aboutsummaryrefslogtreecommitdiff
path: root/nix
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2023-04-05 13:44:38 +0200
committerAlex Auvolat <alex@adnab.me>2023-04-05 13:44:38 +0200
commitbb25797d2f164f3f0f3c81a492e8f6e7fe1fd232 (patch)
tree7856d832d09aeee7588e316e864212e59388134b /nix
parentdec4ea479d47d3337df8e45c732a628051a65ea2 (diff)
downloadnixcfg-bb25797d2f164f3f0f3c81a492e8f6e7fe1fd232.tar.gz
nixcfg-bb25797d2f164f3f0f3c81a492e8f6e7fe1fd232.zip
make script clearer and add documentation
Diffstat (limited to 'nix')
-rw-r--r--nix/deuxfleurs.nix34
1 files changed, 20 insertions, 14 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 8b9a5ef..57486c2 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -40,13 +40,13 @@ in
staticIPv6.defaultGateway = mkOption {
description = ''
IPv6 address of the default route on the local network interface.
- IPv6 Router Advertisements (RA) will be totally disabled.
+ IPv6 Router Advertisements (RA) will be totally disabled if this is set.
'';
type = nullOr str;
default = null;
};
staticIPv6.prefixLength = mkOption {
- description = "IPv6 prefix length";
+ description = "IPv6 prefix length, used only when router advertisements are disabled.";
type = int;
default = 64;
};
@@ -148,24 +148,30 @@ in
networking.useNetworkd = true;
systemd.network.networks."10-uplink" =
let
- dyn_v4 = cfg.staticIPv4.address == null || cfg.staticIPv4.defaultGateway == null;
- dyn_v6 = cfg.staticIPv6.defaultGateway == null;
+ # IPv4 configuration is obtained by DHCP by default,
+ # unless a static v4 address and default gateway are given
+ noDHCP = cfg.staticIPv4.address != null && cfg.staticIPv4.defaultGateway != null;
+ # IPv6 configuration is obtained through router advertisements
+ # (RA), using a static token to ensure a static IPv6,
+ # unless defaultGateway is specified, in which case RAs are
+ # disabled entirely
+ noRA = cfg.staticIPv6.defaultGateway != null;
in
{
matchConfig.Name = "en* eth*";
address =
- optional (!dyn_v4) "${cfg.staticIPv4.address}"
- ++ optional (!dyn_v6) "${cfg.staticIPv6.address}/${toString cfg.staticIPv6.prefixLength}";
+ optional noDHCP "${cfg.staticIPv4.address}"
+ ++ optional noRA "${cfg.staticIPv6.address}/${toString cfg.staticIPv6.prefixLength}";
routes =
- optional (!dyn_v4) {
+ optional noDHCP {
routeConfig = {
Gateway = cfg.staticIPv4.defaultGateway;
# GatewayOnLink - Takes a boolean. If set to true, the kernel does not have to check if the gateway is reachable directly by the current machine (i.e., attached to the local network), so that we can insert the route in the kernel table without it being complained about. Defaults to "no".
GatewayOnLink = true;
};
- } ++ optional (!dyn_v6) {
+ } ++ optional noRA {
routeConfig = {
Gateway = cfg.staticIPv6.defaultGateway;
GatewayOnLink = true;
@@ -173,18 +179,18 @@ in
};
# Dynamic IPv4: enable DHCP but not for DNS servers
- networkConfig.DHCP = mkIf dyn_v4 "ipv4";
- dhcpV4Config.UseDNS = mkIf dyn_v4 false;
+ networkConfig.DHCP = mkIf (!noDHCP) "ipv4";
+ dhcpV4Config.UseDNS = mkIf (!noDHCP) false;
# Dynamic IPv6: only fetch default route, use static
# address and no DNS servers
- ipv6AcceptRAConfig.Token = mkIf dyn_v6 "static:${cfg.staticIPv6.address}";
- ipv6AcceptRAConfig.UseDNS = mkIf dyn_v6 false;
+ ipv6AcceptRAConfig.Token = mkIf (!noRA) "static:${cfg.staticIPv6.address}";
+ ipv6AcceptRAConfig.UseDNS = mkIf (!noRA) false;
# Static IPv6: disable all router advertisements and
# link-local addresses
- networkConfig.IPv6AcceptRA = mkIf (!dyn_v6) false;
- networkConfig.LinkLocalAddressing = mkIf (!dyn_v6) "no";
+ networkConfig.IPv6AcceptRA = mkIf noRA false;
+ networkConfig.LinkLocalAddressing = mkIf noRA "no";
};
# Configure Unbound as a central DNS server for everything