nixbld: altnet setup
This commit is contained in:
parent
c2c7e67549
commit
39a6ea69f6
|
@ -104,6 +104,15 @@ in
|
||||||
address = "2001:470:f891:1::";
|
address = "2001:470:f891:1::";
|
||||||
prefixLength = 64;
|
prefixLength = 64;
|
||||||
}];
|
}];
|
||||||
|
# https://unix.stackexchange.com/questions/423502/iproute2-inherit-or-copy-table
|
||||||
|
# we just copy what matters here. Ugly but easier.
|
||||||
|
ipv4.routes = [
|
||||||
|
{
|
||||||
|
address = "192.168.1.0";
|
||||||
|
prefixLength = 24;
|
||||||
|
options.table = "1";
|
||||||
|
}
|
||||||
|
];
|
||||||
};
|
};
|
||||||
interfaces."${netifWifi}" = {
|
interfaces."${netifWifi}" = {
|
||||||
ipv4.addresses = [{
|
ipv4.addresses = [{
|
||||||
|
@ -161,12 +170,80 @@ in
|
||||||
addresses = [{ address = "2001:470:18:390::2"; prefixLength = 64; }];
|
addresses = [{ address = "2001:470:18:390::2"; prefixLength = 64; }];
|
||||||
routes = [{ address = "::"; prefixLength = 0; }];
|
routes = [{ address = "::"; prefixLength = 0; }];
|
||||||
};
|
};
|
||||||
|
greTunnels.alt0 = {
|
||||||
|
dev = netifWan;
|
||||||
|
remote = "103.206.98.1";
|
||||||
|
local = "94.190.212.123";
|
||||||
|
ttl = 255;
|
||||||
|
type = "tun";
|
||||||
|
};
|
||||||
|
interfaces.alt0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "103.206.98.227";
|
||||||
|
prefixLength = 31;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv4.routes = [
|
||||||
|
{
|
||||||
|
address = "0.0.0.0";
|
||||||
|
prefixLength = 0;
|
||||||
|
via = "103.206.98.226";
|
||||||
|
options.table = "1";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
vlans = {
|
||||||
|
vlan0 = {
|
||||||
|
id = 2;
|
||||||
|
interface = netifLan;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
interfaces.vlan0 = {
|
||||||
|
ipv4.addresses = [{
|
||||||
|
address = "103.206.98.200";
|
||||||
|
prefixLength = 29;
|
||||||
|
}];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
|
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
|
||||||
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
|
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
|
||||||
boot.kernel.sysctl."net.ipv6.conf.${netifLan}.accept_dad" = "0";
|
boot.kernel.sysctl."net.ipv6.conf.${netifLan}.accept_dad" = "0";
|
||||||
boot.kernel.sysctl."net.ipv6.conf.${netifWifi}.accept_dad" = "0";
|
boot.kernel.sysctl."net.ipv6.conf.${netifWifi}.accept_dad" = "0";
|
||||||
|
|
||||||
|
services.strongswan-swanctl.enable = true;
|
||||||
|
services.strongswan-swanctl.swanctl.connections.altnet = {
|
||||||
|
local_addrs = [ "94.190.212.123" ];
|
||||||
|
remote_addrs = [ "103.206.98.1" ];
|
||||||
|
local.main = {
|
||||||
|
auth = "pubkey";
|
||||||
|
id = "fqdn:m-labs.hk";
|
||||||
|
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
|
||||||
|
};
|
||||||
|
remote.main = {
|
||||||
|
auth = "pubkey";
|
||||||
|
id = "fqdn:igw0.hkg.as150788.net";
|
||||||
|
pubkeys = [ "/etc/swanctl/pubkey/igw0.hkg.as150788.net" ];
|
||||||
|
};
|
||||||
|
children.alt0 = {
|
||||||
|
mode = "transport";
|
||||||
|
ah_proposals = [ "sha256-curve25519" ];
|
||||||
|
remote_ts = [ "103.206.98.1[gre]" ];
|
||||||
|
local_ts = [ "94.190.212.123[gre]" ];
|
||||||
|
start_action = "start";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.custom-network-setup = {
|
||||||
|
wantedBy = [ "network.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
ExecStart = "${pkgs.iproute2}/bin/ip rule add from 103.206.98.200/29 table 1";
|
||||||
|
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
||||||
# chown named.named /etc/nixos/named
|
# chown named.named /etc/nixos/named
|
||||||
services.bind = {
|
services.bind = {
|
||||||
|
@ -212,6 +289,23 @@ in
|
||||||
"216.218.133.2" "2001:470:600::2" # slave.dns.he.net
|
"216.218.133.2" "2001:470:600::2" # slave.dns.he.net
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
"200-29.98.206.103.in-addr.arpa" = {
|
||||||
|
name = "200-29.98.206.103.in-addr.arpa";
|
||||||
|
master = true;
|
||||||
|
file = "/etc/nixos/named/200-29.98.206.103.in-addr.arpa";
|
||||||
|
extraConfig =
|
||||||
|
''
|
||||||
|
dnssec-policy "default";
|
||||||
|
inline-signing yes;
|
||||||
|
notify explicit;
|
||||||
|
also-notify {
|
||||||
|
216.218.130.2; # ns1.he.net
|
||||||
|
};
|
||||||
|
'';
|
||||||
|
slaves = [
|
||||||
|
"216.218.133.2" "2001:470:600::2" # slave.dns.he.net
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
zone "mil." IN {
|
zone "mil." IN {
|
||||||
|
|
|
@ -0,0 +1,17 @@
|
||||||
|
$TTL 7200
|
||||||
|
|
||||||
|
@ SOA NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G. sb.m-labs.hk. (
|
||||||
|
2023071303
|
||||||
|
7200
|
||||||
|
3600
|
||||||
|
86400
|
||||||
|
600)
|
||||||
|
|
||||||
|
|
||||||
|
NS NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G.
|
||||||
|
NS ns1.he.net.
|
||||||
|
|
||||||
|
200 PTR router.alt.m-labs.hk.
|
||||||
|
201 PTR stewardship1.alt.m-labs.hk.
|
||||||
|
202 PTR stewardship2.alt.m-labs.hk.
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
$TTL 7200
|
$TTL 7200
|
||||||
|
|
||||||
@ SOA NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G. sb.m-labs.hk. (
|
@ SOA NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G. sb.m-labs.hk. (
|
||||||
2023040501
|
2023071301
|
||||||
7200
|
7200
|
||||||
3600
|
3600
|
||||||
86400
|
86400
|
||||||
|
@ -51,3 +51,7 @@ hestia AAAA 2001:470:f891:1:881c:f409:a090:8401
|
||||||
vulcan AAAA 2001:470:f891:1:105d:3f15:bd53:c5ac
|
vulcan AAAA 2001:470:f891:1:105d:3f15:bd53:c5ac
|
||||||
|
|
||||||
aux A 42.200.147.171
|
aux A 42.200.147.171
|
||||||
|
|
||||||
|
router.alt A 103.206.98.200
|
||||||
|
stewardship1.alt A 103.206.98.201
|
||||||
|
stewardship2.alt A 103.206.98.202
|
||||||
|
|
Loading…
Reference in New Issue