diff options
Diffstat (limited to 'nixos/modules')
| -rw-r--r-- | nixos/modules/default.nix | 1 | ||||
| -rw-r--r-- | nixos/modules/router.nix | 55 | ||||
| -rw-r--r-- | nixos/modules/wifi-adm.nix | 98 |
3 files changed, 140 insertions, 14 deletions
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix index bdab3b2..7d12eef 100644 --- a/nixos/modules/default.nix +++ b/nixos/modules/default.nix @@ -11,5 +11,6 @@ cynerd-openvpn = import ./openvpn.nix; cynerd-router = import ./router.nix; cynerd-syncthing = import ./syncthing.nix; + cynerd-wifi-adm = import ./wifi-adm.nix; cynerd-wifi-client = import ./wifi-client.nix; } diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix index e149633..f5c8668 100644 --- a/nixos/modules/router.nix +++ b/nixos/modules/router.nix @@ -18,11 +18,6 @@ in { type = types.str; description = "Interface for the router's WAN"; }; - brlan = mkOption { - type = types.str; - default = "brlan"; - description = "LAN interface (commonly some bridge)"; - }; lanIP = mkOption { type = types.str; description = "LAN IP address"; @@ -47,16 +42,34 @@ in { config = mkIf cnf.enable { networking = { - interfaces."${cnf.brlan}".ipv4.addresses = [ - { - address = cnf.lanIP; - prefixLength = cnf.lanPrefix; - } - ]; + interfaces = { + brlan.ipv4.addresses = [ + { + address = cnf.lanIP; + prefixLength = cnf.lanPrefix; + } + ]; + brguest.ipv4.addresses = [ + { + address = "192.168.1.1"; + prefixLength = 24; + } + ]; + }; + vlans = { + "brlan.guest" = { + interface = "brlan"; + id = 100; + }; + }; + bridges = { + brlan.interfaces = []; + brguest.interfaces = ["brlan.guest"]; + }; nat = { enable = true; externalInterface = cnf.wan; - internalInterfaces = [cnf.brlan]; + internalInterfaces = ["brlan" "brguest"]; }; dhcpcd.allowInterfaces = [cnf.wan]; nameservers = ["1.1.1.1" "8.8.8.8"]; @@ -65,7 +78,7 @@ in { services.dhcpd4 = { enable = true; authoritative = true; - interfaces = [cnf.brlan]; + interfaces = ["brlan" "brguest"]; extraConfig = '' option domain-name-servers 1.1.1.1, 8.8.8.8; subnet ${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix} netmask ${ipv4.prefix2netmask cnf.lanPrefix} { @@ -78,6 +91,12 @@ in { option subnet-mask ${ipv4.prefix2netmask cnf.lanPrefix}; option broadcast-address ${ipv4.prefix2broadcast cnf.lanIP cnf.lanPrefix}; } + subnet 192.168.1.0 netmask 255.255.255.0 { + range 192.168.1.50 192.168.1.254; + option routers 192.168.1.1; + option subnet-mask 255.255.255.0; + option broadcast-address 192.168.1.255; + } ''; }; @@ -85,7 +104,7 @@ in { # TODO enable = false; authoritative = true; - interfaces = [cnf.brlan]; + interfaces = ["brlan"]; extraConfig = '' ''; }; @@ -93,5 +112,13 @@ in { services.kresd = { enable = false; }; + + networking.nftables.enable = true; + networking.firewall = { + filterForward = true; + extraForwardRules = '' + iifname "brguest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan" + ''; + }; }; } diff --git a/nixos/modules/wifi-adm.nix b/nixos/modules/wifi-adm.nix new file mode 100644 index 0000000..46476a3 --- /dev/null +++ b/nixos/modules/wifi-adm.nix @@ -0,0 +1,98 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cnf = config.cynerd.wifiAP.adm; + + wOptions = band: channelDefault: { + interface = mkOption { + type = with types; nullOr str; + default = null; + description = "Specify interface for ${band}"; + }; + channel = mkOption { + type = types.ints.positive; + default = channelDefault; + description = "Channel to be used for ${band} range"; + }; + }; +in { + options = { + cynerd.wifiAP.adm = { + enable = mkEnableOption "Enable Wi-Fi Access Point support"; + w24 = wOptions "2.4GHz" 7; + w5 = wOptions "5GHz" 36; + }; + }; + + config = mkIf cnf.enable { + networking.wirelessAP = { + enable = true; + environmentFile = "/run/secrets/hostapd.env"; + interfaces = + (optionalAttrs (cnf.w24.interface != null) { + "${cnf.w24.interface}" = { + bssid = "@BSSID_W24_0@"; + countryCode = "CZ"; + hwMode = "g"; + channel = cnf.w24.channel; + ht_capab = ["HT40+" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "DSSS_CCK-40"]; + ssid = "TurrisAdamkovi"; + wpa = 2; + wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@"; + bridge = "brlan"; + bss = { + "wlp3s0.nela" = { + bssid = "@BSSID_W24_1@"; + ssid = "Nela"; + wpa = 2; + wpaPassphrase = "@PASS_NELA@"; + bridge = "brguest"; + }; + "wlp3s0.milan" = { + bssid = "@BSSID_W24_2@"; + ssid = "MILAN-AC"; + wpa = 2; + wpaPassphrase = "@PASS_MILAN_AC@"; + bridge = "brguest"; + }; + }; + }; + }) + // (optionalAttrs (cnf.w5.interface != null) { + "${cnf.w5.interface}" = { + bssid = "@BSSID_W5_0@"; + countryCode = "CZ"; + hwMode = "a"; + channel = cnf.w5.channel; + ieee80211ac = true; + ht_capab = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "DSSS_CCK-40"]; + vht_capab = ["RXLDPC" "SHORT-GI-80" "TX-STBC-2BY1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"]; + ssid = "TurrisAdamkovi5"; + wpa = 2; + wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@"; + bridge = "brlan"; + bss = { + "wlp2s0.nela" = { + bssid = "@BSSID_W5_1@"; + ssid = "Nela5"; + wpa = 2; + wpaPassphrase = "@PASS_NELA@"; + bridge = "brguest"; + }; + "wlp2s0.milan" = { + bssid = "@BSSID_W5_2@"; + ssid = "MILAN-AC"; + wpa = 2; + wpaPassphrase = "@PASS_MILAN_AC@"; + bridge = "brguest"; + }; + }; + }; + }); + }; + }; +} |