cfg.birdExtraConfig }
'';
};
}