From d09e80e88eaa2543d0c55a87bb933cd4acc5e60f Mon Sep 17 00:00:00 2001
From: clerie <git@clerie.de>
Date: Sun, 14 Jul 2024 00:06:41 +0200
Subject: [PATCH] hosts/carbon: Migrate to DTAG DSL

---
 hosts/carbon/configuration.nix | 29 +++----------------
 hosts/carbon/ppp.nix           | 51 ++++++++++++++++++++++++++++++++++
 hosts/carbon/secrets.json      |  6 ++--
 3 files changed, 59 insertions(+), 27 deletions(-)
 create mode 100644 hosts/carbon/ppp.nix

diff --git a/hosts/carbon/configuration.nix b/hosts/carbon/configuration.nix
index 06b8004..fe40263 100644
--- a/hosts/carbon/configuration.nix
+++ b/hosts/carbon/configuration.nix
@@ -5,6 +5,8 @@
     [
       ./hardware-configuration.nix
       ../../configuration/router
+
+      ./ppp.nix
     ];
 
   boot.kernelParams = [ "console=ttyS0,115200n8" ];
@@ -88,7 +90,7 @@
   networking.nat = {
     enableIPv6 = true;
     enable = true;
-    externalInterface = "ppp-ntvdsl";
+    externalInterface = "ppp-dtagdsl";
     internalIPv6s = [ "fd00:152:152::/48" "fd00:3214:9453:4920::/64"];
     internalIPs = [ "10.152.0.0/16" "192.168.32.0/24" ];
   };
@@ -256,7 +258,7 @@
 
   clerie.firewall.enable = true;
   clerie.firewall.extraForwardFilterCommands = ''
-    ip46tables -A forward-filter -i enp1s0.202 -o ppp-ntvdsl -j ACCEPT
+    ip46tables -A forward-filter -i enp1s0.202 -o ppp-dtagdsl -j ACCEPT
     ip46tables -A forward-filter -i enp1s0.202 -j DROP
     ip46tables -A forward-filter -o enp1s0.202 -j DROP
   '';
@@ -264,29 +266,6 @@
     ip46tables -t mangle -A forward-mangle -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1416
   '';
 
