qenya/nixfiles
1
0
Fork 0
Code Issues 4 Pull requests Activity Actions

yevaud/pennykettle: Re-enable, update for 25.05, fix IPv6

Browse source
This commit is contained in:
Katherina Walshe-Grey 2025-06-09 16:22:44 +01:00
parent 909f820af5
commit f11815c2b1
2 changed files with 26 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/yevaud/default.nix
View file

@ -5,8 +5,7 @@
./hardware-configuration.nix ./hardware-configuration.nix
./networking.nix ./networking.nix
# TODO: this breaks external IPv6 somehow ./experiments/pennykettle.nix
# ./experiments/pennykettle.nix
]; ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

39
hosts/yevaud/experiments/pennykettle.nix
View file

@ -2,15 +2,30 @@
{ {
networking.nat.enable = true; networking.nat.enable = true;
networking.nat.enableIPv6 = true;
networking.nat.internalInterfaces = [ "ve-pennykettle1" ]; networking.nat.internalInterfaces = [ "ve-pennykettle1" ];
networking.nat.externalInterface = "ens3"; networking.nat.externalInterface = "ens3";
networking.firewall.allowedUDPPorts = [ 51821 ]; networking.firewall.allowedUDPPorts = [ 51821 ];
# RA = Router Advertisement (how a host finds a gateway IPv6 address for
# SLAAC or DHCPv6).
# networkd usually defaults this to true, but instead defaults it to false
# for ALL networks if ANY network has IPv6Forwarding enabled, on the
# (reasonable) assumption that a host doing IP forwarding is probably a
# network bridge.
# The kernel's RA implementation does this too, and the NixOS networking.nat
# module explicitly overrides that with sysctl, but networkd doesn't pay
# attention to that.
# We thus explicitly enable it, as otherwise external IPv6 is broken.
systemd.network.networks."40-ens3".networkConfig.IPv6AcceptRA = true;
containers."pennykettle1" = { containers."pennykettle1" = {
privateNetwork = true; privateNetwork = true;
extraVeths."ve-pennykettle1" = { extraVeths."ve-pennykettle1" = {
hostAddress = "10.235.1.1"; hostAddress = "10.231.136.1";
localAddress = "10.235.2.1"; localAddress = "10.231.136.2";
hostAddress6 = "fc00::1";
localAddress6 = "fc00::2";
forwardPorts = [{ hostPort = 51821; }]; forwardPorts = [{ hostPort = 51821; }];
}; };
ephemeral = true; ephemeral = true;
@ -30,13 +45,11 @@
networks."10-ve" = { networks."10-ve" = {
matchConfig.Name = "ve-pennykettle1"; matchConfig.Name = "ve-pennykettle1";
networkConfig.Address = "10.235.2.1/32"; networkConfig.Address = [ "10.231.136.2/24" "fc00::2/64" ];
# linkConfig.RequiredForOnline = "routable"; # linkConfig.RequiredForOnline = "routable";
routes = [{ routes = [{
routeConfig = { Gateway = [ "10.231.136.1" "fc00::1" ];
Gateway = "10.235.1.1"; Destination = "217.138.216.162";
Destination = "217.138.216.162/32";
};
}]; }];
}; };
@ -64,12 +77,10 @@
PrivateKeyFile = "/run/secrets/wg-key"; PrivateKeyFile = "/run/secrets/wg-key";
}; };
wireguardPeers = [{ wireguardPeers = [{
wireguardPeerConfig = { PublicKey = "C+u+eQw5yWI2APCfVJwW6Ovj3g4IrTOfe+tMZnNz43s=";
PublicKey = "C+u+eQw5yWI2APCfVJwW6Ovj3g4IrTOfe+tMZnNz43s="; AllowedIPs = "0.0.0.0/0";
AllowedIPs = "0.0.0.0/0"; Endpoint = "217.138.216.162:51820";
Endpoint = "217.138.216.162:51820"; PersistentKeepalive = 5;
PersistentKeepalive = 5;
};
}]; }];
}; };
}; };
@ -82,4 +93,4 @@
group = "systemd-network"; group = "systemd-network";
mode = "640"; mode = "640";
}; };
} }