network/nix/lib/config/options.nix

793 lines
24 KiB
Nix

{ config, options, lib, ... }:
with lib;
let
# A host needs to know a network if it
# - is a configured interface, or
# - is required behind at least two different links
getHostLinkNetworks = hostName: link:
let
hostConfig = config.site.hosts.${hostName};
# all the host's links
hostLinkNetworks = builtins.mapAttrs (link: _:
networksBehindLink hostName link
) hostConfig.links;
# how many links have a net in networksBehindLink
networkLinkCount = net:
builtins.length (
builtins.filter (builtins.elem net)
(builtins.attrValues hostLinkNetworks)
);
in
# access port
if config.site.net ? ${link}
then [ link ]
# multiple vlans on this link
else
builtins.filter (net:
# this port and local interface
hostConfig.interfaces ? ${net}
||
# this port and another
networkLinkCount net > 1
) hostLinkNetworks.${link};
networksBehindLink = hostName: name:
networksBehindLink' {
"${hostName}" = true;
} [ name ];
networksBehindLink' = seen: links:
if links == []
then
# Done, result is the seen link names that are networks:
builtins.filter (name:
config.site.net ? ${name}
) (builtins.attrNames seen)
else
let
link = builtins.head links;
seen' = seen // {
"${link}" = true;
};
onlyUnseen = builtins.filter (link: ! seen' ? ${link});
links' = builtins.tail links;
in
if config.site.hosts ? ${link}
then networksBehindLink' seen' (builtins.filter (link: ! seen' ? ${link}) (
links' ++ (
builtins.attrNames config.site.hosts.${link}.interfaces
) ++ (
onlyUnseen (builtins.attrNames config.site.hosts.${link}.links)
)
))
else if config.site.net ? ${link}
then networksBehindLink' seen' links'
else throw "Link to invalid target ${link}";
dhcpOpts = {
start = mkOption {
description = "First IP address in pool";
type = types.str;
};
end = mkOption {
description = "Last IP address in pool";
type = types.str;
};
time = mkOption {
description = "Renew time in seconds";
type = types.int;
};
max-time = mkOption {
description = "Max renew time in seconds";
type = types.int;
};
server = mkOption {
description = "Container that runs the DHCP server";
type = types.str;
};
router = mkOption {
description = "Gateway";
type = types.str;
};
fixed-hosts = mkOption {
type = with types; attrsOf str;
default = {};
};
};
netOpts = { name, ... }: {
options = {
vlan = mkOption {
description = "VLAN tag number";
type = with types; nullOr int;
};
subnet4 = mkOption {
description = "v.w.x.y/z";
type = with types; nullOr str;
default = null;
};
subnet4Net = mkOption {
type = with types; nullOr types.str;
default =
let
inherit (config.site.net.${name}) subnet4;
s = lib.splitString "/" subnet4;
in
if subnet4 != null && builtins.length s == 2
then builtins.head s
else null;
description = "Don't set, use subnet4 instead!";
};
subnet4Len = mkOption {
type = with types; nullOr types.int;
default =
let
inherit (config.site.net.${name}) subnet4;
s = lib.splitString "/" subnet4;
in
if subnet4 != null && builtins.length s == 2
then lib.toInt (elemAt s 1)
else null;
description = "Don't set, use subnet4 instead!";
};
subnets6 = mkOption {
description = "IPv6 subnets w/o prefixlen (always 64)";
type = with types; attrsOf str;
default = {};
};
hosts4 = mkOption {
description = "Attribute set of hostnames to IPv4 addresses";
type = with types; attrsOf str;
default = {};
};
hosts6 = mkOption {
description = "Attribute set of contexts to attribute sets of hostnames to IPv4 addresses";
type = with types; attrsOf (attrsOf str);
default = {};
};
ospf = {
secret = mkOption {
type = with types; nullOr str;
default = null;
};
};
dhcp = mkOption {
type = with types; nullOr (submodule { options = dhcpOpts; });
default = null;
};
ipv6Router = mkOption {
description = "Who sends router advertisements?";
type = with types; nullOr str;
default = config.site.net.${name}.dhcp.router or null;
