From 79ab172cbeb4f06606ccfc486d24a0b500c72b3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <cynerd@email.cz>
Date: Wed, 18 Jan 2023 14:34:59 +0100
Subject: nixos/adm-omnia: router module

---
 nixos/machine/adm-omnia.nix | 44 ++++++++--------------------------
 nixos/modules/default.nix   |  1 +
 nixos/modules/router.nix    | 58 ++++++++++++++++++++++++++++++++++++++-------
 3 files changed, 61 insertions(+), 42 deletions(-)

diff --git a/nixos/machine/adm-omnia.nix b/nixos/machine/adm-omnia.nix
index d158b45..c704b58 100644
--- a/nixos/machine/adm-omnia.nix
+++ b/nixos/machine/adm-omnia.nix
@@ -7,40 +7,16 @@
 with lib; {
   config = {
     cynerd = {
-      #openvpn.oldpersonal = true;
+      router = {
+        enable = true;
+        wan = "end2";
+        lanIP = config.cynerd.hosts.adm.omnia;
+      };
+      openvpn.oldpersonal = false;
     };
 
-    networking = {
-      # TODO we need vlan filtering to filter out guest and adm network
-      bridges = {
-        brlan = {
-          interfaces = [
-            "lan0"
-            "lan1"
-            "lan2"
-            "lan3"
-            "lan4"
-          ];
-        };
-        #brguest = {
-        #  interfaces = [
-        #    "brlan.2" #"mlan0host" "wlp1s0host"
-        #  ];
-        #};
-      };
-      interfaces.brlan = {
-        ipv4 = {
-          addresses = [
-            {
-              address = config.cynerd.hosts.adm.omnia;
-              prefixLength = 24;
-            }
-          ];
-        };
-      };
-      # TODO localhost
-      nameservers = ["1.1.1.1" "8.8.8.8"];
-      dhcpcd.allowInterfaces = ["end2"];
+    networking.bridges = {
+      brlan.interfaces = ["lan0" "lan1" "lan2" "lan3" "lan4"];
     };
 
     networking.wirelessAP = {
@@ -55,12 +31,12 @@ with lib; {
           ht_capab = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "DSSS_CCK-40"];
           vht_capab = ["RXLDPC" "SHORT-GI-80" "TX-STBC-2BY1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"];
           ssid = "TurrisRules5";
-          wpa = true;
+          wpa = 2;
           wpaPassphrase = "@PASS_TURRIS_RULES@";
           bss = {
             "wlp1s0host" = {
               ssid = "KocoviGuest";
-              wpa = true;
+              wpa = 2;
               wpaPassphrase = "@PASS_KOCOVI@";
             };
           };
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index 72221d8..bdab3b2 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -9,6 +9,7 @@
   cynerd-hosts = import ./hosts.nix;
   cynerd-monitoring = import ./monitoring.nix;
   cynerd-openvpn = import ./openvpn.nix;
+  cynerd-router = import ./router.nix;
   cynerd-syncthing = import ./syncthing.nix;
   cynerd-wifi-client = import ./wifi-client.nix;
 }
diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix
index 00a3c03..cd7841e 100644
--- a/nixos/modules/router.nix
+++ b/nixos/modules/router.nix
@@ -15,41 +15,83 @@ in {
         description = "Enable router support";
       };
       wan = mkOption {
-        type = types.string;
+        type = types.str;
         description = "Interface for the router's WAN";
       };
       brlan = mkOption {
-        type = types.string;
+        type = types.str;
         default = "brlan";
         description = "LAN interface (commonly some bridge)";
       };
-      # TODO IP range and so on
+      lanIP = mkOption {
+        type = types.str;
+        description = "LAN IP address";
+      };
+      dynIPStart = mkOption {
+        type = types.ints.between 0 256;
+        default = 100;
+        description = "Offset for the dynamic IPv4 addresses";
+      };
+      dynIPCount = mkOption {
+        type = types.ints.between 0 256;
+        default = 100;
+        description = "Number of dynamically assigned IPv4 addresses";
+      };
+      lanPrefix = mkOption {
+        type = types.ints.between 0 32;
+        default = 24;
+        description = "LAN IP network prefix length";
+      };
     };
   };
 
-  config = mkIf cnf {
-    # TODO firewall NAT
+  config = mkIf cnf.enable {
     networking = {
+      interfaces."${cnf.brlan}" = {
+        ipv4.addresses = [
+          {
+            address = cnf.lanIP;
+            prefixLength = cnf.lanPrefix;
+          }
+        ];
+      };
+      nat = {
+        externalInterface = cnf.wan;
+        internalInterfaces = [cnf.brlan];
+      };
+      dhcpcd.allowInterfaces = [cnf.wan];
+      nameservers = ["1.1.1.1" "8.8.8.8"];
     };
 
     services.dhcpd4 = {
       enable = true;
       authoritative = true;
-      interfaces = ["brlan"];
+      interfaces = [cnf.brlan];
       extraConfig = ''
+        option domain-name-servers 1.1.1.1 8.8.8.8;
+        subnet ${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix} netmask ${ipv4.prefix2netmask cnf.lanPrefix} {
+            range ${
+          ipv4.ipAdd cnf.lanIP cnf.lanPrefix cnf.dynIPStart
+        } ${
+          ipv4.ipAdd cnf.lanIP cnf.lanPrefix (cnf.dynIPStart + cnf.dynIPCount)
+        };
+            option routers ${cnf.lanIP};
+            option subnet-mask ${ipv4.prefix2netmask cnf.lanPrefix};
+            option broadcast-address ${ipv4.prefix2broadcast cnf.lanIP cnf.lanPrefix};
+        }
       '';
     };
 
     services.dhcpd6 = {
       enable = true;
       authoritative = true;
-      interfaces = ["brlan"];
+      interfaces = [cnf.brlan];
       extraConfig = ''
       '';
     };
 
     services.kresd = {
-      enable = true;
+      enable = false;
     };
   };
 }
-- 
cgit v1.2.3