nixos: some initial router configuration

3 files changed, 140 insertions, 14 deletions

diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index bdab3b2..7d12eef 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -11,5 +11,6 @@
   cynerd-openvpn = import ./openvpn.nix;
   cynerd-router = import ./router.nix;
   cynerd-syncthing = import ./syncthing.nix;
+  cynerd-wifi-adm = import ./wifi-adm.nix;
   cynerd-wifi-client = import ./wifi-client.nix;
 }
diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix
index e149633..f5c8668 100644
--- a/nixos/modules/router.nix
+++ b/nixos/modules/router.nix
@@ -18,11 +18,6 @@ in {
         type = types.str;
         description = "Interface for the router's WAN";
       };
-      brlan = mkOption {
-        type = types.str;
-        default = "brlan";
-        description = "LAN interface (commonly some bridge)";
-      };
       lanIP = mkOption {
         type = types.str;
         description = "LAN IP address";
@@ -47,16 +42,34 @@ in {
 
   config = mkIf cnf.enable {
     networking = {
-      interfaces."${cnf.brlan}".ipv4.addresses = [
-        {
-          address = cnf.lanIP;
-          prefixLength = cnf.lanPrefix;
-        }
-      ];
+      interfaces = {
+        brlan.ipv4.addresses = [
+          {
+            address = cnf.lanIP;
+            prefixLength = cnf.lanPrefix;
+          }
+        ];
+        brguest.ipv4.addresses = [
+          {
+            address = "192.168.1.1";
+            prefixLength = 24;
+          }
+        ];
+      };
+      vlans = {
+        "brlan.guest" = {
+          interface = "brlan";
+          id = 100;
+        };
+      };
+      bridges = {
+        brlan.interfaces = [];
+        brguest.interfaces = ["brlan.guest"];
+      };
       nat = {
         enable = true;
         externalInterface = cnf.wan;
-        internalInterfaces = [cnf.brlan];
+        internalInterfaces = ["brlan" "brguest"];
       };
       dhcpcd.allowInterfaces = [cnf.wan];
       nameservers = ["1.1.1.1" "8.8.8.8"];
@@ -65,7 +78,7 @@ in {
     services.dhcpd4 = {
       enable = true;
       authoritative = true;
-      interfaces = [cnf.brlan];
+      interfaces = ["brlan" "brguest"];
       extraConfig = ''
         option domain-name-servers 1.1.1.1, 8.8.8.8;
         subnet ${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix} netmask ${ipv4.prefix2netmask cnf.lanPrefix} {
@@ -78,6 +91,12 @@ in {
             option subnet-mask ${ipv4.prefix2netmask cnf.lanPrefix};
             option broadcast-address ${ipv4.prefix2broadcast cnf.lanIP cnf.lanPrefix};
         }
+        subnet 192.168.1.0 netmask 255.255.255.0 {
+          range 192.168.1.50 192.168.1.254;
+          option routers 192.168.1.1;
+          option subnet-mask 255.255.255.0;
+          option broadcast-address 192.168.1.255;
+        }
       '';
     };
 
@@ -85,7 +104,7 @@ in {
       # TODO
       enable = false;
       authoritative = true;
-      interfaces = [cnf.brlan];
+      interfaces = ["brlan"];
       extraConfig = ''
       '';
     };
@@ -93,5 +112,13 @@ in {
     services.kresd = {
       enable = false;
     };
+
+    networking.nftables.enable = true;
+    networking.firewall = {
+      filterForward = true;
+      extraForwardRules = ''
+        iifname "brguest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan"
+      '';
+    };
   };
 }
diff --git a/nixos/modules/wifi-adm.nix b/nixos/modules/wifi-adm.nix
new file mode 100644
index 0000000..46476a3
--- /dev/null
+++ b/nixos/modules/wifi-adm.nix
@@ -0,0 +1,98 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cnf = config.cynerd.wifiAP.adm;
+
+  wOptions = band: channelDefault: {
+    interface = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      description = "Specify interface for ${band}";
+    };
+    channel = mkOption {
+      type = types.ints.positive;
+      default = channelDefault;
+      description = "Channel to be used for ${band} range";
+    };
+  };
+in {
+  options = {
+    cynerd.wifiAP.adm = {
+      enable = mkEnableOption "Enable Wi-Fi Access Point support";
+      w24 = wOptions "2.4GHz" 7;
+      w5 = wOptions "5GHz" 36;
+    };
+  };
+
+  config = mkIf cnf.enable {
+    networking.wirelessAP = {
+      enable = true;
+      environmentFile = "/run/secrets/hostapd.env";
+      interfaces =
+        (optionalAttrs (cnf.w24.interface != null) {
+          "${cnf.w24.interface}" = {
+            bssid = "@BSSID_W24_0@";
+            countryCode = "CZ";
+            hwMode = "g";
+            channel = cnf.w24.channel;
+            ht_capab = ["HT40+" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "DSSS_CCK-40"];
+            ssid = "TurrisAdamkovi";
+            wpa = 2;
+            wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
+            bridge = "brlan";
+            bss = {
+              "wlp3s0.nela" = {
+                bssid = "@BSSID_W24_1@";
+                ssid = "Nela";
+                wpa = 2;
+                wpaPassphrase = "@PASS_NELA@";
+                bridge = "brguest";
+              };
+              "wlp3s0.milan" = {
+                bssid = "@BSSID_W24_2@";
+                ssid = "MILAN-AC";
+                wpa = 2;
+                wpaPassphrase = "@PASS_MILAN_AC@";
+                bridge = "brguest";
+              };
+            };
+          };
+        })
+        // (optionalAttrs (cnf.w5.interface != null) {
+          "${cnf.w5.interface}" = {
+            bssid = "@BSSID_W5_0@";
+            countryCode = "CZ";
+            hwMode = "a";
+            channel = cnf.w5.channel;
+            ieee80211ac = true;
+            ht_capab = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "DSSS_CCK-40"];
+            vht_capab = ["RXLDPC" "SHORT-GI-80" "TX-STBC-2BY1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"];
+            ssid = "TurrisAdamkovi5";
+            wpa = 2;
+            wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
+            bridge = "brlan";
+            bss = {
+              "wlp2s0.nela" = {
+                bssid = "@BSSID_W5_1@";
+                ssid = "Nela5";
+                wpa = 2;
+                wpaPassphrase = "@PASS_NELA@";
+                bridge = "brguest";
+              };
+              "wlp2s0.milan" = {
+                bssid = "@BSSID_W5_2@";
+                ssid = "MILAN-AC";
+                wpa = 2;
+                wpaPassphrase = "@PASS_MILAN_AC@";
+                bridge = "brguest";
+              };
+            };
+          };
+        });
+    };
+  };
+}