Compare commits

...

249 Commits

Author SHA1 Message Date
Sandro - af5cf82ed2
dns: bump SOA checks 2024-05-01 23:15:47 +02:00
Sandro - 0ec977a618
dns: switch to serial-policy increment 2024-05-01 23:11:19 +02:00
Astro 065d86b527 revive NAT reflection 2024-05-01 22:27:11 +02:00
Astro 90a9ece874 upstream4: turn nat reflection back on for vpn-gw:wireguard
SNAT is needed as vpn-gw's default route does not go over upstream4.
2024-05-01 22:22:40 +02:00
Markus Schmidl 848cf110ed switch tlms monitoring from serv to flpk 2024-04-28 02:29:17 +02:00
Markus Schmidl dc4a045b92 net serv: add tlms-monitoring v6 2024-04-28 00:24:51 +02:00
Markus Schmidl 6b767f964d net serv: add tlms-monitoring 2024-04-28 00:13:03 +02:00
Sandro - 5e96baf278
dns: only notify over IPv6 which has no nating 2024-04-25 20:08:08 +02:00
Sandro - a49408c480
dns: format 2024-04-25 20:04:38 +02:00
Sandro - f308cbb292
dns: map acl to key
upsi
2024-04-25 20:04:25 +02:00
Sandro - 793547d0ca
dns: add more ipv6 addresses 2024-04-24 21:58:12 +02:00
Sandro - 5b611d43f3
flpk: drop mail AAAA 2024-04-24 20:12:14 +02:00
Sandro - 54fe20b027
uci-config: disable ieee80211r 2024-04-22 21:06:09 +02:00
Sandro - 7872e9e5c5
Switch to our dns.nix fork 2024-04-22 20:41:37 +02:00
Sandro - f5e2724091
dns: advertise ns1.supersandro.de 2024-04-21 19:15:27 +02:00
Sandro - 57e86a5dbf
dns: listen on some addresses 2024-04-21 18:49:34 +02:00
Sandro - 18fb8b635f
dns: add public ns.spaceboyz.net 2024-04-21 18:47:30 +02:00
Sandro - 9b2b8250c4
dns: switch to knot 2024-04-21 18:17:41 +02:00
Sandro - d7fdfd8aa6
dns: fix missing dots 2024-04-21 00:03:38 +02:00
Sandro - e36881f687
Fix srv records 2024-04-20 23:57:34 +02:00
Sandro - 4e848d27f8
dns: collect records correctly 2024-04-20 23:31:13 +02:00
Sandro - e90f8e7ea6
Switch to dns.nix 2024-04-20 22:45:31 +02:00
Sandro - 54c215c320
dnscache: add forth quad 9 server 2024-04-19 11:06:14 +02:00
Sandro - 349f3dcd1b
dnscache: set insecure domains again 2024-04-19 00:03:19 +02:00
Sandro - 05510d606b
dnscache: activate psl 2024-04-18 23:58:07 +02:00
Sandro - 0561661489
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:SuperSandro2000/nixpkgs/5b8aa4fcd72d3e696ede8bfdbbe28e2fd52d23a0' (2024-04-18)
  → 'github:SuperSandro2000/nixpkgs/31755a107e7a2ec708a10d4cbb03c91b00108756' (2024-04-18)
2024-04-18 23:22:06 +02:00
Sandro - 1f6f96d433
dnscache: activate features that required extraFeatures enabled 2024-04-18 22:49:46 +02:00
Sandro - aa0f8b1a5a
dnscache: activate kresd extra features 2024-04-18 22:35:25 +02:00
Sandro - 19f8010560
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:SuperSandro2000/nixpkgs/eacb5e3139ae31cdb8af9b33d5c53ab3ea61527f' (2024-02-08)
  → 'github:SuperSandro2000/nixpkgs/5b8aa4fcd72d3e696ede8bfdbbe28e2fd52d23a0' (2024-04-18)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=9e41117953e31ffe355416e962ecf0e000dc594d' (2024-02-07)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=9b33b74ef71225442361d5192d3a727be212c3cd' (2024-04-18)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/50b6b5c5ae73db5d43c38371d0e6ae4221c68e35' (2024-02-08)
  → 'github:astro/nix-openwrt-imagebuilder/f206bd647a53866c62920a0cfc245a2e358c3374' (2024-04-18)
2024-04-18 22:35:25 +02:00
Sandro - 62fae6a546
dnscache: fix eval and start 2024-04-18 22:18:40 +02:00
Sandro - 721e6959b3
Configure git aliases 2024-04-18 21:37:47 +02:00
Sandro - 3c5fe9c1df
dnscache: migrate to kresd 2024-04-18 21:37:42 +02:00
Sandro - 858d6b170f
Add ns1.supersandro as secondary DNS server 2024-04-18 21:01:26 +02:00
Sandro - 57ca79dc02
Set ddns-replace-client-name 2024-04-18 19:49:38 +02:00
Astro 6b0118254d priv23: bump dhcp.time to 900 2024-04-18 19:43:21 +02:00
Astro 42e2fd8681 ap: remove unused aps 2024-04-18 19:22:44 +02:00
Astro e19caf29ba priv23: lower dhcp.time to 300 2024-04-18 19:22:29 +02:00
Astro dc4cfef526 Revert "Add ddns-update-on-renew option and higher lease time"
This reverts commit 5e36c91ef6.

This is very bad for DynDNS and our DNS servers.
2024-04-18 19:20:53 +02:00
somebody 579fe9226d DHCP: Add control socket and tools 2024-04-18 14:03:26 +02:00
Daniel Poelzleithner 5e36c91ef6 Add ddns-update-on-renew option and higher lease time
Update DDNS entries on renew of lease. Automatically
fixes stale and missing DNS entries.

increase lease time to 15 minutes on priv networks
2024-04-18 13:48:56 +02:00
Sandro - c277a38f5c
upstream: add c3d2 range back 2024-04-17 21:10:43 +02:00
Daniel Poelzleithner 7b198d98a4 priv23: update fixed ips 2024-04-17 10:20:33 +02:00
Daniel Poelzleithner f67fb9333a priv23: change mac of static host 2024-04-16 23:05:37 +02:00
Daniel Poelzleithner eb8ba4d924 ap8: use lan:2 for priv23 network 2024-04-16 22:11:58 +02:00
Astro 6e9ee9c1fe pkgs/openwrt/uci-config: add automatic option band to combat wrong defaults in openwrt 2024-04-16 21:41:27 +02:00
Daniel Poelzleithner 0ae5e86f08 ap8/priv23: route private network to port lan1 2024-04-15 23:28:09 +02:00
Daniel Poelzleithner 7a83be4be9 Add dhcpdump for debugging to package list 2024-04-15 21:15:02 +02:00
Sandro - 753cd1d5f3
upstream: reflect on entire internal network 2024-04-14 21:31:18 +02:00
Sandro - b2b8ba1252
Remove duplicated IP range 2024-04-14 14:23:49 +02:00
Sandro - bc56014b83
Cleanup 2024-04-14 13:44:00 +02:00
Sandro - 0cfb02df6c
Disable mail in serv network, disable port forwards for mail 2024-04-13 15:13:41 +02:00
Sandro - f89eb6146d
upstream: fix mail forward 2024-04-12 23:38:41 +02:00
Sandro - 8c03619c0d
Update mail name 2024-04-12 18:21:16 +02:00
Sandro - 8c844dedd2
Just copy more upstream code to not do stupid mistakes 2024-04-12 00:18:15 +02:00
Sandro - 6a29757919
Fix eval and nat rules 2024-04-12 00:12:12 +02:00
Sandro - 611ac377be
upstream: fix masquerading 2024-04-12 00:01:55 +02:00
Sandro - a2f7356c53
Drop nat reflection
We want to preserve the source ip address especially when using ip allow
lists
2024-04-11 21:59:58 +02:00
Sandro - d76a1c5d25
Reflect 80, 443, 53 2024-04-11 21:12:54 +02:00
Sandro - 795571316f
Drop leon 2024-04-11 21:12:50 +02:00
Sandro - cb616b8b88
serv: add gitea v6 2024-04-08 13:47:56 +02:00
Astro 22a4fb5c39 replace ap54 with ap72 2024-04-03 20:53:13 +02:00
Tassilo - faf3f4eb23
renaming one network allocation addr from internal space 2024-04-01 18:11:41 +02:00
Sandro - f2ac3a3ae2
Remove duplicated -t argument 2024-03-23 23:32:23 +01:00
Astro 4f82d29f79 pkgs/openwrt/uci-config: uciDeleteAll wireless.radio 2024-03-10 20:46:39 +01:00
Astro 69d4bac929 net/mgmt: add ap72 2024-03-10 19:20:51 +01:00
Astro 5bfc31eae3 ap72: prepare 2024-03-10 19:19:20 +01:00
Astro ba0c26319c options: allow "HT40" for wifi htmode 2024-03-03 00:21:38 +01:00
Astro c181d9ad19 doc/hello: update openwrt model recommendations 2024-02-21 18:02:01 +01:00
Astro db45aa1cec pkgs/openwrt: update openwrt 18.06.9 hashes 2024-02-20 10:32:46 +01:00
Sandro - 38f08272a8
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:SuperSandro2000/nixpkgs/a01cce68456d5c9df5d9620f3e0f8194c4457a45' (2024-02-08)
  → 'github:SuperSandro2000/nixpkgs/eacb5e3139ae31cdb8af9b33d5c53ab3ea61527f' (2024-02-08)
2024-02-08 22:49:20 +01:00
Sandro - 61731ca8bb
flake: fix 2024-02-08 20:40:35 +01:00
Sandro - 93398a69b9
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'git+file:///home/sandro/src/nixpkgs' (2024-02-06)
  → 'github:SuperSandro2000/nixpkgs/a01cce68456d5c9df5d9620f3e0f8194c4457a45' (2024-02-08)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=c51d49ba3974ff9e350261bc023970f1d809962e' (2024-02-04)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=9e41117953e31ffe355416e962ecf0e000dc594d' (2024-02-07)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/443a26d41300963899e91bc130eee838b20fba9e' (2024-02-06)
  → 'github:astro/nix-openwrt-imagebuilder/50b6b5c5ae73db5d43c38371d0e6ae4221c68e35' (2024-02-08)
2024-02-08 20:38:01 +01:00
Sandro - 87cea37356
Revert bad change 2024-02-08 20:04:32 +01:00
Sandro - e6b77b8946
c3d2iot: bump dhcp time 2024-02-06 20:21:54 +01:00
Sandro - 14ce3fa31e
c3d2iot: add wled-fairydust 2024-02-06 19:55:24 +01:00
Sandro - f22fc0cd21
defaults: add dig 2024-02-06 18:53:47 +01:00
Sandro - f367cd84e1
c3d2iot: disable firewall for now 2024-02-06 18:22:27 +01:00
Sandro - 59c77fd898
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/f4a8d6d5324c327dcc2d863eb7f3cc06ad630df4' (2024-01-29)
  → 'github:nixos/nixpkgs/9f2ee8c91ac42da3ae6c6a1d21555f283458247e' (2024-02-05)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=8a7f667fb53eb242b684e9c96124778bdee8b743' (2024-01-31)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=c51d49ba3974ff9e350261bc023970f1d809962e' (2024-02-04)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/a288a4b0d2ae43c87dbe44e39214d5c48c3fc0f0' (2024-02-04)
  → 'github:astro/nix-openwrt-imagebuilder/443a26d41300963899e91bc130eee838b20fba9e' (2024-02-06)
2024-02-06 18:19:37 +01:00
Sandro - da788522ab
c3d2iot: increase dhcp lease time, dump freifunk upstream 2024-02-06 18:18:19 +01:00
Astro df3d446992 pkgs/subnetplan/render.rb: fix 2024-02-05 04:07:45 +01:00
Astro 65127a79aa nixos-module/firewall: fix allowing ospf on routers 2024-02-05 03:52:02 +01:00
Astro 19527e47fd nixos-module/firewall: allow ospf on routers 2024-02-05 03:45:26 +01:00
Astro cf1a645d54 cluster: add vlan c3d2iot to servers 2024-02-05 01:34:17 +01:00
Astro de5e360e72 lib/dns: add c3d2iot to dynamicReverseZones4 2024-02-05 01:08:12 +01:00
Astro 09d01a5f43 ap71: prepare 2024-02-05 00:43:37 +01:00
Astro 46debf50c5 nixos-module/firewall: fix 2024-02-04 22:33:47 +01:00
Astro 19f0ae856f openwrt: update sha256 for legacy release 2024-02-04 22:33:25 +01:00
Astro f780643294 c3d2iot: disable disassocLowAck 2024-02-04 22:33:07 +01:00
Astro 6b3005ec1f ap2, ap31: fix c3d2iot 2024-02-04 21:18:39 +01:00
Astro 63328e8cdc contact.md: update 2024-02-04 20:55:25 +01:00
Astro 26bd8446b4 c3d2iot: set wifi psk 2024-02-04 20:53:12 +01:00
Astro f255d09d70 c3d2iot: rename c3d2iot-gw to iot-gw 2024-02-04 20:01:34 +01:00
Astro 8dcb480ea3 c3d2iot: fix addr 2024-02-04 19:57:07 +01:00
Astro 51919fa5d2 c3d2iot: prepare 2024-02-04 19:54:50 +01:00
Astro 9c765d05e0 ap58: remove wlan5-pub
on this device 5ghz is used for backhaul
2024-02-04 03:45:08 +01:00
Astro 85340e955d ap65: fix priv27 bridge 2024-01-31 21:27:18 +01:00
Astro cc172cf61e move priv27, reuse priv41 2024-01-31 20:27:21 +01:00
Astro 5758b028f4 priv49: deploy 2024-01-31 19:59:29 +01:00
Astro 872a2aad0d ap11: fix model 2024-01-31 19:32:17 +01:00
Astro 379e8cf9e6 flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/d2003f2223cbb8cd95134e4a0541beea215c1073' (2024-01-19)
  → 'github:nixos/nixpkgs/f4a8d6d5324c327dcc2d863eb7f3cc06ad630df4' (2024-01-29)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=7338733dc94e3e3b5f3a32d98e9719af20be6cc0' (2024-01-20)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=8a7f667fb53eb242b684e9c96124778bdee8b743' (2024-01-31)
2024-01-31 17:10:47 +01:00
Astro 0a9d749e64 ap57: switch roof 5ghz wifi from VHT80 to HT40 2024-01-30 23:38:35 +01:00
Astro 7720bc6160 ap19: update 2024-01-30 23:35:59 +01:00
Astro 7cbc0b4ecf vpn-gw: update a key 2024-01-30 23:35:29 +01:00
Astro 797886af1e vpn-gw: add peer 2024-01-27 23:57:47 +01:00
Sandro - 7c0e748b77
dns: fix more eval 2024-01-27 23:50:54 +01:00
Sandro - 0b2cc008b4
dns: fix eval 2024-01-27 23:49:11 +01:00
Sandro - 6122a49883
Rename bind to knot 2024-01-27 23:27:11 +01:00
Sandro - 4419a70661
Use variable for port forward 2024-01-27 23:20:07 +01:00
Astro 751a8279de contact.md: update 2024-01-22 15:53:44 +01:00
Astro f9782c3a4f ap69: deploy 2024-01-22 00:03:02 +01:00
Astro 7664394354 ap69, ap70: prepare 2024-01-21 23:16:25 +01:00
Astro 7af4dc6732 flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/1e2e384c5b7c50dbf8e9c441a9e58d85f408b01f' (2023-12-17)
  → 'github:nixos/nixpkgs/d2003f2223cbb8cd95134e4a0541beea215c1073' (2024-01-19)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=fd6831731b9bde3847c7d8fd8dae528d863017dd' (2023-12-18)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=7338733dc94e3e3b5f3a32d98e9719af20be6cc0' (2024-01-20)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/130f7e8f40ceece87056b4aea866845c6d1b9b6b' (2023-12-18)
  → 'github:astro/nix-openwrt-imagebuilder/593e499e5fa5e92775f65d2a9bb1754b941d3e4a' (2024-01-21)
2024-01-21 20:21:37 +01:00
Sandro - 7a04f2d556
serv: cleanup 2023-12-30 00:11:54 +01:00
Astro a91e96900b network-homepage: add /security.txt 2023-12-29 17:20:23 +01:00
Sandro - 4c46e4befe
c3d2: add v4 for schalter to fix kea 2023-12-29 04:13:20 +01:00
Sandro - f83ff221b9
c3d2: add schalter back 2023-12-29 02:17:25 +01:00
Astro aaa5adab62 upstream4: add dn42 port forwarding 2023-12-28 21:15:21 +01:00
Sandro - 868e492014
Don't busyloop when fifo file is missing 2023-12-26 00:16:02 +01:00
Sandro - ab941d3770
Add htop 2023-12-26 00:09:29 +01:00
Markus Schmidl cdbd21c017 net/flpk: add ctf host 2023-12-24 20:01:23 +01:00
Sandro - 3167524757
flpk: cleanup 2023-12-24 18:57:03 +01:00
Astro 7605141e3e pkgs/openwrt/uci-config: create bridge devices for DSA 2023-12-20 23:37:27 +01:00
Astro cbf7404027 pkgs/openwrt/uci-config: revamp DSA config 2023-12-20 22:37:09 +01:00
Astro cda8b4bfbc ap67, ap68: fix priv12 2023-12-20 22:12:46 +01:00
Astro 30dab76fca ap67, ap68: deploy 2023-12-19 02:20:59 +01:00
Astro 571365548c pkgs/openwrt/uci-config: add config for Distributed Switch Architecture 2023-12-19 02:16:52 +01:00
Astro a8bb090bba nix/pkgs/openwrt/usteer-stats: fix fifo path to writable location 2023-12-19 02:16:13 +01:00
Astro e4337940bf ap66: fix 2023-12-18 23:23:58 +01:00
Astro 4aba3c5961 pkgs/openwrt/uci-config: make uci stats scripts +x 2023-12-18 22:34:39 +01:00
Astro a1dbc3d300 priv48: fix dhcp range 2023-12-18 22:31:20 +01:00
Astro 67bdd9cbfd ap66: deploy 2023-12-18 22:22:20 +01:00
Astro 7d5ec3c831 flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/781e2a9797ecf0f146e81425c822dca69fe4a348' (2023-12-10)
  → 'github:nixos/nixpkgs/1e2e384c5b7c50dbf8e9c441a9e58d85f408b01f' (2023-12-17)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=d6b62611b845ea90ad4c901e28fa1787c4b7e9e5' (2023-11-24)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=fd6831731b9bde3847c7d8fd8dae528d863017dd' (2023-12-18)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/86b569526dfce69df8bc1fc7dc5d7b3f09ea52d3' (2023-11-26)
  → 'github:astro/nix-openwrt-imagebuilder/130f7e8f40ceece87056b4aea866845c6d1b9b6b' (2023-12-18)
2023-12-18 21:44:15 +01:00
Astro 0c74a10ac2 priv48-gw: fix 2023-12-18 21:41:03 +01:00
Astro 875f828ef0 c3d2: fix dhcp range 2023-12-18 21:37:50 +01:00
Astro d6279db3ec priv48: prepare 2023-12-18 21:36:57 +01:00
Sandro - 07eaed643f
Add pipebert ipv6 to fix deployment over ipv6 2023-12-17 16:40:47 +01:00
Sandro - 6e2b5e2c5b
serv: add vaultwarden, pretalx v6 2023-12-16 18:37:58 +01:00
Sandro - 71a3c1b687
Delete tmppleroma 2023-12-16 18:37:52 +01:00
Sandro - 754d8168fb
serv: add vaultwarden, pretalx 2023-12-16 18:34:22 +01:00
Jan Böhme bc72cbe596 priv2: fix for dhcp config, upstream4: added forwared port 2023-12-12 17:46:07 +01:00
Astro 45c4938ad1 nixos-module/container/bird: fix check-upstream-ipv[46] ping path 2023-12-11 22:28:26 +01:00
Astro 86add1041d nixos-module/container/bird: fix for site.net.*.dhcp == null 2023-12-11 21:35:27 +01:00
Astro 60e7ce4f51 flake.nix: nixos 23.05 -> 23.11 2023-12-11 20:48:26 +01:00
Sandro - 072867a2a6
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:SuperSandro2000/nixpkgs/c7ea327afe69a5431c4088186035f93660ffe16c' (2023-11-08)
  → 'github:SuperSandro2000/nixpkgs/337b3996fc95c5d53bc1af2ca650aa85b56c3c92' (2023-11-26)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=d3c193525e6210da2834050e92a077d408381320' (2023-11-06)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=d6b62611b845ea90ad4c901e28fa1787c4b7e9e5' (2023-11-24)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/5eac42bca97629365c763a6ab68f8ef38a338c8d' (2023-11-07)
  → 'github:astro/nix-openwrt-imagebuilder/86b569526dfce69df8bc1fc7dc5d7b3f09ea52d3' (2023-11-26)
2023-11-26 20:42:14 +01:00
Astro 13426907df remove pre-openwrt-imagebuilder configs 2023-11-18 03:31:51 +01:00
Astro dbc0e14f63 nixos-module/container/dhcp-server: don't set max-valid-lifetime but hold-reclaimed-time
hope that works without depleting the address pools
2023-11-14 23:30:41 +01:00
Astro dd3d650e46 nixos-module/container/dhcp-server: s/lib.optionalAttrs/lib.mkIf/ 2023-11-14 23:26:33 +01:00
Astro dc27ba9a69 stream.serv: fix addrs
fixes an ip6 reverse zone occuring twice in localZones.
2023-11-13 23:53:54 +01:00
Astro aee094ada3 net/serv: remove bogus fd42:42:c3d2:: address 2023-11-13 23:43:10 +01:00
Astro a138bc2d98 nixos-module/container/dhcp-server: set dhcp6 dns info 2023-11-13 23:35:54 +01:00
Astro aa81a890f3 pkgs/default: s/nixpkgs.lib/lib/ 2023-11-13 23:35:30 +01:00
Astro 93a1ac7ee9 pkgs/default: fix #export-config to contain both config and localZones 2023-11-13 23:34:51 +01:00
Astro 4e6dd9a4a1 nix/lib/config/options: remove net-combined 2023-11-13 23:33:35 +01:00
Astro 125beb091d priv19: remove extra dhcp.max-time config 2023-11-13 23:30:57 +01:00
Astro a9bebbe3a0 nixos-module/container/dhcp-server: just set Restart for kea-*-server.service 2023-11-13 23:14:16 +01:00
Astro c40997bacc nixos-module/container/dhcp-server: use the proper max-valid-lifetime parameter instead of calculating timers 2023-11-13 22:46:51 +01:00
Sandro - 6c6c6f30b0
kea: tweak renew,rebind timer to 2.5min/5min, change max-time of c3d2 to 1d 2023-11-13 19:53:32 +01:00
Astro 352d95bf55 pkgs/openwrt/usteer-stats.sh: output stats for all wlan interfaces 2023-11-10 19:28:02 +01:00
Astro ec47077368 lib/dns: split dynamicReverseZones for ipv4/ipv6 to avoid ip6.arpa zones ending up in reverseZones4 2023-11-10 00:43:57 +01:00
Astro 3295a15758 config/net/{c3d2,pub}: wiggle dhcp pool and times 2023-11-08 20:52:26 +01:00
Sandro - 7cc8115896
Add ripgrep 2023-11-08 01:13:30 +01:00
Sandro - 88a8c9f3e2
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:SuperSandro2000/nixpkgs/2b29ce8cfbbc7967bd86016eda3944af22869bf4' (2023-11-04)
  → 'github:SuperSandro2000/nixpkgs/c7ea327afe69a5431c4088186035f93660ffe16c' (2023-11-08)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=ec54022549f90ba4b72ac4f089ee46510c7127e4' (2023-11-04)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=d3c193525e6210da2834050e92a077d408381320' (2023-11-06)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/5f000c690764b3f64cbb58dbc31d7c6be182d59d' (2023-11-05)
  → 'github:astro/nix-openwrt-imagebuilder/5eac42bca97629365c763a6ab68f8ef38a338c8d' (2023-11-07)
2023-11-08 01:12:54 +01:00
Sandro - bac3c5ba02
Disable assoc steering, initial delay, add comment, cleanup old comment
People should not notice any delay when initially connecting and their
device hopefully choose an AP with good connection
2023-11-06 01:39:14 +01:00
Sandro - 588b86e1dc
flake.lock: Update
Flake lock file updates:

• Updated input 'openwrt-imagebuilder':
    'git+file:///home/sandro/src/github.com/astro/nix-openwrt-imagebuilder' (2023-11-04)
  → 'github:astro/nix-openwrt-imagebuilder/5f000c690764b3f64cbb58dbc31d7c6be182d59d' (2023-11-05)
2023-11-06 01:36:29 +01:00
Sandro - b9a2208602
Add comment 2023-11-05 23:59:32 +01:00
Sandro - e155bc1b1b
Add tmux 2023-11-05 23:59:25 +01:00
Sandro - 1732598123
Fix another chmod +x 2023-11-05 22:47:26 +01:00
Sandro - cd15bb1c9c
Add +x 2023-11-05 04:41:39 +01:00
Sandro - 14ca5736b2
flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:SuperSandro2000/nixpkgs/2b6e730df4c428d340b01efecf9199269c853eeb' (2023-10-29)
  → 'github:SuperSandro2000/nixpkgs/2b29ce8cfbbc7967bd86016eda3944af22869bf4' (2023-11-04)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=64ab02aff86839dad65d97d38ed302c73b22ad40' (2023-10-29)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=ec54022549f90ba4b72ac4f089ee46510c7127e4' (2023-11-04)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/bc529bf83f17e440e3c0e32a6f777dae59b24fc6' (2023-10-29)
  → 'github:astro/nix-openwrt-imagebuilder/98962168b64ee5456aeb2de8169a61c971050a28' (2023-11-04)
2023-11-05 04:13:34 +01:00
Sandro - 6547d4808c
Comment lots of things, use ft-over-air, set reassociation_deadline to 20s from 1s 2023-11-05 04:11:21 +01:00
Sandro - a84afb3a95
Throw out old and noisy candelatech firmware 2023-11-05 04:10:44 +01:00
Sandro - d2ed5665fc
Add comments 2023-11-05 03:46:53 +01:00
Astro 36dbe33fa4 pkgs/openwrt/default: fix script perms 2023-11-03 21:48:31 +01:00
Astro 82c6c49da4 ap65: deploy 2023-11-03 21:10:01 +01:00
Astro 6735263bcf cabling: port discovery! 2023-11-03 20:36:08 +01:00
Astro e50531209c pkgs/openwrt/usteer-stats.sh: fix by outputting types 2023-11-03 20:36:08 +01:00
Astro ccd904f700 pkgs/openwrt/uci-config: configure a static ieee80211rKey so that fast transition works with WPA3 2023-11-03 20:36:08 +01:00
Sandro - fa5ef40657
Name legacy consistent, add ZW Public where missing 2023-11-01 04:02:40 +01:00
Sandro - 80c94ba7a1
Fix legacy on 5 Ghz 2023-11-01 04:02:15 +01:00
Sandro - 24145d86c4
Switch to 20 Mhz bands on 2.4 Ghz 2023-11-01 04:01:50 +01:00
Astro 10bcbd5d52 nix/pkgs/openwrt: add usteer stats 2023-11-01 01:22:43 +01:00
Astro 779cbe9795 pkgs/openwrt/uci-config: properly set mobility_domain, nasid to fix fast transition 2023-11-01 01:14:47 +01:00
Astro 053b49b83f net/serv: fix syntax 2023-10-29 22:00:34 +01:00
Astro 4dfba56509 net/serv: add activity-relay 2023-10-29 20:49:14 +01:00
Sandro - 933cdbac0c
network: don't wait for all interfaces to be online 2023-10-29 18:50:22 +01:00
Sandro - 01572b34c2
Switch to nixos-23.05 fork 2023-10-29 18:30:39 +01:00
Astro dab9f5d1e6 net/{c3d2,priv,pub}: increment dhcp times for stability 2023-10-29 17:56:13 +01:00
Astro b78f9c9305 nixos-module/container/dhcp-server: fix reservations by moving them from global dhcp4 config to subnet4 2023-10-28 03:40:15 +02:00
Astro 0e2c4c7afd nixos-module/container/dhcp-server: fix reservations 2023-10-28 03:20:51 +02:00
Astro 4901048463 config/net/*: lower dhcp times 2023-10-28 01:05:06 +02:00
Astro 6ac42aa334 nixos-module/container/dhcp-server: disable dyndns conflict resolution for dual stack operation 2023-10-28 00:45:24 +02:00
Astro 07963d1b61 nixos-module/container/dhcp-server: enable dhcp6-server just for dyndns 2023-10-27 23:46:06 +02:00
Astro 7149638ef0 pkgs/openwrt/uci-config: try some usteer tuning 2023-10-27 23:46:06 +02:00
Sandro - 5bf28d9326
Add comments 2023-10-27 19:52:03 +02:00
Astro 7722eb6243 nix/nixos-module/container/dhcp-server: fix dyndns and stats 2023-10-24 01:17:41 +02:00
Astro 9b39803076 nix/nixos-module/container/dhcp-server: migrate from isc-dhcpd to kea-dhcp4 2023-10-24 00:57:25 +02:00
Astro db71886898 flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/81122565d7e8cb02536fa2bbcf4573c2a770d967' (2023-09-20)
  → 'github:NixOS/nixpkgs/c1cc5a1dc6ead6839b6dc0ebe29b36ba1daaf59c' (2023-10-20)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=4245adf4e0597c4a44c396dbe2206f26f73a1555' (2023-10-14)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=4afff7b8b54c3b246fba30ed83dfac527e78e57d' (2023-10-20)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/dac9cd8abfbf1254546eb12f0610fbc6cae9a709' (2023-10-15)
  → 'github:astro/nix-openwrt-imagebuilder/9b83af25f73021cea155004a8a42e4c195e27b5e' (2023-10-20)
2023-10-21 00:55:40 +02:00
Astro e034170ce2 pkgs/openwrt: install and configure usteerd 2023-10-21 00:50:55 +02:00
Astro 7856805718 nixos-module/server/defaults: install liboping 2023-10-20 22:03:22 +02:00
Tassilo - 094380ebb7
add rtrlab 2023-10-19 15:19:13 +02:00
Tassilo - 81bd3825a1
fixing v6 addr for server7 2023-10-18 23:22:23 +02:00
Tassilo - 4f53cc3508
removing server7 as section 2023-10-18 22:46:49 +02:00
Tassilo - 4a32f6d021
putting server7 into flpk and reserving ipv4 for dd-dns 2023-10-18 22:45:18 +02:00
Astro d507a95d9b nix/pkgs/openwrt/default: update pkgs for openwrt 23.05 2023-10-15 22:12:38 +02:00
Astro 5740e8b6e5 flake.nix: update input openwrt to 23.05 2023-10-15 19:43:12 +02:00
Astro 1dea065c82 flake.lock: Update
Flake lock file updates:

• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=92a0dd2447bda9a6d5440f4a94d9b617406e3f76' (2023-09-17)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05&rev=4245adf4e0597c4a44c396dbe2206f26f73a1555' (2023-10-14)
2023-10-15 19:42:48 +02:00
Astro b839192f7b flake.lock: Update
Flake lock file updates:

• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/4edbf74f124cd49f30705f82b6127741cbc4447e' (2023-09-25)
  → 'github:astro/nix-openwrt-imagebuilder/dac9cd8abfbf1254546eb12f0610fbc6cae9a709' (2023-10-15)
2023-10-15 19:40:23 +02:00
Tassilo - b7178ba555
removing link aggregation 2023-10-08 01:31:55 +02:00
Sandro - 8750906814
Enable fzf 2023-10-07 16:47:06 +02:00
Tassilo - 5fa2fbb024
adding dresden-zone-dns 2023-10-06 21:04:14 +02:00
Astro d33c0fa2c7 switch-b3: plug priv12 2023-09-29 00:21:17 +02:00
Astro 0aa6cb7828 pkgs/openwrt/uci-config: add support for disassoc_low_ack as used with ap57 2023-09-25 22:06:14 +02:00
Astro fc5f04850a switch-a1: stage many ports 2023-09-25 19:42:18 +02:00
Astro 3f654da630 ap42: plug out ap21 2023-09-21 00:11:49 +02:00
Astro cbb3e618e3 ap38: create br-priv47 2023-09-20 23:23:28 +02:00
Astro f04dcee530 upstream4: remove NAT reflection for dns
doesn't make sense, right?
2023-09-20 22:43:56 +02:00
Astro 30749a5a2b ap24: try to provide priv12 on lan ports 2023-09-20 22:43:21 +02:00
Astro 8c0ac6ba79 flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/18388d019974e90a035bdb938a8a3ca3c0408db9' (2023-06-04)
  → 'github:NixOS/nixpkgs/81122565d7e8cb02536fa2bbcf4573c2a770d967' (2023-09-20)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=171b51519206b5e66ebd01d322f41d790976ce87' (2023-06-03)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=92a0dd2447bda9a6d5440f4a94d9b617406e3f76' (2023-09-17)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/b5901ec9361152f1f588445d1b3f06239ea4b86c' (2023-06-04)
  → 'github:astro/nix-openwrt-imagebuilder/083b982deb6c92848051708f41ba8315fe838a10' (2023-09-20)
2023-09-20 22:41:00 +02:00
Astro dfba6ae3b1 priv47: prepare and plug into ap38 2023-09-20 22:39:53 +02:00
Astro e2bd0ba1ca switch-c3d2-main: deploy another VOC port 2023-09-17 17:49:01 +02:00
Astro d38bb3f450 switch-a1: move port 2 to pub 2023-09-16 00:35:15 +02:00
Astro 39ac6cbc49 switch-ds1: deploy priv25 2023-09-15 19:30:39 +02:00
Astro 58d8d50751 switch: reflect actual plugging 2023-09-14 20:08:21 +02:00
Astro d42bbf429b switch-a1: ds23 2023-09-14 19:22:53 +02:00
Astro 9bff1f171e switch-ds3: deploy 2023-09-14 18:22:28 +02:00
Astro 8e878d1d75 switch-c3d2-main: rm dup vlan 2023-09-14 18:07:31 +02:00
Astro 8b53a1b681 switch-c3d2-main: add more VOC ports 2023-09-14 18:03:04 +02:00
Markus Schmidl 889021152c config/net/serv: add tlms-ctfd 2023-08-25 21:37:54 +02:00
Astro 3ac9e008f6 ap10: fix 2023-07-18 22:08:10 +02:00
Sandro - aa19bcb24f
Revert "Fix schalter ipv6"
This reverts commit 13379379f9.
2023-07-05 23:27:42 +02:00
Sandro - 13379379f9
Fix schalter ipv6 2023-06-25 20:20:02 +02:00
Astro 6c4c86e4a5 nixos-module/container/upstream: flush conntrack states after nat startup 2023-06-07 23:00:50 +02:00
Astro e48343ac8c net/core: add coloradio-gw 2023-06-05 01:32:57 +02:00
Astro 07433f8e7e nixos-module/container/dns: make nsupdate use TCP 2023-06-05 01:25:32 +02:00
Astro b8d27ab9ca nixos-module/container/lxc-config: simplify 2023-06-05 01:25:04 +02:00
Astro c41f5c56a6 nix/nixos-module/server/lxc-containers: make container config independend of host system 2023-06-05 01:17:05 +02:00
Astro e76c8a9a3a pkgs/switches/junos: update password hash method from SHA-256 to SHA-512 2023-06-05 00:27:24 +02:00
Astro 4ada8878fc upstream4: forward 8000/tcp for coloradio 2023-06-04 23:43:45 +02:00
Astro 674f119168 nixos-module/server/lxc-containers: fix container config syntax 2023-06-04 23:43:29 +02:00
Astro 5fa0ac96ff server2: remove deprecated boot.loader.grub.version 2023-06-04 23:36:49 +02:00
Astro d3446c1a94 flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/4ecab3273592f27479a583fb6d975d4aba3486fe' (2023-05-31)
  → 'github:NixOS/nixpkgs/18388d019974e90a035bdb938a8a3ca3c0408db9' (2023-06-04)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=ce32068bf2d85e03d3dd034ab345d55247e5626c' (2023-05-28)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=171b51519206b5e66ebd01d322f41d790976ce87' (2023-06-03)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/c600f6dbe0516b34a307d9ec69015e123ec859a4' (2023-05-31)
  → 'github:astro/nix-openwrt-imagebuilder/b5901ec9361152f1f588445d1b3f06239ea4b86c' (2023-06-04)
2023-06-04 23:35:21 +02:00
Astro 22b08ab0b1 config/secrets: generate site.dyndnsKey that is accepted by dhcpd 2023-06-04 23:35:21 +02:00
Astro f73d4b64dc nixos-module/server/lxc-containers: prevent restart on host nixos-rebuild switch 2023-06-04 23:35:21 +02:00
Astro 87cf64653c nixos-module/server/lxc-containers: shorten coloradio iface names 2023-06-04 23:35:21 +02:00
Astro 8bb6821b87 prepare for nixos 23.05 2023-06-04 23:35:19 +02:00
Astro 371d41b69b flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/781df3d2de37ace250ba3c2731606c0b6bee465b' (2023-04-14)
  → 'github:NixOS/nixpkgs/4ecab3273592f27479a583fb6d975d4aba3486fe' (2023-05-31)
• Updated input 'openwrt':
    'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=9af29da281213108cd861ed77b0416bf6eda0aaf' (2023-04-13)
  → 'git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03&rev=ce32068bf2d85e03d3dd034ab345d55247e5626c' (2023-05-28)
• Updated input 'openwrt-imagebuilder':
    'github:astro/nix-openwrt-imagebuilder/b3d1f398472452ea288ce2d8dbf20d6115bf1c64' (2023-04-14)
  → 'github:astro/nix-openwrt-imagebuilder/c600f6dbe0516b34a307d9ec69015e123ec859a4' (2023-05-31)
2023-06-04 23:34:50 +02:00
Astro d797cdd3a2 flake.nix: bump inputs.nixpkgs from 22.11 to 23.05 2023-06-04 23:34:50 +02:00
Sandro - d410bf0d82
Add telnet 2023-06-01 21:35:46 +02:00
Sandro - f46e961d1b
Format 2023-06-01 21:35:46 +02:00
54 changed files with 2017 additions and 18769 deletions

View File

@ -26,7 +26,7 @@ Alle Stecker im Haus sind in Schema A gecrimpt.
| | ![][gi] B 2.05.02 | ![][gi] UVB 1.09 | | 14 |
| ![][ri] B 4.02.01 *v* | ![][gi] B 2.05.05 | ![][gi] UVB 1.10 | | 15 |
| ![][ri] B 4.01.01 *v* | ![][gi] B 2.05.06 | ![][gi] 1.06 | | 16 |
| ![][ri] B 4.03.01 | ![][gi] B 2.05.03 *v* | | | 17 |
| ![][ri] B 4.03.01 *v* | ![][gi] B 2.05.03 *v* | ![][gi] 1.16 *v* | | 17 |
| ![][ri] B 4.04.01 *v* | ![][gi] B 2.05.07 *v* | | | 18 |
| ![][ri] B 4.05.02 *v* | ![][gi] B 2.06 | | | 19 |
| ![][ri] B 4.06.01 *v* | ![][ri] B 2.07 | | | 20 |

View File

@ -33,7 +33,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
uebergangsnetz = { net = "priv6"; };
@ -60,15 +60,15 @@
};
};
location = "Turm D, 1. Etage";
model = "tl-wr841-v10";
model = "tl-wr841-v9";
role = "ap";
wifi = {
"platform/qca953x_wmac" = {
channel = 6;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"iz-dresden.org" = { net = "priv15"; };
"iz-dresden.org" = { net = "priv15"; encryption = "wpa2"; };
};
};
};
@ -92,12 +92,12 @@
};
};
location = "B 2.03.04";
model = "tplink_tl-wr1043nd-v1";
model = "tplink_tl-wr1043nd-v2";
role = "ap";
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
braeunigkoschnik = { net = "priv8"; };
@ -130,7 +130,7 @@
wifi = {
"platform/ar934x_wmac" = {
channel = 6;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"IrèneMélix" = { net = "priv38"; };
"ZW public" = { net = "pub"; };
@ -139,8 +139,6 @@
};
};
};
ap13 = { };
ap14 = { };
ap15 = {
interfaces = {
mgmt = {
@ -165,7 +163,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
etz250 = { net = "priv10"; };
@ -173,7 +171,6 @@
};
};
};
ap16 = { };
ap17 = {
interfaces = {
mgmt = {
@ -200,7 +197,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 5;
htmode = "HT40+";
htmode = "HT20";
ssids = {
EDUB = { net = "priv33"; };
"ZW public" = { net = "pub"; };
@ -234,7 +231,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"Restaurierung Wolff/Kober" = { net = "priv9"; };
"ZW public" = { net = "pub"; };
@ -262,15 +259,15 @@
};
};
location = "Turm C oberste Etage";
model = "tl-wr841-v10";
model = "tl-wr841-v11";
role = "ap";
wifi = {
"platform/qca953x_wmac" = {
channel = 6;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"Studio 01127" = { net = "priv41"; };
Walter = { net = "priv26"; };
"Bockwurst" = { net = "priv41"; encryption = "wpa2"; };
Walter = { net = "priv26"; encryption = "wpa2"; };
"ZW public" = { net = "pub"; };
};
};
@ -279,6 +276,7 @@
ap2 = {
interfaces = {
c3d2.type = "bridge";
c3d2iot.type = "bridge";
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
@ -303,15 +301,20 @@
htmode = "VHT80";
ssids = {
C3D2 = { net = "c3d2"; };
"ZW public legacy" = { net = "pub"; };
"ZW public" = { net = "pub"; };
};
};
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"C3D2 legacy" = { net = "c3d2"; };
"ZW public" = { net = "pub"; };
"C3D2 IoT" = {
net = "c3d2iot";
hidden = true;
disassocLowAck = false;
};
"ZW public legacy" = { net = "pub"; };
};
};
};
@ -342,7 +345,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 5;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
};
@ -372,7 +375,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 11;
htmode = "HT40-";
htmode = "HT20";
ssids = { "ZW public" = { net = "pub"; }; };
};
};
@ -406,7 +409,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"LBK Network" = { net = "priv30"; };
"ZW public" = { net = "pub"; };
@ -425,12 +428,9 @@
pub.type = "bridge";
};
links = {
priv12 = {
ports = [ "lan" ];
};
switch-b3 = {
ports = [ "wan" ];
};
# Ends up in /etc/config but not in `swconfig dev switch0 show`
priv12.ports = [ "lan:1" "lan:2" "lan:3" "lan:4" ];
switch-b3.ports = [ "wan" ];
};
location = "Farbwerk";
model = "tl-wr740n-v4";
@ -438,7 +438,7 @@
wifi = {
"platform/ar933x_wmac" = {
channel = 6;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; encryption = "wpa2"; };
@ -464,13 +464,13 @@
ports = [ "wan" ];
};
};
location = "Farbwerk";
location = "Farbwerk, lost";
model = "tl-wr740n-v1";
role = "ap";
wifi = {
"platform/ar933x_wmac" = {
channel = 6;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
@ -502,7 +502,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 11;
htmode = "HT40-";
htmode = "HT20";
ssids = {
Dezember = { net = "priv37"; };
"ZW public" = { net = "pub"; };
@ -533,7 +533,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = { "ZW public" = { net = "pub"; }; };
};
};
@ -561,7 +561,7 @@
wifi = {
"platform/ar934x_wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = { "ZW public" = { net = "pub"; }; };
};
};
@ -598,7 +598,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 6;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
jungnickel-fotografie = { net = "priv13"; };
@ -633,7 +633,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 128;
htmode = "HT40+";
htmode = "HT20";
ssids = {
C3D2 = { net = "c3d2"; };
"ZW public" = { net = "pub"; };
@ -641,7 +641,7 @@
};
"platform/ar934x_wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"C3D2 legacy" = { net = "c3d2"; };
"ZW public legacy" = { net = "pub"; };
@ -673,7 +673,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
WLANb0402 = { net = "priv14"; };
"ZW public" = { net = "pub"; };
@ -684,6 +684,7 @@
ap31 = {
interfaces = {
c3d2.type = "bridge";
c3d2iot.type = "bridge";
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
@ -711,9 +712,14 @@
};
"platform/ahb/18100000.wmac" = {
channel = 5;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"C3D2 legacy" = { net = "c3d2"; };
"C3D2 IoT" = {
net = "c3d2iot";
hidden = true;
disassocLowAck = false;
};
FOTOAKADEMIEdd = { net = "priv39"; };
"ZW public legacy" = { net = "pub"; };
};
@ -751,7 +757,7 @@
channel = 9;
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"ZW public legacy" = { net = "pub"; };
"ZW stage legacy" = { net = "priv25"; };
};
};
@ -786,7 +792,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"C3D2 legacy" = { net = "c3d2"; };
"ZW public legacy" = { net = "pub"; };
@ -823,7 +829,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
etz250 = { net = "priv10"; };
@ -855,7 +861,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
Koch = { net = "priv18"; };
"ZW public" = { net = "pub"; };
@ -887,7 +893,7 @@
wifi = {
"platform/ar933x_wmac" = {
channel = 5;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"C3D2 legacy" = { net = "c3d2"; };
"ZW public" = { net = "pub"; };
@ -924,11 +930,10 @@
};
"platform/ahb/18100000.wmac" = {
channel = 6;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"hechtfilm.de legacy" = { net = "priv19"; };
"LIZA".net = "priv43";
};
};
};
@ -942,6 +947,7 @@
};
priv20.type = "bridge";
priv28.type = "bridge";
priv47.type = "bridge";
pub.type = "bridge";
};
links = {
@ -967,11 +973,12 @@
};
"platform/ahb/18100000.wmac" = {
channel = 11;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW heinrichsgarten" = { net = "priv28"; };
"ZW public" = { net = "pub"; };
plop = { net = "priv20"; };
millimeter = { net = "priv47"; };
};
};
};
@ -1000,7 +1007,7 @@
wifi = {
"platform/10180000.wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = {
EckiTino = { net = "priv7"; };
"ZW public" = { net = "pub"; };
@ -1033,7 +1040,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 11;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"jam-circle.de" = { net = "priv4"; };
@ -1052,12 +1059,9 @@
pub.type = "bridge";
};
links = {
priv22 = {
ports = [ "lan:1" "lan:2" "lan:3" "lan:4" ];
};
switch-b3 = {
ports = [ "wan" ];
};
priv22.ports = [ "lan:2" "lan:3" "lan:4" ];
ap70.ports = [ "lan:1" ];
switch-b3.ports = [ "wan" ];
};
location = "B4.01";
model = "tplink_archer-c7-v5";
@ -1073,7 +1077,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 6;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"M legacy" = { net = "priv22"; };
"ZW public" = { net = "pub"; };
@ -1113,7 +1117,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 6;
htmode = "HT40-";
htmode = "HT20";
ssids = {
Walter = { net = "priv26"; };
"ZW public" = { net = "pub"; };
@ -1132,8 +1136,8 @@
pub.type = "bridge";
};
links = {
ap21.ports = [ "lan:3" ];
priv4.ports = [ "lan:1" "lan:2" "lan:4" ];
# ap21.ports = [ "lan:3" ];
priv4.ports = [ "lan:1" "lan:2" "lan:3" "lan:4" ];
switch-b3.ports = [ "wan" ];
};
location = "Dresden School of Lindy Hop";
@ -1142,7 +1146,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 128;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"jam-circle.de" = { net = "priv4"; };
@ -1150,7 +1154,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 11;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"jam-circle.de legacy" = { net = "priv4"; };
@ -1407,7 +1411,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"verbalwerk.de" = { net = "priv5"; };
@ -1486,7 +1490,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
antrares = { net = "priv17"; };
@ -1555,7 +1559,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"Karen Koschnick" = { net = "priv11"; };
"ZW public" = { net = "pub"; };
@ -1581,13 +1585,13 @@
ports = [ "wan" ];
};
};
location = "B1.05.02";
location = "Removed";
model = "tplink_archer-c7-v5";
role = "ap";
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 128;
htmode = "HT40+";
htmode = "HT20";
ssids = {
Abyssinia = { net = "priv35"; };
"ZW public" = { net = "pub"; };
@ -1595,7 +1599,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
Abyssinia = { net = "priv35"; };
"ZW public" = { net = "pub"; };
@ -1704,9 +1708,12 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 100;
htmode = "VHT80";
htmode = "HT40";
ssids = {
"Zentralwerk" = { net = "roof"; };
"Zentralwerk" = {
net = "roof";
disassocLowAck = false;
};
"ZW public" = { net = "pub"; };
};
};
@ -1799,7 +1806,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 6;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"Ebs 2000" = { net = "priv21"; };
@ -1830,7 +1837,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 13;
htmode = "HT40-";
htmode = "HT20";
ssids = { "ZW public" = { net = "pub"; }; };
};
};
@ -1859,7 +1866,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 128;
htmode = "HT40+";
htmode = "HT20";
ssids = {
Abyssinia = { net = "priv35"; };
"ZW public" = { net = "pub"; };
@ -1867,7 +1874,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
Abyssinia = { net = "priv35"; };
"ZW public" = { net = "pub"; };
@ -1895,7 +1902,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 36;
htmode = "HT40+";
htmode = "HT20";
ssids = {
tomiru = { net = "priv44"; };
"ZW public" = { net = "pub"; };
@ -1903,7 +1910,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
tomiru = { net = "priv44"; };
"ZW public" = { net = "pub"; };
@ -1943,7 +1950,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"Wolke7 legacy" = { net = "priv45"; encryption = "wpa2"; };
"ZW public" = { net = "pub"; };
@ -1975,7 +1982,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 36;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
EckiTino = { net = "priv7"; };
@ -1983,7 +1990,7 @@
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"EckiTino legacy" = { net = "priv7"; };
@ -2015,7 +2022,7 @@
wifi = {
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
"Princess Castle" = { net = "priv46"; };
@ -2023,6 +2030,195 @@
};
};
};
ap65 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv12.type = "bridge";
priv27.type = "bridge";
pub.type = "bridge";
};
links = {
switch-b3.ports = [ "lan" ];
};
location = "El Perro";
model = "ubnt_unifi-6-lite";
role = "ap";
wifi = {
"1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0" = {
channel = 6;
htmode = "HT20";
ssids = {
"ZW public".net = "pub";
"farbwerk".net = "priv12";
"Kaffeetasse".net = "priv27";
};
};
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0" = {
channel = 149;
htmode = "VHT80";
ssids = {
"ZW public".net = "pub";
"farbwerk".net = "priv12";
};
};
};
};
ap66 = {
interfaces = {
priv48.type = "bridge";
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
pub.type = "bridge";
};
links = {
priv48.ports = [ "lan:1" "lan:2" "lan:3" "lan:4" ];
switch-b3.ports = [ "wan" ];
};
location = "B 4.03.01";
model = "tplink_archer-c7-v5";
role = "ap";
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 36;
htmode = "VHT80";
ssids = {
"Buschfunk4.03" = { net = "priv48"; };
"ZW public" = { net = "pub"; };
};
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT20";
ssids = {
"Buschfunk4.03 legacy" = { net = "priv48"; };
"ZW public" = { net = "pub"; };
};
};
};
};
ap67 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv12.type = "bridge";
pub.type = "bridge";
};
links = {
priv12.ports = [
"lan1" "lan2" "lan3"
];
switch-b3.ports = [ "wan" ];
};
location = "Farbwerk";
model = "zyxel_wsm20";
role = "ap";
wifi = {
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0" = {
channel = 6;
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
};
};
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1" = {
channel = 149;
htmode = "VHT80";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
};
};
};
};
ap68 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv12.type = "bridge";
pub.type = "bridge";
};
links = {
priv12.ports = [
"lan1" "lan2" "lan3"
];
switch-b3.ports = [ "wan" ];
};
location = "Farbwerk";
model = "zyxel_wsm20";
role = "ap";
wifi = {
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0" = {
channel = 1;
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
};
};
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1" = {
channel = 36;
htmode = "VHT80";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
};
};
};
};
ap69 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv43.type = "bridge";
pub.type = "bridge";
};
links = {
priv43 = {
ports = [ "lan" ];
};
switch-b3 = {
ports = [ "wan" ];
};
};
location = "B.01.B01";
model = "tplink_archer-c7-v2";
role = "ap";
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 36;
htmode = "HT40+";
ssids = {
"ZW public".net = "pub";
"LIZA".net = "priv43";
};
};
"platform/ahb/18100000.wmac" = {
channel = 1;
htmode = "HT20";
ssids = {
"ZW public".net = "pub";
"LIZA".net = "priv43";
};
};
};
};
ap7 = {
interfaces = {
mgmt = {
@ -2047,7 +2243,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
mino = { net = "priv40"; };
@ -2055,6 +2251,99 @@
};
};
};
ap70 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv22.type = "bridge";
pub.type = "bridge";
};
links = {
priv22.ports = [ "lan" ];
ap40.ports = [ "wan" ];
};
location = "B4.01 behind ap40";
model = "tplink_archer-c7-v2";
role = "ap";
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 149;
htmode = "HT40+";
ssids = {
"ZW public".net = "pub";
M.net = "priv22";
};
};
"platform/ahb/18100000.wmac" = {
channel = 9;
htmode = "HT20";
ssids = {
"ZW public".net = "pub";
"M legacy".net = "priv22";
};
};
};
};
ap71 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv22.type = "bridge";
pub.type = "bridge";
};
links = {
priv22.ports = [ "eth1" "eth2" ];
ap40.ports = [ "eth0" ];
};
location = "B4.01 behind ap40";
model = "ubnt_unifi-usg";
role = "ap";
# No WiFi, splits just VLANs
};
ap72 = {
interfaces = {
mgmt = {
gw4 = "mgmt-gw";
gw6 = "mgmt-gw";
type = "phys";
};
priv12.type = "bridge";
pub.type = "bridge";
};
links = {
priv12.ports = [
"lan1" "lan2" "lan3"
];
switch-b3.ports = [ "wan" ];
};
location = "B1.05.02 (Patchpanel B12)";
model = "zyxel_wsm20";
role = "ap";
wifi = {
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0" = {
channel = 1;
htmode = "HT20";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
};
};
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1" = {
channel = 36;
htmode = "VHT80";
ssids = {
"ZW public" = { net = "pub"; };
farbwerk = { net = "priv12"; };
};
};
};
};
ap8 = {
interfaces = {
c3d2.type = "bridge";
@ -2068,7 +2357,10 @@
};
links = {
c3d2 = {
ports = [ "lan:1" "lan:2" "lan:3" "lan:4" ];
ports = [ "lan:3" "lan:4" ];
};
priv23 = {
ports = [ "lan:2" ];
};
switch-b3 = {
ports = [ "wan" ];
@ -2080,7 +2372,7 @@
wifi = {
"pci0000:00/0000:00:00.0" = {
channel = 36;
htmode = "HT40+";
htmode = "HT20";
ssids = {
C3D2 = { net = "c3d2"; };
"ZW public" = { net = "pub"; };
@ -2088,7 +2380,7 @@
};
"platform/ar934x_wmac" = {
channel = 13;
htmode = "HT40-";
htmode = "HT20";
ssids = {
"C3D2 legacy" = { net = "c3d2"; };
"ZW public" = { net = "pub"; };
@ -2121,7 +2413,7 @@
wifi = {
"platform/qca953x_wmac" = {
channel = 1;
htmode = "HT40+";
htmode = "HT20";
ssids = {
Herzzbuehne = { net = "priv16"; };
"ZW public" = { net = "pub"; };

