profiles/dn42-router: Take over config from configuration/dn42

hosts/dn42-il-gw5/configuration.nix

@@ -4,182 +4,108 @@
   imports =
     [
       ./hardware-configuration.nix
-      ../../configuration/dn42
     ];
 
   profiles.clerie.mercury-vm.enable = true;
+  profiles.clerie.common-networking.enable = true;
 
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "/dev/vda";
 
-  networking.useDHCP = false;
-  # VM Nat Netz mercury
-  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.25"; prefixLength = 24; } ];
-  # OSPF Netz
-  networking.interfaces.ens19 = {};
-  # Lokales Netz
-  networking.interfaces.ens20.ipv6.addresses = [ { address = "fd56:4902:eca0:5::1"; prefixLength = 64; } ];
-  # IPv6 Uplink
-  networking.interfaces.ens21.ipv6.addresses = [ { address = "2001:638:904:ffc9::a"; prefixLength = 64; } ];
-  # Ildix
-  networking.interfaces.ens22.ipv6.addresses = [ { address = "fd81:edb3:71d8:ffff:2574::5"; prefixLength = 64; } ];
-
-  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
-  networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens21"; };
-
-  petabyte.policyrouting = {
-    enable = true;
-    rules6 = [
-      { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; }
-      { rule = "from all to all lookup 2342"; prio = 10000; }
-      { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; }
-      { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; }
+  systemd.network.networks."10-wan" = {
+    matchConfig.Name = "ens21";
+    address = [
+      "2001:638:904:ffc9::a/64"
     ];
+    routes = [
+      { Gateway = "2001:638:904:ffc9::1"; }
+    ];
+    linkConfig.RequiredForOnline = "routable";
+  };
+  systemd.network.networks."10-nat-netz-mercury" = {
+    matchConfig.Name = "ens18";
+    address = [
+      "192.168.10.25/24"
+    ];
+    routes = [
+      { Gateway = "192.168.10.1"; }
+    ];
+    linkConfig.RequiredForOnline = "routable";
+  };
+  systemd.network.networks."10-dn42-ospf-netz" = {
+    matchConfig.Name = "ens19";
+    linkConfig.RequiredForOnline = "no";
+  };
+  systemd.network.networks."10-dn42-lokales-netz" = {
+    # Aktuell nicht verwendet, da in lo-dn42 umgezogen
+    matchConfig.Name = "ens20";
+    linkConfig.RequiredForOnline = "no";
+  };
+  systemd.network.networks."10-dn42-ildix" = {
+    matchConfig.Name = "ens22";
+    address = [
+      "fd81:edb3:71d8:ffff:2574::5/64"
+    ];
+    linkConfig.RequiredForOnline = "no";
   };
 
-  services.bird.enable = true;
-  services.bird.package = pkgs.bird2;
-  services.bird.config = ''
-  router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address };
+  profiles.clerie.dn42-router = {
+    enable = true;
+    loopbackIp = "fd56:4902:eca0:5::1";
+    routerId = "192.168.10.25";
 
-  ipv6 table ospf6;
-  ipv6 table bgp6;
+    ospfInterfaces = [
+      "ens19"
+    ];
 
-  protocol direct {
-    interface "ens20";
-    ipv6 {
-      table ospf6;
-    };
-  }
+    ibgpPeers = [
+      {
+        peerName = "gw1";
+        remoteAddress = "fd56:4902:eca0:1::1";
+      }
+      {
+        peerName = "gw6";
+        remoteAddress = "fd56:4902:eca0:6::1";
+      }
+    ];
 
