1
0
vcp-bula-nixfiles/modules/policyrouting/default.nix

117 lines
2.7 KiB
Nix
Raw Normal View History

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.clerie.policyrouting;
startScript = pkgs.writeScriptBin "policyrouting-start" ''
#! ${pkgs.runtimeShell} -e
ip -6 rule flush 2> /dev/null || true
ip rule flush 2> /dev/null || true
${concatMapStrings (rule: ''
ip -6 rule add ${rule.rule} prio ${toString rule.prio}
'') (cfg.rules ++ cfg.rules6)}
${concatMapStrings (rule: ''
ip rule add ${rule.rule} prio ${toString rule.prio}
'') (cfg.rules ++ cfg.rules4)}
'';
stopScript = pkgs.writeScriptBin "policyrouting-stop" ''
#! ${pkgs.runtimeShell} -e
ip -6 rule flush 2> /dev/null || true
ip rule flush 2> /dev/null || true
# Loading default settings
ip -6 rule add from all lookup main prio 32766
ip rule add from all lookup main prio 32766
ip -6 rule add from all lookup default prio 32767
ip rule add from all lookup default prio 32767
'';
ruleOpts = { ... }: {
options = {
prio = mkOption {
type = types.int;
example = 20000;
};
rule = mkOption {
type = types.str;
example = "from fd00:23:42::/64 lookup 20101";
};
};
};
in
{
options = {
clerie.policyrouting = {
enable = mkOption {
type = types.bool;
default = false;
description =
''
Enable policy routing
'';
};
rules = mkOption {
type = with types; listOf (submodule ruleOpts);
default = [];
description = "Rules applied both, to IPv6 and IPv4";
};
rules6 = mkOption {
type = with types; listOf (submodule ruleOpts);
default = [];
description = "Rules applied to IPv6";
};
rules4 = mkOption {
type = with types; listOf (submodule ruleOpts);
default = [];
description = "Rules applied to IPv4";
};
};
};
config = mkIf cfg.enable {
# always use main routing table as a fallback
clerie.policyrouting.rules = [
{ rule = "lookup main"; prio = 32766; }
{ rule = "lookup default"; prio = 32767; }
];
environment.systemPackages = [ pkgs.iproute2 ];
systemd.services.policyrouting = {
description = "Policyrouting";
before = [ "network.target" ];
wantedBy = [ "network.target" ];
after = [ "network-pre.target" ];
path = [ pkgs.iproute2 ];
unitConfig.ConditionCapability = "CAP_NET_ADMIN";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "@${startScript}/bin/policyrouting-start policyrouting-start";
ExecStop = "@${stopScript}/bin/policyrouting-stop policyrouting-stop";
};
};
};
}