Update nixpkgs 2025-12-04-02-03

configuration/common/programs.nix

@@ -7,9 +7,6 @@
     gptfdisk
     parted
     grow-last-partition-and-filesystem
-    pciutils
-    lshw
-    ethtool
 
     # Normal usage
     htop

hosts/carbon/configuration.nix

@@ -9,12 +9,16 @@
       ./ds-lite-ncfttb.nix
       ./mdns.nix
       ./net-dsl.nix
+      ./net-gastnetz.nix
       ./net-heimnetz.nix
       ./net-iot.nix
+      ./net-lte.nix
       ./net-mgmt.nix
       ./net-printer.nix
+      ./net-voip.nix
       ./ntp.nix
       ./ppp-ncfttb.nix
+      ./scan-to-gpg.nix
       ./wg-clerie.nix
     ];
 
@@ -33,6 +37,14 @@
 
   networking.useDHCP = false;
 
+  networking.nat = {
+    enableIPv6 = true;
+    enable = true;
+    externalInterface = "ppp-ncfttb";
+    internalIPv6s = [ "fd00:152:152::/48" "fd00:3214:9453:4920::/64"];
+    internalIPs = [ "10.152.0.0/16" "192.168.32.0/24" ];
+  };
+
   services.radvd.enable = true;
 
   services.kea.dhcp4 = {

hosts/carbon/ds-lite-ncfttb.nix

@@ -8,7 +8,7 @@
     tunnelInterfaceName = "ds-lite-ncfttb";
     lanInterfaces = [
       {
-        name = "enp2s0";
+        name = "net-heimnetz";
         sla_id = 201;
         prefix_len = 64;
       }

hosts/carbon/net-dsl.nix

@@ -3,9 +3,17 @@
 {
 
   ## DSL-Uplink
+  networking.vlans."enp1s0.10" = {
+    id = 10;
+    interface = "enp1s0";
+  };
   networking.vlans."enp3s0.10" = {
     id = 10;
     interface = "enp3s0";
   };
+  networking.bridges."net-dsl".interfaces = [
+    "enp1s0.10"
+    "enp3s0.10"
+  ];
 
 }

hosts/carbon/net-gastnetz.nix

@@ -0,0 +1,69 @@
+{ ... }:
+
+{
+
+  ## Gastnetz
+  networking.vlans."enp1s0.202" = {
+    id = 202;
+    interface = "enp1s0";
+  };
+  networking.bridges."net-gastnetz".interfaces = [
+    "enp1s0.202"
+  ];
+  networking.interfaces."net-gastnetz".ipv6.addresses = [
+    { address = "fd00:3214:9453:4920::1"; prefixLength = 64; }
+  ];
+  networking.interfaces."net-gastnetz".ipv4.addresses = [
+    { address = "192.168.32.1"; prefixLength = 24; }
+  ];
+
+  services.radvd.config = ''
+    interface net-gastnetz {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 300;
+        AdvPreferredLifetime 120;
+      };
+      RDNSS 2620:fe::fe 2620:fe::9 {}; # Quad 9
+    };
+  '';
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "net-gastnetz" ];
+      };
+      subnet4 = [
+        # Gastnetz
+        {
+          id = 202;
+          subnet = "192.168.32.0/24";
+          pools = [
+            {
+              pool = "192.168.32.100 - 192.168.32.240";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "192.168.32.1";
+            }
+            {
+              name = "domain-name-servers";
+              data = "9.9.9.9,149.112.112.112"; # Quad 9
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  # net-gastnetz can only access internet
+  clerie.firewall.extraForwardFilterCommands = ''
+    ip46tables -A forward-filter -i net-gastnetz -o ppp-ncfttb -j ACCEPT
+    ip46tables -A forward-filter -i net-gastnetz -j DROP
+    ip46tables -A forward-filter -o net-gastnetz -j DROP
+  '';
+
+}

