nixos-module/container/mgmt-gw: init

nix/lib/config/legacy.nix

@@ -59,7 +59,21 @@ in
   config.site.hosts = lib.mkMerge (
     [
       (builtins.foldl' (result: hostName: result // {
-        "${hostName}".role = "server";
+        "${hostName}" = {
+          role = "server";
+          interfaces = builtins.mapAttrs (net: _: {
+            type = "phys";
+          } // lib.optionalAttrs (net == "core") {
+            gw4 = "mgmt-gw";
+            gw6 = "mgmt-gw";
+          }) (
+            lib.filterAttrs (_: hosts: hosts ? ${hostName}) (
+              pillar.hosts-inet // (
+                builtins.foldl' (result: hosts: result // hosts) {} (builtins.attrValues pillar.hosts-inet6)
+              )
+            )
+          );
+        };
       }) {} mainServers)
 
       (builtins.mapAttrs (_: switch: {

nix/nixos-module/container/mgmt-gw.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  networking.nat = {
+    enable = true;
+    externalInterface = "core";
+  };
+
+  # TODO: firewall
+}

nix/nixos-module/default.nix

@@ -31,5 +31,8 @@ in {
     builtins.match "upstream.*" hostName != null
   ) [
     ./container/upstream.nix
+  ]
+  ++ optionals (hostName == "mgmt-gw") [
+    ./container/mgmt-gw.nix
   ];
 }