};
domainName = mkOption {
description = "Domain name option";
type = types.str;
default = "${name}.zentralwerk.org";
};
extraRecords = mkOption {
type = with types; listOf (submodule {
options = {
name = mkOption {
type = str;
};
type = mkOption {
type = enum [ "A" "AAAA" "MX" "SRV" "CNAME" "TXT" ];
};
data = mkOption {
type = str;
};
};
});
default = [];
description = "Extraneous DNS records";
};
dynamicDomain = mkOption {
type = types.bool;
default = false;
description = "Domain updated by DHCP server?";
};
mtu = mkOption {
type = with types; nullOr int;
default = null;
};
};
};
upstreamOpts = {
provider = mkOption {
type = types.str;
};
link = mkOption {
type = with types; nullOr str;
default = null;
description = "Underlying interface name for eg. PPPoE";
};
staticIpv4Address = mkOption {
type = with types; nullOr str;
default = null;
};
upBandwidth = mkOption {
type = with types; nullOr int;
default = null;
};
noNat.subnets4 = mkOption {
type = with types; listOf str;
default = [];
description = "Do not NAT traffic from these public static subnets";
};
noNat.subnets6 = mkOption {
type = with types; listOf str;
default = [];
description = "Do not NAT66 traffic from these public static subnets";
};
user = mkOption {
type = with types; nullOr str;
default = null;
};
password = mkOption {
type = with types; nullOr str;
default = null;
};
};
interfaceOpts = { ... }: {
options = {
hwaddr = mkOption {
type = with types; nullOr str;
default = null;
description = "Static MAC address";
};
type = mkOption {
type = types.enum [ "phys" "veth" "pppoe" "bridge" "wireguard" "vxlan" ];
description = ''
veth: Virtual ethernet to be attached to a bridge.
phys: (Physical) interface from a server moved into the
container. Do not use with VLAN interfaces because they
won't be moved back after lxc-stop.
'';
};
gw4 = mkOption {
type = with types; nullOr str;
default = null;
description = "IPv4 gateway";
};
gw6 = mkOption {
type = with types; nullOr str;
default = null;
description = "IPv6 gateway";
};
upstream = mkOption {
type = with types; nullOr (submodule { options = upstreamOpts; });
default = null;
description = "Upstream interface configuration";
};
wireguard = mkOption {
default = null;
type = with types; nullOr (submodule {
options = {
endpoint = mkOption {
type = str;
};
publicKey = mkOption {
type = str;
};
privateKey = mkOption {
type = str;
};
addresses = mkOption {
type = listOf str;
};
};
});
};
vxlan = mkOption {
default = null;
type = with types; nullOr (submodule {
options = {
peer = mkOption {
type = str;
};
};
});
};
};
};
hostOpts = { name, ... }: {
options = {
prebuilt = mkOption {
type = types.bool;
default = false;
description = ''
Include the container system in the server's `build-container` script.
'';
};
firstboot = mkOption {
type = types.bool;
default = false;
description = ''
true if host is a newly flashed OpenWRT device with a default address
'';
};
role = mkOption {
type = types.enum [ "ap" "switch" "server" "container" "client" ];
default = "client";
};
model = mkOption {
type = types.str;
default = {
ap = "unknown";
switch = "unknown";
server = "pc";
container = "lxc";
client = "any";
}."${config.site.hosts.${name}.role}";
};
password = mkOption {
type = with types; nullOr str;
default = null;
};
location = mkOption {
type = with types; nullOr str;
default = null;
};
interfaces = mkOption {
default = {};
type = with types; attrsOf (submodule interfaceOpts);
description = "Network interfaces";
};
physicalInterfaces = mkOption {
default = lib.filterAttrs (_: { type, ... }:
builtins.elem type [ "phys" "veth" ]
) config.site.hosts.${name}.interfaces;
type = with types; attrsOf (submodule interfaceOpts);
description = "Network interfaces that are not virtual (don't set!)";
};
isRouter = mkOption {
type = types.bool;
