xin/hosts/router/default.nix

{ config
, pkgs
, lib
, ...
}:
let
  inherit
    (builtins)
    head
    concatStringsSep
    attrValues
    mapAttrs
    attrNames
    ;# hasAttr;
  inherit (lib.attrsets) filterAttrsRecursive filterAttrs;
  pubKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7v+/xS8832iMqJHCWsxUZ8zYoMWoZhjj++e26g1fLT europa"
  ];
  userBase = {
    openssh.authorizedKeys.keys = pubKeys ++ config.myconf.managementPubKeys;
  };

  wan = "enp5s0f0";
  trunk = "enp5s0f1";
  dnsServers = [ "45.90.28.147" "45.90.30.147" ];
  interfaces = {
    "${wan}" = { useDHCP = true; };
    "${trunk}" = rec {
      ipv4.addresses = [
        {
          address = "10.99.99.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "Management";
        route = false;
        router = "${(head ipv4.addresses).address}";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        net = "10.99.99.0";
        dhcp = {
          enable = true;
          start = "10.99.99.100";
          end = "10.99.99.150";
          staticIPs = [
            {
              name = "doublemint";
              mac = "74:83:c2:19:9e:51";
              address = "10.99.99.54";
            }
            {
              name = "switch0";
              mac = "18:e8:29:b5:48:15";
              address = "10.99.99.4";
            }
            {
              name = "switch1";
              mac = "fc:ec:da:4e:2e:51";
              address = "10.99.99.5";
            }
            {
              name = "switch2";
              mac = "fc:ec:da:d4:10:81";
              address = "10.99.99.6";
            }
            {
              name = "ap2";
              mac = "74:83:c2:89:0b:52";
              address = "10.99.99.7";
            }
            {
              name = "ap1";
              mac = "80:2a:a8:96:50:76";
              address = "10.99.99.8";
            }
          ];
        };
      };
    };
    enp1s0f0 = rec {
      ipv4.addresses = [
        {
          address = "10.99.1.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "unused";
        route = true;
        router = "${(head ipv4.addresses).address}";
        net = "10.99.1.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = true;
          start = "10.99.1.100";
          end = "10.99.1.155";
          staticIPs = [ ];
        };
      };
    };
    enp2s0f1 = rec {
      ipv4.addresses = [
        {
          address = "10.98.1.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "work";
        route = false;
        router = "${(head ipv4.addresses).address}";
        net = "10.98.1.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = true;
          start = "10.98.1.100";
          end = "10.98.1.150";
          staticIPs = [ ];
        };
      };
    };
    badwifi = rec {
      ipv4.addresses = [
        {
          address = "10.10.0.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "IoT WiFi";
        route = true;
        router = "${(head ipv4.addresses).address}";
        net = "10.10.0.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = true;
          start = "10.10.0.100";
          end = "10.10.0.155";
          staticIPs = [ ];
        };
      };
    };
    goodwifi = rec {
      ipv4.addresses = [
        {
          address = "10.12.0.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "WiFi";
        route = false;
        router = "${(head ipv4.addresses).address}";
        net = "10.12.0.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = false;
          start = "10.12.0.100";
          end = "10.12.0.155";
          staticIPs = [ ];
        };
      };
    };
    lab = rec {
      ipv4.addresses = [
        {
          address = "10.3.0.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        vlanID = 2;
        description = "Lab";
        route = true;
        router = "${(head ipv4.addresses).address}";
        net = "10.3.0.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = true;
          start = "10.3.0.100";
          end = "10.3.0.155";
          staticIPs = [
            {
              name = "bbb";
              mac = "c8:a0:30:ac:1d:0d";
              address = "10.3.0.2";
            }
          ];
        };
      };
    };
    external = rec {
      ipv4.addresses = [
        {
          address = "10.20.30.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "DMZ";
        route = true;
        router = "${(head ipv4.addresses).address}";
        net = "10.20.30.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = false;
          start = "10.20.30.100";
          end = "10.20.30.155";
          staticIPs = [ ];
        };
      };
    };
    common = rec {
      ipv4.addresses = [
        {
          address = "10.6.0.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "Common";
        route = true;
        router = "${(head ipv4.addresses).address}";
        vlanID = 5;
        net = "10.6.0.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = true;
          start = "10.6.0.100";
          end = "10.6.0.250";
          staticIPs = [
            {
              name = "tal";
              mac = "3c:7c:3f:1d:95:9c";
              address = "10.6.0.110";
            }
            {
              name = "namish";
              mac = "b8:ae:ed:78:b5:37";
              address = "10.6.0.78";
            }
            {
              name = "g5";
              mac = "00:0a:95:a8:26:42";
              address = "10.6.0.111";
            }
            {
              name = "box";
              mac = "d0:50:99:c2:b5:4b";
              address = "10.6.0.15";
            }
            {
              name = "greenhouse";
              mac = "6c:0b:84:1b:20:07";
              address = "10.6.0.20";
            }
            {
              name = "inside";
              mac = "6c:0b:84:cb:a7:59";
              address = "10.6.0.21";
            }
            {
              name = "weather";
              mac = "b8:27:eb:3e:5b:4e";
              address = "10.6.0.22";
            }
          ];
        };
      };
    };
    voip = rec {
      ipv4.addresses = [
        {
          address = "10.7.0.1";
          prefixLength = 24;
        }
      ];
      info = rec {
        description = "VoIP";
        route = true;
        router = "${(head ipv4.addresses).address}";
        net = "10.7.0.0";
        netmask = "255.255.255.0";
        network = "${net}/${toString (head ipv4.addresses).prefixLength}";
        dhcp = {
          enable = false;
          start = "10.7.0.100";
          end = "10.7.0.155";
          staticIPs = [ ];
        };
      };
    };
  };
in
{
  _module.args.isUnstable = false;
  imports = [ ./hardware-configuration.nix ../../modules/tsvnstat.nix ];

  boot.kernel.sysctl = {
    "net.ipv4.conf.all.forwarding" = true;
    "net.ipv6.conf.all.forwarding" = true;

