{ config, pkgs, lib, ... }: { imports = [ ./hardware-configuration.nix ../../configuration/proxmox-vm ../../configuration/dn42 ]; boot.loader.grub.enable = true; boot.loader.grub.device = "/dev/vda"; networking.hostName = "dn42-il-gw1"; networking.useDHCP = false; networking.interfaces.lo.ipv6.addresses = [ { address = "fd56:4902:eca0:1::1"; prefixLength = 64; } ]; # VM Nat Netz mercury networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.23"; prefixLength = 24; } ]; # OSPF Netz networking.interfaces.ens19 = {}; # IPv6 Uplink networking.interfaces.ens20.ipv6.addresses = [ { address = "2001:638:904:ffc9::7"; prefixLength = 64; } ]; networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; }; networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens20"; }; networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ]; networking.wireguard.enable = true; networking.wireguard.interfaces = { # n0emis wg0197 = { ips = [ "fe80::42:1/128" # peer fe80::42:42:1/128 ]; postSetup = '' ip -6 route flush dev wg0197 ip addr del dev wg0197 fe80::42:1/128 && ip addr add dev wg0197 fe80::42:1/128 peer fe80::42:42:1/128 ''; listenPort = 50197; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "himalia.dn42.n0emis.eu:52574"; publicKey = "ObF+xGC6DdddJer0IUw6nzC0RqzeKWwEiQU0ieowzhg="; } ]; privateKeyFile = config.sops.secrets.wg0197.path; }; # e1mo wg0565 = { ips = [ "fe80::2574/128" # peer fe80::565/128 ]; postSetup = '' ip -6 route flush dev wg0565 ip addr del dev wg0565 fe80::2574/128 && ip addr add dev wg0565 fe80::2574/128 peer fe80::565/128 ''; listenPort = 50565; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "dn42-nbg1.net.dont-break.it:22574"; publicKey = "qYaDuYYVpuFqy7KyC5PmJavqs0a7GtyuES8VwugdPSQ="; } ]; privateKeyFile = config.sops.secrets.wg0565.path; }; # fooker wg1271 = { ips = [ "fe80::1/128" # peer fe80::2/128 ]; postSetup = '' ip -6 route flush dev wg1271 ip addr del dev wg1271 fe80::1/128 && ip addr add dev wg1271 fe80::1/128 peer fe80::2/128 ''; listenPort = 51271; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "north.zitadelle.dev.open-desk.net:23425"; publicKey = "xxPjHWVzePinOOMnuhwGAI3PKY9pvpifIvIbPu3IwQw="; } ]; privateKeyFile = config.sops.secrets.wg1271.path; }; wg1272 = { ips = [ "fe80::1:1/128" # peer fe80::1:2/128 ]; postSetup = '' ip -6 route flush dev wg1272 ip addr del dev wg1272 fe80::1:1/128 && ip addr add dev wg1272 fe80::1:1/128 peer fe80::1:2/128 ''; listenPort = 51272; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "south.zitadelle.dev.open-desk.net:23425"; publicKey = "Iae2R4B7VVsloKWK8T1j1vLMuxpP4dVDUdzEg/YpAjE="; } ]; privateKeyFile = config.sops.secrets.wg1272.path; }; # margau wg1280 = { ips = [ "fde3:4c0d:2836:ff00::21/127" # peer fde3:4c0d:2836:ff00::20/127 ]; listenPort = 51280; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "wg1.margau.ipv6.church:51830"; publicKey = "CEge9jdHQArzdniUiWyB3IUZOjGiew3gPmz/MOf4ahU="; } ]; privateKeyFile = config.sops.secrets.wg1280.path; }; # perflyst wg1302 = { ips = [ "fe80::a14e/128" # peer fe80::a14d/128 ]; postSetup = '' ip -6 route flush dev wg1302 ip addr del dev wg1302 fe80::a14e/128 && ip addr add dev wg1302 fe80::a14e/128 peer fe80::a14d/128 ''; listenPort = 51302; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "[2a03:4000:6:f6ed::1]:22574"; publicKey = "TSPvvpMY8dCFk6gd58aYtkibtqUn8EzIF6dXP52b3y8="; } ]; privateKeyFile = config.sops.secrets.wg1302.path; }; # lutoma wg4719 = { ips = [ #"fe80::1/128" # peer fe80::acab/128 ]; postSetup = '' ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128 ''; listenPort = 54719; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "[2603:c020:8001:ed42::42]:42546"; publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ="; } ]; privateKeyFile = config.sops.secrets.wg4719.path; }; }; petabyte.policyrouting = { enable = true; rules6 = [ { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; } { rule = "from all to all lookup 2342"; prio = 10000; } { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; } { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; } ]; }; services.bird2.enable = true; services.bird2.config = '' router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address }; ipv6 table ospf6; ipv6 table bgp6; protocol direct { interface "lo"; ipv6 { table ospf6; }; } protocol static { ipv6 { table bgp6; }; route fd56:4902:eca0::/48 via "lo"; route fd56:4902:eca0::/52 via "lo"; } protocol kernel { ipv6 { table ospf6; export filter { krt_prefsrc=fd56:4902:eca0:1::1; accept; }; import none; }; kernel table 1337; } protocol kernel { ipv6 { table bgp6; export filter { krt_prefsrc=fd56:4902:eca0:1::1; accept; }; import none; }; kernel table 2342; } protocol ospf v3 { ipv6 { table ospf6; import all; export all; }; area 0 { interface "ens19" { cost 80; type broadcast; }; }; } protocol bgp gw5 { local as 4242422574; graceful restart on; neighbor fd56:4902:eca0:5::1 as 4242422574; source address fd56:4902:eca0:1::1; ipv6 { table bgp6; igp table ospf6; next hop self; import keep filtered; import all; export all; }; } protocol bgp gw6 { local as 4242422574; graceful restart on; neighbor fd56:4902:eca0:6::1 as 4242422574; source address fd56:4902:eca0:1::1; ipv6 { table bgp6; igp table ospf6; next hop self; import keep filtered; import all; export all; }; } template bgp bgp_peer { local as 4242422574; graceful restart on; ipv6 { table bgp6; next hop self; import keep filtered; import filter { if net ~ [fd00::/8{48,64}] then accept; reject; }; export filter { if net ~ [fd00::/8{48,64}] then accept; reject; }; }; } protocol bgp peer_0197_himalia from bgp_peer { neighbor fe80::42:42:1%wg0197 as 4242420197; source address fe80::42:1; } protocol bgp peer_0565 from bgp_peer { neighbor fe80::565%wg0565 as 4242420565; source address fe80::2574; } protocol bgp peer_1271_north from bgp_peer { neighbor fe80::2%wg1271 as 4242421271; source address fe80::1; } protocol bgp peer_1271_south from bgp_peer { neighbor fe80::1:2%wg1272 as 4242421271; source address fe80::1:1; } protocol bgp peer_1280_wg1 from bgp_peer { neighbor fde3:4c0d:2836:ff00::20%wg1280 as 4242421280; source address fde3:4c0d:2836:ff00::21; } protocol bgp peer_1302 from bgp_peer { neighbor fe80::a14d%wg1302 as 4242421302; source address fe80::a14e; } protocol bgp peer_4719 from bgp_peer { neighbor fe80::acab%wg4719 as 64719; } protocol device { scan time 10; } ''; clerie.system-auto-upgrade = { allowReboot = true; autoUpgrade = true; }; clerie.monitoring = { enable = true; id = "301"; pubkey = "kTuC3/rLr4Qb3C4oEn1ecB/vS78poxmu6/Id3Rc1VGY="; bird = true; }; system.stateVersion = "21.03"; }