# isRouter = Part of the core network?
default =
config.site.hosts.${name}.interfaces ? core &&
config.site.net.core.hosts4 ? ${name} &&
config.site.hosts.${name}.role == "container";
description = "Should this host route?";
};
firewall.enable = mkOption {
type = types.bool;
default = false;
description = "Enable firewall to disallow incoming connections from core";
};
forwardPorts = mkOption {
type = with types; listOf (submodule { options = {
proto = mkOption {
type = types.enum [ "tcp" "udp" ];
};
sourcePort = mkOption {
type = types.int;
};
destination = mkOption {
type = types.str;
};
reflect = mkOption {
type = types.bool;
default = true;
description = ''
Enable NAT reflection
Any forwarded connection will have our static IPv4
address as source so that forwarded services become
available internally.
Unfortunately, this breaks identification by IPv4
adress.
'';
};
}; });
default = [];
};
ospf.stubNets4 = mkOption {
type = with types; listOf str;
default = [];
description = "Additional IPv4 networks to announce";
};
ospf.stubNets6 = mkOption {
type = with types; listOf str;
default = [];
description = "Additional IPv6 networks to announce";
};
ospf.allowedUpstreams = mkOption {
type = with types; listOf str;
default = [];
description = "Accept default routes from these OSPF routers, in order of preference";
};
ospf.allowedUpstreams6 = mkOption {
type = with types; listOf str;
default = config.site.hosts.${name}.ospf.allowedUpstreams;
description = "Accept IPv6 default routes from these OSPF3 routers, in order of preference";
};
ospf.upstreamInstance = mkOption {
type = with types; nullOr int;
default = null;
description = "OSPF instance for advertising the default route";
};
bgp = mkOption {
default = null;
type = with types; nullOr (submodule {
options = bgpOpts;
});
};
services.dns = {
enable = mkOption {
type = types.bool;
default = false;
};
};
services.dnscache.enable = mkOption {
type = types.bool;
default = false;
};
services.yggdrasil = {
enable = mkOption {
type = types.bool;
default = false;
};
keys = mkOption {
type = types.str;
default = "";
};
};
links = mkOption {
description = "Which port is connected to what other device? Keys are either network names or known hostnames.";
default = {};
type = with types; attrsOf (submodule (linkOpts name));
};
wifi = mkOption {
default = {};
type = with types; attrsOf (submodule (
{ ... }: {
options = {
htmode = mkOption {
type = enum [ "HT20" "HT40-" "HT40+" "VHT80" ];
};
channel = mkOption {
type = int;
};
ssids = mkOption {
type = attrsOf (submodule ({ config, ... }: {
options = {
net = mkOption {
type = str;
};
psk = mkOption {
type = nullOr str;
default = null;
};
encryption = mkOption {
type = enum [ "none" "owe" "wpa2" "wpa3" ];
default =
if config.psk == null
then "none"
else "wpa3";
};
mode = mkOption {
type = enum [ "ap" "sta" ];
default = "ap";
};
ifname = mkOption {
type = nullOr str;
default = null;
};
};
}));
};
};
}
));
};
wifiOnLink.enable = mkOption {
type = types.bool;
default = true;
description = ''
Install the wifi-on-link.sh script on OpenWRT devices.