-  services.pppd = {
-    enable = true;
-    peers.ntvdsl = {
-      config = ''
-        plugin pppoe.so net-dsl
-        user "dsl-31997-001#regio@bsa-vdsl"
-        ifname ppp-ntvdsl
-        persist
-        maxfail 0
-        holdoff 5
-        noipdefault
-        lcp-echo-interval 20
-        lcp-echo-failure 3
-        mtu 1456
-        hide-password
-        defaultroute
-        +ipv6
-        debug
-      '';
-    };
-  };
-
-
   clerie.monitoring = {
     enable = true;
     id = "104";
diff --git a/hosts/carbon/ppp.nix b/hosts/carbon/ppp.nix
new file mode 100644
index 0000000..82cec5f
--- /dev/null
+++ b/hosts/carbon/ppp.nix
@@ -0,0 +1,51 @@
+{ config, pkgs, utils, ... }:
+
+{
+
+  services.pppd = {
+    enable = true;
+    peers.dtagdsl = {
+      config = ''
+        plugin pppoe.so net-dsl
+        user "''${PPPD_DTAGDSL_USERNAME}"
+        ifname ppp-dtagdsl
+        persist
+        maxfail 0
+        holdoff 5
+        noipdefault
+        lcp-echo-interval 20
+        lcp-echo-failure 3
+        mtu 14592
+        hide-password
+        defaultroute
+        +ipv6
+        debug
+      '';
+    };
+  };
+
+  environment.etc."ppp/peers/dtagdsl".enable = false;
+
+  systemd.services."pppd-dtagdsl".serviceConfig = {
+    EnvironmentFile = config.sops.secrets.pppd-dtagdsl-username.path;
+    ExecStartPre = [
+      "+${utils.systemdUtils.lib.makeJobScript "pppd-dtagdsl-pre-start" ''
+        mkdir -p /etc/ppp/peers
+
+        # Created files only readable by root
+        umask u=rw,g=,o=
+
+        # Copy config and substitute username
+        rm -f /etc/ppp/peers/dtagdsl
+        ${pkgs.envsubst}/bin/envsubst -i "${config.environment.etc."ppp/peers/dtagdsl".source}" > /etc/ppp/peers/dtagdsl
+
+        # Copy login secrets
+        rm -f /etc/ppp/pap-secrets
+        cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/pap-secrets
+        rm -f /etc/ppp/chap-secrets
+        cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/chap-secrets
+      ''}"
+    ];
+  };
+
+}
diff --git a/hosts/carbon/secrets.json b/hosts/carbon/secrets.json
index b2ef8ab..1b585f6 100644
--- a/hosts/carbon/secrets.json
+++ b/hosts/carbon/secrets.json
@@ -1,5 +1,7 @@
 {
 	"wg-monitoring": "ENC[AES256_GCM,data:+k5MgBrj/psMCE1T2jDtCCJI9Q7L+wJ3j83inNkeGp3LSUjoAPtBp4YoyL4=,iv:C19g/Lqi+cWAyiJBMNDtgLc3SDNI9bMBrBPWn+26mVY=,tag:9zIoawuGeGCMbOX1HKR/sQ==,type:str]",
+	"pppd-dtagdsl-username": "ENC[AES256_GCM,data:JC7EyyMoN0p5YwnS9W5I0G5Omhk5usw28UiJrCfifGr+2FUgMrtFYAHQdrtWAELvYNBQDPgrHMmQjGQLhpqqK0hH,iv:/q+Fm63GVBApGInyS8i39V/lo6iv+I2omVh47deq+o8=,tag:LkR+1zTDNWuYkhH2iWT7SA==,type:str]",
+	"pppd-dtagdsl-secrets": "ENC[AES256_GCM,data:c5pOb8It1py/9NXNTgLvt9zmsBVbSLHJt4iXWiNA+Osvomw3r7pgoO/JJh9ujomPMnOlDwN7g+pJ,iv:W36gA8E1mWchN6+8hdMdt2epv/RdS91T5ANB/JTcHCE=,tag:7eZ3fZkjERCVJCXYrABnlQ==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -11,8 +13,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Rkd5WFE3aE5EQzY5ZXV4\nbXVGYmxTdVg1ekRpVjlRUnozY2tMTGloL21RCktjZW95OU9ZZ2owTCtMR1NxaXJn\na2VYS2ttb3VhSjNXOG84UUJtYU04QjAKLS0tIGd3aHM0RldFYnVFdDRVS0Vhc3BF\nckJhYmN6a1FJUC9ibks1cGlRaU1zbFkKE4ClunQ3XGAILwluC6iYFs+rlR02PdhK\njOmPbOlS0aNG0hoC7Z6aetgpj689AkJgl68QVcyvm+ecHH7TOT7l1A==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2024-05-10T13:06:06Z",
-		"mac": "ENC[AES256_GCM,data:Suz7S6XzlEMvVVRMb1YIkeiZWRcnadFeX6oswLiZSc4w35Xw/nn/XY1wsWTZEXj+TecEyhWJDzw27mKLRoqClA9BqPT0E1nzkXMjb2aTp72DjrI6VuBmbuUDBQgKDXToEfrv3/H5ovAT1s69nlxYDqUq185KR2eMqhsJPUwMRSw=,iv:0vj9ezTPxPyx751iEY++GMnzuQ/HM0tgLwAeJpk7CAk=,tag:7nYfqhy4R5JOYR0majlafg==,type:str]",
+		"lastmodified": "2024-07-13T21:56:57Z",
+		"mac": "ENC[AES256_GCM,data:/jZ/aIQUxYrF0deBTJOyc009yPKfshiYnAB2GR5SRTi00Ls5efKzhjDJaEWvAkgBTFz5/a8fy2k+vXEDsDlrgcgWqMS8/Az5LRf9RWUBWkerDyoBJ2UZRdt7UVPfkN8ObKQpfFqxhzkm4zio+MwSbqSMZil6fGaxz6lyUkwaphg=,iv:KStinEtV1DTaEl0ebMEw8lSMvrE5rtxqfTbzssC9oGY=,tag:YOr8T3wqqxyv0mpO1wMDEg==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-05-10T13:05:56Z",