-  protocol static {
-          ipv6 {
-                  table bgp6;
+    bgpPeers = [
+      {
+        peerName = "peer_ildix_clerie";
+        localAddress = "fd81:edb3:71d8:ffff:2574::5";
+        remoteAddress = "fd81:edb3:71d8:ffff::13";
+        remoteAsn = "4242422953";
+      }
+      {
+        peerName = "peer_ildix_nex";
+        localAddress = "fd81:edb3:71d8:ffff:2574::5";
+        remoteAddress = "fd81:edb3:71d8:ffff::14";
+        remoteAsn = "4242422953";
+      }
+    ];
+
+    birdExtraConfig = ''
+      # Internal
+      protocol bgp peer_2953_dn42_ildix_service {
+        local as 4242422574;
+        neighbor fd81:edb3:71d8:ffff:2953::1 port 1179 as 4242422953;
+        source address fd81:edb3:71d8:ffff:2574::5;
+        multihop 64;
+        ipv6 {
+          table bgp6;
+          igp table ospf6;
+          next hop keep;
+          add paths tx;
+          import filter {
+            reject;
           };
-          route fd56:4902:eca0::/48 via "lo";
-          route fd56:4902:eca0::/52 via "lo";
-  }
-
-  protocol kernel {
-    ipv6 {
-      table ospf6;
-      export filter {
-        krt_prefsrc=fd56:4902:eca0:5::1;
-        accept;
-      };
-      import none;
-    };
-    kernel table 1337;
-  }
-
-  protocol kernel {
-          ipv6 {
-                  table bgp6;
-                  export filter {
-                          krt_prefsrc=fd56:4902:eca0:5::1;
-        accept;
-                  };
-                  import none;
+          export filter {
+            accept;
           };
-    kernel table 2342;
-  }
-
-  protocol ospf v3 {
-    ipv6 {
-      table ospf6;
-      import all;
-      export all;
-    };
-    area 0 {
-      interface "ens19" {
-        cost 80;
-        type broadcast;
-      };
-    };
-  }
-
-  protocol bgp gw1 {
-          local as 4242422574;
-          graceful restart on;
-          neighbor fd56:4902:eca0:1::1 as 4242422574;
-          source address fd56:4902:eca0:5::1;
-          ipv6 {
-                  table bgp6;
-                  igp table ospf6;
-                  next hop self;
-                  import keep filtered;
-                  import all;
-                  export all;
-          };
-  }
-
-  protocol bgp gw6 {
-          local as 4242422574;
-          graceful restart on;
-          neighbor fd56:4902:eca0:6::1 as 4242422574;
-          source address fd56:4902:eca0:5::1;
-          ipv6 {
-      table bgp6;
-      igp table ospf6;
-                  next hop self;
-                  import keep filtered;
-                  import all;
-                  export all;
-          };
-  }
-
-  template bgp ildix {
-    local as 4242422574;
-    graceful restart on;
-    source address fd81:edb3:71d8:ffff:2574::5;
-    ipv6 {
-      table bgp6;
-      igp table ospf6;
-      next hop self;
-      import keep filtered;
-      import filter {
-        if net ~ [fd00::/8{8,64}] then accept;
-        reject;
-      };
-      export filter {
-        if net ~ [fd00::/8{8,64}] then accept;
-        reject;
-      };
-    };
-  }
-
-  protocol bgp peer_ildix_clerie from ildix {
-    neighbor fd81:edb3:71d8:ffff::13 as 4242422953;
-  }
-
-  protocol bgp peer_ildix_nex from ildix {
-    neighbor fd81:edb3:71d8:ffff::14 as 4242422953;
-  }
-
-  # Internal
-  protocol bgp peer_2953_dn42_ildix_service {
-    local as 4242422574;
-    neighbor fd81:edb3:71d8:ffff:2953::1 port 1179 as 4242422953;
-    source address fd81:edb3:71d8:ffff:2574::5;
-    multihop 64;
-    ipv6 {
-      table bgp6;
-      igp table ospf6;
-      next hop keep;
-      add paths tx;
-      import filter {
-        reject;
-      };
-      export filter {
-        accept;
-      };
-    };
-  }
-
-  protocol device {
-    scan time 10;
-  }
-  '';
+        };
+      }
+    '';
+  };
 
   clerie.system-auto-upgrade = {
     allowReboot = true;