View File

@ -18,5 +18,4 @@ in
# IP networks
++ lib.filesystem.listFilesRecursive ./net;
site.net-combined = concatMapAttrsRecursive (name: value: { inherit (value) hosts4 hosts6; }) config.site.net;
}

View File

@ -3,60 +3,60 @@
site.net.c3d2 = {
dhcp = {
server = "c3d2-gw3";
start = "172.22.99.60";
start = "172.22.99.100";
end = "172.22.99.199";
fixed-hosts = {
"172.22.99.96" = "08:00:27:bb:8c:b3";
"172.22.99.98" = "08:00:27:aa:90:e2";
# "astrom.hq.c3d2.de" = "aa:00:5b:08:f0:5c";
# "astron.hq.c3d2.de" = "aa:00:5b:08:f0:5b";
# "batman.hq.c3d2.de" = "5c:cf:7f:c0:05:28";
# "beere.hq.c3d2.de" = "b8:27:eb:ac:65:d2";
# "beere2.hq.c3d2.de" = "b8:27:eb:53:0b:27";
# "astrom" = "aa:00:5b:08:f0:5c";
# "astron" = "aa:00:5b:08:f0:5b";
# "batman" = "5c:cf:7f:c0:05:28";
# "beere" = "b8:27:eb:ac:65:d2";
# "beere2" = "b8:27:eb:53:0b:27";
# "bender.hq.c3de.de" = "00:23:df:7e:c8:0a";
# "cider.hq.c3d2.de" = "00:0d:93:75:ee:fa";
"dacbert.hq.c3d2.de" = "dc:a6:32:e0:46:bf";
"dn42.hq.c3d2.de" = "aa:00:42:7a:32:46";
"drucker.hq.c3d2.de" = "00:23:c3:d2:12:0f";
# "feile.hq.c3d2.de" = "aa:00:5b:12:c1:f7";
# "fernandopoo.hq.c3d2.de" = "aa:00:f7:52:85:27";
# "fhem.hq.c3d2.de" = "b8:27:eb:9e:8b:db";
# "git.hq.c3d2.de" = "aa:00:47:d8:57:10";
"glotzbert.hq.c3d2.de" = "90:1b:0e:88:da:0a";
"wled-nix-snowflake.hq.c3d2.de" = "44:17:93:10:77:e8";
"wled-fairy-dust.hq.c3d2.de" = "3c:61:05:e3:2f:ad";
"wled-warnbert.hq.c3d2.de" = "3c:61:05:fc:21:37";
"wled-matrix.hq.c3d2.de" = "e8:db:84:e4:f4:30";
# "ledball1.hq.c3d2.de" = "b8:27:eb:53:0b:27";
# "cider" = "00:0d:93:75:ee:fa";
"dacbert" = "dc:a6:32:e0:46:bf";
"dn42" = "aa:00:42:7a:32:46";
# "drucker" = "00:23:c3:d2:12:0f";
# "feile" = "aa:00:5b:12:c1:f7";
# "fernandopoo" = "aa:00:f7:52:85:27";
# "fhem" = "b8:27:eb:9e:8b:db";
# "git" = "aa:00:47:d8:57:10";
"glotzbert" = "90:1b:0e:88:da:0a";
# "wled-nix-snowflake" = "44:17:93:10:77:e8";
# "wled-fairy-dust" = "3c:61:05:e3:2f:ad";
# "wled-warnbert" = "3c:61:05:fc:21:37";
# "wled-matrix" = "e8:db:84:e4:f4:30";
# "ledball1" = "b8:27:eb:53:0b:27";
# Beleuchtungskiste auf Traverse über Fernseher
"ledbeere.hq.c3d2.de" = "b8:27:eb:60:99:59";
# "leviathan.hq.c3d2.de" = "00:ff:08:31:db:e5";
# "lisbeth.hq.c3d2.de" = "b8:27:eb:a5:ee:5c";
# "marenz-build.hq.c3d2.de" = "44:1e:a1:59:2e:e8";
"matemat.hq.c3d2.de" = "a2:1b:7c:e8:19:72";
# "minecraft.hq.c3d2.de" = "4a:57:d3:64:fe:e9";
# "moleflap.hq.c3d2.de" = "aa:00:0d:b1:6c:67";
# "monit.hq.c3d2.de" = "00:23:ae:94:e7:19";
"pipebert.hq.c3d2.de" = "ec:a8:6b:fe:b4:cb";
"public-access-proxy.hq.c3d2.de" = "12:24:5f:bd:9b:e7";
"pulsebert.hq.c3d2.de" = "b8:27:eb:16:31:61";
# "ruststripe1.hq.c3d2.de" = "06:32:0e:39:21:69";
"schalter.hq.c3d2.de" = "b8:27:eb:4c:be:ff";
# "semanta.hq.c3d2.de" = "00:ff:e4:bb:ea:2a";
# "server2.hq.c3d2.de" = "d0:67:e5:f3:57:10";
# "server3.hq.c3d2.de" = "e4:1f:13:2e:4f:c0";
# "server4.hq.c3d2.de" = "00:9c:02:a9:26:01";
# "sharing.hq.c3d2.de" = "00:23:c3:d2:75:18";
# "sofafon.hq.c3d2.de" = "b8:27:eb:23:8d:01";
# "storage2.hq.c3d2.de" = "42:5e:0f:4e:f3:cc";
# "ustriper.hq.c3d2.de" = "aa:bb:95:33:bb:aa";
# "wiefelspuetz.hq.c3d2.de" = "aa:00:7f:01:8a:d0";
# "wormhole.hq.c3d2.de" = "00:23:c3:d2:00:76";
# "www1.hq.c3d2.de" = "aa:00:13:8b:03:47";
"riscbert.hq.c3d2.de" = "6c:cf:39:00:05:95";
# "ledbeere" = "b8:27:eb:60:99:59";
# "leviathan" = "00:ff:08:31:db:e5";
# "lisbeth" = "b8:27:eb:a5:ee:5c";
# "marenz-build" = "44:1e:a1:59:2e:e8";
# "matemat" = "a2:1b:7c:e8:19:72";
# "minecraft" = "4a:57:d3:64:fe:e9";
# "moleflap" = "aa:00:0d:b1:6c:67";
# "monit" = "00:23:ae:94:e7:19";
"pipebert" = "ec:a8:6b:fe:b4:cb";
# "public-access-proxy" = "12:24:5f:bd:9b:e7";
"pulsebert" = "b8:27:eb:16:31:61";
# "ruststripe1" = "06:32:0e:39:21:69";
"schalter" = "b8:27:eb:ac:65:d2";
# "semanta" = "00:ff:e4:bb:ea:2a";
# "server2" = "d0:67:e5:f3:57:10";
# "server3" = "e4:1f:13:2e:4f:c0";
# "server4" = "00:9c:02:a9:26:01";
# "sharing" = "00:23:c3:d2:75:18";
# "sofafon" = "b8:27:eb:23:8d:01";
# "storage2" = "42:5e:0f:4e:f3:cc";
# "ustriper" = "aa:bb:95:33:bb:aa";
# "wiefelspuetz" = "aa:00:7f:01:8a:d0";
# "wormhole" = "00:23:c3:d2:00:76";
# "www1" = "aa:00:13:8b:03:47";
# "riscbert" = "6c:cf:39:00:05:95";
};
time = 86400;
max-time = 2592000;
time = 300;
max-time = 30 * 24 * 3600;
router = "c3d2-gw3";
};
domainName = "c3d2.zentralwerk.org";
@ -68,6 +68,7 @@
c3d2-gw2 = "172.22.99.3";
c3d2-gw3 = "172.22.99.4";
dacbert = "172.22.99.203";
schalter = "172.22.99.204";
glotzbert = "172.22.99.205";
pulsebert = "172.22.99.208";
pipebert = "172.22.99.209";
@ -88,6 +89,7 @@
c3d2-gw1 = "2a00:8180:2c00:223::c3d2:2";
c3d2-gw2 = "2a00:8180:2c00:223::c3d2:3";
c3d2-gw3 = "2a00:8180:2c00:223::c3d2:4";
pipebert = "2a00:8180:2c00:223:eea8:6bff:fefe:b4cb";
};
subnets6 = {
dn42 = "fd23:42:c3d2:523::/64";

47
config/net/c3d2iot.nix Normal file
View File

@ -0,0 +1,47 @@
{
site.net.c3d2iot = {
dhcp = {
start = "10.22.0.2";
end = "10.22.255.253";
router = "iot-gw";
server = "iot-gw";
# devices don't often change and a missing DNS record causes trouble
time = 3600;
max-time = 24 * 3600;
};
dynamicDomain = true;
domainName = "c3d2iot.zentralwerk.org";
hosts4 = {
iot-gw = "10.22.0.1";
};
hosts6 = {
dn42 = {
iot-gw = "fd23:42:c3d2:587:ffff:ffff:ffff:ffff";
};
};
subnet4 = "10.22.0.0/16";
subnets6 = {
dn42 = "fd23:42:c3d2:587::/64";
up4 = "2a00:8180:2c00:287::/64";
};
};
site.hosts.iot-gw = {
# TODO: needs to be done more granular, aka allow c3d2 and serv network
# firewall.enable = true;
interfaces = {
core = {
hwaddr = "0A:22:48:01:24:01";
type = "veth";
};
c3d2iot = {
hwaddr = "0A:22:48:01:24:00";
type = "veth";
};
};
ospf = {
allowedUpstreams = [ "upstream4" "upstream3" "anon1" ];
};
role = "container";
};
}

View File

@ -7,8 +7,15 @@ in
ipv6Router = "cls-gw";
domainName = "cluster.zentralwerk.org";
extraRecords = map (host: {
data = "1 1 6789 ${host}";
name = "_ceph-mon._tcp";
data = {
service = "ceph-mon";
proto = "tcp";
priority = 1;
weight = 1;
port = 6789;
target = host;
};
name = "@";
type = "SRV";
}) cephMonServers
++
@ -137,6 +144,7 @@ in
"mgmt"
"serv"
"c3d2"
"c3d2iot"
"pub"
"priv23"
"priv31"

View File

@ -53,6 +53,9 @@
priv44-gw = "172.20.72.70";
priv45-gw = "172.20.72.72";
priv46-gw = "172.20.72.73";
priv47-gw = "172.20.72.74";
priv48-gw = "172.20.72.75";
priv49-gw = "172.20.72.76";
priv5-gw = "172.20.72.15";
priv6-gw = "172.20.72.16";
priv7-gw = "172.20.72.17";
@ -68,9 +71,10 @@
server8 = "172.20.72.58";
upstream3 = "172.20.72.11";
upstream4 = "172.20.72.12";
# unused = "172.20.72.62";
coloradio-gw = "172.20.72.62";
vpn-gw = "172.20.72.69";
flpk-gw = "172.20.72.71";
iot-gw = "172.20.72.77";
};
hosts6 = {
dn42 = {
@ -83,6 +87,7 @@
cls-gw = "fd23:42:c3d2:581::c3d2:4";
freifunk = "fd23:42:c3d2:581:8000::1";
mgmt-gw = "fd23:42:c3d2:581::8:3";
iot-gw = "fd23:42:c3d2:581::8:7";
priv1-gw = "fd23:42:c3d2:581::c:0";
priv10-gw = "fd23:42:c3d2:581::c:9";
priv11-gw = "fd23:42:c3d2:581::c:a";
@ -124,6 +129,9 @@
priv44-gw = "fd23:42:c3d2:581::c:2b";
priv45-gw = "fd23:42:c3d2:581::c:2c";
priv46-gw = "fd23:42:c3d2:581::c:2d";
priv47-gw = "fd23:42:c3d2:581::c:2e";
priv48-gw = "fd23:42:c3d2:581::c:2f";
priv49-gw = "fd23:42:c3d2:581::c:30";
priv5-gw = "fd23:42:c3d2:581::c:4";
priv6-gw = "fd23:42:c3d2:581::c:5";
priv7-gw = "fd23:42:c3d2:581::c:6";
@ -134,6 +142,7 @@
upstream3 = "fd23:42:c3d2:581::b:2";
upstream4 = "fd23:42:c3d2:581::b:3";
vpn-gw = "fd23:42:c3d2:581:9001::1";
coloradio-gw = "fd23:42:c3d2:581:9009::1";
};
up4 = {
anon1 = "2a00:8180:2c00:281::9:1";
@ -145,6 +154,7 @@
cls-gw = "2a00:8180:2c00:281::8:4";
freifunk = "2a00:8180:2c00:281:8000::1";
mgmt-gw = "2a00:8180:2c00:281::8:3";
iot-gw = "2a00:8180:2c00:281::8:7";
priv1-gw = "2a00:8180:2c00:281::c:0";
priv10-gw = "2a00:8180:2c00:281::c:9";
priv11-gw = "2a00:8180:2c00:281::c:a";
@ -186,6 +196,9 @@
priv44-gw = "2a00:8180:2c00:281::c:2b";
priv45-gw = "2a00:8180:2c00:281::c:2c";
priv46-gw = "2a00:8180:2c00:281::c:2d";
priv47-gw = "2a00:8180:2c00:281::c:2e";
priv48-gw = "2a00:8180:2c00:281::c:2f";
priv49-gw = "2a00:8180:2c00:281::c:30";
priv5-gw = "2a00:8180:2c00:281::c:4";
priv6-gw = "2a00:8180:2c00:281::c:5";
priv7-gw = "2a00:8180:2c00:281::c:6";
@ -194,6 +207,7 @@
serv-gw = "2a00:8180:2c00:281::8:1";
upstream4 = "2a00:8180:2c00:281::b:1";
vpn-gw = "2a00:8180:2c00:281:9001::1";
coloradio-gw = "2a00:8180:2c00:281:9009::1";
};
};
subnet4 = "172.20.72.0/25";

View File

@ -7,23 +7,31 @@
subnets6.flpk = "2a0f:5382:acab:1400::/64";
hosts4 = {
flpk-gw = "45.158.40.160";
leon = "45.158.40.162";
notice-me-senpai = "45.158.40.162"; # tlms monitoring
sshlog = "45.158.40.163";
caveman = "45.158.40.164";
leoncloud = "45.158.40.165";
# tlms-37c3-ctf vm on server9
ctf = "45.158.40.165";
mastodon = "45.158.40.166";
c3d2-web = "45.158.40.167";
mailtngbert = "45.158.40.168";
mail = "45.158.40.168";
dresden-zone-dns = "45.158.40.169";
# server7 = "45.158.40.170"; # unused
rtrlab = "45.158.40.171"; # temporary
};
hosts6.flpk = {
flpk-gw = "2a0f:5382:acab:1400::c3d2";
leon = "2a0f:5382:acab:1400::1e0";
notice-me-senpai = "2a0f:5382:acab:1400:2de:5bff:fef9:e23e"; # tlms-monitoring
sshlog = "2a0f:5382:acab:1400::22";
caveman = "2a0f:5382:acab:1400::a4";
leoncloud = "2a0f:5382:acab:1400::a5";
# tlms-37c3-ctf vm on server9
ctf = "2a0f:5382:acab:1400::a5";
mastodon = "2a0f:5382:acab:1400::a6";
c3d2-web = "2a0f:5382:acab:1400::a7";
mailtngbert = "2a0f:5382:acab:1400::a8";
# mail = "2a0f:5382:acab:1400::a8"; # we don't have an PTR for IPv6 and it gets way more often marked as spam
dresden-zone-dns = "2a0f:5382:acab:1400::a9";
# server7 = "2a0f:5382:acab:1400::aa";
rtrlab = "2a0f:5382:acab:1400::ab";
};
};

View File

@ -63,7 +63,15 @@
ap62 = "10.0.0.102";
ap63 = "10.0.0.103";
ap64 = "10.0.0.104";
ap65 = "10.0.0.105";
ap66 = "10.0.0.106";
ap67 = "10.0.0.107";
ap68 = "10.0.0.108";
ap69 = "10.0.0.109";
ap7 = "10.0.0.47";
ap70 = "10.0.0.110";
ap71 = "10.0.0.111";
ap72 = "10.0.0.112";
ap8 = "10.0.0.48";
ap9 = "10.0.0.49";
logging = "10.0.0.251";
@ -98,6 +106,7 @@
switch-b3 = "10.0.0.18";
switch-ds1 = "10.0.0.20";
switch-ds2 = "10.0.0.21";
switch-ds3 = "10.0.0.22";
};
hosts6 = {
dn42 = {
@ -162,7 +171,15 @@
ap62 = "fd23:42:c3d2:580::4:3e";
ap63 = "fd23:42:c3d2:580::4:3f";
ap64 = "fd23:42:c3d2:580::4:40";
ap65 = "fd23:42:c3d2:580::4:41";
ap66 = "fd23:42:c3d2:580::4:42";
ap67 = "fd23:42:c3d2:580::4:43";
ap68 = "fd23:42:c3d2:580::4:44";
ap69 = "fd23:42:c3d2:580::4:45";
ap7 = "fd23:42:c3d2:580::4:7";
ap70 = "fd23:42:c3d2:580::4:46";
ap71 = "fd23:42:c3d2:580::4:47";
ap72 = "fd23:42:c3d2:580::4:48";
ap8 = "fd23:42:c3d2:580::4:8";
ap9 = "fd23:42:c3d2:580::4:9";
mgmt-gw = "fd23:42:c3d2:580:ffff:ffff:ffff:ffff";

View File

@ -1,6 +1,6 @@
{ lib, ... }:
let
privCount = 46;
privCount = 49;
seq = n: max:
if n <= max
then [ n ] ++ seq (n + 1) max
@ -16,8 +16,8 @@ lib.mkMerge (
site.net."priv${toString n}" = {
dhcp = {
server = "priv${toString n}-gw";
time = 120;
max-time = 86400;
time = 300;
max-time = 60 * 24 * 3600;
router = "priv${toString n}-gw";
};
domainName = "priv${toString n}.zentralwerk.org";
@ -58,10 +58,12 @@ lib.mkMerge (
subnet4 = "172.20.75.0/27";
dhcp = {
start = "172.20.75.2";
end = "172.20.75.31";
end = "172.20.75.30";
fixed-hosts = {
"172.20.75.2" = "ac:1f:6b:dc:93:8e";
"172.20.75.3" = "ac:1f:6b:dc:95:de";
"172.20.75.9" = "ac:1f:6b:dc:95:df";
"172.20.75.7" = "60:33:4b:0b:cd:fc";
"172.20.75.9" = "00:11:32:22:95:79";
};
};
};
@ -202,7 +204,6 @@ lib.mkMerge (
dhcp = {
start = "172.20.73.194";
end = "172.20.73.254";
max-time = lib.mkForce 2592000;
};
};
priv20 = {
@ -237,9 +238,10 @@ lib.mkMerge (
end = "172.20.73.190";
fixed-hosts = {
"172.20.73.162" = "da:2c:3a:2c:87:22";
"172.20.73.163" = "ca:9f:27:b2:bf:6d";
"172.20.73.164" = "60:01:94:6f:81:a6";
"172.20.73.163" = "b8:27:eb:16:31:61";
"172.20.73.164" = "ca:71:c4:90:3e:c7";
};
time = lib.mkForce 900;
};
};
priv24 = {
@ -430,6 +432,30 @@ lib.mkMerge (
end = "172.20.77.238";
};
};
priv47 = {
hosts4 = { priv47-gw = "172.20.76.161"; };
subnet4 = "172.20.76.160/28";
dhcp = {
start = "172.20.76.162";
end = "172.20.76.174";
};
};
priv48 = {
hosts4 = { priv48-gw = "172.20.77.33"; };
subnet4 = "172.20.77.32/28";
dhcp = {
start = "172.20.77.34";
end = "172.20.77.46";
};
};
priv49 = {
hosts4 = { priv49-gw = "172.20.76.49"; };
subnet4 = "172.20.76.48/28";
dhcp = {
start = "172.20.76.50";
end = "172.20.76.62";
};
};
};
site.hosts = {
@ -724,6 +750,24 @@ lib.mkMerge (
priv46.hwaddr = "0A:14:48:01:2A:59";
};
};
priv47-gw = {
interfaces = {
core.hwaddr = "0A:14:48:01:2A:5A";
priv47.hwaddr = "0A:14:48:01:2A:5B";
};
};
priv48-gw = {
interfaces = {
core.hwaddr = "0A:14:48:01:2A:5C";
priv48.hwaddr = "0A:14:48:01:2A:5D";
};
};
priv49-gw = {
interfaces = {
core.hwaddr = "0A:14:48:01:2A:5E";
priv49.hwaddr = "0A:14:48:01:2A:5F";
};
};
};
} ]
)

