configuration
flake
hosts
_iso
aluminium
astatine
backup-4
beryllium
carbon
configuration.nix
dns.nix
hardware-configuration.nix
mdns.nix
net-dsl.nix
net-gastnetz.nix
net-heimnetz.nix
net-iot.nix
net-lte.nix
net-mgmt.nix
net-printer.nix
net-voip.nix
ntp.nix
ppp.nix
scan-to-gpg.nix
secrets.json
ssh.pub
wg-clerie.nix
clerie-backup
dn42-il-gw1
dn42-il-gw5
dn42-il-gw6
dn42-ildix-clerie
dn42-ildix-service
gatekeeper
hydra-1
hydra-2
krypton
mail-2
monitoring-3
nonat
osmium
palladium
porter
storage-2
tungsten
web-2
zinc
lib
modules
pkgs
profiles
users
.gitignore
README.md
flake.lock
flake.nix
64 lines
1.6 KiB
Nix
64 lines
1.6 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
|
|
services.pppd = {
|
|
enable = true;
|
|
peers.dtagdsl = {
|
|
config = ''
|
|
plugin pppoe.so net-dsl
|
|
user "''${PPPD_DTAGDSL_USERNAME}"
|
|
ifname ppp-dtagdsl
|
|
persist
|
|
maxfail 0
|
|
holdoff 5
|
|
noipdefault
|
|
lcp-echo-interval 20
|
|
lcp-echo-failure 3
|
|
mtu 1492
|
|
hide-password
|
|
defaultroute
|
|
+ipv6
|
|
debug
|
|
'';
|
|
};
|
|
};
|
|
|
|
environment.etc."ppp/peers/dtagdsl".enable = false;
|
|
|
|
systemd.services."pppd-dtagdsl".serviceConfig = let
|
|
preStart = ''
|
|
mkdir -p /etc/ppp/peers
|
|
|
|
# Created files only readable by root
|
|
umask u=rw,g=,o=
|
|
|
|
# Copy config and substitute username
|
|
rm -f /etc/ppp/peers/dtagdsl
|
|
${pkgs.envsubst}/bin/envsubst -i "${config.environment.etc."ppp/peers/dtagdsl".source}" > /etc/ppp/peers/dtagdsl
|
|
|
|
# Copy login secrets
|
|
rm -f /etc/ppp/pap-secrets
|
|
cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/pap-secrets
|
|
rm -f /etc/ppp/chap-secrets
|
|
cat ${config.sops.secrets.pppd-dtagdsl-secrets.path} > /etc/ppp/chap-secrets
|
|
'';
|
|
|
|
preStartFile = pkgs.writeShellApplication {
|
|
name = "pppd-dtagdsl-pre-start";
|
|
text = preStart;
|
|
};
|
|
in {
|
|
EnvironmentFile = config.sops.secrets.pppd-dtagdsl-username.path;
|
|
ExecStartPre = [
|
|
# "+" marks script to be executed without priviledge restrictions
|
|
"+${lib.getExe preStartFile}"
|
|
];
|
|
};
|
|
|
|
clerie.firewall.extraForwardMangleCommands = ''
|
|
ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
|
|
'';
|
|
|
|
}
|