Richie
e4eef6dff0
treefmt / nix fmt (pull_request) Successful in 5s
pytest / pytest (pull_request) Successful in 29s
test ebook search / test-ebook-search (pull_request) Successful in 34s
build_systems / build-brain (pull_request) Successful in 48s
build_systems / build-bob (pull_request) Successful in 48s
build_systems / build-rhapsody-in-green (pull_request) Successful in 58s
build_systems / build-jeeves (pull_request) Successful in 2m14s
- split networking into interface and firewall modules - define named service ports in one location - remove scattered service-level firewall rules
78 lines
2.3 KiB
Nix
78 lines
2.3 KiB
Nix
{
|
|
# Docker loads br_netfilter on jeeves. Disable bridge netfilter so
|
|
# br-nix-builder behaves like a pure L2 bridge and bridged traffic
|
|
# does not hit the host firewall/rpfilter path.
|
|
boot.kernel.sysctl = {
|
|
"net.bridge.bridge-nf-call-arptables" = 0;
|
|
"net.bridge.bridge-nf-call-ip6tables" = 0;
|
|
"net.bridge.bridge-nf-call-iptables" = 0;
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
wait-online = {
|
|
enable = false;
|
|
anyInterface = true;
|
|
};
|
|
netdevs = {
|
|
"20-br-nix-builder" = {
|
|
netdevConfig = {
|
|
Kind = "bridge";
|
|
Name = "br-nix-builder";
|
|
};
|
|
};
|
|
"30-internet-vlan" = {
|
|
netdevConfig = {
|
|
Kind = "vlan";
|
|
Name = "internet-vlan";
|
|
};
|
|
vlanConfig.Id = 100;
|
|
};
|
|
};
|
|
networks = {
|
|
# Unused second port of the onboard i350; keep it down so the dead
|
|
# PCIe link (see dmesg "PCIe link lost") stops logging Tx errors.
|
|
"01-unused-igb-port" = {
|
|
matchConfig.Name = "enp97s0f0";
|
|
linkConfig.ActivationPolicy = "always-down";
|
|
};
|
|
# Aquantia 10G card (0000:21:00.0); loses PCIe link, and its
|
|
# unicast RX path is dead while TX still works, so when it's up it
|
|
# answers ARP for the host IPs and black-holes the replies. Keep
|
|
# it down until the card is fixed or replaced.
|
|
"01-unused-atlantic-port" = {
|
|
matchConfig.Name = "enp33s0";
|
|
linkConfig.ActivationPolicy = "always-down";
|
|
};
|
|
"10-Primary" = {
|
|
matchConfig.Name = "enp97s0f1";
|
|
address = [ "192.168.99.14/24" ];
|
|
dns = [
|
|
"192.168.99.1"
|
|
"2600:4040:abfb:d700::1"
|
|
];
|
|
routes = [ { Gateway = "192.168.99.1"; } ];
|
|
vlan = [ "internet-vlan" ];
|
|
dhcpV4Config.UseDNS = false;
|
|
dhcpV6Config.UseDNS = false;
|
|
ipv6AcceptRAConfig.UseDNS = false;
|
|
linkConfig.RequiredForOnline = "routable";
|
|
};
|
|
"50-internet-vlan" = {
|
|
matchConfig.Name = "internet-vlan";
|
|
bridge = [ "br-nix-builder" ];
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
"60-br-nix-builder" = {
|
|
matchConfig.Name = "br-nix-builder";
|
|
bridgeConfig = { };
|
|
networkConfig = {
|
|
IPv6AcceptRA = false;
|
|
LinkLocalAddressing = "no";
|
|
};
|
|
linkConfig.RequiredForOnline = "no";
|
|
};
|
|
};
|
|
};
|
|
}
|