View File

@ -3,10 +3,10 @@
dhcp = {
start = "172.20.78.2";
end = "172.20.79.253";
max-time = 3600;
router = "pub-gw";
server = "pub-gw";
time = 300;
time = 120;
max-time = 12 * 3600;
};
domainName = "pub.zentralwerk.org";
dynamicDomain = true;

View File

@ -7,21 +7,24 @@
serv-gw = "172.20.73.1";
dns = "172.20.73.2";
stats = "172.20.73.3";
dresden-zone = "172.20.73.4";
tlms-elastic = "172.20.73.7"; # tlms
dnscache = "172.20.73.8";
tlms-ctfd = "172.20.73.9"; # tlms
buzzrelay = "172.20.73.15";
matemat = "172.20.73.21";
spaceapi = "172.20.73.25";
mucbot = "172.20.73.27";
scrape = "172.20.73.32";
pretalx = "172.20.73.33";
vaultwarden = "172.20.73.34";
uranus = "172.20.73.37"; # tlms
tram-borzoi = "172.20.73.38"; # tlms
borken-data-hoarder = "172.20.73.39"; # tlms
matrix = "172.20.73.40";
# "172.20.73.41"
activity-relay = "172.20.73.41";
luulaatsch-asterisk = "172.20.73.42";
grafana = "172.20.73.43";
# "172.20.73.44"
public-access-proxy = "172.20.73.45";
marenz = "172.20.73.46";
network-homepage = "172.20.73.47";
@ -35,12 +38,10 @@
jabber = "172.20.73.55";
mobilizon = "172.20.73.56";
radiobert = "172.20.73.57";
mail = "172.20.73.58";
# "172.20.73.59"
# mail = "172.20.73.58";
sdrweb = "172.20.73.60";
bind = "172.20.73.61";
knot = "172.20.73.61";
blogs = "172.20.73.62";
# "172.20.73.63"
staging-data-hoarder = "172.20.73.64"; # tlms
oparl = "172.20.73.65";
hedgedoc = "172.20.73.66";
@ -50,28 +51,25 @@
broker = "172.20.73.70";
ftp = "172.20.73.71";
auth = "172.20.73.72";
# "172.20.73.73"
# "172.20.73.74"
doubleblind-science = "172.20.73.73";
prometheus = "172.20.73.75";
# "172.20.73.76"
drone = "172.20.73.77";
# FILL IN THE HOLES BEFORE APPENDING!
};
ipv6Router = "serv-gw";
subnets6.dn42 = "fd23:42:c3d2:582::/64";
subnets6.up4 = "2a00:8180:2c00:282::/64";
hosts6.dn42 = {
bind = "fd23:42:c3d2:582:cd7:56ff:fe69:6366";
blogs = "fd42:42:c3d2:582:b8a8:7dff:fee8:5ac2";
knot = "fd23:42:c3d2:582:cd7:56ff:fe69:6366";
blogs = "fd23:42:c3d2:582:b8a8:7dff:fee8:5ac2";
dns = "fd23:42:c3d2:582:2:0:0:2";
dnscache = "fd23:42:c3d2:582:f096:dbff:fee8:427d";
gitea = "fd23:42:c3d2:582:702a:daff:fe35:83be";
grafana = "fd23:42:c3d2:582:4042:fbff:fe4b:2de8";
hydra = "fd23:42:c3d2:582:e2cb:4eff:fe3b:f94b";
jabber = "fd23:42:c3d2:582:b869:ccff:fe46:902a";
keycloak = "fd23:42:c3d2:582:c48:bbff:fe87:721d";
logging = "fd23:42:c3d2:582:6811:edff:fe40:89c6";
mail = "fd23:42:c3d2:582:88c0:41ff:fe70:d6cd";
# mail = "fd23:42:c3d2:582:88c0:41ff:fe70:d6cd";
matemat = "fd23:42:c3d2:582:f82b:1bff:fedc:8572";
minetest = "fd23:42:c3d2:582:c3a:42ff:fe5d:b20c";
mobilizon = "fd23:42:c3d2:582:48d1:5cff:fea7:1676";
mongo = "fd23:42:c3d2:582:14ec:c8ff:fe0a:fc5c";
mucbot = "fd23:42:c3d2:582:28db:dff:fe6b:e89a";
@ -81,38 +79,31 @@
serv-gw = "fd23:42:c3d2:582::1";
spaceapi = "fd23:42:c3d2:582:1457:adff:fe93:62e9";
stats = "fd23:42:c3d2:582:2:0:0:3";
zeit = "fd23:42:c3d2:582:2:0:0:5";
direkthilfe = "fd23:42:c3d2:582:1cde:c5ff:fe47:8c2a";
nix-build = "fd23:42:c3d2:582:683d:a9ff:fe45:3d1f";
staging-data-hoarder = "fd23:42:c3d2:582:2de:5bff:fef9:e23d";
oparl = "fd23:42:c3d2:582:2de:9aff:fece:3879";
gnunet = "fd23:42:c3d2:582:44";
broker = "fd23:42:c3d2:582:46";
ftp = "fd23:42:c3d2:582:47";
zengel = "fd23:42:c3d2:582:4a";
network-homepage = "fd23:42:c3d2:582:2f";
owncast = "fd23:42:c3d2:582:32";
prometheus = "fd23:42:c3d2:582:4b";
buzzrelay = "fd23:42:c3d2:582:f";
oxigraph = "fd23:42:c3d2:582:4c";
tmppleroma = "fd23:42:c3d2:582:2c";
luulaatsch-asterisk = "fd23:42:c3d2:582:2a";
stream = "fd23:42:c3d2:583:dc91:c7ff:fe51:d1c5";
};
hosts6.up4 = {
bind = "2a00:8180:2c00:282:cd7:56ff:fe69:6366";
knot = "2a00:8180:2c00:282:cd7:56ff:fe69:6366";
blogs = "2a00:8180:2c00:282:b8a8:7dff:fee8:5ac2";
dns = "2a00:8180:2c00:282:2:0:0:2";
dnscache = "2a00:8180:2c00:282:f096:dbff:fee8:427d";
gitea = "2a00:8180:2c00:282:702a:daff:fe35:83be";
grafana = "2a00:8180:2c00:282:4042:fbff:fe4b:2de8";
hydra = "2a00:8180:2c00:282:e2cb:4eff:fe3b:f94b";
jabber = "2a00:8180:2c00:282:b869:ccff:fe46:902a";
keycloak = "2a00:8180:2c00:282:c48:bbff:fe87:721d";
logging = "2a00:8180:2c00:282:6811:edff:fe40:89c6";
mail = "2a00:8180:2c00:282:88c0:41ff:fe70:d6cd";
# mail = "2a00:8180:2c00:282:88c0:41ff:fe70:d6cd";
matemat = "2a00:8180:2c00:282:f82b:1bff:fedc:8572";
minetest = "2a00:8180:2c00:282:c3a:42ff:fe5d:b20c";
mobilizon = "2a00:8180:2c00:282:48d1:5cff:fea7:1676";
mongo = "2a00:8180:2c00:282:14ec:c8ff:fe0a:fc5c";
mucbot = "2a00:8180:2c00:282:28db:dff:fe6b:e89a";
public-access-proxy = "2a00:8180:2c00:282:1024:5fff:febd:9be7";
radiobert = "2a00:8180:2c00:282:e65f:1ff:fe5d:1679";
@ -121,28 +112,27 @@
sdrweb = "2a00:8180:2c00:282:3078:bbff:fe76:e9ef";
spaceapi = "2a00:8180:2c00:282:1457:adff:fe93:62e9";
stats = "2a00:8180:2c00:282:2:0:0:3";
stream = "fd23:42:c3d2:583:dc91:c7ff:fe51:d1c5";
stream = "2a00:8180:2c00:282:dc91:c7ff:fe51:d1c5";
ticker = "2a00:8180:2c00:282:b407:40ff:fec1:81f2";
zeit = "2a00:8180:2c00:282:2:0:0:5";
direkthilfe = "2a00:8180:2c00:282:1cde:c5ff:fe47:8c2a";
nix-build = "2a00:8180:2c00:282:683d:a9ff:fe45:3d1f";
staging-data-hoarder = "2a00:8180:2c00:282:2de:5bff:fef9:e23d";
oparl = "2a00:8180:2c00:282:2de:9aff:fece:3879";
serv-gw = "2a00:8180:2c00:282::1";
luulaatsch-asterisk = "2a00:8180:2c00:282::2a";
drone = "2a00:8180:2c00:282::2b";
tmppleroma = "2a00:8180:2c00:282::2c";
pretalx = "2a00:8180:2c00:282::2c";
matrix = "2a00:8180:2c00:282::2d";
activity-relay = "2a00:8180:2c00:282::2e";
network-homepage = "2a00:8180:2c00:282::2f";
mediawiki = "2a00:8180:2c00:282::43";
vaultwarden = "2a00:8180:2c00:282::31";
owncast = "2a00:8180:2c00:282::32";
mediawiki = "2a00:8180:2c00:282::43";
gnunet = "2a00:8180:2c00:282::44";
data-hoarder = "2a00:8180:2c00:282::45";
broker = "2a00:8180:2c00:282::46";
ftp = "2a00:8180:2c00:282::47";
auth = "2a00:8180:2c00:282::48";
zengel = "2a00:8180:2c00:282::4a";
dresden-zone = "2a00:8180:2c00:282::49";
prometheus = "2a00:8180:2c00:282::4b";
oxigraph = "2a00:8180:2c00:282::4c";
hedgedoc = "2a00:8180:2c00:282::6";

View File

@ -2,7 +2,7 @@
let
servHosts = config.site.net.serv.hosts4;
inherit (config.site.net.c3d2.hosts4) dn42;
inherit (config.site.net.flpk.hosts4) c3d2-web leon mailtngbert;
inherit (config.site.net.flpk.hosts4) c3d2-web;
in
{
site.hosts = {
@ -43,248 +43,177 @@ in
{ # gemini
destination = "${c3d2-web}:1965";
proto = "tcp";
reflect = true;
sourcePort = 1965;
}
{
destination = "172.20.73.61";
destination = servHosts.knot;
proto = "tcp";
reflect = true;
sourcePort = 53;
}
{
destination = "172.20.73.61";
destination = servHosts.knot;
proto = "udp";
reflect = true;
sourcePort = 53;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2325;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2327;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2337;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2338;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2339;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2340;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 2342;
}
{
destination = dn42;
proto = "udp";
sourcePort = 2399;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 24699;
}
{
destination = dn42;
proto = "udp";
reflect = true;
sourcePort = 64699;
}
{ #ssh
destination = "${leon}:22";
proto = "tcp";
reflect = true;
sourcePort = 2223;
}
{ #Website
destination = "${leon}:5000";
proto = "tcp";
reflect = true;
sourcePort = 5001;
}
{ #VPN_Wireguard VPN1-interface
destination = "${leon}:18900";
proto = "udp";
reflect = true;
sourcePort = 18800;
}
{ #VPN_Wireguard VPN2-interface
destination = "${leon}:19900";
proto = "udp";
reflect = true;
sourcePort = 19800;
}
# ?
{
destination = "172.22.99.175:22";
proto = "tcp";
reflect = true;
sourcePort = 2224;
}
{
destination = servHosts.gitea;
proto = "tcp";
reflect = true;
sourcePort = 22;
}
{
destination = servHosts.jabber;
proto = "tcp";
reflect = true;
sourcePort = 5222;
}
{
destination = servHosts.jabber;
proto = "tcp";
reflect = true;
sourcePort = 5223;
}
{
destination = servHosts.jabber;
proto = "tcp";
reflect = true;
sourcePort = 5269;
}
{
destination = servHosts.jabber;
proto = "tcp";
reflect = true;
sourcePort = 3478;
}
{
destination = servHosts.jabber;
proto = "tcp";
reflect = true;
sourcePort = 3479;
}
{
destination = servHosts.jabber;
proto = "udp";
reflect = true;
sourcePort = 3478;
}
{
destination = servHosts.jabber;
proto = "udp";
reflect = true;
sourcePort = 3479;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 25;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 465;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 587;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 110;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 143;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 993;
}
{
destination = mailtngbert;
proto = "tcp";
reflect = true;
sourcePort = 995;
}
# poelzi
{
destination = "172.20.73.162:22";
proto = "tcp";
reflect = true;
sourcePort = 2323;
}
# jan
{
destination = "172.20.75.3:51820";
proto = "udp";
sourcePort = 30057;
}
# zw-ev RDP
{
destination = "172.20.75.222:3389";
proto = "tcp";
reflect = true;
sourcePort = 45000;
}
{
destination = config.site.net.core.hosts4.vpn-gw;
proto = "udp";
reflect = true;
sourcePort = config.site.vpn.wireguard.port;
reflect = true;
}
{
destination = servHosts.gnunet;
proto = "tcp";
reflect = true;
sourcePort = 2086;
}
# dresden zone
{
destination = servHosts.dresden-zone;
proto = "udp";
sourcePort = 51844;
}
# data-hoarder
{
destination = servHosts.data-hoarder;
proto = "udp";
reflect = true;
sourcePort = 51820;
}
{
destination = "${servHosts.data-hoarder}:22";
proto = "tcp";
reflect = false;
sourcePort = 2269;
}
# data-hoarder-staging
{
destination = "${servHosts.staging-data-hoarder}:51820";
proto = "udp";
reflect = true;
sourcePort = 51821;
}
{
destination = "${servHosts.ftp}:22";
proto = "tcp";
reflect = true;
sourcePort = 1022;
}
# coloRadio
{
proto = "tcp";
sourcePort = 8000;
destination = "192.168.9.127";
}
];
interfaces = {
core = {

View File

@ -1,76 +1,84 @@
-----BEGIN PGP MESSAGE-----
hQEMA2PKcvDMvlKLAQf+JsLbrcbKYL196zauRq/WXR04ls0lWKGgxf/U7kdOJW+a
ldf29aRG95v0ditzate8pISfg+Ffs0HR/86sxnFRvo81NXcVlTSFZohjRvSeD6iG
wISlWpi89YzxSpXE5gZuGW5HFJCInlcP8aFZ1t1TObOoLZjuscvG0gHQjHil7sRD
l7P/J9ors9RWs9bY9fc4FtfcYaBucXkxPz1eWml0B/8B1c4ttb/UAyH+ozatwi/H
JVyy/2EdvGhOX+HJmcwgFwmfcYu9PMSsKGPPb7jznBHnPJ9fFjxZsS+rQJSBGvnK
+dzO31PJYfxgwkLYFpPcO84bjiTNR/7PgaRqi2tjUdLqARSwfzcYWhOUKiCabiZT
Mb5xiGcR7EWW3bbuRss5UPMhwN6UBigcAeACIvgB0aHrQT2v89is5pzw0yR38NS8
B59XHM0R5DyF3AO35oEZDoY3v3AvJ21LmxFZJhey80qp4TXaE7SFwhIB/ym2a/KZ
DKdDb+kpdetKLlH68JQ3p/+V9xCs11fp//1jR+63ieT10o0+MH/JaibbpXZgkvck
1PwY2Lbnu5kqPHklAprzcLUSlA7oWfpOwCr2KI+NHI9vYSsKFKs5GrbU+a3KQ5GD
rCsV8yxTz2njlFBtTc9qUl+VpmJd7rn1l7YnyM5LRo3+wfez1mpTU3u6YZaA/MLm
+nNNLjR/HSgw9DWVulAgxLzcrLXXh8fLBO9QLrMbUu0EgGj6xCyG2Uzo+/b+7lYg
NO4ReHc3sVeLnWvtAH8G3Z5drkyXxZFuYxS8JzrV0g3hpXr3S5fzt8OMgZTnGHmm
3XxJfEBl32wVvJ5fOToXWe4xZzSok5tyQ3fnwMhiHLT4VbeHk4qOAx702nPTEVpC
YLzKW0mLf/CASNv+Zbzbg/F951fETDoqzzhK7zuZIxCKT9HdEFOptKpuu1EwC1p4
o6nXc92IOB1OO6o3I0qpxeHnm7N0K0KMV3PGgjH7CtdeprfJ7YuSiRZfDVYU50WD
Z19f9/hPc1GT5/+Cit2Gx9hYA4R1l3aNnhRxqmGF5QUWQHjo592PKGL+5UobjitD
8CnZcyzyij/hCne/70COg9S/88Gq0EZL3ETpKnR0jkeDz7jLEcfgclmQhd92rnuc
EhAmZMoX1safyICIdwTab6ZsUwt0f0Ri0k8106VePhcKX6G/EUFTt5Zk41GSQbNH
y5B7/oiP3o04FGLQs3+oDGiM2VaS+nm1pHeZ5X7j80kvSLrjVoEu08LVfr/KC5QQ
cpA3pMAuST5u76bacxffK0ECBlHB8Ayy5Jqsap/6CnuXRq32GkyE8cy449tETpcT
oxXg/Jt9WJLxAGPq6JXJ1Ygn4VxAjq2qya2taXxS/DDdANhplWgOHf/vJo4tUQ6L
Jn6oQY9cM4cnxYijvykRLGKw9xUzn617B5UDw7o6WGngogAqwFwFOfb4oY1EQx9j
LMWJ3oh+PXR1BqBHMPFfbeBn7AU/+4+Z0BukO0xa1HI/JX40qZrJbiDthrx3LyxX
N3zvA2tKaVGyzJ/sLNUqzUpCnbkfK9VBvIJXKkdAPlqYzPGSicN0IjyiBLM7WYrk
XiXNIANtWBN8hZx4psOuuohi9F7N0PDpdLjhpavXm3DC01j5+OQvkEUxe/B3JaJE
wZUovYchZzdCgNvp0We8tS6PvENVAp5nGlxYsZRSzAa0U+pJDUfQ8sN7+qLBGdic
xerKCHnrGFhY91BYNl8AaEURmrvF3xvPMfPQCMpJZM9E+yxsikxOFbPa6XDOgmCQ
7h52ASwkE6Qyu1oug53N2d/Jc6sUCk/fjVmYthKq2feZIJU7YmipZLawmzP+HkjO
0jtkB/3cZsd9xuhwCf/tq/ZV0RYzV5Iicp+RE74r5tmo9PZyVr+5GSDitbKDyqwm
eOJvQrgZFIxylgExmZSRUM9wbXfHTBwb9ESfETcAsF+UFUk9hIRfTwkUz1HKPg9p
Y9MN1e8ujxT/yUPX1Hx/Zplf3kHFSj01WROsc6zwbrnhJ66oV5XYfnLs7t6vICXQ
dqrWpLYKJF4Yz2ersS6VcZ+FgFKOq7JgrqQ5xVxJ8y2e1UOlyo7Zpz8jOAAml9xr
m2kgDVaVWLnbPhpIaeDZkyedIvbd5dRFprYxsW9oDEGKjNmjXkmg+Gj+uLlpMCKh
GlmJXGSdMp0AJcde8KZueICkE9mK3OloBVYvwoCqUFU76emZxcBcjlI1g2wiik9K
nUinR+6AcejzmOTpRerHr1VDrVb4r2WqfetcnOYD73OElJljG7kYl8oTGyT8fMbR
wStT4TTRB8l1B3j41MONlY3exZ0UIHpu0Ht+CQ7KnyEV84n0rII97CAuLISPe8+0
6q08i5t2Kk0OyX4FzhAv5zXRUV+wzNc9tYzLTHdNE4PL8Jn8X+HCksStNUtvNSIy
mahKKJH44WV44wBEArI8RUAJDNafohNfgGMkZ7IFSaxCXabwQ4OseElE6T+tPdR4
DBCbIT6bt8QCSAE1A/1Uk1BmKfnudErXI+TvhdVrLv5bZgY6J51Np6eBnCZOMCPP
GxXazmkmQnnmQezUEkz4uCCUIUFR/gkXLGH80uFdBpd22XMy1xiLNtbauiZCNiOK
uVXNGgfiPa80fgO1wIpAkQFk3+vxQP/JILtiOH20zfenp8SCxZ3SO8CcjXGshYns
z5fot3ROozuk2qX2/kjwmuvJOjgR1Ikw45yZbZdNsB2oSwQVzlPzAxnMGI6HOk8G
vybM+YAOWKbA0dIh6GCmr3serukuAbGCs2ixxw0qq11LqsAqg1mljD+l/GBnMuw7
S2/g6LXvHD8ukgGwz/rwDtVXWlFxuZrA+OQh2kKYmF4N5dkU11EVr8alZCW43trv
hluz21NsrTlbNwOaQwotrfPeKKjQLYCI9xaEW7udjI9FexfKzT4Ef7ozuKIhQtta
53EZeGJY052fvYPDaZxy+5qo3i0ewbauC1zVuu1ZcQyYDaqb0pNr3uoimJDcKw9m
UOyvkqYtgiFB0JQHHIrtgAl2REYZiBsdnZfdBtvBnY2+CYp+rPhdsSBrsGA7LEVr
59LOpEqhZF+kRW6Isr7B2o+Q6pasZHqEc6yRvDA2rwx1Rqk7wTtx2wDIo5RVDSVW
bJxXBB8h///SmNE9ie2Axt0IjOV3lxQVns1wEFXZIaPxOrZHorzpEaaF50mBXzys
IZ6Y9bo2BrRhuyWmz1YFa7oMeOcdBIOohRorbNaT6indz7fx0r/im16HoV3Rjk44
DlU6qA7Gmvwl7HjP0HftjAKz8UndygffY7fuYcEcWURKTCdFECCaj8sYfVf6rw5H
ZR7BY0Z9kAnVe8Vokh2OwMme3tKOsRcA61zIhc55I3yJZ9cdkeNymhjNaGun34DO
qErA5pwrZXjzE/nzJ1wIwh4jCjs5h2f828yIK4e23Jofjjt+/l8hCTaA3Ftd4tWM
vJUlPbUgGk5gTMCc8szuMGlH17vL7VVhXaaOcqStTBWs4aUeIMDYFejUyUvUrwMl
qI90JRwBSEbfUZUpuNneUsb+QBeLJMVxcFsJH5TtRptDhIp8/6uuJ52Azr2mIRLV
/C7iQ1WXyZ1i7r9cFzSLi8UbTLGxi6hXD4y3VRiOQbU/PM1koYqtS5+BeTzzVpcy
pKluVOgqSWK8lCTgRLh6cchfGBY2VGjicxoM9/sOohT/Wnh/tWfouWIegnlKyQI0
yFIxnObDpcdhw8+tO+JNNK+z5fLc7IubjW9MaAklsI++2Cz2HsevE/vwjstRi3+V
6yyUTQlQVCHc+xAJFnoHdtmkJFe2+K2+Eszj466sVQH5NMhjilRnLm5QCETeLq7n
Eg2G1nh2H609psEkJTr5Lb/DfSqZvkI/15WbUebr/YU4ETYHdyCZQkwO/8EpxQFB
+9NYs8+55Gw8Wg1egO/dUUCOjfsuTsJd7aCshUFSe2p16DBPnKDR/INHa2E2aY1G
AC+BdYYe91u2H5OsVsIs+uFDy0E28Dj1E63y5O7SvAqVFqbdMMxAmntfaZ+QEzZY
twoEqpZDuE0DnOJ1AylWVKtcGm44odpwfvudI9xAqXQMhx7x1EE9dlx8eC1fxj9h
LUpui1A74tbCQ7OKm4rFZDfZlFAW4J+yToQZGD8lEZshsEa8tW4EyJMRSHKIPz7x
tijuEVZIjMIBtpE8PnFJGgVH6GdvFZ1xFS/gmT1o0U82504zkXmy2yI82W6Gc7Is
2taTPIEH1MEnM8nXDa+PQLSVZUtVku1rsqFthMvJVGmE9ltGMIjbHot6o58pzwhG
eNdr3+tLXW1Qk3WdzvZ9HrkQdy889s+J0cRtiRfzn58JPMXrOCZewzMtSMvC3egY
tk/lKvIKx2MnXq74peh5k1Q2saYqj55ciisotwv5W+BZD5Pi1t/CjXXbtbWqonZJ
MUdPDrUyuNjmQsATZ9AErVol+Zn0fX9opsNuEJmV16DHM7NREGrJvTbnWC6kQEmv
3AzIJIGZzowJvhm1hGNDzQ2wa9I4Mq900+DscUImJRG5cZMDCt+PxUONg0k11ypP
Rmax/XN+U1apZtOMls8w9//dIId8
=4rTB
hQEMA2PKcvDMvlKLAQf9H11MeVsKpyi49/f8YxayUL8mbu8FEuUEW2F4N6MbThXz
/kEweXTs3m9KywyieiF17S2UE/02b5E2533sn41mRa5Jo3vmGPb6WANRkoB7YLOO
T770KStpvdIH8vljhGj3eFrNk64POch9fPrGMt8pz4uYcmKgjYhKNb4iUqFj8ZIi
RsdheQ78MnY37df7IzLQmFGZs1jIA773rHN6aVomOqNBTzfVTQO41zKATzbrKpW4
qqau3kn1fbQTab1FedJMEqk1YPhD1H8Pyhib3ff7JpPeWxkUzuZt+grAUD59aJsr
ZX93USKoHSuJ5tUCY3dfmpiaetH2qjOmjI2ysCYGENLqAW440k/1U/Z58B0/ezTZ
RTyU2GPbf7kpC2VL8EDZSTwLkDMB+mmXlZffF3bB1rdmZCahzjk4X9awKSXLIVTV
ShGx2z9sI1pjmtz5CzXA7Ry0wmfJJ8gFM4DUaPCs2KghHVurGY4lmn1VWw80VtXn
+u2dqhYTtdgxArwGV4EsKYBqRRAjsKn9NWXRo+WXIhH9EPzHioJGwKgbDw/n69Qa
zMBNfePDj1HapEILaTq7jL/K67+07hDMVOnkUJL/lE2yzwCKkb0PnWAGgzXyOCQG
p4ih9+samGMM7rIjxM1eI892MuAlrf+awkHY6P4cwU9vKxKHbqmqeRbOe8wUBuqg
kmF9MCOPsCrS/5Dtr0JoR9WTnByLvekPbChW3ANMzAuHtKrjE7H583Z+ql52iYcj
cLqlDP/1XzXu7dwfm3VcY0VD73Qy9gAHaOXcMHk6nOFzPiiAjVuqrw+pC7qS3SxJ
pnzbyRz4ourfMymsfGj0aMlZknCcWidR366gnVLVDw19hWQ+s76cBJ1sKh/dNpUo
d9h5qC7mlZ1RTHZFS8RKF1WODcq9h9W+CkQUg0y2R6EztEdVnc263fgwJH1VFAZW
vsYhFehx1TJ/X/miMvScUDedrA1xcD+gs2zhXi5lYpk2U3HpfvGpEkLJaTzAXQiX
7MxTBjnWviHv0s4ozeLICQDp81QqPNgCskaWf2I+9tYjU0Ob2I2ZqQ4LCx4UAraV
iHmrszgP3OvkqRnidX1sYxwu7NUxZQK+Nmpb+N0+PyDErZdHNfpgl0erh0YswPOf
Cc6WLsp9B2YkLNNGLxJnpYJEccE3I23JJ5/2A/4ZbfUZnDA6jKTx4qXj4ScygY0S
kBiCwIaX2xEPOpQ61fE0xzV2xXnfGBT7IgcTwjL1ilOIWrWRbCad1wIlaL1c5lfv
chCdv3ItWL9rwQvv3aiFm1oq3PL0Tp5qdth5ylmcyFwLRNVJKmZC79tD9/XYx1LG
NTAWtMqR2dsz44nTPvn3x+HI08Ll3UbGK64hKlfjUjjYUUMCDwXXSl1HiunzZVa9
5aVMD/Eg5TzzuS1aL1y01cfBhjZH5guFRxl6KUuNzIjAWh4rScCplTWfKtSQVhTO
ZwAAuY3TZ5R4M/PFNLXCByUMI+nivKazVhVZSVMPTU1ENYrSFVKURsvuLwju8Pan
K026oBtPdnaetOkERZJzayiPA2KCqN/LkPNMsmfniAZedj+7SUmyYigwMVRWFuB+
HLPzZSDb4WJD53OiJhYdFlblEtTATZ2JdOBEATHB7wQqxBTNKheYTKV3ALZnu0d/
6jOlRNHeAD6XlyAvTyuMFiU1qHEACmFN4EQ2y7yR9TI8KmCKkP6wXPzavtVjB/ll
qeozsjD1BDhHhQLmOra8yXuZ9NoWkgNUtn9HRhbMlv0XjrPerkJ+xv0HQudI6Hyy
sEj3fJY5l47CauUOaMmzSf/+ONSE5YQ6eh8Q6RNqpjKJ7HKJqgBDsVCcfkbA6Dtp
KaQcUr4Q8cGoYejqUt9glVnmJDYicebdZFt9BA8i/mCykKvPpsGc/oFyh+u5lFjd
GiFr4QlULSZsO3Yfv4xeFPWqkJ7xMeX65zPc+q5MH2+8pYXL6l/7U3yFI4gEXACX
xiWrnvi8KWhju0GMHji/obUHuaudzYRaWdQWb7ga/xw2Q3UagXZxvM0arOliQT1P
1EvHdN8U7xahKo9kGYAn2sgbOEMuoLC+MRkBE2PocC1TqU8LRootXXah4oJMglvu
80MJYCZ5AvbMeW/lpnrtx9v9gbumP1bl/fxzi+fksMJzjwrQlgjdTM2peNVRP2OT
EQFQm3jtqLqtKo0Oc7BtExevVzb0eGH8L/3Y2NUZCsLkY+KvIZe6O+8nBOcX4GeU
nxSypDDTNxP0bhjMYaSI+eIVFRhEvCHdtscbtzpiOdsAUq9C20HDNTjeJ4QlpP4t
/8nfywmBvgQ3ddujkRX7iGYzGebHOKfJwSXksT+md2wslx/CvMumEvK3CRN2OLK/
dS3deYWLy3DLRJA5bgcp/OAnVKNGt3EGQq11ucup23Fm3jINCgEVzccW/X2AP0uV
cyEFudLnMuHERcjcAHfXHqPCqqohSo+MNGZwoKLjXWSctY7dlofILlwShauBR/Gb
HnArSBPuQaWQRX8gtWIwwjUmy2a63cgKIrvhtSGQO7JY32/omZjAYSGJQ2zppZh+
aluD1TMos69ThHITEaLApO18xzWHlHFxdP0v9sPx1BUhd6NaZiXvjWQnTjBlepjn
xntPyEsM4xypmEAViQeWz7WJdm5O7NhafoFQyn1i+fVysO/ru+LBRFmXp2xwfVUw
Z8m1bCNAZ3ZOro2VIztQsgO9Zv1tycteII+wP+RicDIYaaHnLYbGznbuTtYNAyqb
rBd2uHwlUjVqEfSMlnmdsOcF34ssGF6hU8bBgU3d44BeQCzYpCaxN0MQCCPK/d+V
R/KDe1C1QkDEifDL0wvAZ6uyPPakpQlPi0pTA/20Vfc16LQiCISWBrLWoE3MmtGV
ocAQe1M+xt+1pjOMlv7vPJ5Wfb3zeQ3yL/+d+qL54kr0cHSAF5mE6GjMYscWjott
Vz81RjFgt8ci3pdzDK3W1Zt97qUcFBG+4liQpJZVB3we/v6mhJaQ9lcyb/G1Urk1
GynGtWzzk8aXHMeVi5cfNAGqigxuwl8lMDYlCRoT+q6lzCFqIk+P9avoCZRXCS62
FzVz8lwhDaslYoC+SdWQl7hq6gdxdRFvx+n+nHWcKprGVJ82f9wVid7fqwKh++2P
bNequ4JORLCofyJ1QWYTv/Ep/RQW1rNdgrEf+SUXtK+HSxz6ZwRYCyz2OdBqJgLt
df6s3ivk4ekkowF0h+8a62+aQpHmW9rWVFdP1ibUeThxsyLu41Y4/6LG8FhKxn8U
Qyz9xJvP3QhSrf4LgY8hDb4I8YbZFYrNqlkaeT9ulcbR9bilNJJ8vbpPt0/gsDNx
hbkaL6grhoyva/dDbnUIuYoSRJUCp4I6lBczyYXBtP900jSNH4ezJS0HRarRHf1V
vn5J2xWQnFzbbYAlY4wbzjDRqKwShx/koe9q4JSvs2cYc6tg7Aw1cjJcrmo+TORo
cdoN4S5iL3babk788B8FHjZJeMnoEyqFzzHgq+bSzR4RrhIUVPf6PTIiMMcUt20j
seYUAwZC0I4cJU81Y+ok8nVuOHxRucr9A0MWhjaY05+rdM+TmwFVHDuPGoy0fKOQ
Acj1EAPhhAQGQRXlq7tlbPrsJCHxHpQvCcawIGVYf9Ci0QwDd4q3s5nR5rSW2LUy
+MJh57Rutd7H0Exgj7+KDkEoBxAJMMYuiOm9FJBZ7rxBe9dYjih0vv0ORsMjWTgW
Jr5IxxXuLgIHsMOIL/Z3TS+omXqia6SAWcEogh6QwXdKrt/HZnKJIpUF5roTPmFK
iFTMh3brwkJ2FF8Xgf3MYKnb5WHplQvK8hkLb98rz7J2YqwPY52vaNPQInnocfEs
pYTQTVb2OhRop/nMSr/77vNirnGocySg6IWpQnwU8pc4evtdmX6G0Q4rdHpwy3DE
21w7SOIYAaDKJj9gmsUiik8lCIn58xL+lgZjt1OuB1LP3P5OZ8rZ7Ff+S6Cdltyy
Gn/Q0YBFRD1JtM2anXOGhX/bqsJyvmqD4NsO1dogT8GDd9TJLSbUFdY0zoCk6xfJ
BKQ/IwN7mfXMRmqlJaZgGwzywPpoViQ6iHHIfGNGnqjNwltGHJDefGMLPos03c40
fHqsfCJfseTEUZtreKp/B2RiZeqYg72emcpqWs+q9C2Warrn52GeKpFzKJlELeTL
WpIhuaYI1WEbeoMdBJrV7207U4Ufd4sHTC2QOQOXoRCNMBUHF77vMvgaPHPVETTg
fEzpuDpoTnU79LMWdME0MkGvsCudbBrupNwC15ULt7mNuA2SalfrYxkNskvPKYAh
sg87w/zkl/IVIk5tvSdN44Gvji7vVZvMkfVcyk5o8OU4IZUxy/iRTZUzvBZrqzaA
CFHl+QwXLgApwphApTBEZGWZMCdP1FD21QXNUt4sXWB8eW419p0a6oJFwGPEkRMD
XTJMjhCqP7SJUDPWIS1CuI33bdOuyjGeUSeb0Xe1IYuxWqPBI0oNJL3s6K+V98Ut
meIVIUCOo+sOS64UqdBmcbAkFSnE04xxiFN7jOd3Bfr+2aRDOMYlozM2j+H2oDBF
JyMEZAY2Nn7s2iqyK66q70DLku2x9kmuuY1U6jUxuvYn3id6D5tk4+BhvbSXpvHo
a0pGupBsx2pIY+uHQafwErqGNoH6BAhARq8aeRzNZrPlcfyTiTZ2xYsh40AVYx0S
fNcWNhi4/ZVamjveZD1Gg/w6u4ouzrrBS3PeOebuBrVkUExitZ4QnvZe8Vda/YcY
miV13I66Ks6ZTALSeZ4Hd0b7yjsZnNiBkmAMCClYM8qcrOfGJsAGhi/V4uIzrz0Z
LAMMX5Il3xwDhN/463hP89GTWymwQ2s6R2Y5e4TNUzt/2fajPy7ENDT1htnObeIR
cEsjz7vCkMplEK6tVNbfp7PxfOrH3SnBkkG1A+QlWPrHL3J8Ck4hVq6XKhRwPRgM
8ERpyTgTRmwvPEGXQptVsStFKvqhS8jsJDkxadGFJaOhgqzysIhJUgbO8335oW6M
efyeKPih0zwr2RUq1sKE9KW9T8vnwT2V5BRw3LjZ99NP3ONiuhXflVyLevnGLkmY
7VScu8rGlKij6jW9mIiAL/UA0nt9Dh/vJZGDTh4bMHVwJb0yFMfsbw==
=EhAz
-----END PGP MESSAGE-----

