pyrox.dev
1# /etc files related to networking, such as /etc/services.
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7let
8
9 cfg = config.networking;
10 dnsmasqResolve = config.services.dnsmasq.enable &&
11 config.services.dnsmasq.resolveLocalQueries;
12 hasLocalResolver = config.services.bind.enable || dnsmasqResolve;
13
14 resolvconfOptions = cfg.resolvconfOptions
15 ++ optional cfg.dnsSingleRequest "single-request"
16 ++ optional cfg.dnsExtensionMechanism "ends0";
17in
18
19{
20
21 options = {
22
23 networking.extraHosts = lib.mkOption {
24 type = types.lines;
25 default = "";
26 example = "192.168.0.1 lanlocalhost";
27 description = ''
28 Additional entries to be appended to <filename>/etc/hosts</filename>.
29 '';
30 };
31
32 networking.dnsSingleRequest = lib.mkOption {
33 type = types.bool;
34 default = false;
35 description = ''
36 Recent versions of glibc will issue both ipv4 (A) and ipv6 (AAAA)
37 address queries at the same time, from the same port. Sometimes upstream
38 routers will systemically drop the ipv4 queries. The symptom of this problem is
39 that 'getent hosts example.com' only returns ipv6 (or perhaps only ipv4) addresses. The
40 workaround for this is to specify the option 'single-request' in
41 /etc/resolv.conf. This option enables that.
42 '';
43 };
44
45 networking.dnsExtensionMechanism = lib.mkOption {
46 type = types.bool;
47 default = false;
48 description = ''
49 Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With
50 that option set, <code>glibc</code> supports use of the extension mechanisms for
51 DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
52 which does not work without it.
53 '';
54 };
55
56 networking.extraResolvconfConf = lib.mkOption {
57 type = types.lines;
58 default = "";
59 example = "libc=NO";
60 description = ''
61 Extra configuration to append to <filename>resolvconf.conf</filename>.
62 '';
63 };
64
65 networking.resolvconfOptions = lib.mkOption {
66 type = types.listOf types.str;
67 default = [];
68 example = [ "ndots:1" "rotate" ];
69 description = ''
70 Set the options in <filename>/etc/resolv.conf</filename>.
71 '';
72 };
73
74 networking.proxy = {
75
76 default = lib.mkOption {
77 type = types.nullOr types.str;
78 default = null;
79 description = ''
80 This option specifies the default value for httpProxy, httpsProxy, ftpProxy and rsyncProxy.
81 '';
82 example = "http://127.0.0.1:3128";
83 };
84
85 httpProxy = lib.mkOption {
86 type = types.nullOr types.str;
87 default = cfg.proxy.default;
88 description = ''
89 This option specifies the http_proxy environment variable.
90 '';
91 example = "http://127.0.0.1:3128";
92 };
93
94 httpsProxy = lib.mkOption {
95 type = types.nullOr types.str;
96 default = cfg.proxy.default;
97 description = ''
98 This option specifies the https_proxy environment variable.
99 '';
100 example = "http://127.0.0.1:3128";
101 };
102
103 ftpProxy = lib.mkOption {
104 type = types.nullOr types.str;
105 default = cfg.proxy.default;
106 description = ''
107 This option specifies the ftp_proxy environment variable.
108 '';
109 example = "http://127.0.0.1:3128";
110 };
111
112 rsyncProxy = lib.mkOption {
113 type = types.nullOr types.str;
114 default = cfg.proxy.default;
115 description = ''
116 This option specifies the rsync_proxy environment variable.
117 '';
118 example = "http://127.0.0.1:3128";
119 };
120
121 allProxy = lib.mkOption {
122 type = types.nullOr types.str;
123 default = cfg.proxy.default;
124 description = ''
125 This option specifies the all_proxy environment variable.
126 '';
127 example = "http://127.0.0.1:3128";
128 };
129
130 noProxy = lib.mkOption {
131 type = types.nullOr types.str;
132 default = null;
133 description = ''
134 This option specifies the no_proxy environment variable.
135 If a default proxy is used and noProxy is null,
136 then noProxy will be set to 127.0.0.1,localhost.
137 '';
138 example = "127.0.0.1,localhost,.localdomain";
139 };
140
141 envVars = lib.mkOption {
142 type = types.attrs;
143 internal = true;
144 default = {};
145 description = ''
146 Environment variables used for the network proxy.
147 '';
148 };
149 };
150 };
151
152 config = {
153
154 environment.etc =
155 { # /etc/services: TCP/UDP port assignments.
156 "services".source = pkgs.iana_etc + "/etc/services";
157
158 # /etc/protocols: IP protocol numbers.
159 "protocols".source = pkgs.iana_etc + "/etc/protocols";
160
161 # /etc/rpc: RPC program numbers.
162 "rpc".source = pkgs.glibc.out + "/etc/rpc";
163
164 # /etc/hosts: Hostname-to-IP mappings.
165 "hosts".text =
166 ''
167 127.0.0.1 localhost
168 ${optionalString cfg.enableIPv6 ''
169 ::1 localhost
170 ''}
171 ${cfg.extraHosts}
172 '';
173
174 # /etc/resolvconf.conf: Configuration for openresolv.
175 "resolvconf.conf".text =
176 ''
177 # This is the default, but we must set it here to prevent
178 # a collision with an apparently unrelated environment
179 # variable with the same name exported by dhcpcd.
180 interface_order='lo lo[0-9]*'
181 '' + optionalString config.services.nscd.enable ''
182 # Invalidate the nscd cache whenever resolv.conf is
183 # regenerated.
184 libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
185 '' + optionalString (length resolvconfOptions > 0) ''
186 # Options as described in resolv.conf(5)
187 resolv_conf_options='${concatStringsSep " " resolvconfOptions}'
188 '' + optionalString hasLocalResolver ''
189 # This hosts runs a full-blown DNS resolver.
190 name_servers='127.0.0.1'
191 '' + optionalString dnsmasqResolve ''
192 dnsmasq_conf=/etc/dnsmasq-conf.conf
193 dnsmasq_resolv=/etc/dnsmasq-resolv.conf
194 '' + cfg.extraResolvconfConf + ''
195 '';
196
197 } // (optionalAttrs config.services.resolved.enable (
198 if dnsmasqResolve then {
199 "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
200 } else {
201 "resolv.conf".source = "/run/systemd/resolve/resolv.conf";
202 }
203 ));
204
205 networking.proxy.envVars =
206 optionalAttrs (cfg.proxy.default != null) {
207 # other options already fallback to proxy.default
208 no_proxy = "127.0.0.1,localhost";
209 } // optionalAttrs (cfg.proxy.httpProxy != null) {
210 http_proxy = cfg.proxy.httpProxy;
211 } // optionalAttrs (cfg.proxy.httpsProxy != null) {
212 https_proxy = cfg.proxy.httpsProxy;
213 } // optionalAttrs (cfg.proxy.rsyncProxy != null) {
214 rsync_proxy = cfg.proxy.rsyncProxy;
215 } // optionalAttrs (cfg.proxy.ftpProxy != null) {
216 ftp_proxy = cfg.proxy.ftpProxy;
217 } // optionalAttrs (cfg.proxy.allProxy != null) {
218 all_proxy = cfg.proxy.allProxy;
219 } // optionalAttrs (cfg.proxy.noProxy != null) {
220 no_proxy = cfg.proxy.noProxy;
221 };
222
223 # Install the proxy environment variables
224 environment.sessionVariables = cfg.proxy.envVars;
225
226 # The ‘ip-up’ target is started when we have IP connectivity. So
227 # services that depend on IP connectivity (like ntpd) should be
228 # pulled in by this target.
229 systemd.targets.ip-up.description = "Services Requiring IP Connectivity";
230
231 # This is needed when /etc/resolv.conf is being overriden by networkd
232 # and other configurations. If the file is destroyed by an environment
233 # activation then it must be rebuilt so that applications which interface
234 # with /etc/resolv.conf directly don't break.
235 system.activationScripts.resolvconf = stringAfter [ "etc" "tmpfs" "var" ]
236 ''
237 # Systemd resolved controls its own resolv.conf
238 rm -f /run/resolvconf/interfaces/systemd
239 ${optionalString config.services.resolved.enable ''
240 rm -rf /run/resolvconf/interfaces
241 mkdir -p /run/resolvconf/interfaces
242 ln -s /run/systemd/resolve/resolv.conf /run/resolvconf/interfaces/systemd
243 ''}
244
245 # Make sure resolv.conf is up to date if not managed by systemd
246 ${optionalString (!config.services.resolved.enable) ''
247 ${pkgs.openresolv}/bin/resolvconf -u
248 ''}
249 '';
250
251 };
252
253 }