profiles/default.nix

@@ -7,6 +7,7 @@
     ./common-dns
     ./common-networking
     ./cybercluster-vm
+    ./dn42-router
     ./fem-net
     ./hetzner-cloud
     ./mercury-vm

profiles/dn42-router/default.nix

@@ -0,0 +1,291 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.profiles.clerie.dn42-router;
+
+  myAsn = 4242422574;
+  ospf6Table = 1337;
+  bgp6Table = 2342;
+
+in {
+
+  options.profiles.clerie.dn42-router = {
+    enable = mkEnableOption "DN42 router base config";
+    loopbackIp = mkOption {
+      type = types.str;
+      description = "IPv6 lookback IP";
+    };
+    routerId = mkOption {
+      type = types.str;
+      description = "IPv6 lookback IP";
+    };
+    ospfInterfaces = mkOption {
+      type = with types; listOf str;
+      default = [];
+    };
+    ibgpPeers = mkOption {
+      type = with types; listOf (submodule ({ ... }: {
+        options = {
+          remoteAddress = mkOption {
+            type = types.str;
+          };
+          peerName = mkOption {
+            type = types.str;
+          };
+        };
+      }));
+      default = {};
+      description = "External bgp peers";
+    };
+    bgpPeers = mkOption {
+      type = with types; listOf (submodule ({ ... }: {
+        options = {
+          localAddress = mkOption {
+            type = types.str;
+          };
+          remoteAddress = mkOption {
+            type = types.str;
+          };
+          peerName = mkOption {
+            type = types.str;
+          };
+          remoteAsn = mkOption {
+            type = types.str;
+          };
+        };
+      }));
+      default = {};
+      description = "External bgp peers";
+    };
+    wireguardPeers = mkOption {
+      type = with types; listOf (submodule ({ ... }: {
+        options = {
+          interfaceName = mkOption {
+            type = types.str;
+          };
+          localAddress = mkOption {
+            type = types.str;
+          };
+          #localAddressPrefixlen = ;
+          remoteAddress = mkOption {
+            type = types.str;
+          };
+          #remoteAddressPrefixlen = ;
+          #localPrivateKey = ;
+          #remotePublicKey = ;
+          #localListenPort = ;
+          #remoteEnpoint = ;
+          peerName = mkOption {
+            type = types.str;
+          };
+          remoteAsn = mkOption {
+            type = types.str;
+          };
+        };
+      }));
+      default = [];
+      description = "External bgp peers";
+    };
+    birdExtraConfig = mkOption {
+      type = types.str;
+      default = "";
+    };
+  };
+
+  config = mkIf config.profiles.clerie.dn42-router.enable {
+
+    systemd.network.config.routeTables = {
+      bgp6 = bgp6Table;
+      ospf6 = ospf6Table;
+    };
+    systemd.network.config.addRouteTablesToIPRoute2 = true;
+
+    environment.systemPackages = with pkgs; [
+      wireguard-tools
+    ];
+
+    boot.kernel.sysctl = {
+      "net.ipv4.ip_forward" = true;
+      "net.ipv6.conf.all.forwarding" = true;
+    };
+
+    networking.firewall.checkReversePath = false;
+
+    # Open Firewall for BGP
+    networking.firewall.allowedTCPPorts = [ 179 ];
+    # Open Fireall for OSPF
+    networking.firewall.extraCommands = ''
+      ip6tables -A INPUT -p ospfigp -j ACCEPT
+      iptables -A INPUT -p ospfigp -j ACCEPT
+    '';
+
+    systemd.network.netdevs."10-lo-dn42" = {
+      netdevConfig = {
+        Kind = "dummy";
+        Name = "lo-dn42";
+      };
+    };
+
+    systemd.network.networks."10-lo-dn42" = {
+      matchConfig.Name = "lo-dn42";
+      address = [ "${ cfg.loopbackIp }/128" ];
+      linkConfig.RequiredForOnline = "no";
+      routingPolicyRules = [
+        {
+          Priority = 10000;