View File

@ -2,6 +2,8 @@
{
site.net = {
core.ospf.secret = "encrypted";
pub.wifi.ieee80211rKey = "2dc40abba46da9490ea0e00f93f18ce5";
c3d2.wifi.ieee80211rKey = "d1b1fa2461efc0df9e2d96579607b7f6";
};
site.hosts = {
@ -63,6 +65,14 @@
ap61.password = "encrypted";
ap63.password = "encrypted";
ap64.password = "encrypted";
ap65.password = "encrypted";
ap66.password = "encrypted";
ap67.password = "encrypted";
ap68.password = "encrypted";
ap69.password = "encrypted";
ap70.password = "encrypted";
ap71.password = "encrypted";
ap72.password = "encrypted";
switch-a1.password = "encrypted";
switch-b1.password = "encrypted";
switch-b2.password = "encrypted";
@ -73,6 +83,7 @@
switch-dach.password = "encrypted";
switch-ds1.password = "encrypted";
switch-ds2.password = "encrypted";
switch-ds3.password = "encrypted";
upstream4.interfaces.up4-pppoe.upstream = {
user = "encrypted";
@ -109,12 +120,15 @@
};
ap18.wifi."platform/qca953x_wmac".ssids."Restaurierung Wolff/Kober".psk = "encrypted";
ap19.wifi."platform/qca953x_wmac".ssids = {
"Studio 01127".psk = "encrypted";
"Bockwurst".psk = "encrypted";
"Walter".psk = "encrypted";
};
ap2.wifi = {
"pci0000:00/0000:00:00.0".ssids."C3D2".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids."C3D2 legacy".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids = {
"C3D2 legacy".psk = "encrypted";
"C3D2 IoT".psk = "encrypted";
};
};
ap23.wifi = {
"pci0000:00/0000:00:00.0".ssids."LBK Network".psk = "encrypted";
@ -136,6 +150,7 @@
"pci0000:00/0000:00:00.0".ssids."C3D2".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids = {
"C3D2 legacy" = { "psk" = "encrypted"; };
"C3D2 IoT" = { "psk" = "encrypted"; };
"FOTOAKADEMIEdd" = { "psk" = "encrypted"; };
};
};
@ -154,7 +169,6 @@
ap37.wifi = {
"pci0000:00/0000:00:00.0".ssids."hechtfilm.de".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids."hechtfilm.de legacy".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids."LIZA".psk = "encrypted";
};
ap38.wifi = {
"pci0000:00/0000:00:00.0".ssids = {
@ -164,6 +178,7 @@
"platform/ahb/18100000.wmac".ssids = {
"ZW heinrichsgarten" = { "psk" = "encrypted"; };
"plop" = { "psk" = "encrypted"; };
"millimeter" = { "psk" = "encrypted"; };
};
};
ap39.wifi."platform/10180000.wmac".ssids."EckiTino".psk = "encrypted";
@ -269,7 +284,38 @@
ap64.wifi = {
"platform/ahb/18100000.wmac".ssids."Princess Castle".psk = "encrypted";
};
ap65.wifi = {
"1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0".ssids = {
"farbwerk".psk = "encrypted";
"Kaffeetasse".psk = "encrypted";
};
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0".ssids."farbwerk".psk = "encrypted";
};
ap66.wifi = {
"pci0000:00/0000:00:00.0".ssids."Buschfunk4.03".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids."Buschfunk4.03 legacy".psk = "encrypted";
};
ap67.wifi = {
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0".ssids."farbwerk".psk = "encrypted";
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1".ssids."farbwerk".psk = "encrypted";
};
ap68.wifi = {
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0".ssids."farbwerk".psk = "encrypted";
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1".ssids."farbwerk".psk = "encrypted";
};
ap69.wifi = {
"pci0000:00/0000:00:00.0".ssids."LIZA".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids."LIZA".psk = "encrypted";
};
ap7.wifi."platform/qca953x_wmac".ssids."mino".psk = "encrypted";
ap70.wifi = {
"pci0000:00/0000:00:00.0".ssids."M".psk = "encrypted";
"platform/ahb/18100000.wmac".ssids."M legacy".psk = "encrypted";
};
ap72.wifi = {
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0".ssids."farbwerk".psk = "encrypted";
"1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1".ssids."farbwerk".psk = "encrypted";
};
ap8.wifi = {
"pci0000:00/0000:00:00.0".ssids."C3D2".psk = "encrypted";
"platform/ar934x_wmac".ssids = {
@ -280,7 +326,7 @@
ap9.wifi."platform/qca953x_wmac".ssids."Herzzbuehne".psk = "encrypted";
};
site.dyndnsKey = "SECRET";
site.dyndnsKey = "oYmxXCIa0nArp0679L6v+y/UfnhripOudLv+R5Cop8I=";
site.vpn.wireguard = {
privateKey = "wPNXY4ED3Jz3Kz0KOmvfQOou6/wHrgqSsykaMYrtb28=";

View File

@ -8,17 +8,30 @@
links = {
switch-a2.ports = [ "7" ];
# Panel A2: Foyer
switch-ds1.ports = [ "3" ];
# Panel A6: kl Saal hinten
switch-ds2.ports = [ "8" ];
priv25.ports = [
# A6: Kleiner Saal Schaltschrank
"1"
# Kabinett A10
"2"
"3"
# A16: Buehne rechts unten
"4"
# artnet node
"5"
# Panel A2: Foyer
"8"
# Panel A8: Kleiner Saal Buehne
];
priv31.ports = [ "6" ];
iso4.ports = [ "1" ];
priv31.ports = [
# A4: Buero
"6"
];
# A3: Techniklager
# (DS23: Hackcenter vor kleinem Saal)
# A17: Grosser Saal ueber der Buehne
# switch-a2 Port 13
# Panel A6: kl Saal hinten
};
};
switch-a2 = {
@ -29,6 +42,9 @@
links = {
switch-c1.ports = [ "1" ];
switch-a1.ports = [ "2" ];
switch-ds1.ports = [ "3" ];
switch-ds2.ports = [ "4" ];
switch-ds3.ports = [ "5" ];
ap44.ports = [ "10" ];
ap45.ports = [ "11" ];
ap46.ports = [ "12" ];
@ -117,8 +133,6 @@
ap11.ports = [ "ge-1/0/10" ];
ap34.ports = [ "ge-1/0/12" ];
ap18.ports = [ "ge-1/0/18" ];
ap24.ports = [ "ge-1/0/34" ];
ap25.ports = [ "ge-1/0/35" ];
ap29.ports = [ "ge-0/0/46" ];
ap30.ports = [ "ge-1/0/22" ];
ap35.ports = [ "ge-1/0/23" ];
@ -130,11 +144,13 @@
ap5.ports = [ "ge-1/0/7" ];
ap51.ports = [ "ge-1/0/13" ];
ap53.ports = [ "ge-0/0/7" ];
ap54.ports = [ "ge-1/0/38" ];
ap72.ports = [ "ge-1/0/38" ];
ap55.ports = [ "ge-1/0/19" ];
ap56.ports = [ "ge-1/0/9" ];
ap60.ports = [ "ge-1/0/20" ];
ap62.ports = [ "ge-0/0/11" ];
ap65.ports = [ "ge-0/0/9" ];
ap66.ports = [ "ge-1/0/43" ];
mgmt.ports = [
"ge-0/0/0"
"ge-0/0/1"
@ -147,25 +163,24 @@
# server9
"ge-1/0/48"
];
flpk.ports = [
# server7
"ge-0/0/40"
];
priv1.ports = [ "ge-1/0/3" ];
priv19.ports = [ "ge-1/0/40" ];
priv2.ports = [ "ge-1/0/4" ];
priv24.ports = [ "ge-0/0/6" "ge-1/0/16" ];
priv3.ports = [ "ge-1/0/5" ];
priv30.ports = [ "ge-0/0/12" ];
priv49.ports = [ "ge-1/0/1" ];
ap67.ports = [ "ge-1/0/34" ];
ap68.ports = [ "ge-1/0/35" ];
ap69.ports = [ "ge-0/0/35" ];
ap64.ports = [ "ge-0/0/45" ];
pub.ports = [
"ge-1/0/11"
];
server7 = {
group = "8";
ports = [
"ge-0/0/40"
"ge-0/0/44"
"ge-1/0/1"
"ge-1/0/43"
];
};
server9 = {
group = "10";
ports = [
@ -254,11 +269,8 @@
# Fenster
ap33.ports = [ "5" ];
c3d2.ports = [ "8-20" ];
# Testing
ap-test1.ports = [ "4" ];
bmx.ports = [ "7" ];
# tmp Datenspuren: VOC
iso4.ports = [ "6" ];
iso4.ports = [ "4" "6" "7" ];
};
};
@ -345,27 +357,30 @@
"GigabitEthernet1/0/13"
"GigabitEthernet1/0/14"
"GigabitEthernet1/0/15"
];
# Stage uplink
priv25.ports = [
"GigabitEthernet1/0/16"
"GigabitEthernet1/0/17"
"GigabitEthernet1/0/18"
"GigabitEthernet1/0/19"
"GigabitEthernet1/0/20"
];
# Uplink
switch-a1.ports = [ "GigabitEthernet1/0/24" ];
# Freifunk
bmx.ports = [
"GigabitEthernet1/0/20"
"GigabitEthernet1/0/21"
"GigabitEthernet1/0/22"
"GigabitEthernet1/0/23"
];
# Uplink
switch-a2.ports = [ "GigabitEthernet1/0/24" ];
};
};
switch-ds2 = {
role = "switch";
model = "3com-5500G";
location = "Vor dem Kl Saal";
location = "Grosser Saal oben";
interfaces = { mgmt.type = "phys"; };
links = {
@ -390,16 +405,64 @@
"GigabitEthernet1/0/17"
"GigabitEthernet1/0/18"
"GigabitEthernet1/0/19"
"GigabitEthernet1/0/20"
];
# Uplink
switch-a1.ports = [ "GigabitEthernet1/0/24" ];
# Freifunk
bmx.ports = [
# Stage uplink
priv25.ports = [
"GigabitEthernet1/0/20"
"GigabitEthernet1/0/21"
];
# VOC isolated
iso4.ports = [
"GigabitEthernet1/0/22"
"GigabitEthernet1/0/23"
];
# Uplink
switch-a2.ports = [ "GigabitEthernet1/0/24" ];
};
};
switch-ds3 = {
firstboot = true;
role = "switch";
model = "3com-5500G";
location = "Kleiner Saal";
interfaces = { mgmt.type = "phys"; };
links = {
# Public
pub.ports = [
"GigabitEthernet1/0/1"
"GigabitEthernet1/0/2"
"GigabitEthernet1/0/3"
"GigabitEthernet1/0/4"
"GigabitEthernet1/0/5"
"GigabitEthernet1/0/6"
"GigabitEthernet1/0/7"
"GigabitEthernet1/0/8"
"GigabitEthernet1/0/9"
"GigabitEthernet1/0/10"
"GigabitEthernet1/0/11"
"GigabitEthernet1/0/12"
"GigabitEthernet1/0/13"
"GigabitEthernet1/0/14"
"GigabitEthernet1/0/15"
"GigabitEthernet1/0/16"
"GigabitEthernet1/0/17"
"GigabitEthernet1/0/18"
"GigabitEthernet1/0/19"
];
# Stage uplink
priv25.ports = [
"GigabitEthernet1/0/20"
"GigabitEthernet1/0/21"
];
# VOC isolated
iso4.ports = [
"GigabitEthernet1/0/22"
"GigabitEthernet1/0/23"
];
# Uplink
switch-a2.ports = [ "GigabitEthernet1/0/24" ];
};
};
};

View File

@ -25,6 +25,8 @@ in
up2 = 11;
up3 = 12;
up4 = 13;
# Isolated other stuff
c3d2iot = 20;
# Isolated neighbors directly connectied with their modems
iso1 = 101;
iso2 = 102;

Binary file not shown.