'';
};
};
};
bgpOpts = {
asn = mkOption {
type = types.int;
};
peers = mkOption {
type = with types; attrsOf (submodule ({ ... }: {
options = {
asn = mkOption {
type = types.int;
};
};
}));
default = {};
};
};
linkOpts = hostName: { name, ... }: {
options = {
ports = mkOption {
type = with types; listOf str;
description = "Port names";
};
group = mkOption {
type = with types; nullOr str;
default = null;
description = "Link aggregation group with a fixed number";
};
nets = mkOption {
type = with types; listOf str;
description = "Automatically generated";
default = getHostLinkNetworks hostName name;
};
vlans = mkOption {
type = with types; listOf int;
description = "Automatically generated, do not set";
default = builtins.concatMap (net:
let
inherit (config.site.net.${net}) vlan;
in if vlan != null
then [ vlan ]
else []
) config.site.hosts.${hostName}.links.${name}.nets;
};
trunk = mkOption {
type = types.bool;
description = "Trunk with tagged VLANs?";
default =
if config.site.net ? ${name}
then false
else if config.site.hosts ? ${name}
then true
else throw "Invalid link target: \"${name}\"";
};
};
};
vpnOpts = {
privateKey = mkOption {
type = types.str;
};
port = mkOption {
type = types.int;
default = 1337;
};
peers = mkOption {
type = with types; listOf (submodule {
options = {
publicKey = mkOption {
type = str;
};
allowedIPs = mkOption {
type = listOf str;
};
};
});
};
};
in
{
options.site = {
net = mkOption {
description = "All subnets";
default = {};
type = with types; attrsOf (submodule netOpts);
};
net-combined = mkOption {
description = "All hosts of all subnets";
default = {};
type = with types; submodule netOpts;
};
hosts = mkOption {
description = "All the static hosts";
default = {};
type = with types; attrsOf (submodule hostOpts);
};
sshPubKeys = mkOption {
type = with types; listOf str;
};
dyndnsKey = mkOption {
type = types.str;
};
vpn.wireguard = vpnOpts;
mqttServer = {
host = mkOption {
type = types.str;
default = config.site.net.serv.hosts4.broker;
};
user = mkOption {
type = types.str;
default = "user";
};
password = mkOption {
type = types.str;
default = "secret";
};
};
};
config.warnings =
let
findCollisions = getter: xs:
(builtins.foldl' ({ known, dup }: k:
let
ks = builtins.toString k;
in
if known ? ${ks}
then { inherit known; dup = dup ++ [ks]; }
else { known = known // { ${ks} = true; }; inherit dup; }
) {
known = {}; dup = [];
} (
concatMap getter (builtins.attrValues xs)
)).dup;
reportCollisions = name: getter: xs:
map (k: "Duplicate ${name}: ${k}") (findCollisions getter xs);
ospfUpstreamXorGw =
builtins.concatMap (hostName:
let
hostConf = config.site.hosts.${hostName};
gwNets = builtins.filter (netName:
hostConf.interfaces.${netName}.gw4 != null
) (builtins.attrNames hostConf.interfaces);
in if gwNets != [] && hostConf.ospf.allowedUpstreams != []
then [ ''
Host ${hostName} has gateway on ${builtins.head gwNets} but accepts default routes from OSPF
'' ]
else []
) (builtins.attrNames config.site.hosts);
in
(reportCollisions "VLAN tag" (x: lib.optional (x.vlan != null) x.vlan) config.site.net) ++
(reportCollisions "IPv4 subnet" (x: if x.subnet4 == null then [] else [x.subnet4]) config.site.net) ++
(reportCollisions "IPv6 subnet" (x: builtins.attrValues x.subnets6) config.site.net) ++
ospfUpstreamXorGw;
config.assertions =
# Duplicate host/net name check
map (name: {
assertion = ! config.site.net ? ${name};
message = "Host \"${name}\" must be named differently if net \"${name}\" exists.";
}) (builtins.attrNames config.site.hosts)
++
# Duplicate address check
(let
addrHosts =