+          Family = "ipv6";
+          To = "fd56:4902:eca0::/48";
+          Table = "ospf6";
+        }
+        {
+          Priority = 11000;
+          Family = "ipv6";
+          Table = "bgp6";
+        }
+        {
+          Priority = 15000;
+          Family = "ipv6";
+          From = "fd56:4902:eca0::/48";
+          Type = "unreachable";
+        }
+        {
+          Priority = 16000;
+          Family = "ipv6";
+          To = "fd56:4902:eca0::/48";
+          Type = "unreachable";
+        }
+        {
+          Priority = 20000;
+          Family = "both";
+          Table = "main";
+        }
+      ];
+    };
+
+    services.bird.enable = true;
+    services.bird.package = pkgs.bird2;
+    services.bird.config = ''
+      router id ${ cfg.routerId };
+  
+      ipv6 table ospf6;
+      ipv6 table bgp6;
+  
+      protocol direct {
+        interface "lo-dn42";
+        ipv6 {
+          table ospf6;
+        };
+      }
+  
+      protocol static {
+        ipv6 {
+          table bgp6;
+        };
+        route fd56:4902:eca0::/48 via "lo-dn42";
+      }
+  
+      protocol kernel {
+        ipv6 {
+          table ospf6;
+          export filter {
+            krt_prefsrc=${ cfg.loopbackIp };
+            accept;
+          };
+          import none;
+        };
+        kernel table ${ toString ospf6Table };
+      }
+  
+      protocol kernel {
+        ipv6 {
+          table bgp6;
+          export filter {
+            krt_prefsrc=${ cfg.loopbackIp };
+            accept;
+          };
+          import none;
+        };
+        kernel table ${ toString bgp6Table };
+      }
+
+      protocol device {
+        scan time 10;
+      }
+
+      protocol ospf v3 {
+        ipv6 {
+          table ospf6;
+          import all;
+          export all;
+        };
+        area 0 {
+          ${ concatMapStringsSep "\n" (interfaceName: ''
+          interface "${interfaceName}" {
+            cost 80;
+            type broadcast;
+          };
+          '') cfg.ospfInterfaces}
+        };
+      }
+    
+      template bgp ibgp_peer {
+        local as ${ toString myAsn };
+        graceful restart on;
+        source address ${ cfg.loopbackIp};
+        ipv6 {
+          table bgp6;
+          igp table ospf6;
+          next hop self;
+          import keep filtered;
+          import all;
+          export all;
+        };
+      }
+    
+      ${concatMapStringsSep "\n" ( peerConfig: ''
+      protocol bgp ${peerConfig.peerName} from ibgp_peer {
+        neighbor ${peerConfig.remoteAddress} as ${ toString myAsn };
+      }
+      '') cfg.ibgpPeers}
+
+      template bgp bgp_peer {
+        local as ${ toString myAsn };
+        graceful restart on;
+        ipv6 {
+          table bgp6;
+          next hop self;
+          import keep filtered;
+          import filter {
+            if net ~ [fd00::/8{48,64}] then accept;
+            reject;
+          };
+          export filter {
+            if net ~ [fd00::/8{48,64}] then accept;
+            reject;
+          };
+        };
+      }
+
+      ${concatMapStringsSep "\n" ( peerConfig: ''
+      protocol bgp ${peerConfig.peerName} from bgp_peer {
+        neighbor ${peerConfig.remoteAddress} as ${peerConfig.remoteAsn};
+        source address ${peerConfig.localAddress};
+      }
+      '') cfg.bgpPeers}
+
+      ${concatMapStringsSep "\n" ( peerConfig: ''
+      protocol bgp ${peerConfig.peerName} from bgp_peer {
+        neighbor ${peerConfig.remoteAddress}%${peerConfig.interfaceName} as ${peerConfig.remoteAsn};
+        source address ${peerConfig.localAddress};
+      }
+      '') cfg.wireguardPeers}
+
+      ${ cfg.birdExtraConfig }
+
+    '';
+  
+  };
+}