View File

@ -55,10 +55,14 @@ Von geeigneten Routern haben wir stets zu wenige übrig, so dass wir sie
gemeinsam kaufen und bezahlen müssen. Such dir einen aus, dann
bestellen und konfigurieren wir ihn.
* Zyxel WSM20 (Multy M1) ([25€](https://geizhals.de/zyxel-multy-m1-v101058.html))
* TP-Link Archer C7 v2 ([58€](http://geizhals.de/tp-link-archer-c7-v2-a923544.html))
* Ubiquiti UniFi nanoHD ([150€](https://geizhals.de/ubiquiti-unifi-nanohd-uap-nanohd-a1802819.html))
* [Jedes Gerät auf dem OpenWRT läuft](https://openwrt.org/supported_devices)
Die genannten Preise sind unverbindlich und schwanken stark mit den
Situationen rund um die Straße von Malaka, Rotem Meer und
Suez-Kanal. Auf eBay gibts gebrauchte Geräte.
![WLAN-Router](https://upload.wikimedia.org/wikipedia/commons/thumb/3/34/Linksys-Wireless-G-Router.jpg/280px-Linksys-Wireless-G-Router.jpg)
### Netzverteilung

View File

@ -1,17 +1,53 @@
{
"nodes": {
"nixpkgs": {
"dns-nix": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1681490924,
"narHash": "sha256-6WrkhmG0pI09VqeYWRLxEgNlVeWdnM5at6vm0w4prBk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "781df3d2de37ace250ba3c2731606c0b6bee465b",
"lastModified": 1703643450,
"narHash": "sha256-EUUF5oxFFPX/etKm0FNQg+7MPHQlNjmM1XhNgyDf7A0=",
"owner": "SuperSandro2000",
"repo": "dns.nix",
"rev": "70dcce71560d4253f63812fa36dee994c81ae814",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-22.11",
"owner": "SuperSandro2000",
"repo": "dns.nix",
"type": "github"
}
},
"flake-utils": {
"locked": {
"lastModified": 1614513358,
"narHash": "sha256-LakhOx3S1dRjnh0b5Dg3mbZyH0ToC9I8Y2wKSkBaTzU=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5466c5bbece17adaab2d82fae80b46e807611bf3",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1713634877,
"narHash": "sha256-+tmLKU8N+YMIIBRPmWFueaytsbSDu4wqGnxc3RKYZwk=",
"owner": "SuperSandro2000",
"repo": "nixpkgs",
"rev": "84f20dcf85434cd2e2a163ec3a30937c78cc26b2",
"type": "github"
},
"original": {
"owner": "SuperSandro2000",
"ref": "nixos-23.11",
"repo": "nixpkgs",
"type": "github"
}
@ -19,16 +55,16 @@
"openwrt": {
"flake": false,
"locked": {
"lastModified": 1681412046,
"narHash": "sha256-mW4B/9GVminuxC0EM6WeQ9soqBy2k8INjhpT+mrnIow=",
"ref": "openwrt-22.03",
"rev": "9af29da281213108cd861ed77b0416bf6eda0aaf",
"revCount": 54587,
"lastModified": 1713442482,
"narHash": "sha256-OAcv1qiM2V6wPQm4Tz2QnnDpw34pifG6QRDZea7AP9o=",
"ref": "openwrt-23.05",
"rev": "9b33b74ef71225442361d5192d3a727be212c3cd",
"revCount": 58296,
"type": "git",
"url": "https://git.openwrt.org/openwrt/openwrt.git"
},
"original": {
"ref": "openwrt-22.03",
"ref": "openwrt-23.05",
"type": "git",
"url": "https://git.openwrt.org/openwrt/openwrt.git"
}
@ -40,11 +76,11 @@
]
},
"locked": {
"lastModified": 1681468707,
"narHash": "sha256-aD+74KowPjyxWP+bIqmZZaIHe5WxEhoXOSF+qOOCwPg=",
"lastModified": 1713693953,
"narHash": "sha256-DsJ/pzBSF3CxQWyiw4V3k96h7Q3UaRnQnL1N9tw+uWg=",
"owner": "astro",
"repo": "nix-openwrt-imagebuilder",
"rev": "b3d1f398472452ea288ce2d8dbf20d6115bf1c64",
"rev": "d4dc8c84f4397be494ae834709276f099df892e7",
"type": "github"
},
"original": {
@ -55,6 +91,7 @@
},
"root": {
"inputs": {
"dns-nix": "dns-nix",
"nixpkgs": "nixpkgs",
"openwrt": "openwrt",
"openwrt-imagebuilder": "openwrt-imagebuilder"

View File

@ -2,9 +2,13 @@
description = "Zentralwerk network";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/release-22.11";
dns-nix = {
url = "github:SuperSandro2000/dns.nix";
inputs.nixpkgs.follows = "nixpkgs";
};
nixpkgs.url = "github:SuperSandro2000/nixpkgs/nixos-23.11";
openwrt = {
url = "git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-22.03";
url = "git+https://git.openwrt.org/openwrt/openwrt.git?ref=openwrt-23.05";
flake = false;
};
openwrt-imagebuilder = {
@ -13,7 +17,7 @@
};
};
outputs = inputs@{ self, nixpkgs, openwrt, openwrt-imagebuilder }:
outputs = inputs@{ self, dns-nix, nixpkgs, openwrt, openwrt-imagebuilder }:
let
system = "x86_64-linux";
systems = [ system ];
@ -26,16 +30,15 @@
specialArgs = {
hostName = name;
inherit (self) lib;
inherit inputs self;
inherit inputs dns-nix self;
};
};
in {
# Config, and utilities
lib = nixpkgs.lib.extend (_final: _prev:
import ./nix/lib {
inherit self;
inherit openwrt;
pkgs = nixpkgs.legacyPackages.x86_64-linux;
inherit self openwrt;
inherit (nixpkgs.legacyPackages.x86_64-linux) lib pkgs;
});
# Everything that can be built locally outside of NixOS

View File

@ -178,7 +178,7 @@ let
type = enum [ "A" "AAAA" "MX" "SRV" "CNAME" "TXT" ];
};
data = mkOption {
type = str;
type = oneOf [ str (attrsOf (oneOf [ int str ])) ];
};
};
});
@ -194,6 +194,13 @@ let
type = with types; nullOr int;
default = null;
};
wifi.ieee80211rKey = mkOption {
type = with types; nullOr str;
default = null;
description = ''
Key between WiFi access points for Fast Transition
'';
};
};
};
@ -439,10 +446,19 @@ let
wifi = mkOption {
default = {};
type = with types; attrsOf (submodule (
{ ... }: {
{ config, ... }: {
options = {
band = mkOption {
type = enum [ "2g" "5g" ];
default =
if config.channel >= 1 && config.channel <= 14
then "2g"
else if config.channel >= 32 && config.channel <= 177
then "5g"
else throw "What band is channel ${toString config.channel}?";
};
htmode = mkOption {
type = enum [ "HT20" "HT40-" "HT40+" "VHT80" ];
type = enum [ "HT20" "HT40-" "HT40+" "HT40" "VHT80" ];
};
channel = mkOption {
type = int;
@ -457,6 +473,10 @@ let
type = nullOr str;
default = null;
};
hidden = mkOption {
type = bool;
default = false;
};
encryption = mkOption {
type = enum [ "none" "owe" "wpa2" "wpa3" ];
default =
@ -472,6 +492,13 @@ let
type = nullOr str;
default = null;
};
disassocLowAck = mkOption {
type = bool;
default = true;
description = ''
Disable for wireless bridges.
'';
};
};
}));
};
@ -577,11 +604,6 @@ in
type = with types; attrsOf (submodule netOpts);
};
net-combined = mkOption {
description = "All hosts of all subnets";
default = {};
type = with types; submodule netOpts;
};
hosts = mkOption {
description = "All the static hosts";

View File

@ -1,13 +1,13 @@
{ self, pkgs, openwrt }:
{ self, lib, openwrt, pkgs }:
rec {
config = (import ./config { inherit self pkgs; }).config;
inherit (import ./config { inherit self pkgs; }) config;
netmasks = import ./netmasks.nix;
subnet = import ./subnet { inherit pkgs; };
dns = import ./dns.nix { inherit pkgs config; };
dns = import ./dns.nix { inherit config lib; };
openwrtModels = import ./openwrt-models.nix { inherit self openwrt; };

View File

@ -1,17 +1,18 @@
{ pkgs, config }:
{ config, lib }:
let
lib = pkgs.lib;
in
rec {
ns = "dns.serv.zentralwerk.org";
internalNS = [ ns ];
# public servers (slaves)
publicNS = [ "ns.c3d2.de" "ns.spaceboyz.net" ];
publicNS = [
"ns.c3d2.de"
"ns.spaceboyz.net"
"ns1.supersandro.de"
];
publicIPv4 = config.site.hosts.upstream4.interfaces.up4-pppoe.upstream.staticIpv4Address;
dynamicReverseZones = [
dynamicReverseZones4 = [
"73.20.172.in-addr.arpa"
"74.20.172.in-addr.arpa"
"75.20.172.in-addr.arpa"
@ -20,6 +21,12 @@ rec {
"78.20.172.in-addr.arpa"
"79.20.172.in-addr.arpa"
"99.22.172.in-addr.arpa"
"22.10.in-addr.arpa"
];
dynamicReverseZones6 = [
"2.0.0.0.c.2.0.8.1.8.0.0.a.2.ip6.arpa"
"4.1.b.a.c.a.2.8.3.5.f.0.a.2.ip6.arpa"
"5.0.2.d.3.c.2.4.0.0.3.2.d.f.ip6.arpa"
];
mapI = start: end: f:
@ -92,7 +99,7 @@ rec {
"${zone}" = true;
}
) {} (builtins.attrNames reverseHosts4)
) ++ dynamicReverseZones
) ++ dynamicReverseZones4
);
# turns `::` into `0000:0000:0000:0000:0000:0000:0000:0000`
@ -237,7 +244,7 @@ rec {
builtins.filter (lib.hasSuffix ".${zone}")
(builtins.attrNames reverseHosts4)
);
dynamic = builtins.elem zone dynamicReverseZones;
dynamic = builtins.elem zone dynamicReverseZones4;
}) reverseZones4
++
builtins.concatMap (ctx:
@ -256,6 +263,7 @@ rec {
builtins.filter (lib.hasSuffix ".${zone}")
(builtins.attrNames reverseHosts6.${ctx})
);
dynamic = builtins.elem zone dynamicReverseZones6;
}) reverseZones6.${ctx}
) (builtins.attrNames reverseZones6);
}

View File

@ -95,7 +95,9 @@ let
ucidef_set_interfaces_lan_wan.ports =
makeLinkFromArg "lan" (builtins.elemAt args 0) //
makeLinkFromArg "wan" (builtins.elemAt args 1);
self.lib.optionalAttrs (builtins.length args > 1) (
makeLinkFromArg "wan" (builtins.elemAt args 1)
);
};
in
if commands ? ${command}

View File

@ -90,7 +90,7 @@ in
Host "inbert.c3d2.de"
Host "heise.de"
'';
}) (lib.optionalAttrs config.services.dhcpd4.enable {
}) (lib.optionalAttrs config.services.kea.dhcp4.enable {
plugins.exec =
let
maxTimeout = builtins.foldl' (maxTimeout: net:
@ -117,11 +117,11 @@ in
}) ];
systemd.services.collectd = lib.mkIf config.services.dhcpd4.enable {
after = [ "dhcpd4.service" ];
systemd.services.collectd = lib.mkIf config.services.kea.dhcp4.enable {
after = [ "kea-dhcp4-server.service" ];
};
security.wrappers = lib.mkIf config.services.dhcpd4.enable {
security.wrappers = lib.mkIf config.services.kea.dhcp4.enable {
collectd-dhcpcount =
let
dhcpcount = pkgs.runCommand "dhcpcount" {

View File

@ -1,36 +1,28 @@
#!/usr/bin/env ruby
require 'date'
require 'csv'
INTERVAL = 300
TIMEOUT = ARGV[0].to_i
hostname = IO::readlines("/proc/sys/kernel/hostname").join.strip
INTERVAL = 60
TIMEOUT = ARGV[0].to_i # TODO: now unused
hostname = CSV::readlines("/proc/sys/kernel/hostname").join.strip
STDOUT.sync = true
loop do
seen = {}
count = 0
now = Time.now.to_i
addr = nil
starts = nil
CSV::readlines("/var/lib/kea/kea-leases4.csv", headers: true).each do |rec|
h = rec.to_h
addr = h["hwaddr"]
next unless addr
last = h["expire"].to_i
elapsed = now - last
next if elapsed >= TIMEOUT
IO::readlines("/var/lib/dhcpd4/dhcpd.leases").each do |line|
if line =~ /^lease (.+) \{/
addr = $1
starts = nil
elsif line =~ /starts \d+ (.+?);/
starts = DateTime.parse($1).to_time
elsif line =~ /^\}/
now = Time.now
if starts and
now >= starts and now < starts + TIMEOUT
unless seen[addr]
count += 1
seen[addr] = true
end
end
unless seen[addr]
count += 1
seen[addr] = true
end
end
puts "PUTVAL \"#{hostname}/exec-dhcpd/current_sessions-leases\" interval=#{INTERVAL} N:#{count}"

View File

@ -112,6 +112,14 @@ in
min ra interval 10;
max ra interval 60;
solicited ra unicast yes;
${if (config.site.net.${net}.dhcp.server or null) == null
then ''
# Do not use DHCP6.
managed no;
'' else ''
# Use DHCP6 for DynDNS.
managed yes;
''}
${builtins.concatStringsSep "\n" (
map (subnet6: ''
@ -439,7 +447,7 @@ in
User = "bird2";
Group = "bird2";
};
path = [ pkgs.bird2 "/run/wrappers" ];
path = with pkgs; [ bird2 iputils ];
script = ''
STATE=unknown

View File

@ -1,4 +1,4 @@
{ config, lib, modulesPath, ... }:
{ config, lib, modulesPath, pkgs, ... }:
{
imports = [
@ -6,18 +6,13 @@
(modulesPath + "/virtualisation/lxc-container.nix")
];
boot = {
isContainer = true;
loader = {
initScript.enable = true;
};
environment = {
etc."machine-id".text = builtins.substring 0 8 (builtins.hashString "sha256" config.networking.hostName);
systemPackages = with pkgs; [
ripgrep
];
};
environment.etc."machine-id".text =
builtins.substring 0 8 (
builtins.hashString "sha256" config.networking.hostName
);
nix = {
settings = {
sandbox = false;

View File

@ -8,98 +8,331 @@ let
dhcp.server == hostName
) config.site.net;
concatMapDhcpNets = f:
lib.pipe dhcpNets [
(builtins.mapAttrs f)
builtins.attrValues
(map (r: if builtins.isList r then r else [ r ]))
builtins.concatLists
];
enabled = builtins.length (builtins.attrNames dhcpNets) > 0;
in
{
services.dhcpd4 = lib.optionalAttrs enabled {
services.kea.dhcp4 = lib.mkIf enabled {
enable = true;
interfaces = builtins.attrNames dhcpNets;
settings = {
interfaces-config.interfaces = builtins.attrNames dhcpNets;
dhcp-ddns.enable-updates = true;
ddns-send-updates = true;
# TODO: use with kea >= 2.5.0
# ddns-conflict-resolution-mode = "check-exists-with-dhcid";
ddns-use-conflict-resolution = false;
ddns-replace-client-name = "when-not-present";
expired-leases-processing.hold-reclaimed-time = builtins.foldl' lib.max
3600 (concatMapDhcpNets (net: { dhcp, ... }: dhcp.max-time));
extraConfig = ''
${builtins.concatStringsSep "\n" (
builtins.attrValues (
builtins.mapAttrs (net: { dhcp, subnet4Net, subnet4Len, domainName, ...}:
''
ddns-update-style standard;
key dyndns {
algorithm hmac-sha256;
secret ${config.site.dyndnsKey};
};
zone ${domainName}. {
primary ${config.site.net.serv.hosts4.dns};
primary6 ${config.site.net.serv.hosts6.dn42.dns};
key dyndns;
subnet4 = concatMapDhcpNets (net: { vlan, subnet4, hosts4, dhcp, domainName, ... }: {
id = vlan;
subnet = subnet4;
pools = [ {
pool = "${dhcp.start} - ${dhcp.end}";
} ];
renew-timer = builtins.ceil (.5 * dhcp.time);
rebind-timer = builtins.ceil (.85 * dhcp.time);
valid-lifetime = dhcp.time;
option-data = [ {
space = "dhcp4";
name = "routers";
code = 3;
data = config.site.net.${net}.hosts4.${dhcp.router};
} {
space = "dhcp4";
name = "domain-name";
code = 15;
data = domainName;
} {
space = "dhcp4";
name = "domain-name-servers";
code = 6;
data = "${config.site.net.serv.hosts4.dnscache}, 9.9.9.9";
} ];
ddns-qualifying-suffix = domainName;
reservations = lib.pipe dhcp.fixed-hosts [
(builtins.mapAttrs (fixedAddr: hwaddr:
if hosts4 ? ${fixedAddr}
then # fixedAddr is a known hostname
let
name = fixedAddr;
addr = hosts4.${fixedAddr};
in {
hostname = "${name}.${net}.zentralwerk.org";
hw-address = hwaddr;
ip-address = addr;
}
${lib.concatMapStrings ({ name, dynamic, ... }:
lib.optionalString (
dynamic &&
lib.hasSuffix ".in-addr.arpa" name
) ''
zone ${name}. {
primary ${config.site.net.serv.hosts4.dns};
primary6 ${config.site.net.serv.hosts6.dn42.dns};
key dyndns;
}
''
) config.site.dns.localZones}
option guid code 97 = text;
group {
default-lease-time ${toString dhcp.time};
max-lease-time ${toString dhcp.max-time};
option routers ${config.site.net.${net}.hosts4.${dhcp.router}};
option domain-name "${domainName}";
option domain-name-servers 172.20.73.8, 9.9.9.9;
ddns-domainname "${domainName}";
class "pxeclients" {
match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
next-server ${config.site.net.serv.hosts4.nfsroot};
option tftp-server-address ${config.site.net.serv.hosts4.nfsroot};
if suffix(reverse(1, option guid), 5) = 34:69:50:52:00 {
# RPi4
option vendor-class-identifier "PXEClient";
option vendor-encapsulated-options "Raspberry Pi Boot";
option tftp-server-name "${config.site.net.serv.hosts4.nfsroot}";
} elsif option pxe-system-type = 00:00 {
filename "netboot.xyz.kpxe"; # BIOS
} elsif option pxe-system-type = 00:07 {
filename "netboot.xyz.efi"; # EFI
option bootfile-name "netboot.xyz.efi";
} elsif option pxe-system-type = 00:06 {
filename "netboot.xyz.efi"; # ia32_EFI
}
else
let
names = builtins.attrNames (
lib.filterAttrs (_: hostAddr:
hostAddr == fixedAddr
) hosts4);
name = builtins.head names;
in
if builtins.length names > 0
then { # fixedAddr is IPv4 of a known hostname
hostname = "${name}.${net}.zentralwerk.org";
hw-address = hwaddr;
ip-address = hosts4.${name};
} # fixedAddr is IPv4?
else {
hw-address = hwaddr;
ip-address = fixedAddr;
}
))
builtins.attrValues
(builtins.filter (r: r != null))
];
});
subnet ${subnet4Net} netmask ${lib.netmasks.${toString subnet4Len}} {
range ${dhcp.start} ${dhcp.end};
match-client-id = false;
host-reservation-identifiers = [ "hw-address" ];
# always assign the same IP to the same MAC address.
# fixes changing IP for PXE clients.
ignore-client-uids true;
}
# Netbooting
option-def = [ {
name = "PXEDiscoveryControl";
code = 6;
space = "vendor-encapsulated-options-space";
type = "uint8";
array = false;
} {
name = "PXEMenuPrompt";
code = 10;
space = "vendor-encapsulated-options-space";
type = "record";
array = false;
record-types = "uint8,string";
} {
name = "PXEBootMenu";
code = 9;
space = "vendor-encapsulated-options-space";
type = "record";
array = false;
record-types = "uint16,uint8,string";
} ];
client-classes =
let
rpi4Class = {
name = "rpi4-pxe";
test = "option[vendor-class-identifier].text == 'PXEClient:Arch:00000:UNDI:002001'";
option-data = [ {
name = "boot-file-name";
data = "bootcode.bin";
} {
name = "vendor-class-identifier";
data = "PXEClient";
} {
name = "vendor-encapsulated-options";
} {
name = "PXEBootMenu";
csv-format = true;
data = "0,17,Raspberry Pi Boot";
space = "vendor-encapsulated-options-space";
} {
name = "PXEDiscoveryControl";
data = "3";
space = "vendor-encapsulated-options-space";
} {
name = "PXEMenuPrompt";
csv-format = true;
data = "0,PXE";
space = "vendor-encapsulated-options-space";
} ];
};
update-static-leases on;
pxeClassData = {
PXE-Legacy = {
arch = "00000";
boot-file-name = "netboot.xyz.kpxe";
};
PXE-UEFI-32-1.arch = "00002";
PXE-UEFI-32-2.arch = "00006";
PXE-UEFI-64-1.arch = "00007";
PXE-UEFI-64-2.arch = "00008";
PXE-UEFI-64-3.arch = "00009";
};
${builtins.concatStringsSep "\n" (
builtins.attrValues (
builtins.mapAttrs (addr: hwaddr:
''
host ${addr} {
hardware ethernet ${hwaddr};
fixed-address ${addr};
}
''
) dhcp.fixed-hosts
)
)}
}
''
) dhcpNets
)
)}
'';
makePxe = name: { boot-file-name ? "netboot.xyz.efi", arch }: {
inherit name boot-file-name;
test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:${arch}'";
next-server = config.site.net.serv.hosts4.nfsroot;
};
in
[ rpi4Class ]
++
builtins.attrValues (
builtins.mapAttrs makePxe pxeClassData
);
control-socket = {
socket-type = "unix";
socket-name = "/run/kea/dhcp4-socket";
};
hooks-libraries = [ {
library = "/run/current-system/sw/lib/kea/hooks/libdhcp_stat_cmds.so";
} {
library = "/run/current-system/sw/lib/kea/hooks/libdhcp_lease_cmds.so";
} ];
};
};
services.kea.dhcp6 = lib.mkIf enabled {
enable = true;
settings = {
interfaces-config.interfaces = builtins.attrNames dhcpNets;
dhcp-ddns.enable-updates = true;
ddns-override-no-update = true;
ddns-override-client-update = true;
ddns-replace-client-name = "when-not-present";
# TODO: use with kea >= 2.5.0
# ddns-conflict-resolution-mode = "check-exists-with-dhcid";
ddns-use-conflict-resolution = false;
subnet6 = concatMapDhcpNets (net: { vlan, subnets6, dhcp, domainName, ... }:
let
subnet = subnets6.up4 or subnets6.flpk or null;
prefix = builtins.head (builtins.split "::/" subnet);
in
if subnet != null
then {
id = vlan;
interface = net;
inherit subnet;
pools = [ {
pool = "${prefix}:c3d2:c3d2:c3d2:1000 - ${prefix}:c3d2:c3d2:c3d2:ffff";
#pool = subnet;
} ];
valid-lifetime = dhcp.time;
max-valid-lifetime = dhcp.max-time;
option-data = [ {
space = "dhcp6";
name = "domain-search";
code = 24;
data = domainName;
} {
space = "dhcp6";
name = "dns-servers";
code = 23;
data = "${config.site.net.serv.hosts6.dn42.dnscache}, 2620:fe::9";
} ];
ddns-generated-prefix = "d";
ddns-qualifying-suffix = domainName;
}
else []
);
host-reservation-identifiers = [ "hw-address" ];
#reservations = concatMapDhcpNets (net: { hosts6, dhcp, ... }:
# builtins.filter (r: r != null) (
# builtins.attrValues (
# builtins.mapAttrs (name: hwaddr:
# let
# ip-addresses = lib.pipe hosts6 [
# (builtins.mapAttrs (_: hosts6: hosts6.${name} or null))
# builtins.attrValues
# (builtins.filter (a: a != null))
# ];
# in
# if builtins.trace (lib.generators.toPretty {} ip-addresses) (builtins.length ip-addresses) > 0
# then {
# hostname = "${name}.${net}.zentralwerk.org";
# hw-address = hwaddr;
# inherit ip-addresses;
# }
# else null
# ) dhcp.fixed-hosts
# )));
control-socket = {
socket-type = "unix";
socket-name = "/run/kea/dhcp6.socket";
};
hooks-libraries = [ {
library = "/run/current-system/sw/lib/kea/hooks/libdhcp_stat_cmds.so";
} {
library = "/run/current-system/sw/lib/kea/hooks/libdhcp_lease_cmds.so";
} ];
};
};
services.kea.dhcp-ddns = lib.mkIf enabled {
enable = true;
settings = {
tsig-keys = [ {
name = "dyndns";
algorithm = "hmac-sha256";
secret = config.site.dyndnsKey;
} ];
forward-ddns.ddns-domains = concatMapDhcpNets (net: { domainName, ... }: {
name = "${domainName}.";
key-name = "dyndns";
dns-servers = [ {
ip-address = config.site.net.serv.hosts4.dns;
} {
ip-address = config.site.net.serv.hosts6.dn42.dns;
} ];
});
reverse-ddns.ddns-domains = map ({ name, ...}: {
name = "${name}.";
key-name = "dyndns";
dns-servers = [ {
ip-address = config.site.net.serv.hosts4.dns;
} {
ip-address = config.site.net.serv.hosts6.dn42.dns;
} ];
}) (
builtins.filter ({ name, dynamic, ... }:
dynamic &&
(lib.hasSuffix ".in-addr.arpa" name ||
lib.hasSuffix ".ip6.arpa" name)
) config.site.dns.localZones
);
control-socket = {
socket-type = "unix";
socket-name = "/run/kea/dhcp-ddns.socket";
};
};
};
services.kea.ctrl-agent = lib.mkIf enabled {
enable = true;
settings.control-sockets = {
dhcp4 = {
socket-type = "unix";
socket-name = "/run/kea/dhcp4.socket";
};
dhcp6 = {
socket-type = "unix";
socket-name = "/run/kea/dhcp6.socket";
};
d2 = {
socket-type = "unix";
socket-name = "/run/kea/dhcp-ddns.socket";
};
};
};
# Increase reliablity
# (mostly for kea-dhcp-ddns-server.service)
systemd.services =
let
restartService.serviceConfig = {
RestartSec = 4;
Restart = "always";
};
in {
kea-dhcp4-server = restartService;
kea-dhcp6-server = restartService;
kea-dhcp-ddns-server = restartService;
};
}

