blob: 07da891b969503034f0a4683ea27ef8d62695a7e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
{config, ...}: let
hosts = config.cynerd.hosts.zd;
in {
system.stateVersion = "25.05";
turris.board = "mox";
deploy = {
enable = true;
ssh.host = "zd.cynerd.cz";
};
cynerd = {
router = {
enable = true;
wan = "pppoe-wan";
lanIP = hosts.mox;
staticLeases = {
"4c:d5:77:0d:85:d9" = hosts.binky;
};
};
wifiAP.zd = {
enable = false;
qca988x = {
interface = "wlp1s0";
bssids = config.secrets.wifiMacs.zd-mox.qca988x;
channel = 36;
};
};
wireguard = true;
monitoring.speedtest = true;
};
services = {
journald.extraConfig = ''
SystemMaxUse=512M
'';
btrfs.autoScrub = {
enable = true;
fileSystems = ["/"];
};
fail2ban = {
enable = true;
ignoreIP = ["10.8.0.0/24" "10.8.1.0/24" "10.8.2.0/24"];
};
};
networking.useDHCP = false;
systemd.network = {
netdevs = {
"end2.848" = {
netdevConfig = {
Kind = "vlan";
Name = "end2.848";
};
vlanConfig.Id = 848;
};
};
networks = {
"end2" = {
matchConfig.Name = "end2";
networkConfig.VLAN = ["end2.848"];
};
"end2.848" = {
matchConfig.Name = "end2.848";
networkConfig.BindCarrier = "end2";
};
"pppoe-wan" = {
matchConfig.Name = "pppoe-wan";
networkConfig = {
BindCarrier = "end2.848";
DHCP = "ipv6";
IPv6AcceptRA = "no";
DHCPPrefixDelegation = "yes";
#DNS = ["84.19.64.3" "84.19.64.4" "1.1.1.1"];
DNS = "1.1.1.1";
};
dhcpV6Config = {
PrefixDelegationHint = "::/56";
UseDNS = "no";
};
dhcpPrefixDelegationConfig = {
UplinkInterface = ":self";
SubnetId = 0;
Announce = "no";
};
linkConfig.RequiredForOnline = "routable";
};
"lan-brlan" = {
matchConfig.Name = "lan*";
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
EgressUntagged = 1;
PVID = 1;
}
{VLAN = 2;}
];
};
};
};
services.pppd = {
enable = true;
peers."wan".config = ''
plugin pppoe.so end2.848
ifname pppoe-wan
lcp-echo-interval 1
lcp-echo-failure 5
lcp-echo-adaptive
defaultroute
defaultroute6
maxfail 1
# user and password added in secrets
'';
};
systemd.services."pppd-wan" = {
after = ["sys-subsystem-net-devices-end2.848.device"];
partOf = ["systemd-networkd.service"];
};
# TODO limit NSS clamping to just pppoe-wan
networking.firewall.extraForwardRules = ''
tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4"
iifname {"home", "wg"} oifname {"home", "wg"} accept
'';
}
|
