diff options
| -rw-r--r-- | hosts/poweredge-pro/configuration.nix | 47 | ||||
| -rw-r--r-- | hosts/poweredge-pro/networking.nix | 133 |
2 files changed, 180 insertions, 0 deletions
diff --git a/hosts/poweredge-pro/configuration.nix b/hosts/poweredge-pro/configuration.nix new file mode 100644 index 0000000..691dedb --- /dev/null +++ b/hosts/poweredge-pro/configuration.nix @@ -0,0 +1,47 @@ +{ config, ... }: { + # Setup bootloader + boot._loader.enable = true; + + # Enable common options + _archetypes = { + profiles = { + headless = { + enable = true; + home.users.timmy.enable = true; + }; + #zfs.enable = true; + }; + }; + + # Import zfs pools + #boot.zfs.extraPools = [ "storage" ]; + + # Enable user timmy + _users.timmy.enable = true; + + # Without this, "ZFS requires networking.hostId to be set" will be raised + #networking.hostId = "4d9e002f"; + + + nixpkgs.config.allowUnfree = true; + nixpkgs.config.cudaSupport = true; + + # NVIDIA + services.xserver.videoDrivers = [ "nvidia" ]; # xserver.videoDrivers does not imply X + hardware.graphics.enable = true; + hardware.nvidia = { + modesetting.enable = true; # Required + nvidiaSettings = false; # Don't need gui + open = false; + package = config.boot.kernelPackages.nvidiaPackages.legacy_580; # Support for Tesla P100 + powerManagement.enable = false; # Can cause bugs + powerManagement.finegrained = false; # Only works on turing and newer + }; + + # Packages + environment.systemPackages = with pkgs; [ + config.hardware.nvidia.package # nvidia-smi + ]; + + system.stateVersion = "26.05"; +} diff --git a/hosts/poweredge-pro/networking.nix b/hosts/poweredge-pro/networking.nix new file mode 100644 index 0000000..6f70ac8 --- /dev/null +++ b/hosts/poweredge-pro/networking.nix @@ -0,0 +1,133 @@ +let + hostIp = "192.168.1.10"; +in { config, ... }: { + networking = { + # Label lan and wan interfaces + _interfaceLabels = { + enable = true; + interfaces.lan0 = "50:9a:4c:5d:c3:7a"; + interfaces.lan1 = "50:9a:4c:5d:c3:7a"; + interfaces.lan2 = "50:9a:4c:5d:c3:7a"; + interfaces.wan0 = "50:9a:4c:5d:c3:7b"; + }; + # Create bridged lan interface for all containers + bridges.br-lan0.interfaces = [ "lan0" ]; + # Disable dhcp on router interfaces + interfaces = { + veth-router-lan.useDHCP = false; + vb-router-lan0.useDHCP = false; + }; + # Configure network + defaultGateway = "10.255.255.1"; # Read explaination for veth-router-lan below + nameservers = [ "192.168.1.1" ]; # DNS will only be available from this ip address THROUGH the default gateway + # br-lan0 will be the interface used for networking on poweredge host + interfaces.br-lan0.ipv4.addresses = [{ + address = hostIp; + prefixLength = 24; + }]; + }; + + # Router container + containers.router = { + autoStart = true; + ephemeral = true; + privateNetwork = true; + # Pass wan0 directly into container since it isn't needed elsewhere + interfaces = [ "wan0" ]; + # Setup router lan0 + # NOTE: Host/container communication is not possible through a hostBridge interface + extraVeths.vb-router-lan0.hostBridge = "br-lan0"; + # Setup virtual host-router bridge interface. + # This is the default gateway for host/container communication since + # communication isn't possible through hostBridge interfaces. + # This is essentially equivalent to connecting the host to the + # container with a virtual ethernet cable on a separate interface. + extraVeths.veth-router-lan = { + hostAddress = "10.255.255.2"; + localAddress = "10.255.255.1"; + }; + # Bind wg0-router secret to container + bindMounts."/run/secrets/wg0" = { + hostPath = config.sops.secrets.wg0-router.path; + isReadOnly = true; + }; + + config = { lib, config, ... }: { + imports = [ + ../../nixos/services/router + ./router-hosts.nix # Contains dhcp config + static leases + overrides + ]; + + networking = { + # Set ip addresses + enableIPv6 = false; + interfaces = { + vb-router-lan0.ipv4.addresses = [{ + address = "192.168.1.1"; + prefixLength = 24; + }]; + wan0.ipv4.addresses = [ + # .163 address reserved for remote backup access + { address = "46.110.173.161"; prefixLength = 29; } # Gateway + { address = "46.110.173.162"; prefixLength = 29; } # Mail + { address = "46.110.173.164"; prefixLength = 29; } # Web + { address = "46.110.173.165"; prefixLength = 29; } # Wg + { address = "46.110.173.166"; prefixLength = 29; } # Spare + ]; + }; + defaultGateway = { + address = "46.110.173.161"; + interface = "wan0"; + }; + # NAT (port-forwarding) rules + nat.forwardPorts =[ + #{ # Filebrowser + # sourcePort = 19045; + # proto = "tcp"; + # destination = "192.168.1.45:9000"; + #} + ]; + }; + + # Setup router + services._router = { + dnsDhcpConfig.enable = true; + routing = { + enable = true; + interfaces = { + lan = [ "vb-router-lan0" "veth-router-lan" ]; + wan = "wan0"; + }; + }; + }; + + services.unbound._blocklists = { + enable = true; + hageziBlocklists = [ "pro" "nsfw" ]; + }; + + system.stateVersion = "26.05"; + }; + }; + + # FIXME the following snippet will cause the router container to fail to start: + # networking.defaultGateway = { + # address = "10.255.255.1"; + # interface = "veth-router-lan"; + # }; + # Journalctl will report: + # poweredge container router: Bring veth-router-lan up + # poweredge container router: RTNETLINK answers: File exists + # poweredge systemd: container@router.service: Control process exited, code=exited, status=2/INVALIDARGUMENT + # So the issue nixos is creating an interface with that same name. + # As a temporary workaround, the following service is deployed (after the container starts): + systemd.services.router-default-route = { + after = [ "container@router.service" ]; + wants = [ "container@router.service" ]; + serviceConfig.Type = "oneshot"; + script = '' + /run/current-system/sw/bin/ip route replace default via 10.255.255.1 dev veth-router-lan + ''; + wantedBy = [ "multi-user.target" ]; + }; +} |