View File

@ -1,26 +1,26 @@
{ hostName, config, lib, pkgs, self, ... }:
{ config, dns-nix, hostName, lib, pkgs, self, ... }:
let
serial = builtins.substring 0 10 self.lastModifiedDate;
generateZoneFile = { name, ns, records, dynamic }:
builtins.toFile "${name}.zone" ''
$ORIGIN ${name}.
$TTL 1h
@ IN SOA ${lib.dns.ns}. astro.spaceboyz.net. (
${serial} ; serial
1h ; refresh
1m ; retry
2h ; expire
1m ; minimum
)
${lib.concatMapStrings (ns: " IN NS ${ns}.\n") ns}
${lib.concatMapStrings ({ name, type, data }:
"${name} IN ${type} ${data}\n"
) records}
'';
generateZoneFile = let
util = dns-nix.util.${pkgs.system};
in { name, ns, records, ... }: util.writeZone name {
TTL = 60*60;
SOA = {
nameServer = "${lib.dns.ns}.";
adminEmail = "astro@spaceboyz.net";
serial = lib.toInt serial;
refresh = 1*60*60;
retry = 5*60;
expire = 2*60*60;
minimum = 1*60;
};
NS = map (a: a+".") ns;
subdomains = lib.foldl (a: b: lib.recursiveUpdate a b) { } (map ({ name, type, data }: {
${name}.${type} = [ data ];
}) records);
};
in
{
options =
@ -35,7 +35,7 @@ in
type = types.enum [ "A" "AAAA" "MX" "SRV" "CNAME" "TXT" "PTR" ];
};
data = mkOption {
type = types.str;
type = types.oneOf [ types.str (types.attrsOf (types.oneOf [ types.int types.str ]))];
};
};
@ -69,90 +69,151 @@ in
config = {
site.dns.localZones = lib.dns.localZones;
services.bind = lib.mkIf config.site.hosts.${hostName}.services.dns.enable (
services.knot = lib.mkIf config.site.hosts.${hostName}.services.dns.enable (
let
generateZone = zone@{ name, dynamic, ... }: {
inherit name;
master = true;
# allowed for zone-transfer
slaves = [
# ns.c3d2.de
"217.197.84.53" "2001:67c:1400:2240::a"
config.site.net.serv.hosts4.bind
config.site.net.serv.hosts6.dn42.bind
config.site.net.serv.hosts6.up4.bind
# ns.spaceboyz.net
"172.22.24.4" "2a01:4f9:4b:39ec::4"
];
file =
if dynamic
then "/var/db/bind/${name}.zone"
domain = name;
template = "zentralwerk";
acl = [ "zone_xfr" ] ++ lib.optional dynamic "dyndns";
file = if dynamic
then "/var/lib/knot/zones/${name}.zone"
else generateZoneFile zone;
extraConfig = ''
also-notify {
# ns.c3d2.de
217.197.84.53;
2001:67c:1400:2240::a;
${config.site.net.serv.hosts4.bind};
${config.site.net.serv.hosts6.dn42.bind};
${config.site.net.serv.hosts6.up4.bind};
# ns.spaceboyz.net
172.22.24.4;
95.217.229.209;
2a01:4f9:4b:39ec::4;
};
notify-source ${config.site.net.serv.hosts4.dns};
notify-source-v6 ${config.site.net.serv.hosts6.up4.dns};
'' + lib.optionalString dynamic ''
allow-update { key "dyndns"; };
'';
notify = [ "all" ];
};
in {
enable = true;
zones = map generateZone config.site.dns.localZones;
settings = {
acl = [
{
id = "dyndns";
action = "update";
key = "dyndns";
}
{
id = "zone_xfr";
address = with config.site.net.serv; [
# ns.c3d2.de
hosts4.knot hosts6.dn42.knot hosts6.up4.knot
"2a00:8180:2c00:282:2041:cbff:fe0c:8516"
"fd23:42:c3d2:582:2041:cbff:fe0c:8516"
# ns.spaceboyz.net
"172.22.24.4" "95.217.229.209" "2a01:4f9:4b:39ec::4"
# ns1.supersandro.de
"188.34.196.104" "2a01:4f8:1c1c:1d38::1"
];
action = "transfer";
}
];
extraConfig = ''
key "dyndns" {
algorithm hmac-sha256;
secret "${config.site.dyndnsKey}";
key = [ {
id = "dyndns";
algorithm = "hmac-sha256";
secret = config.site.dyndnsKey;
} ];
log = [ {
target = "syslog";
any = "info";
} ];
mod-stats = [ {
id = "default";
query-type = "on";
} ];
remote = let
via = with config.site.net.serv; [ hosts4.dns hosts6.up4.dns ];
in [
{
id = "ns.c3d2.de";
address = with config.site.net.serv; [ hosts4.knot hosts6.dn42.knot hosts6.up4.knot ];
inherit via;
} {
id = "ns.spaceboyz.net";
address = [ "172.22.24.4" "95.217.229.209" "2a01:4f9:4b:39ec::4" ];
inherit via;
} {
id = "ns1.supersandro.de";
address = [ /*"188.34.196.104"*/ "2a01:4f8:1c1c:1d38::1" ];
inherit via;
}
];
remotes = [ {
id = "all";
remote = [ "ns.c3d2.de" "ns.spaceboyz.net" "ns1.supersandro.de" ];
} ];
server = {
answer-rotation = true;
automatic-acl = true;
identity = "dns.serv.zentralwerk.org";
listen = with config.site.net; [
"127.0.0.1" "::1"
serv.hosts4.dns serv.hosts6.up4.dns serv.hosts6.dn42.dns
];
tcp-fastopen = true;
version = null;
};
'';
extraOptions = ''
# allow underscores in dynamic hostnames
${lib.concatMapStringsSep "\n" (type: ''
check-names ${type} ignore;
'') [ "master" "slave" "response" ]}
'';
template = [
{
# default is a magic name and is always loaded.
# Because we want to use catalog-role/catalog-zone settings for all zones *except* the catalog zone itself, we must split the templates
id = "default";
global-module = [ "mod-stats" ];
}
{
id = "zentralwerk";
catalog-role = "member";
catalog-zone = "zentralwerk.";
dnssec-signing = true;
journal-content = "all"; # required for zonefile-load=difference-no-serial and makes cold starts like zone reloads
module = "mod-stats/default";
semantic-checks = true;
serial-policy = "increment";
storage = "/var/lib/knot/zones";
zonefile-load = "difference-no-serial";
}
];
zone = [ {
acl = "zone_xfr";
catalog-role = "generate";
domain = "zentralwerk.";
notify = [ "ns1.supersandro.de" ];
storage = "/var/lib/knot/catalog";
} ] ++ map generateZone config.site.dns.localZones;
};
});
systemd.services.create-dynamic-zones = {
description = "Creates dynamic zone files";
requiredBy = [ "bind.service" ];
before = [ "bind.service" ];
serviceConfig.Type = "oneshot";
script = ''
mkdir -p /var/db/bind
systemd.services = {
create-dynamic-zones = {
description = "Creates dynamic zone files";
requiredBy = [ "knot.service" ];
before = [ "knot.service" ];
serviceConfig.Type = "oneshot";
script = ''
mkdir -p /var/lib/knot/zones
${lib.concatMapStringsSep "\n" (zone@{ name, ... }: ''
[ -e /var/db/bind/${name}.zone ] || \
cp ${generateZoneFile zone} /var/db/bind/${name}.zone
chown -R named /var/db/bind
chmod -R u+rwX /var/db/bind
'') (
builtins.filter ({ dynamic, ... }: dynamic) config.site.dns.localZones
)}
'';
};
systemd.services.update-dynamic-zones = {
description = "Creates initial records in dynamic zone files";
requiredBy = [ "bind.service" ];
after = [ "bind.service" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.dnsutils ];
script = ''
${lib.concatMapStrings (zone: ''
nsupdate -y "hmac-sha256:dyndns:${config.site.dyndnsKey}" <<EOF
${lib.concatMapStringsSep "\n" (zone@{ name, ... }: ''
[ -e /var/lib/knot/zones/${name}.zone ] || \
cp ${generateZoneFile zone} /var/lib/knot/zones/${name}.zone
chown -R knot /var/lib/knot/zones
chmod -R u+rwX /var/lib/knot/zones
'') (builtins.filter ({ dynamic, ... }: dynamic) config.site.dns.localZones)}
'';
};
update-dynamic-zones = {
description = "Creates initial records in dynamic zone files";
requiredBy = [ "knot.service" ];
after = [ "knot.service" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.dnsutils ];
script = lib.concatMapStrings (zone: ''
nsupdate -v -y "hmac-sha256:dyndns:${config.site.dyndnsKey}" <<EOF
server localhost
${lib.concatMapStringsSep "\n" ({ name, type, data }: ''
@ -162,10 +223,8 @@ in
send
EOF
'') (
builtins.filter ({ dynamic, ... }: dynamic) config.site.dns.localZones
)}
'';
'') (builtins.filter ({ dynamic, ... }: dynamic) config.site.dns.localZones);
};
};
};
}

View File

@ -1,124 +1,99 @@
{ hostName, config, lib, pkgs, ... }:
lib.mkIf config.site.hosts.${hostName}.services.dnscache.enable {
services.unbound = {
services.kresd = {
enable = true;
settings = {
remote-control = {
control-enable = true;
control-use-cert = false;
};
server = {
num-threads = 4;
verbosity = 1;
prefetch = true;
prefetch-key = true;
serve-expired = true;
cache-min-ttl = 60;
cache-max-ttl = 3600;
infra-cache-slabs = "8";
key-cache-slabs = "8";
msg-cache-slabs = "8";
rrset-cache-slabs = "8";
msg-cache-size = "256m"; # half again 128m?
rrset-cache-size = "512m"; # half again 256m?
instances = 4;
listenPlain = [ "0.0.0.0:53" "[::0]:53" ];
package = pkgs.knot-resolver.override { extraFeatures = true; };
extraConfig = /* lua */ ''
modules = {
'http',
'policy',
'predict',
'prefill',
'serve_stale < cache', -- servce stail records while refreshing the record
'workarounds < iterate', -- solve problems around specific broken subdomains, mainly disables case randomization
'view'
}
interface = [ "0.0.0.0" "'::0'" ];
# TODO: generate
access-control = builtins.concatLists [
[ # localhost
"::1/128 allow"
"127.0.0.0/8 allow"
]
[ # mgmt
"${config.site.net.mgmt.subnet4} allow"
]
[ # dn42
"fd23:42:c3d2:500::/56 allow"
"::172.20.72.0/117 allow"
"::172.22.99.0/120 allow"
"172.20.72.0/21 allow"
"172.22.99.0/24 allow"
]
[ # freifunk
"10.200.0.0/15 allow"
]
[ # DSI
"2a00:8180:2000:37::1/128 allow"
"2a00:8180:2c00:200::/56 allow"
]
[ # flpk
"${config.site.net.flpk.subnet4} allow"
"2a0f:5382:acab:1400::/56 allow"
]
[ # default
"0.0.0.0/0 deny"
"::/0 deny"
]
];
# For DNS over TLS
tls-cert-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
cache.size = 500 * MB
cache.min_ttl(60)
# allow reverse lookup of rfc1918 space, which includes the DN42 address space
unblock-lan-zones = true;
insecure-lan-zones = true;
net.listen('127.0.0.1', 8453, { kind = 'webmgmt' })
http.prometheus.namespace = 'resolver_'
domain-insecure = [
"dn42"
"d.f.ip6.arpa"
"ffdd"
];
};
-- dns42
policy.add(policy.suffix(
policy.STUB({'fd42:d42:d42:54::1', 'fd42:d42:d42:53::1', '172.20.0.53', '172.23.0.53'}),
policy.todnames({'dn42.', 'd.f.ip6.arpa', '20.172.in-addr.arpa', '21.172.in-addr.arpa', '22.172.in-addr.arpa', '23.172.in-addr.arpa'})
))
forward-zone = let
mkFfddZone = name: {
inherit name;
forward-addr = [ "10.200.0.4" "10.200.0.16" ];
};
in [ {
name = ".";
forward-tls-upstream = true;
forward-addr = [
# Quad9
"2620:fe::fe@853#dns.quad9.net"
"9.9.9.9@853#dns.quad9.net"
"2620:fe::9@853#dns.quad9.net"
"149.112.112.112@853#dns.quad9.net"
# Cloudflare DNS
"2606:4700:4700::1111@853#cloudflare-dns.com"
"1.1.1.1@853#cloudflare-dns.com"
"2606:4700:4700::1001@853#cloudflare-dns.com"
"1.0.0.1@853#cloudflare-dns.com"
];
} ] ++
# Local networks
map ({ name, ... }: {
name = "${name}";
forward-addr = [ "${config.site.net.serv.hosts4.dns}" ] ++
map (hosts6: hosts6.dns)
(builtins.attrValues config.site.net.serv.hosts6);
}) config.site.dns.localZones
# Freifunk
++ (map mkFfddZone [
"ffdd"
"200.10.in-addr.arpa"
"201.10.in-addr.arpa"
]);
# DN42
stub-zone = let
mkDn42Zone = name: {
inherit name;
stub-prime = true;
stub-addr = [
"172.20.0.53" "fd42:d42:d42:54::1"
"172.23.0.53" "fd42:d42:d42:53::1"
];
};
in map mkDn42Zone [
"dn42" "d.f.ip6.arpa"
"20.172.in-addr.arpa" "21.172.in-addr.arpa"
"22.172.in-addr.arpa" "23.172.in-addr.arpa"
];
};
-- freifunk
policy.add(policy.suffix(
policy.STUB({'10.200.0.4', '10.200.0.16'}),
policy.todnames({'ffdd.', '200.10.in-addr.arpa', '201.10.in-addr.arpa'})
))
-- size.dns.localZones
policy.add(policy.suffix(
policy.STUB({'${config.site.net.serv.hosts4.dns}', ${lib.concatStringsSep ", " (map (hosts6: "'${hosts6.dns}'") (builtins.attrValues config.site.net.serv.hosts6))}}),
policy.todnames({${lib.concatStringsSep ", " (map (zone: "'${zone.name}'") config.site.dns.localZones)}})
))
-- forward to dns caches
policy.add(policy.slice(
policy.slice_randomize_psl(),
-- quad9
policy.TLS_FORWARD({
{'2620:fe::fe', hostname='dns.quad9.net'},
{'2620:fe::9', hostname='dns.quad9.net'},
{'9.9.9.9', hostname='dns.quad9.net'},
{'149.112.112.112', hostname='dns.quad9.net'}
}),
-- cloudflare
policy.TLS_FORWARD({
{'2606:4700:4700::1111', hostname='cloudflare-dns.com'},
{'2606:4700:4700::1001', hostname='cloudflare-dns.com'},
{'1.1.1.1', hostname='cloudflare-dns.com'},
{'1.0.0.1', hostname='cloudflare-dns.com'}
})
))
-- allow access from our networks
'' + lib.concatMapStringsSep "\n" (cidr: "view:addr('${cidr}', policy.all(policy.PASS))") [
# localhost
"::1/128" "127.0.0.0/8"
# mgmt
"${config.site.net.mgmt.subnet4}"
# dn42
"fd23:42:c3d2:500::/56" "::172.20.72.0/117" "::172.22.99.0/120"
"172.20.72.0/21" "172.22.99.0/24"
# freifunk
"10.200.0.0/15"
# DSI
"2a00:8180:2000:37::1/128" "2a00:8180:2c00:200::/56"
# flpk
"${config.site.net.flpk.subnet4}" "2a0f:5382:acab:1400::/56 allow"
] + "\n" + /* lua */ ''
-- drop everything that hasn't matched
view:addr('0.0.0.0/0', policy.all(policy.DROP))
view:addr('::/0', policy.all(policy.DROP))
predict = {
window = 15, -- sampling window
period = 24*(60/15) -- track last X hours, divide through sampling window
}
prefill.config({
['.'] = {
url = 'https://www.internic.net/domain/root.zone',
interval = 86400, -- seconds
}
})
trust_anchors.set_insecure({'dn42', 'd.f.ip6.arpa', 'ffdd'})
'';
};
}

View File

@ -0,0 +1,114 @@
{ config, lib, ... }:
let
inherit (config.networking) hostName;
interfaces = config.site.hosts.${hostName}.physicalInterfaces;
# linux iface name max length = 15
shortenNetName = name:
if builtins.match "priv(.*)" name != null
then "p" + builtins.substring 4 9 name
else if name == "coloradio"
then "cr"
else if name == "coloradio-gw"
then "cr-gw"
else name;
checkIfname = ifname: let
len = builtins.stringLength ifname;
in if len > 15
then throw "Interface name ${ifname} is ${toString (len - 15)} chars too long."
else ifname;
# `lxc.net.*` formatter for lxc.container.conf files
netConfig =
let
attrNamesOrdered = attrs:
if attrs ? type
then [ "type" ] ++ lib.remove "type" (builtins.attrNames attrs)
else builtins.attrNames attrs;
serialize = name: x:
if builtins.isString x
then "${name} = ${x}\n"
else if builtins.isAttrs x
then builtins.concatStringsSep "" (
map (n: serialize "${name}.${n}" x.${n}) (attrNamesOrdered x)
)
else if builtins.isList x
then
let
enumerate = xs: n:
if xs == []
then []
else [ {
e = builtins.head xs;
i = n;
} ] ++ enumerate (builtins.tail xs) (n + 1);
in
builtins.concatStringsSep "" (
map ({ e, i }: serialize "${name}.${toString i}" e) (enumerate x 0)
)
else throw "Invalid data in lxc net config for ${name}: ${lib.generators.toPretty {} x}";
in
serialize "lxc.net" (
map (netName:
let
ifData = interfaces.${netName};
in {
type = ifData.type;
name = checkIfname netName;
flags = "up";
hwaddr = if ifData ? hwaddr && ifData.hwaddr != null
then ifData.hwaddr
else "0A:14:48:xx:xx:xx";
} // (lib.optionalAttrs (ifData.type == "veth") {
veth.pair = checkIfname "${shortenNetName hostName}-${shortenNetName netName}";
veth.mode = checkIfname "bridge";
link = checkIfname netName;
}) // (lib.optionalAttrs (ifData.type == "phys") {
link = checkIfname "ext-${netName}";
})
) (builtins.attrNames interfaces)
);
in
{
system.build.lxcConfig = builtins.toFile "${hostName}.conf" ''
# For lxcfs and sane defaults
lxc.include = /etc/lxc/common.conf
lxc.uts.name = ${hostName}
# Handled by lxc@.service
lxc.start.auto = 0
lxc.rootfs.path = /var/lib/lxc/${hostName}/rootfs
lxc.init.cmd = "/init"
lxc.mount.entry = /nix/store nix/store none bind,ro 0 0
lxc.mount.entry = none tmp tmpfs defaults 0 0
lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
lxc.autodev = 1
lxc.tty.max = 0
lxc.pty.max = 8
lxc.cap.drop = sys_module sys_time sys_nice sys_pacct sys_rawio
security.privileged = false
lxc.apparmor.profile = lxc-container-default-with-mounting
lxc.cgroup.memory.limit_in_bytes = 1G
lxc.cgroup.memory.kmem.tcp.limit_in_bytes = 128M
# tuntap
lxc.cgroup.devices.allow = c 10:200 rw
lxc.cgroup2.devices.allow = c 10:200 rw
# ppp
lxc.cgroup.devices.allow = c 108:0 rwm
lxc.cgroup2.devices.allow = c 108:0 rwm
${netConfig}
'';
}

View File

@ -1,4 +1,4 @@
{ hostName, config, lib, ... }:
{ hostName, config, lib, pkgs, ... }:
let
hostConf = config.site.hosts.${hostName};
@ -98,12 +98,25 @@ in
${lib.optionalString (staticIpv4Address != null) ''
# Allow connections to ${staticIpv4Address} from other hosts behind NAT
${lib.concatMapStrings (fwd: ''
iptables -t nat -t nat -A nixos-nat-pre \
${lib.concatMapStrings (fwd: let
m = builtins.match "([0-9.]+):([0-9-]+)" fwd.destination;
destinationIP = if m == null then throw "bad ip:ports `${fwd.destination}'" else lib.elemAt m 0;
destinationPorts = if m == null then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (lib.elemAt m 1);
in ''
iptables -t nat -A nixos-nat-pre \
-d ${staticIpv4Address} -p ${fwd.proto} \
--dport ${builtins.toString fwd.sourcePort} \
-j DNAT --to-destination ${fwd.destination}
'') config.networking.nat.forwardPorts}
iptables -t nat -A nixos-nat-post \
-d ${destinationIP} -p ${fwd.proto} \
--dport ${destinationPorts} \
-s 172.20.72.0/21 -j MASQUERADE
iptables -t nat -A nixos-nat-post \
-d ${destinationIP} -p ${fwd.proto} \
--dport ${destinationPorts} \
-s ${config.site.net.c3d2.subnet4} -j MASQUERADE
'') config.networking.nat.forwardPorts}
''}
# Do not NAT our public IPv4 addresses
@ -126,6 +139,10 @@ in
-j RETURN
'') upstreamInterfaces.${net}.upstream.noNat.subnets6
) (builtins.attrNames upstreamInterfaces)}
# There just have been moments without a complete ruleset. Flush
# out invalid conntrack states!
${pkgs.conntrack-tools}/bin/conntrack -F
'';
extraStopCommands = ''
iptables -F FORWARD 2>/dev/null || true

View File

@ -26,7 +26,7 @@ in lib.mkIf (pppoeInterfaces != {}) {
enable = true;
autostart = true;
config = ''
plugin rp-pppoe.so
plugin pppoe.so
nic-${upstream.link}
ifname ${ifName}
# Login settings. (PAP)
@ -39,11 +39,11 @@ in lib.mkIf (pppoeInterfaces != {}) {
maxfail 0
# Seconds between reconnection attempts
holdoff 1
# LCP settings.
lcp-echo-interval 5
lcp-echo-failure 6
# PPPoE compliant settings.
noaccomp
default-asyncmap

View File

@ -1,13 +1,13 @@
# Pulls together NixOS configuration modules according to the
# name/role of the host to be built.
{ hostName, config, lib, ... }:
{ hostName, lib, ... }:
let
inherit (lib) optionals;
hostConfig = lib.config.site.hosts.${hostName};
in {
site = lib.config.site;
inherit (lib.config) site;
imports = [
../lib/config/options.nix
@ -20,6 +20,7 @@ in {
./server/default.nix
] ++
optionals (hostConfig.role == "container") [
./container/lxc-config.nix
./container/defaults.nix
./container/dhcp-server.nix
./container/wireguard.nix

View File

@ -7,9 +7,9 @@
# Prevents automatic creation of interface bond0 by the kernel
"bonding.max_bonds=0"
];
boot.tmpOnTmpfs = true;
boot.tmp.useTmpfs = true;
# Includes wireguard
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelPackages = pkgs.zfsUnstable.latestCompatibleLinuxPackages;
# Keep building
boot.zfs.enableUnstable = true;
@ -35,8 +35,8 @@
};
documentation = {
enable = false;
nixos.enable = false;
enable = lib.mkForce false;
nixos.enable = lib.mkForce false;
};
environment.systemPackages = with pkgs; [
@ -44,6 +44,8 @@
bridge-utils
conntrack-tools
dhcpcd
dhcpdump
dig
ethtool
git
iftop
@ -56,6 +58,7 @@
screen
speedtest-cli
tcpdump
tmux
traceroute
vim
wget
@ -63,6 +66,25 @@
networking.hostName = hostName;
programs = {
fzf.keybindings = true;
git = {
enable = true;
config = {
alias = {
co = "checkout";
lg = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold y
ow)%d%C(reset)'";
remote = "remote -v";
st = "status";
undo = "reset --soft HEAD^";
};
pull.rebase = true;
rebase.autoStash = true;
};
};
};
users.users.root.initialHashedPassword = "";
system.stateVersion = "20.09";

View File

@ -1,11 +1,18 @@
{ hostName, config, lib, ... }:
lib.mkIf config.site.hosts.${hostName}.firewall.enable {
networking.firewall = {
let
hostConfig = config.site.hosts.${hostName};
in {
networking.firewall = lib.mkIf hostConfig.firewall.enable {
enable = true;
extraCommands = ''
${lib.optionalString hostConfig.isRouter ''
ip46tables -I nixos-fw -p ospfigp -j ACCEPT
''}
ip46tables -A FORWARD -i core -m state --state ESTABLISHED,RELATED -j ACCEPT
ip46tables -A FORWARD -i core -j REJECT --reject-with net-unreach
ip46tables -A FORWARD -i core -j REJECT
'';
extraStopCommands = ''
ip46tables -F FORWARD

View File

@ -8,14 +8,20 @@
time.timeZone = "Europe/Berlin";
environment.systemPackages = with pkgs; [
wget vim git screen
git
inetutils # telnet
ipmitool
liboping # noping
screen
vim
wget
];
services.openssh.enable = true;
services.openssh.permitRootLogin = "prohibit-password";
services.openssh = {
enable = true;
settings.PermitRootLogin = "prohibit-password";
};
# additional config for bare metal
services.collectd = {
plugins.ipmi = "";
};
services.collectd.plugins.ipmi = "";
}