hosts/carbon/net-heimnetz.nix

@@ -3,16 +3,24 @@
 {
 
   ## Heimnetz
-  networking.interfaces."enp2s0".ipv6.addresses = [
+  networking.vlans."enp1s0.201" = {
+    id = 201;
+    interface = "enp1s0";
+  };
+  networking.bridges."net-heimnetz".interfaces = [
+    "enp1s0.201"
+    "enp2s0"
+  ];
+  networking.interfaces."net-heimnetz".ipv6.addresses = [
     { address = "fe80::1"; prefixLength = 64; }
     { address = "fd00:152:152:4::1"; prefixLength = 64; }
   ];
-  networking.interfaces."enp2s0".ipv4.addresses = [
+  networking.interfaces."net-heimnetz".ipv4.addresses = [
     { address = "10.152.4.1"; prefixLength = 24; }
   ];
 
   services.radvd.config = ''
-    interface enp2s0 {
+    interface net-heimnetz {
       AdvSendAdvert on;
       MaxRtrAdvInterval 30;
       prefix ::/64 {
@@ -27,7 +35,7 @@
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
-        interfaces = [ "enp2s0" ];
+        interfaces = [ "net-heimnetz" ];
       };
       subnet4 = [
         # Heimnetz

hosts/carbon/net-lte.nix

@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+
+  ## LTE-Uplink
+  networking.vlans."enp1s0.102" = {
+    id = 102;
+    interface = "enp1s0";
+  };
+
+}

hosts/carbon/net-voip.nix

@@ -0,0 +1,105 @@
+{ ... }:
+
+{
+
+  ## VoIP
+  networking.vlans."enp1s0.204" = {
+    id = 204;
+    interface = "enp1s0";
+  };
+  networking.interfaces."enp1s0.204".ipv4.addresses = [
+    { address = "10.152.33.1"; prefixLength = 24; }
+  ];
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "enp1s0.204" ];
+      };
+      option-def = [
+        {
+          space = "dhcp4";
+          name = "vendor-encapsulated-options";
+          code = 43;
+          type = "empty";
+          encapsulate = "sipdect";
+        }
+        {
+          space = "sipdect";
+          name = "ommip1";
+          code = 10;
+          type = "ipv4-address";
+        }
+        {
+          space = "sipdect";
+          name = "ommip2";
+          code = 19;
+          type = "ipv4-address";
+        }
+        {
+          space = "sipdect";
+          name = "syslogip";
+          code = 14;
+          type = "ipv4-address";
+        }
+        {
+          space = "sipdect";
+          name = "syslogport";
+          code = 15;
+          type = "int16";
+        }
+        {
+          space = "dhcp4";
+          name = "magic_str";
+          code = 224;
+          type = "string";
+        }
+      ];
+      subnet4 = [
+        # VoIP
+        {
+          id = 204;
+          subnet = "10.152.33.0/24";
+          pools = [
+            {
+              pool = "10.152.33.10 - 10.152.33.200";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "10.152.33.1";
+            }
+          ];
+
+          reservations = [
+            {
+              hostname = "iridium";
+              hw-address = "00:30:42:1B:8C:7C";
+              ip-address = "10.152.33.11";
+              option-data = [
+                {
+                  name = "host-name";
+                  data = "iridium";
+                }
+                {
+                  name = "vendor-encapsulated-options";
+                }
+                {
+                  space = "sipdect";
+                  name = "ommip1";
+                  data = "10.152.33.11";
+                }
+                {
+                  name = "magic_str";
+                  data = "OpenMobilitySIP-DECT";
+                }
+              ];
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+}

hosts/carbon/ppp-ncfttb.nix

@@ -6,7 +6,7 @@
     enable = true;
     peers.ncfttb = {
       config = ''
-        plugin pppoe.so enp3s0.10
+        plugin pppoe.so net-dsl
         user "''${PPPD_NETCOLOGNE_USERNAME}"
         ifname ppp-ncfttb
         persist
@@ -56,46 +56,6 @@
     ];
   };
 