builtins.foldl' (result: { hosts4, ... }:
builtins.foldl' (result: host:
let
addr = hosts4.${host};
in
if result ? ${addr}
then result // {
"${addr}" = result.${addr} ++ [ host ];
}
else result // {
"${addr}" = [ host ];
}
) result (builtins.attrNames hosts4)
) {} (builtins.attrValues config.site.net)
//
builtins.foldl' (result: net:
builtins.foldl' (result: ctx:
builtins.foldl' (result: host:
let
addr = config.site.net.${net}.hosts6.${ctx}.${host};
in
if result ? ${addr}
then result // {
"${addr}" = result.${addr} ++ [ host ];
}
else result // {
"${addr}" = [ host ];
}
) result (builtins.attrNames config.site.net.${net}.hosts6.${ctx})
) result (builtins.attrNames config.site.net.${net}.hosts6)
) {} (builtins.attrNames config.site.net);
in map (addr: {
assertion = builtins.length addrHosts.${addr} == 1;
message = "Address ${addr} is assigned to more than one host: ${lib.concatStringsSep " " addrHosts.${addr}}";
}) (builtins.attrNames addrHosts))
++
# duplicate vlan check
(let
vlanNets =
builtins.foldl' (result: net:
let
vlan = toString config.site.net.${net}.vlan;
in
if config.site.net.${net}.vlan != null && result ? ${vlan}
then result // {
"${vlan}" = result.${vlan} ++ [ net ];
}
else result // {
"${vlan}" = [ net ];
}
) {} (builtins.attrNames config.site.net);
in map (vlan: {
assertion = builtins.length vlanNets.${vlan} == 1;
message = "VLAN ${vlan} is used by more than one network: ${lib.concatStringsSep " " vlanNets.${vlan}}";
}) (builtins.attrNames vlanNets))
++
# Duplicate switch port check
builtins.concatMap (hostName:
let
ports = lib.unique (
builtins.concatMap (linkName:
config.site.hosts.${hostName}.links.${linkName}.ports
) (builtins.attrNames config.site.hosts.${hostName}.links)
);
linksOfPort = port:
builtins.attrNames (
lib.filterAttrs (_: { ports, ... }: builtins.elem port ports)
config.site.hosts.${hostName}.links
);
in map (port: {
assertion = builtins.length (linksOfPort port) == 1;
message = "${hostName}: port ${port} is used in more than one link: ${lib.concatStringsSep " " (linksOfPort port)}";
}) ports
) (builtins.attrNames config.site.hosts)
++
# Duplicate switch port group check
builtins.concatMap (hostName:
let
groups = lib.unique (
builtins.filter builtins.isString (
builtins.map (linkName:
config.site.hosts.${hostName}.links.${linkName}.group
) (builtins.attrNames config.site.hosts.${hostName}.links)
)
);
linksOfGroup = wantedGroup:
builtins.attrNames (
lib.filterAttrs (_: { group, ... }: group == wantedGroup)
config.site.hosts.${hostName}.links
);
in map (group: {
assertion = builtins.length (linksOfGroup group) == 1;
message = "${hostName}: group ${group} is used in more than one link: ${lib.concatStringsSep " " (linksOfGroup group)}";
}) groups
) (builtins.attrNames config.site.hosts)
++
# wifi psk checks
builtins.concatMap (hostName:
builtins.concatMap (wifiPath:
map (ssid:
let
ssidConf = config.site.hosts.${hostName}.wifi.${wifiPath}.ssids.${ssid};
in
if builtins.elem ssidConf.encryption [ "none" "owe" ]
then {
assertion = ssidConf.psk == null;
message = "${hostName}: SSID ${ssid} has encryption ${ssidConf.encryption} but a PSK is set";
}
else if builtins.elem ssidConf.encryption [ "wpa2" "wpa3" ]
then {
assertion = ssidConf.psk != null;
message = "${hostName}: SSID ${ssid} has encryption ${ssidConf.encryption} but no PSK is set";
}
else throw "Unsupported WiFi encryption ${ssidConf.encryption}"
) (builtins.attrNames config.site.hosts.${hostName}.wifi.${wifiPath}.ssids)
) (builtins.attrNames config.site.hosts.${hostName}.wifi)
) (builtins.attrNames config.site.hosts);
}