View File

@ -10,70 +10,6 @@ let
enabled = containers != {};
# linux iface name max length = 15
shortenNetName = name:
if builtins.match "priv(.*)" name != null
then "p" + builtins.substring 4 9 name
else name;
checkIfname = ifname: let
len = builtins.stringLength ifname;
in if len > 15
then throw "Interface name ${ifname} is ${toString (len - 15)} chars too long."
else ifname;
# `lxc.net.*` formatter for lxc.container.conf files
netConfig = ctName: interfaces:
let
config = map (netName:
let
ifData = interfaces.${netName};
in {
type = ifData.type;
name = checkIfname netName;
flags = "up";
hwaddr = if ifData ? hwaddr && ifData.hwaddr != null
then ifData.hwaddr
else "0A:14:48:xx:xx:xx";
} // (lib.optionalAttrs (ifData.type == "veth") {
veth.pair = checkIfname "${shortenNetName ctName}-${shortenNetName netName}";
veth.mode = checkIfname "bridge";
link = checkIfname netName;
}) // (lib.optionalAttrs (ifData.type == "phys") {
link = checkIfname "ext-${netName}";
})
) (builtins.attrNames interfaces);
attrNamesOrdered = attrs:
if attrs ? type
then [ "type" ] ++ lib.remove "type" (builtins.attrNames attrs)
else builtins.attrNames attrs;
serialize = name: x:
if builtins.isString x
then "${name} = ${x}\n"
else if builtins.isAttrs x
then builtins.concatStringsSep "" (
map (n: serialize "${name}.${n}" x.${n}) (attrNamesOrdered x)
)
else if builtins.isList x
then
let
enumerate = xs: n:
if xs == []
then []
else [ {
e = builtins.head xs;
i = n;
} ] ++ enumerate (builtins.tail xs) (n + 1);
in
builtins.concatStringsSep "" (
map ({ e, i }: serialize "${name}.${toString i}" e) (enumerate x 0)
)
else throw "Invalid data in lxc net config for ${name}: ${lib.generators.toPretty {} x}";
in
serialize "lxc.net" config;
# User-facing script to build/update container NixOS systems
build-script = pkgs.writeScriptBin "build-container" ''
#! ${pkgs.runtimeShell} -e
@ -94,6 +30,7 @@ let
${ctName})
echo Using prebuilt system for container $c
SYSTEM=${self.packages.x86_64-linux."${ctName}-rootfs"}
CONFIG=${self.packages.x86_64-linux."${ctName}-lxc-config"}
;;
'') (
builtins.attrNames (
@ -105,6 +42,8 @@ let
echo Building $c
nix build -o /nix/var/nix/gcroots/lxc/$c zentralwerk-network#$c-rootfs
SYSTEM=$(readlink /nix/var/nix/gcroots/lxc/$c)
nix build -o /nix/var/nix/gcroots/lxc/$c.config zentralwerk-network#$c-lxc-config
CONFIG=$(readlink /nix/var/nix/gcroots/lxc/$c.config)
;;
esac
@ -117,6 +56,7 @@ let
mkdir -p /var/lib/lxc/$c/rootfs/$d
done
ln -fs $SYSTEM/init /var/lib/lxc/$c/rootfs/init
ln -fs $CONFIG /var/lib/lxc/$c/config
done
# Activate all the desired container after all of them are
@ -162,10 +102,8 @@ in
virtualisation.lxc = lib.mkIf enabled {
enable = true;
# Container configs live in /etc so that they can be created
# through `environment.etc`.
systemConfig = ''
lxc.lxcpath = /etc/lxc/containers
lxc.lxcpath = /var/lib/lxc
'';
};
@ -176,50 +114,7 @@ in
enable-script disable-script
];
# Create lxc.container.conf files
environment.etc =
builtins.foldl' (etc: ctName: etc // {
"lxc/containers/${ctName}/config" = {
enable = true;
source =
builtins.toFile "${ctName}.conf" ''
# For lxcfs and sane defaults
lxc.include = /etc/lxc/common.conf
lxc.uts.name = ${ctName}
# Handled by lxc@.service
lxc.start.auto = 0
lxc.rootfs.path = /var/lib/lxc/${ctName}/rootfs
lxc.init.cmd = "/init"
lxc.mount.entry = /nix/store nix/store none bind,ro 0 0
lxc.mount.entry = none tmp tmpfs defaults 0 0
lxc,mount.auto = proc:mixed sys:ro cgroup:mixed
lxc.autodev = 1
lxc.tty.max = 0
lxc.pty.max = 8
lxc.cap.drop = sys_module sys_time sys_nice sys_pacct sys_rawio
security.privileged = false
lxc.apparmor.profile = lxc-container-default-with-mounting
lxc.cgroup.memory.limit_in_bytes = 1G
lxc.cgroup.memory.kmem.tcp.limit_in_bytes = 128M
# tuntap
lxc.cgroup.devices.allow = c 10:200 rw
lxc.cgroup2.devices.allow = c 10:200 rw
# ppp
lxc.cgroup.devices.allow = c 108:0 rwm
lxc.cgroup2.devices.allow = c 108:0 rwm
${netConfig ctName containers.${ctName}.physicalInterfaces}
'';
};
}) {
"lxc/common.conf".source = "${pkgs.lxc}/share/lxc/config/common.conf";
} (builtins.attrNames containers);
environment.etc."lxc/common.conf".source = "${pkgs.lxc}/share/lxc/config/common.conf";
# Systemd service template for LXC containers
systemd.services."lxc@" = {
@ -248,6 +143,8 @@ in
Restart = "always";
RestartSec = "1s";
};
# Prevent restart on host nixos-rebuild switch
restartIfChanged = false;
};
# Starts all the containers after boot

View File

@ -114,5 +114,7 @@ in
networkConfig.Bridge = net;
};
}) {} ctNets;
wait-online.anyInterface = true;
};
}

View File

@ -39,7 +39,6 @@
};
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/sda";
networking.hostName = "server2"; # Define your hostname.

View File

@ -7,11 +7,14 @@ let
inherit (pkgs) lib;
export-openwrt-models = pkgs.writeText "openwrt-models.nix" (
nixpkgs.lib.generators.toPretty {} self.lib.openwrtModels
lib.generators.toPretty {} self.lib.openwrtModels
);
export-config = pkgs.writeText "config.nix" (
nixpkgs.lib.generators.toPretty {} (lib.filterAttrsRecursive (n: v: n != "net-combined") config)
);
lib.generators.toPretty {} (
lib.recursiveUpdate
config
{ site.dns.localZones = self.lib.dns.localZones; }
));
encrypt-secrets = pkgs.writeScriptBin "encrypt-secrets" ''
#! ${pkgs.runtimeShell} -e
@ -52,7 +55,20 @@ let
"${hostName}-rootfs" = mkRootfs hostName;
}) {} (
builtins.attrNames (
nixpkgs.lib.filterAttrs (_: { role, ... }: builtins.elem role ["server" "container"])
lib.filterAttrs (_: { role, ... }: builtins.elem role ["server" "container"])
config.site.hosts
)
);
mkLxcConfig = hostName:
self.nixosConfigurations.${hostName}.config.system.build.lxcConfig;
lxc-configs =
builtins.foldl' (rootfs: hostName: rootfs // {
"${hostName}-lxc-config" = mkLxcConfig hostName;
}) {} (
builtins.attrNames (
lib.filterAttrs (_: { role, ... }: role == "container")
config.site.hosts
)
);
@ -65,7 +81,7 @@ let
});
}) {} (
builtins.attrNames (
nixpkgs.lib.filterAttrs (_: { role, ... }: role == "server")
lib.filterAttrs (_: { role, ... }: role == "server")
config.site.hosts
)
);
@ -79,7 +95,7 @@ let
"${hostName}-image" = openwrt.buildImage hostName;
}) {} (
builtins.attrNames (
nixpkgs.lib.filterAttrs (_: { role, ... }:
lib.filterAttrs (_: { role, ... }:
role == "ap"
) config.site.hosts
)
@ -117,7 +133,7 @@ let
inherit self;
};
in
rootfs-packages // vm-packages // device-templates // openwrt-packages // network-graphs // network-cypher-graphs // starlink // subnetplans // {
rootfs-packages // lxc-configs // vm-packages // device-templates // openwrt-packages // network-graphs // network-cypher-graphs // starlink // subnetplans // {
inherit export-openwrt-models export-config dns-slaves
encrypt-secrets decrypt-secrets switch-to-production
homepage gateway-report switch-report vlan-report

View File

@ -13,7 +13,7 @@ let
export-config
gateway-report network-graphs
subnetplans switch-report vlan-report;
in
stdenv.mkDerivation {
pname = "zentralwerk-network-homepage";
@ -65,6 +65,7 @@ stdenv.mkDerivation {
ln -s ${network-graphs}/share/doc/zentralwerk/* $DIR/
ln -s ${../../../doc/core.png} $DIR/core.png
ln -s ${./security.txt} $DIR/security.txt
cp *.{html,css,png,svg} $DIR/
mkdir -p $out/nix-support

View File

@ -0,0 +1,3 @@
Contact: mailto:astro@spaceboyz.net
Preferred-Languages: en, de
Hiring: https://www.c3d2.de/space.html

View File

@ -7,17 +7,17 @@ let
modelPackages = {
"tplink_archer-c7-v2" = [
"-kmod-ath10k-ct" "-ath10k-firmware-qca988x-ct"
"-kmod-ath10k-ct" "-ath10k-firmware-qca988x-ct-full-htt" "-ath10k-firmware-qca988x-ct"
"kmod-ath10k" "ath10k-firmware-qca988x"
];
"tplink_archer-c7-v5" = [
"-kmod-ath10k-ct" "-ath10k-firmware-qca988x-ct" "-ath10k-firmware-qca988x-ct-full-htt"
"kmod-ath10k" "ath10k-firmware-qca988x"
];
"ubnt_unifiac-lite" = [
"-kmod-ath10k-ct" "-ath10k-firmware-qca988x-ct"
"kmod-ath10k" "ath10k-firmware-qca988x"
];
# "ubnt_unifiac-lite" = [
# "-kmod-ath10k-ct" "-ath10k-firmware-qca988x-ct"
# "kmod-ath10k" "ath10k-firmware-qca988x"
# ];
"ubnt_unifiac-mesh" = [
"-kmod-ath10k-ct" "-ath10k-firmware-qca988x-ct"
"kmod-ath10k" "ath10k-firmware-qca988x"
@ -70,10 +70,10 @@ in rec {
target = "ar71xx";
variant = "tiny";
profile = model;
sha256 = "109a2557gwmgib7r500qn9ygd8j4r4cv5jl5rpn9vczsm4ilkc1z";
sha256 = "sha256-P7BJI6n6s53szYXKshnJRKL2fLIYgJLPiq/yd0oRKoE=";
feedsSha256 = {
base.sha256 = "0xklqsk6d5d6bai0ry2hzfjr4sycf6241ihv8v1lmmf9r7d47cr1";
packages.sha256 = "05g048saibh304ndnlczyq92b1c67c3cqvbhdamw1xqbsp6jzifp";
base.sha256 = "sha256-IbND2snJ1UrDRhvGQIRxzGuSpftQ+AyiWqaVZqbGdHY=";
packages.sha256 = "sha256-18UvzdUL98CranBtzAY7hoUlEvafUdssAQOuqDQi4BU=";
};
}
else null;
@ -83,22 +83,26 @@ in rec {
extraImageName = "zw-${hostName}";
packages = [
# remove unused default .ipk
"-dnsmasq" "-firewall"
"-dnsmasq" "-firewall" "-firewall4"
"-ppp" "-ppp-mod-pppoe" "-kmod-ppp" "-kmod-pppoe" "-kmod-pppox"
"-iptables" "-ip6tables" "-kmod-ipt-offload"
"-odhcp6c" "-odhcpd-ipv6only"
"-wpad-basic-mbedtls"
# monitoring
"collectd"
"collectd-mod-iwinfo" "collectd-mod-network"
"collectd-mod-interface" "collectd-mod-load" "collectd-mod-cpu"
"collectd-mod-exec"
] ++ (
if args.variant != "tiny"
then [
# debugging
"htop"
"tcpdump"
# wpa3
"-wpad-basic-wolfssl" "-wpad-mini"
"wpad-openssl"
"usteer"
] else [
# debugging
"tcpdump-mini"
@ -115,6 +119,10 @@ in rec {
cat > $out/etc/uci-defaults/99-zentralwerk <<EOF
${uciConfig hostName}
EOF
mkdir -p $out/usr/{bin,sbin}
cp ${./usteer-info.sh} $out/usr/sbin/usteer-info.sh
cp ${./usteer-stats.sh} $out/usr/bin/usteer-stats.sh
chmod +x $out/usr/bin/*.sh $out/usr/sbin/*.sh
'';
});

View File

@ -18,8 +18,21 @@ let
# ours don't come with a switch.
then false
else
openwrtModel ? ports
&&
any ({ switch ? null, ... }: switch != null)
(builtins.attrValues openwrtModel.ports);
hasDSA = (
all ({ switch ? null, ... }:
switch == null
) (builtins.attrValues openwrtModel.ports or {})
&&
any ({ port ? null, interface ? null, ... }:
port != null &&
interface != null &&
port == interface
) (builtins.attrValues openwrtModel.ports or {})
) || hostConfig.model == "ubnt_unifi-usg";
portsDoc =
let
@ -99,6 +112,20 @@ let
)
);
dsaPorts = net:
unique (
concatMap ({ ports, ... }: ports) (
builtins.filter ({ nets, ... }: builtins.elem net nets)
(builtins.attrValues hostConfig.links)
));
dsaPortType = net: port:
if any ({ ports, trunk, ... }: trunk && builtins.elem port ports) (
builtins.attrValues hostConfig.links
) || hostConfig.links.${net}.trunk or true
then "t"
else "u*";
networkInterfaces = net:
let
inherit (config.site.net.${net}) vlan;
@ -132,6 +159,16 @@ let
)
);
mgmtInterface =
if hasDSA
then "br0.${toString config.site.net.mgmt.vlan}"
else
let
mgmtInterfaces = networkInterfaces "mgmt";
in if builtins.length mgmtInterfaces == 1
then builtins.head mgmtInterfaces
else "br-mgmt";
in
''
# Set root password
@ -151,8 +188,8 @@ in
uci set system.@system[0].log_ip=${config.site.net.mgmt.hosts4.logging}
uci set system.@system[0].log_proto=udp
# Switch config
${optionalString hasSwitch ''
# Switch config
# Ports ${portsDoc}
${concatMapStrings (net: ''
uci add network switch_vlan
@ -161,7 +198,42 @@ in
uci set network.@switch_vlan[-1].vlan='${toString config.site.net.${net}.vlan}'
uci set network.@switch_vlan[-1].ports='${switchPortsConfig net}'
uci set network.@switch_vlan[-1].comment='${net}'
'') (
sort (net1: net2:
config.site.net.${net1}.vlan < config.site.net.${net2}.vlan
) (
unique (
builtins.concatMap ({ nets, ... }: nets)
(builtins.attrValues hostConfig.links)
)
)
)}
''}
${optionalString hasDSA ''
# DSA
${uciDeleteAll "network.@device"}
uci add network device
uci set network.@device[-1].name='br0'
uci set network.@device[-1].type='bridge'
${concatMapStrings (port: ''
uci add_list network.@device[-1].ports='${port}'
'') (
unique (
builtins.concatMap ({ ports, ... }: ports)
(builtins.attrValues hostConfig.links)
)
)}
uci set network.br0='interface'
uci set network.br0.proto='none'
uci set network.br0.device='br0'
${concatMapStrings (net: ''
uci add network bridge-vlan
uci set network.@bridge-vlan[-1].device='br0'
uci set network.@bridge-vlan[-1].vlan='${toString config.site.net.${net}.vlan}'
${concatMapStrings (port: ''
uci add_list network.@bridge-vlan[-1].ports='${port}:${dsaPortType net port}'
'') (dsaPorts net)}
'') (
sort (net1: net2:
config.site.net.${net1}.vlan < config.site.net.${net2}.vlan
@ -176,11 +248,16 @@ in
# mgmt network
uci set network.mgmt=interface
uci set network.mgmt.ifname='${
if builtins.length (networkInterfaces "mgmt") > 0
then concatStringsSep " " (networkInterfaces "mgmt")
else throw "${hostName}: No interface for mgmt"
}'
${if hasDSA
then ''
uci set network.mgmt.device='br0.${toString config.site.net.mgmt.vlan}'
'' else ''
uci set network.mgmt.ifname='${
if builtins.length (networkInterfaces "mgmt") > 0
then concatStringsSep " " (networkInterfaces "mgmt")
else throw "${hostName}: No interface for mgmt"
}'
''}
uci set network.mgmt.proto=static
${optionalString (hostConfig.interfaces.mgmt.type == "bridge") ''
uci set network.mgmt.type=bridge
@ -210,9 +287,17 @@ in
uci set network.${net}=interface
${optionalString (iface.type == "bridge") ''
uci set network.${net}.type=bridge
uci add network device
uci set network.@device[-1].name='${net}'
uci set network.@device[-1].type='bridge'
''}
uci set network.${net}.proto=static
uci set network.${net}.ifname='${concatStringsSep " " (networkInterfaces net)}'
${if hasDSA
then ''
uci set network.${net}.device='br0.${toString config.site.net.${net}.vlan}'
'' else ''
uci set network.${net}.ifname='${concatStringsSep " " (networkInterfaces net)}'
''}
${optionalString (config.site.net.${net}.mtu != null) ''
uci set network.${net}.mtu=${toString config.site.net.${net}.mtu}
''}
@ -244,6 +329,7 @@ in
'') (builtins.attrNames hostConfig.interfaces)
}
${uciDeleteAll "wireless.radio"}
uci -q delete wireless.default_radio0 || true
uci -q delete wireless.default_radio1 || true
${concatStrings (imap0 (index: path:
@ -256,6 +342,7 @@ in
uci set wireless.radio${toString index}=wifi-device
uci set wireless.radio${toString index}.type=mac80211
uci set wireless.radio${toString index}.country=DE
uci set wireless.radio${toString index}.band=${radioConfig.band}
uci set wireless.radio${toString index}.channel=${toString radioConfig.channel}
uci set wireless.radio${toString index}.path=${path}
uci set wireless.radio${toString index}.htmode=${radioConfig.htmode}
@ -265,6 +352,7 @@ in
${concatMapStrings (ssid:
let
ssidConfig = radioConfig.ssids.${ssid};
netConfig = config.site.net.${ssidConfig.net};
# mapping our option to openwrt/hostapd setting
encryption = {
@ -279,6 +367,11 @@ in
then ssidConfig.ifname
else "${ifPrefix}-${ssidConfig.net}";
pad = len: prefix: s:
if builtins.stringLength s < len
then pad len prefix "${prefix}${s}"
else s;
in ''
uci add wireless wifi-iface
uci set wireless.@wifi-iface[-1].ifname=${ifname}
@ -287,6 +380,7 @@ in
uci set wireless.@wifi-iface[-1].mode=${ssidConfig.mode}
uci set wireless.@wifi-iface[-1].network=${ssidConfig.net}
uci set wireless.@wifi-iface[-1].mcast_rate=18000
uci set wireless.@wifi-iface[-1].hidden=${if ssidConfig.hidden then "1" else "0"}
uci set wireless.@wifi-iface[-1].encryption='${encryption}'
${if (ssidConfig.psk != null)
then ''
@ -295,10 +389,59 @@ in
else ''
uci -q delete wireless.@wifi-iface[-1].key || true
''}
${lib.optionalString (!ssidConfig.disassocLowAck) ''
uci set wireless.@wifi-iface[-1].disassoc_low_ack='0'
''}
${lib.optionalString (netConfig.wifi.ieee80211rKey != null) ''
# for usteerd
# see https://www.libe.net/en-wlan-roaming#client-steering
# https://openwrt.org/docs/guide-user/network/wifi/usteer#configure_80211k_and_80211v_on_all_ap-nodes
uci set wireless.@wifi-iface[-1].bss_transition=1
uci set wireless.@wifi-iface[-1].wnm_sleep_mode=1
uci set wireless.@wifi-iface[-1].time_advertisement=2
uci set wireless.@wifi-iface[-1].time_zone=GMT0
uci set wireless.@wifi-iface[-1].ieee80211k=1
uci set wireless.@wifi-iface[-1].rrm_neighbor_report=1
uci set wireless.@wifi-iface[-1].rrm_beacon_report=1
# breaks Apple devices connecting to wifi when used together with wpa2/wpa3 mixed mode (sae-mixed)
# uci set wireless.@wifi-iface[-1].ieee80211r=1
# when unset derived from interface MAC
uci set wireless.@wifi-iface[-1].nasid=${pad 12 "0" (toString ((lib.toInt (lib.removePrefix "ap" hostName)) * 65536 + index))}
# when unset derived from the first 4 chars of the md5 hashed SSID
uci set wireless.@wifi-iface[-1].mobility_domain=${pad 4 "0" (lib.toHexString (49920 + netConfig.vlan))}
# https://github.com/openwrt/openwrt/issues/7907
# https://github.com/openwrt/openwrt/commit/2984a0420649733662ff95b0aff720b8c2c19f8a
uci set wireless.@wifi-iface[-1].ft_over_ds=0
# as recommend in 7907 and seems to fairly often trigger while testing
uci set wireless.@wifi-iface[-1].reassociation_deadline=20000
# might be unused if ft_over_ds is not used
uci set wireless.@wifi-iface[-1].ft_bridge=${mgmtInterface}
# otherwise the r0kh/r1kh options below are not applied
uci set wireless.@wifi-iface[-1].ft_psk_generate_local=0
# do not just rely on the monility domain for increased security
# https://forum.openwrt.org/t/802-11r-fast-transition-how-to-understand-that-ft-works/110920/81
uci set wireless.@wifi-iface[-1].r0kh=ff:ff:ff:ff:ff:ff,\*,${netConfig.wifi.ieee80211rKey}
uci set wireless.@wifi-iface[-1].r1kh=00:00:00:00:00:00,00:00:00:00:00:00,${netConfig.wifi.ieee80211rKey}
uci set wireless.@wifi-iface[-1].pmk_r1_push=1
''}
''
) (builtins.attrNames radioConfig.ssids)}
'') (builtins.attrNames hostConfig.wifi))}
uci set usteer.@usteer[0].network=mgmt
uci set usteer.@usteer[0].load_kick_enabled=1
uci set usteer.@usteer[0].load_kick_threshold=67
uci set usteer.@usteer[0].signal_diff_threshold=15
uci set usteer.@usteer[0].load_balancing_threshold=8
uci set usteer.@usteer[0].band_steering_threshold=16
uci commit
# Add hotfixes for MTU settings
@ -320,6 +463,7 @@ in
# the gateways is reachable
cat >/etc/crontabs/root <<__CRON__
* * * * * /usr/sbin/wifi-on-link.sh
* * * * * /usr/sbin/usteer-info.sh
__CRON__
cat >/usr/sbin/wifi-on-link.sh <<__SH__
#!/bin/sh
@ -366,11 +510,16 @@ in
LoadPlugin interface
LoadPlugin iwinfo
LoadPlugin network
LoadPlugin exec
<Plugin network>
Server "${config.site.net.serv.hosts6.dn42.stats}" "25826"
</Plugin>
<Plugin exec>
Exec "nobody" "/usr/bin/usteer-stats.sh"
</Plugin>
COLLECTD
''}
chmod +x /usr/bin/usteer-stats.sh /usr/sbin/usteer-info.sh
for svc in dnsmasq uhttpd ; do
rm -f /etc/rc.d/*\$svc

View File

@ -0,0 +1,3 @@
#! /bin/sh
[ -p /tmp/usteer-info ] || exit 0
exec /bin/ubus call usteer local_info > /tmp/usteer-info

View File

@ -0,0 +1,32 @@
#! /bin/sh
HOSTNAME=`cat /proc/sys/kernel/hostname`
INTERVAL=60
[ -p /tmp/usteer-info ] || mkfifo /tmp/usteer-info
while true; do
if [ ! -p /tmp/usteer-info ]; then
echo "/tmp/usteer-info went missing!"
exit 1
fi
DATA="$(cat /tmp/usteer-info)"
cd /sys/class/net
for iface in wlan*; do
eval $( echo "$DATA" | jsonfilter \
-e 'LOAD=@["hostapd.'$iface'"].load' \
-e 'NOISE=@["hostapd.'$iface'"].noise' \
-e 'N_ASSOC=@["hostapd.'$iface'"].n_assoc' \
-e 'FREQ=@["hostapd.'$iface'"].freq' \
-e 'ROAM_SOURCE=@["hostapd.'$iface'"].roam_events.source' \
-e 'ROAM_TARGET=@["hostapd.'$iface'"].roam_events.target'
)
echo "PUTVAL \"$HOSTNAME/usteer_local_info-$iface/stations-load\" interval=$INTERVAL N:$LOAD"
echo "PUTVAL \"$HOSTNAME/usteer_local_info-$iface/signal_noise-noise\" interval=$INTERVAL N:$NOISE"
echo "PUTVAL \"$HOSTNAME/usteer_local_info-$iface/stations-n_assoc\" interval=$INTERVAL N:$N_ASSOC"
echo "PUTVAL \"$HOSTNAME/usteer_local_info-$iface/frequency-freq\" interval=$INTERVAL N:$FREQ"
echo "PUTVAL \"$HOSTNAME/usteer_local_info-$iface/transitions-roam_source\" interval=$INTERVAL N:$ROAM_SOURCE"
echo "PUTVAL \"$HOSTNAME/usteer_local_info-$iface/transitions-roam_target\" interval=$INTERVAL N:$ROAM_TARGET"
done
done

View File

@ -60,7 +60,11 @@ exit 1 if collisions > 0
GROUP_PREFIX = 19
groups = {}
nets.each do |net|
group = net.addr.supernet(GROUP_PREFIX).to_s
if net.addr.prefix > GROUP_PREFIX
group = net.addr.supernet(GROUP_PREFIX).to_s
else
group = net.addr.to_s
end
(groups[group] ||= []) << net
end

View File

@ -9,7 +9,7 @@ let
host-name ${hostName};
time-zone Europe/Berlin;
root-authentication {
encrypted-password "$5$EBmFELmv$kQxtWwS0SBS.TqVPRvs8sKpH./l9DTtTxX/I2FJB2n2"; ## SECRET-DATA
encrypted-password "%%HASH%%"; ## SECRET-DATA
ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHGgoLzQMeyX1wjsX/hgVkN//zyfOQPiBRYgO2ajEGH6 root@server2";
}
services {
@ -114,13 +114,9 @@ let
'';
configFileWithHash = runCommand "junos.config" {
nativeBuildInputs = [ python3 ];
nativeBuildInputs = [ mkpasswd ];
} ''
cat >gen.py<<EOF
import crypt
print(crypt.crypt('${hostConfig.password}', crypt.mksalt(crypt.METHOD_SHA256)))
EOF
HASH=$(python gen.py)
HASH=$(echo "${hostConfig.password}" | mkpasswd --method=SHA-512 --stdin)
substitute ${configFile} $out \
--replace "%%HASH%%" "$HASH"
'';

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff