router: enable xfce desktop for debugging

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752062782,
-        "narHash": "sha256-Dod77HcIByOyfGLEJOgRxg2Fmk2Y5lVgMEcN/xVEt/8=",
+        "lastModified": 1749178927,
+        "narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bec8ff39811568eb7c8c8d1e2a1a476326748f51",
+        "rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751903740,
-        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
+        "lastModified": 1747663185,
+        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
+        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751984180,
-        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
+        "lastModified": 1748929857,
+        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
+        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
         "type": "github"
       },
       "original": {

flake.nix

@@ -37,19 +37,6 @@
       # Optionally, use home-manager.extraSpecialArgs to pass
       # arguments to home.nix
     };
-
-    mkRouter = hostFile: nixpkgs.lib.nixosSystem {
-      system = "x86_64-linux";
-      modules = [
-        secrix.nixosModules.default
-        ./modules
-        ./modules/router
-        ./hosts/common.nix
-        hostFile
-        ./users/cazzzer
-        (hmModule ./home/common.nix)
-      ];
-    };
   in
   {
     apps.x86_64-linux.secrix = secrix.secrix self;
@@ -90,9 +77,17 @@
           (hmModule ./home/cazzzer-pc.nix)
         ];
       };
-      router = mkRouter ./hosts/router;
-      router-1 = mkRouter ./hosts/router-1;
-      router-2 = mkRouter ./hosts/router-2;
+      router = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          secrix.nixosModules.default
+          ./modules
+          ./hosts/common.nix
+          ./hosts/router
+          ./users/cazzzer
+          (hmModule ./home/common.nix)
+        ];
+      };
     };
     # https://github.com/nix-community/nixos-generators?tab=readme-ov-file#using-in-a-flake
     packages.x86_64-linux = {

hosts/Yura-PC/hardware-configuration.nix

@@ -18,11 +18,6 @@
       fsType = "zfs";
     };
 
-  fileSystems."/nix" =
-    { device = "zroot/data/nix";
-      fsType = "zfs";
-    };
-
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/970C-6A15";
       fsType = "vfat";

hosts/common-desktop.nix

@@ -7,7 +7,7 @@
     "sysrq_always_enabled=1"
   ];
 
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_15;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
   boot.loader = {
     efi.canTouchEfiVariables = true;
     timeout = 3;
@@ -24,9 +24,6 @@
 
   # Enable networking
   networking.networkmanager.enable = true;
-  networking.networkmanager.plugins = [
-    pkgs.networkmanager-openvpn
-  ];
 
   # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
@@ -110,7 +107,6 @@
     jq
     ldns
     mediainfo
-    powertop
     rbw
     restic
     resticprofile

hosts/router-1/default.nix

@@ -1,24 +0,0 @@
-{
-  imports = [
-    ../hw-vm.nix
-  ];
-
-  router = {
-    enableDesktop = false;
-    enableDhcpClient = false;
-    wanMAC = "bc:24:11:af:bd:84";
-    lanMAC = "bc:24:11:38:b1:91";
-    wanLL = "fe80::be24:11ff:feaf:bd84";
-    lanLL = "fe80::be24:11ff:fe38:b191";
-    defaultToken = 251;
-
-    pdFromWan = "fd46:fbbe:ca55:100";
-    wanAddr4 = "192.168.1.63";
-    wanGw4 = "192.168.1.254";
-  };
-
-  networking.hostName = "grouty";
-
-  # override hw-vm.nix default
-  networking.useDHCP = false;
-}

hosts/router-2/default.nix

@@ -1,24 +0,0 @@
-{
-  imports = [
-    ../hw-vm.nix
-  ];
-
-  router = {
-    enableDesktop = false;
-    enableDhcpClient = false;
-    wanMAC = "bc:24:11:bc:db:c1";
-    lanMAC = "bc:24:11:19:2a:96";
-    wanLL = "fe80::be24:11ff:febc:dbc1";
-    lanLL = "fe80::be24:11ff:fe19:2a96";
-    defaultToken = 252;
-
-    pdFromWan = "fd46:fbbe:ca55:100";
-    wanAddr4 = "192.168.1.64";
-    wanGw4 = "192.168.1.254";
-  };
-
-  networking.hostName = "grouta";
-
-  # override hw-vm.nix default
-  networking.useDHCP = false;
-}

hosts/router/default.nix

@@ -1,18 +1,93 @@
+{ config, lib, pkgs, ... }:
+let
+  vars = import ./vars.nix;
+  enableDesktop = true;
+in
 {
-  imports = [
-    ./hardware-configuration.nix
-    ./private.nix
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./ifconfig.nix
+      ./wireguard.nix
+      ./firewall.nix
+      ./dns.nix
+      ./kea.nix
+      ./glance.nix
+      ./services.nix
+    ];
+  # Secrix for secrets management
+  secrix.hostPubKey = vars.pubkey;
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.kernelParams = [
+    "sysrq_always_enabled=1"
   ];
 
-  router = {
-    enableDesktop = false;
-    enableDhcpClient = true;
-    wanMAC = "bc:24:11:4f:c9:c4";
-    lanMAC = "bc:24:11:83:d8:de";
-    wanLL = "fe80::be24:11ff:fe4f:c9c4";
-    lanLL = "fe80::be24:11ff:fe83:d8de";
-    defaultToken = 1;
-  };
+  boot.loader.timeout = 2;
+  boot.loader.systemd-boot.configurationLimit = 5;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+  boot.growPartition = true;
 
   networking.hostName = "grouter";
+
+  # Enable the X11 windowing system.
+  # You can disable this if you're only using the Wayland session.
+  services.xserver.enable = false;
+
+  # Enable the KDE Plasma Desktop Environment.
+  # Useful for debugging with wireshark.
+  hardware.graphics.enable = true;
+  services.xserver.desktopManager.xfce.enable = enableDesktop;
+  services.xserver.desktopManager.xfce.enableWaylandSession = enableDesktop;
+  # services.displayManager.sddm.enable = enableDesktop;
+  # services.displayManager.sddm.wayland.enable = enableDesktop;
+  # services.desktopManager.plasma6.enable = enableDesktop;
+  # No need for audio in VM
+  services.pipewire.enable = false;
+
+  # VM services
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  security.sudo.wheelNeedsPassword = false;
+
+  programs.firefox.enable = true;
+  programs.fish.enable = true;
+  programs.git.enable = true;
+  programs.neovim.enable = true;
+  programs.bat.enable = true;
+  programs.htop.enable = true;
+  programs.wireshark.enable = true;
+  programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
+
+  environment.systemPackages = with pkgs; [
+    dust
+    eza
+    fastfetch
+    fd
+    kdePackages.kate
+    ldns
+    lsof
+    micro
+    mpv
+    openssl
+    ripgrep
+    rustscan
+    starship
+    tealdeer
+    transcrypt
+    waypipe
+    whois
+    wireguard-tools
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.11"; # Did you read the comment?
 }

hosts/router/dns.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   domain = vars.domain;
   ldomain = vars.ldomain;
   sysdomain = vars.sysdomain;
@@ -80,14 +80,11 @@ in
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
-      "|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
-
       # Lab DNS rewrites
       "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
-      "@@||stats.grafana.org"
     ]
       # Alpina DNS rewrites
       ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;

hosts/router/firewall.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   links = vars.links;
   ifs = vars.ifs;
   pdFromWan = vars.pdFromWan;

hosts/router/glance.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   domain = vars.domain;
 in
 {

hosts/router/ifconfig.nix

@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  cfg = config.router;
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   links = vars.links;
   ifs = vars.ifs;
   pdFromWan = vars.pdFromWan;
@@ -58,7 +57,7 @@ in
   # https://github.com/systemd/systemd/issues/22571
   # https://github.com/systemd/systemd/issues/22571#issuecomment-2094905496
   # https://gist.github.com/csamsel/0f8cca3b2e64d7e4cc47819ec5ba9396
-  networking.dhcpcd.enable = cfg.enableDhcpClient;
+  networking.dhcpcd.enable = true;
   networking.dhcpcd.allowInterfaces = [ ifs.wan.name ];
   networking.dhcpcd.extraConfig = ''
     debug

hosts/router/kea.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   ldomain = vars.ldomain;
   ifs = vars.ifs;
 

hosts/router/private.nix

@@ -1,3 +1,3 @@
-U2FsdGVkX1+eMFkQxarJDGLkX0zXyMRPukeRNvzd/BJ0XDAUZ2EeZvQnZw8U53Xz
-W97X4rvT+K/NQ7FVCYfOg1XpQhzlSiC9z1M4WLmPRutUgsDY5n5RFJu2R8K5DAfi
-sAPcxiQUGVKrmDUva16yNqoR2Dkx2XE9iW1hpkfGFYVUK+QKIBkUEowQQlJJ1Wg1
+U2FsdGVkX1/MGwxIMmhbZuPqJUZzex9v5tTuiOrEvDVldI7xY0edUy9Ii5udFLXt
+AbxShsH43FH1ucgygKDlKTB/yXZWDoDVhjdgLFjaBtAt0xyAL9Doet844oDVhbbO
+FqOwXHMd+PE23rgqiCscsA==

hosts/router/services.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   domain = vars.domain;
 in
 {
@@ -58,36 +58,27 @@ in
     enable = true;
     package = pkgs.caddy.withPlugins {
       plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-2D7dnG50CwtCho+U+iHmSj2w14zllQXPjmTHr6lJZ/A=";
+      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
     };
-    virtualHosts."*.${domain}".extraConfig = ''
+    virtualHosts."grouter.${domain}".extraConfig = ''
       encode
       tls {
           dns cloudflare {env.CF_API_KEY}
           resolvers 1.1.1.1
       }
-
-      @grouter host grouter.${domain}
-      handle @grouter {
-          @grafana path /grafana /grafana/*
-          handle @grafana {
-              reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
-          }
-          redir /adghome /adghome/
-          handle_path /adghome/* {
-              reverse_proxy localhost:${toString config.services.adguardhome.port}
-              basic_auth {
-                  Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
-              }
-          }
-          handle /* {
-              reverse_proxy localhost:${toString config.services.glance.settings.server.port}
+      @grafana path /grafana /grafana/*
+      handle @grafana {
+          reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
+      }
+      redir /adghome /adghome/
+      handle_path /adghome/* {
+          reverse_proxy localhost:${toString config.services.adguardhome.port}
+          basic_auth {
+              Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
           }
       }
-
-      @hass host hass.${domain}
-      handle @hass {
-          reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
+      handle /* {
+          reverse_proxy localhost:${toString config.services.glance.settings.server.port}
       }
     '';
   };

hosts/router/vars.nix

@@ -1,6 +1,6 @@
-config:
 let
-  cfg = config.router;
+  private = import ./private.nix;
+
   mkIfConfig = {
     name_,
     domain_,
@@ -10,7 +10,7 @@ let
     p6Size_ ? 64,
     ulaPrefix_,  # /64
     ulaSize_ ? 64,
-    token? cfg.defaultToken,
+    token? 1,
     ip6Token_? "::${toString token}",
     ulaToken_? "::${toString token}",
     }: rec {
@@ -41,21 +41,21 @@ rec {
   ldomain = "l.${domain}";
   sysdomain = "sys.${domain}";
   links = {
-    wanMAC = cfg.wanMAC;
-    lanMAC = cfg.lanMAC;
-    wanLL = cfg.wanLL;
-    lanLL = cfg.lanLL;
+    wanMAC = "bc:24:11:4f:c9:c4";
+    lanMAC = "bc:24:11:83:d8:de";
+    wanLL = "fe80::be24:11ff:fe4f:c9c4";
+    lanLL = "fe80::be24:11ff:fe83:d8de";
   };
 
   p4 = "10.17";                      # .0.0/16
-  pdFromWan = cfg.pdFromWan;         # ::/60
+  pdFromWan = private.pdFromWan;  # ::/60
   ulaPrefix = "fdab:07d3:581d";      # ::/48
   ifs = rec {
     wan = rec {
       name = "wan";
-      addr4 = cfg.wanAddr4;
-      addr4Sized = "${addr4}/24";
-      gw4 = cfg.wanGw4;
+      addr4 = private.wanAddr4;
+      addr4Sized = "${addr4}/23";
+      gw4 = private.wanGw4;
     };
     lan = mkIfConfig {
       name_ = "lan";
@@ -77,7 +77,7 @@ rec {
       p4_ = "${p4}.20";                  # .0/24
       p6_ = "${pdFromWan}0";             # ::/64 managed by Att box
       ulaPrefix_ = "${ulaPrefix}:0020";  # ::/64
-      ip6Token_ = "::1:${toString cfg.defaultToken}";  # override ipv6 for lan20, since the Att box uses ::1 here
+      ip6Token_ = "::1:1";  # override ipv6 for lan20, since the Att box uses ::1 here
     };
     lan30 = mkIfConfig {
       name_ = "${lan.name}.30";

hosts/router/wireguard.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix config;
+  vars = import ./vars.nix;
   wg0 = vars.ifs.wg0;
 
   peerIps = ifObj: token: [

modules/router/default.nix

@@ -1,92 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  vars = import ./vars.nix config;
-  enableDesktop = config.router.enableDesktop;
-in
-{
-  imports =
-    [ # Include the results of the hardware scan.
-      ./opts.nix
-      ./ifconfig.nix
-      ./wireguard.nix
-      ./firewall.nix
-      ./dns.nix
-      ./kea.nix
-      ./glance.nix
-      ./services.nix
-    ];
-  # Secrix for secrets management
-  secrix.hostPubKey = vars.pubkey;
-
-  # Bootloader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = false;
-  boot.kernelParams = [
-    "sysrq_always_enabled=1"
-  ];
-
-  boot.loader.timeout = 2;
-  boot.loader.systemd-boot.configurationLimit = 5;
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
-  boot.growPartition = true;
-
-  # Enable the X11 windowing system.
-  # You can disable this if you're only using the Wayland session.
-  services.xserver.enable = false;
-
-  # Enable the KDE Plasma Desktop Environment.
-  # Useful for debugging with wireshark.
-  hardware.graphics.enable = true;
-  services.xserver.desktopManager.xfce.enable = enableDesktop;
-  services.xserver.desktopManager.xfce.enableWaylandSession = enableDesktop;
-  # services.displayManager.sddm.enable = enableDesktop;
-  # services.displayManager.sddm.wayland.enable = enableDesktop;
-  # services.desktopManager.plasma6.enable = enableDesktop;
-  # No need for audio in VM
-  services.pipewire.enable = false;
-
-  # VM services
-  services.qemuGuest.enable = true;
-  services.spice-vdagentd.enable = true;
-
-  security.sudo.wheelNeedsPassword = false;
-
-  programs.firefox.enable = true;
-  programs.fish.enable = true;
-  programs.git.enable = true;
-  programs.neovim.enable = true;
-  programs.bat.enable = true;
-  programs.htop.enable = true;
-  programs.wireshark.enable = true;
-  programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
-
-  environment.systemPackages = with pkgs; [
-    dust
-    eza
-    fastfetch
-    fd
-    kdePackages.kate
-    ldns
-    lsof
-    micro
-    mpv
-    openssl
-    ripgrep
-    rustscan
-    starship
-    tealdeer
-    transcrypt
-    wakeonlan
-    waypipe
-    whois
-    wireguard-tools
-  ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.11"; # Did you read the comment?
-}

modules/router/opts.nix

@@ -1,69 +0,0 @@
-{ lib, config, ... }:
-
-with lib;
-
-{
-  options = {
-    router = {
-      enableDesktop = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Enable desktop environment for debugging";
-      };
-
-      enableDhcpClient = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Enable DHCP client (should only be set on the main router)";
-      };
-
-      wanMAC = mkOption {
-        type = types.str;
-        example = "bc:24:11:4f:c9:c4";
-        description = "WAN interface MAC address";
-      };
-
-      lanMAC = mkOption {
-        type = types.str;
-        example = "bc:24:11:83:d8:de";
-        description = "LAN interface MAC address";
-      };
-
-      wanLL = mkOption {
-          type = types.str;
-          example = "fe80::be24:11ff:fe4f:c9c4";
-          description = "WAN IPv6 link-local address";
-      };
-
-      lanLL = mkOption {
-          type = types.str;
-          example = "fe80::be24:11ff:fe83:d8de";
-          description = "LAN IPv6 link-local address";
-      };
-
-      defaultToken = mkOption {
-        type = types.int;
-        default = 1;
-        description = "Default token for interface addressing";
-      };
-
-      wanAddr4 = mkOption {
-        type = types.str;
-        example = "192.168.1.61";
-        description = "WAN IPv4 address";
-      };
-
-      wanGw4 = mkOption {
-        type = types.str;
-        example = "192.168.1.254";
-        description = "WAN IPv4 gateway";
-      };
-
-      pdFromWan = mkOption {
-        type = types.str;
-        example = "2001:db8:0:000";
-        description = "IPv6 prefix delegation from ISP (/60)";
-      };
-    };
-  };
-}

users/cazzzer/default.nix

@@ -5,7 +5,7 @@
     isNormalUser = true;
     description = "Yura";
     group = "cazzzer";
-    extraGroups = [ "wheel" "dialout" ]
+    extraGroups = [ "wheel" ]
       ++ lib.optionals config.networking.networkmanager.enable [ "networkmanager" ]
       ++ lib.optionals config.virtualisation.docker.enable [ "docker" ]
       ++ lib.optionals config.programs.wireshark.enable [ "wireshark" ]