Richie
47f77443dd
treefmt / nix fmt (pull_request) Successful in 5s
pytest / pytest (pull_request) Successful in 49s
build_systems / build-bob (pull_request) Successful in 1m9s
build_systems / build-brain (pull_request) Successful in 1m12s
build_systems / build-rhapsody-in-green (pull_request) Successful in 1m15s
treefmt / nix fmt (push) Successful in 6s
pytest / pytest (push) Successful in 25s
build_systems / build-jeeves (pull_request) Successful in 2m59s
build_systems / build-brain (push) Successful in 32s
build_systems / build-bob (push) Successful in 33s
build_systems / build-rhapsody-in-green (push) Successful in 46s
build_systems / build-jeeves (push) Successful in 2m26s
99 lines
2.9 KiB
Nix
99 lines
2.9 KiB
Nix
{
|
|
# Docker loads br_netfilter on jeeves. Disable bridge netfilter so
|
|
# br-nix-builder behaves like a pure L2 bridge and bridged traffic
|
|
# does not hit the host firewall/rpfilter path.
|
|
boot.kernel.sysctl = {
|
|
"net.bridge.bridge-nf-call-arptables" = 0;
|
|
"net.bridge.bridge-nf-call-ip6tables" = 0;
|
|
"net.bridge.bridge-nf-call-iptables" = 0;
|
|
};
|
|
|
|
networking = {
|
|
hostName = "jeeves";
|
|
hostId = "0e15ce35";
|
|
firewall = {
|
|
enable = true;
|
|
interfaces.br-nix-builder = {
|
|
allowedTCPPorts = [ ];
|
|
allowedUDPPorts = [ ];
|
|
};
|
|
allowedTCPPorts = [
|
|
8070
|
|
];
|
|
};
|
|
useNetworkd = true;
|
|
# Without this, unconfigured NICs get a catch-all DHCP network and
|
|
# join the LAN uninvited (how the dead atlantic card ended up
|
|
# ARP-poisoning 192.168.99.14). Every interface must be configured
|
|
# explicitly below.
|
|
useDHCP = false;
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
wait-online = {
|
|
enable = false;
|
|
anyInterface = true;
|
|
};
|
|
netdevs = {
|
|
"20-br-nix-builder" = {
|
|
netdevConfig = {
|
|
Kind = "bridge";
|
|
Name = "br-nix-builder";
|
|
};
|
|
};
|
|
"30-internet-vlan" = {
|
|
netdevConfig = {
|
|
Kind = "vlan";
|
|
Name = "internet-vlan";
|
|
};
|
|
vlanConfig.Id = 100;
|
|
};
|
|
};
|
|
networks = {
|
|
# Unused second port of the onboard i350; keep it down so the dead
|
|
# PCIe link (see dmesg "PCIe link lost") stops logging Tx errors.
|
|
"01-unused-igb-port" = {
|
|
matchConfig.Name = "enp97s0f0";
|
|
linkConfig.ActivationPolicy = "always-down";
|
|
};
|
|
# Aquantia 10G card (0000:21:00.0); loses PCIe link, and its
|
|
# unicast RX path is dead while TX still works, so when it's up it
|
|
# answers ARP for the host IPs and black-holes the replies. Keep
|
|
# it down until the card is fixed or replaced.
|
|
"01-unused-atlantic-port" = {
|
|
matchConfig.Name = "enp33s0";
|
|
linkConfig.ActivationPolicy = "always-down";
|
|
};
|
|
"10-Primary" = {
|
|
matchConfig.Name = "enp97s0f1";
|
|
address = [ "192.168.99.14/24" ];
|
|
dns = [
|
|
"192.168.99.1"
|
|
"2600:4040:abfb:d700::1"
|
|
];
|
|
routes = [ { Gateway = "192.168.99.1"; } ];
|
|
vlan = [ "internet-vlan" ];
|
|
dhcpV4Config.UseDNS = false;
|
|
dhcpV6Config.UseDNS = false;
|
|
ipv6AcceptRAConfig.UseDNS = false;
|
|
linkConfig.RequiredForOnline = "routable";
|
|
};
|
|
"50-internet-vlan" = {
|
|
matchConfig.Name = "internet-vlan";
|
|
bridge = [ "br-nix-builder" ];
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
"60-br-nix-builder" = {
|
|
matchConfig.Name = "br-nix-builder";
|
|
bridgeConfig = { };
|
|
networkConfig = {
|
|
IPv6AcceptRA = false;
|
|
LinkLocalAddressing = "no";
|
|
};
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
};
|
|
};
|
|
}
|