-  environment.etc."ppp/ipv6-up" = {
-    text = ''
-      #! ${pkgs.runtimeShell} -e
-
-      ${pkgs.systemd}/bin/systemctl restart --no-block "ppp-setup-interface-queues@''${IFNAME}.service"
-      ${pkgs.systemd}/bin/systemctl restart --no-block ds-lite-dhcpcd.service
-    '';
-    mode = "555";
-  };
-
-  systemd.services."ppp-setup-interface-queues@".serviceConfig = let
-    setup-interface-queues = pkgs.clerie-build-support.writePythonScript {
-      name = "setup-interface-queues";
-      text = ''
-        import multiprocessing
-        from pathlib import Path
-        import sys
-
-        interface_name = sys.argv[1]
-
-        print(f"New ppp interface: {interface_name}")
-
-        num_cpus = multiprocessing.cpu_count()
-
-        print(f"Detected {num_cpus} cpus")
-
-        bitmask = "1" * num_cpus
-        hexmask = "{:x}".format(int(bitmask, 2))
-
-        rps_cpus = Path(f"/sys/class/net/{interface_name}/queues/rx-0/rps_cpus")
-        rps_cpus.write_text(hexmask)
-
-        print(f"Wrote hexmask {hexmask} to {rps_cpus}")
-      '';
-   };
-  in {
-    Type = "oneshot";
-    ExecStart = "${lib.getExe setup-interface-queues} %i";
-  };
-
   clerie.firewall.extraForwardMangleCommands = ''
     ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   '';

hosts/carbon/scan-to-gpg.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+
+  services.scan-to-gpg = {
+    enable = true;
+    gpgkey = "${pkgs.clerie-keys}/gpg/clerie@clerie.de.asc";
+  };
+
+  users.users."clerie".extraGroups = [ "scan-to-gpg" ];
+}

hosts/dn42-il-gw1/configuration.nix

@@ -46,25 +46,6 @@
     # dn42-router-general-wireguard-key public key:
     # r38qvXqu26x4f6yUGxg44Ji4db/g2HK7RZwG7Boh+38=
 
-    # darkpoint
-    wg0150 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg0150 fe80::2574/128 peer fe80::150/128
-      '';
-      listenPort = 50150;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "fra.darkpoint.xyz:22574";
-          publicKey = "nfoxTtmJdBdxNR3TmfVLG13KA5E+ZtU+uIGCegxrxxw=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
     # e1mo
     wg0565 = {
       ips = [
@@ -183,25 +164,25 @@
       ];
       privateKeyFile = config.sops.secrets.wg1280.path;
     };
-    # c4tg1rl5
+    # lutoma
-    # https://catgirls.systems/peering/
+    wg4719 = {
-    wg1411 = {
       ips = [
-        "fe80::2574/128"
+        #"fe80::1/128"
+        # peer fe80::acab/128
       ];
       postSetup = ''
-      ip addr replace dev wg1411 fe80::2574/128 peer fe80::1411/128
+      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
       '';
-      listenPort = 51411;
+      listenPort = 54719;
       allowedIPsAsRoutes = false;
       peers = [
-        #{
+        {
-        #  allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-        #  endpoint = "";
+          endpoint = "[2603:c020:8001:ed42::42]:42546";
-        #  publicKey = "";
+          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
-        #}
+        }
       ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+      privateKeyFile = config.sops.secrets.wg4719.path;
     };
     # zaphyra
     wg1718 = {
@@ -223,101 +204,17 @@
       ];
       privateKeyFile = config.sops.secrets.wg1718.path;
     };
-    # iedon
-    # https://iedon.net/
-    wg2189 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg2189 fe80::2574/128 peer fe80::2189:e9/128
-      '';
-      listenPort = 52189;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "de-fra.dn42.iedon.net:42463";
-          publicKey = "FHp0OR4UpAS8/Ra0FUNffTk18soUYCa6NcvZdOgxY0k=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
-    # jona / cryne
-    wg3402 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg3402 fe80::2574/128 peer fe80::3402/128
-      '';
-      listenPort = 53402;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "dn42.cryne.me:42574";
-          publicKey = "YsKInIp90is8ysnQDHGoKnz2CqlTMWMZDmQ+vwvN2C0=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
-    # lutoma
-    wg4719 = {
-      ips = [
-        #"fe80::1/128"
-        # peer fe80::acab/128
-      ];
-      postSetup = ''
-      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
-      '';
-      listenPort = 54719;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "[2603:c020:8001:ed42::42]:42546";
-          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.wg4719.path;
-    };
-    # tbspace
-    wg6190 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg6190 fe80::2574/128 peer fe80::1299:e/128
-      '';
-      listenPort = 56190;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "dn42.tbspace.de:49168";
-          publicKey = "skvyDl81J8Zu3Ziem+7JKeU4UYLhhWt7gWelg8nEbzQ=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
   };
 