    "net.ipv6.conf.all.accept_ra" = 0;
    "net.ipv6.conf.all.autoconf" = 0;
    "net.ipv6.conf.all.use_tempaddr" = 0;

    "net.netfilter.nf_conntrack_helper" = true;
  };

  sops.secrets = {
    wireguard_private_key = {
      sopsFile = config.xin-secrets.router.networking;
    };
    router_stats_ts_key = {
      sopsFile = config.xin-secrets.router.networking;
      owner = config.users.users.tsvnstat.name;
    };
  };

  networking = {
    hostName = "router";

    enableIPv6 = true;
    useDHCP = false;
    firewall.enable = false;
    dhcpcd = {
      enable = true;
      extraConfig = ''
        interface ${wan}
        ipv6rs
        iaid 1
        ia_pd 1 common
      '';
    };

    # TODO: iterate over interfaces where .<name>.vlanID is set
    vlans = {
      badwifi = {
        id = 10;
        interface = "${trunk}";
      };
      goodwifi = {
        id = 11;
        interface = "${trunk}";
      };
      lab = {
        id = 2;
        interface = "${trunk}";
      };
      common = {
        id = 5;
        interface = "${trunk}";
      };
      voip = {
        id = 6;
        interface = "${trunk}";
      };
      external = {
        id = 20;
        interface = "${trunk}";
      };
    };

    interfaces = filterAttrsRecursive (n: _: n != "info") interfaces;

    nftables = {
      enable = true;
      ruleset = ''
        define DEV_PRIVATE = enp1s0f0
        define DEV_HAM = enp2s0f1

        table ip global {

            chain inbound_world {
                #icmp type echo-request limit rate 5/second accept
                #tcp dport ssh limit rate 1/minute accept
                udp dport dhcpv6-client accept
            }

            chain inbound_private {
                icmp type echo-request limit rate 5/second accept
                ip protocol . th dport vmap {
                  tcp . 22 : accept,
                  udp . 53 : accept,
                  tcp . 53 : accept,
                  udp . 67 : accept
                }
            }

            #ct helper tftp {
            #  type "tftp" protocol udp;
            #}

            chain inbound_lab {
                icmp type echo-request limit rate 5/second accept
                #udp dport 69 ct helper set "tftp"
                ip protocol . th dport vmap {
                  tcp . 53 : accept,
                  tcp . 67 : accept,
                  udp . 53 : accept,
                  udp . 69 : accept,
                  udp . 67 : accept
                }
            }

            chain inbound {
                type filter hook input priority 0; policy drop;
                ct state vmap { established : accept, related : accept, invalid : drop }

                iifname vmap {
                  lo : accept,
                  ${wan} : jump inbound_world,
                  $DEV_PRIVATE : jump inbound_private,
                  $DEV_HAM : jump inbound_private,
                  common : jump inbound_private,
                  badwifi : jump inbound_private,
                  external : jump inbound_private,
                  voip : jump inbound_private,
                  lab : jump inbound_lab
                }
            }

            chain forward {
                type filter hook forward priority 0; policy drop;

                ct state vmap { established : accept, related : accept, invalid : drop }

                oifname $DEV_HAM iifname != $DEV_HAM drop
                iifname $DEV_PRIVATE accept
                iifname $DEV_HAM accept
                iifname common accept
                iifname badwifi accept
                iifname external accept
                iifname voip accept
                iifname lab accept
            }

            chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                oifname ${wan} masquerade
            }
        }
      '';
    };
  };

  services = {
    corerad = {
      enable = true;
      settings = {
        interfaces = [
          {
            name = wan;
            monitor = true;
          }
          {
            name = "common";
            advertise = true;
            prefix = [{ prefix = "::/64"; }];
          }
        ];
      };
    };
    tsvnstat = {
      enable = true;
      keyPath = "${config.sops.secrets.router_stats_ts_key.path}";
    };
    atftpd = {
      enable = true;
      extraOptions = [
        "--verbose=9"
        "--trace"
        "--bind-address ${
          (head config.networking.interfaces.lab.ipv4.addresses).address
        }"
      ];
    };

    dhcpd4 = {
      enable = true;
      extraConfig = ''
        option subnet-mask 255.255.255.0;
        option domain-name-servers ${concatStringsSep ", " dnsServers};

        ${concatStringsSep "\n" (attrValues (mapAttrs (intf: val: ''
          # ${intf} : ${val.info.description}
          subnet ${val.info.net} netmask ${val.info.netmask} {
            option routers ${val.info.router};
            range ${val.info.dhcp.start} ${val.info.dhcp.end};

            ${
            concatStringsSep "\n" (map (e: ''
                host ${e.name} {
                    hardware ethernet ${e.mac};
                    fixed-address ${e.address};
                }
              '')
              val.info.dhcp.staticIPs)
          }
          }
        '') (filterAttrsRecursive (n: _: n != "${wan}") interfaces)))}
      '';
      interfaces =
        attrNames (filterAttrs (_: v: v.info.dhcp.enable)
          (filterAttrsRecursive (n: _: n != "${wan}") interfaces));
      # TODO: Probably a better way to pre-filter the interfaces set
    };
  };

  environment.systemPackages = with pkgs; [ bmon termshark tcpdump ];

  users.users.root = userBase;
  users.users.qbit = userBase;

  system = {
    autoUpgrade = {
      rebootWindow = {
        upper = "03:00";
        lower = "01:00";
      };
    };
    stateVersion = "22.05";
  };
}