   networking.firewall.allowedUDPPorts = [
-    50150 # wg0150
     50565 # wg0565
-    50663 # wg0663
     51240 # wg1240
     51241 # wg1241
     51271 # wg1271
     51272 # wg1272
     51280 # wg1280
-    51411 # wg1411
-    51718 # wg1718
-    52189 # wg2189
-    53402 # wg3402
     54719 # wg4719
-    56190 # wg6190
+    51718 # wg1718
   ];
 
   profiles.clerie.dn42-router = {
@@ -341,13 +238,6 @@
     ];
 
     wireguardPeers = [
-      {
-        peerName = "peer_0150";
-        remoteAddress = "fe80::150";
-        interfaceName = "wg0150";
-        remoteAsn = "4242420150";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_0565";
         remoteAddress = "fe80::565";
@@ -390,34 +280,6 @@
         remoteAsn = "4242421280";
         localAddress = "fde3:4c0d:2836:ff00::21";
       }
-      {
-        peerName = "peer_1411_de_fsn";
-        remoteAddress = "fe80::1411";
-        interfaceName = "wg1411";
-        remoteAsn = "4242421411";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_1718";
-        remoteAddress = "fe80::6b61";
-        interfaceName = "wg1718";
-        remoteAsn = "4242421718";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_2189_de_fra";
-        remoteAddress = "fe80::2189:e9";
-        interfaceName = "wg2189";
-        remoteAsn = "4242422189";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_3402";
-        remoteAddress = "fe80::3402";
-        interfaceName = "wg3402";
-        remoteAsn = "4242423402";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_4719";
         remoteAddress = "fe80::acab";
@@ -426,10 +288,10 @@
         localAddress = "fe80::1";
       }
       {
-        peerName = "peer_6190";
+        peerName = "peer_1718";
-        remoteAddress = "fe80::1299:e";
+        remoteAddress = "fe80::6b61";
-        interfaceName = "wg6190";
+        interfaceName = "wg1718";
-        remoteAsn = "76190";
+        remoteAsn = "4242421718";
         localAddress = "fe80::2574";
       }
     ];

hosts/krypton/configuration.nix

@@ -13,10 +13,6 @@
     ];
 
   profiles.clerie.desktop.enable = true;
-  profiles.clerie.desktop.users = [
-    "clerie"
-  ];
-
 
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;

profiles/desktop/default.nix

@@ -6,11 +6,6 @@ with lib;
 
   options.profiles.clerie.desktop = {
     enable = mkEnableOption "clerie Desktop Config";
-    users = mkOption {
-      type = with types; listOf str;
-      default = [];
-      description = "Names of users that are considered desktop users and therefore get special permissions";
-    };
   };
 
   imports = [

profiles/desktop/networking.nix

@@ -2,13 +2,9 @@
 
 with lib;
 
-let
+{
 
-  cfg = config.profiles.clerie.desktop;
+  config = mkIf config.profiles.clerie.desktop.enable {
-
-in {
-
-  config = mkIf cfg.enable {
 
     networking.networkmanager.settings = {
       connectivity = {
@@ -19,8 +15,6 @@ in {
       };
     };
 
-    users.groups.networkmanager.members = cfg.users;
-
   };
 
 }