pyrox.dev
1# /etc files related to networking, such as /etc/services.
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7let
8
9 cfg = config.networking;
10 dnsmasqResolve = config.services.dnsmasq.enable &&
11 config.services.dnsmasq.resolveLocalQueries;
12 hasLocalResolver = config.services.bind.enable || dnsmasqResolve;
13
14 resolvconfOptions = cfg.resolvconfOptions
15 ++ optional cfg.dnsSingleRequest "single-request"
16 ++ optional cfg.dnsExtensionMechanism "edns0";
17in
18
19{
20
21 options = {
22
23 networking.hosts = lib.mkOption {
24 type = types.attrsOf ( types.listOf types.str );
25 default = {};
26 example = literalExample ''
27 {
28 "127.0.0.1" = [ "foo.bar.baz" ];
29 "192.168.0.2" = [ "fileserver.local" "nameserver.local" ];
30 };
31 '';
32 description = ''
33 Locally defined maps of hostnames to IP addresses.
34 '';
35 };
36
37 networking.extraHosts = lib.mkOption {
38 type = types.lines;
39 default = "";
40 example = "192.168.0.1 lanlocalhost";
41 description = ''
42 Additional verbatim entries to be appended to <filename>/etc/hosts</filename>.
43 '';
44 };
45
46 networking.hostConf = lib.mkOption {
47 type = types.lines;
48 default = "multi on";
49 example = ''
50 multi on
51 reorder on
52 trim lan
53 '';
54 description = ''
55 The contents of <filename>/etc/host.conf</filename>. See also <citerefentry><refentrytitle>host.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
56 '';
57 };
58
59 networking.dnsSingleRequest = lib.mkOption {
60 type = types.bool;
61 default = false;
62 description = ''
63 Recent versions of glibc will issue both ipv4 (A) and ipv6 (AAAA)
64 address queries at the same time, from the same port. Sometimes upstream
65 routers will systemically drop the ipv4 queries. The symptom of this problem is
66 that 'getent hosts example.com' only returns ipv6 (or perhaps only ipv4) addresses. The
67 workaround for this is to specify the option 'single-request' in
68 /etc/resolv.conf. This option enables that.
69 '';
70 };
71
72 networking.dnsExtensionMechanism = lib.mkOption {
73 type = types.bool;
74 default = true;
75 description = ''
76 Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With
77 that option set, <code>glibc</code> supports use of the extension mechanisms for
78 DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
79 which does not work without it.
80 '';
81 };
82
83 networking.extraResolvconfConf = lib.mkOption {
84 type = types.lines;
85 default = "";
86 example = "libc=NO";
87 description = ''
88 Extra configuration to append to <filename>resolvconf.conf</filename>.
89 '';
90 };
91
92 networking.resolvconfOptions = lib.mkOption {
93 type = types.listOf types.str;
94 default = [];
95 example = [ "ndots:1" "rotate" ];
96 description = ''
97 Set the options in <filename>/etc/resolv.conf</filename>.
98 '';
99 };
100
101 networking.timeServers = mkOption {
102 default = [
103 "0.nixos.pool.ntp.org"
104 "1.nixos.pool.ntp.org"
105 "2.nixos.pool.ntp.org"
106 "3.nixos.pool.ntp.org"
107 ];
108 description = ''
109 The set of NTP servers from which to synchronise.
110 '';
111 };
112
113 networking.proxy = {
114
115 default = lib.mkOption {
116 type = types.nullOr types.str;
117 default = null;
118 description = ''
119 This option specifies the default value for httpProxy, httpsProxy, ftpProxy and rsyncProxy.
120 '';
121 example = "http://127.0.0.1:3128";
122 };
123
124 httpProxy = lib.mkOption {
125 type = types.nullOr types.str;
126 default = cfg.proxy.default;
127 description = ''
128 This option specifies the http_proxy environment variable.
129 '';
130 example = "http://127.0.0.1:3128";
131 };
132
133 httpsProxy = lib.mkOption {
134 type = types.nullOr types.str;
135 default = cfg.proxy.default;
136 description = ''
137 This option specifies the https_proxy environment variable.
138 '';
139 example = "http://127.0.0.1:3128";
140 };
141
142 ftpProxy = lib.mkOption {
143 type = types.nullOr types.str;
144 default = cfg.proxy.default;
145 description = ''
146 This option specifies the ftp_proxy environment variable.
147 '';
148 example = "http://127.0.0.1:3128";
149 };
150
151 rsyncProxy = lib.mkOption {
152 type = types.nullOr types.str;
153 default = cfg.proxy.default;
154 description = ''
155 This option specifies the rsync_proxy environment variable.
156 '';
157 example = "http://127.0.0.1:3128";
158 };
159
160 allProxy = lib.mkOption {
161 type = types.nullOr types.str;
162 default = cfg.proxy.default;
163 description = ''
164 This option specifies the all_proxy environment variable.
165 '';
166 example = "http://127.0.0.1:3128";
167 };
168
169 noProxy = lib.mkOption {
170 type = types.nullOr types.str;
171 default = null;
172 description = ''
173 This option specifies the no_proxy environment variable.
174 If a default proxy is used and noProxy is null,
175 then noProxy will be set to 127.0.0.1,localhost.
176 '';
177 example = "127.0.0.1,localhost,.localdomain";
178 };
179
180 envVars = lib.mkOption {
181 type = types.attrs;
182 internal = true;
183 default = {};
184 description = ''
185 Environment variables used for the network proxy.
186 '';
187 };
188 };
189 };
190
191 config = {
192
193 environment.etc =
194 { # /etc/services: TCP/UDP port assignments.
195 "services".source = pkgs.iana-etc + "/etc/services";
196
197 # /etc/protocols: IP protocol numbers.
198 "protocols".source = pkgs.iana-etc + "/etc/protocols";
199
200 # /etc/rpc: RPC program numbers.
201 "rpc".source = pkgs.glibc.out + "/etc/rpc";
202
203 # /etc/hosts: Hostname-to-IP mappings.
204 "hosts".text =
205 let oneToString = set : ip : ip + " " + concatStringsSep " " ( getAttr ip set );
206 allToString = set : concatMapStringsSep "\n" ( oneToString set ) ( attrNames set );
207 userLocalHosts = optionalString
208 ( builtins.hasAttr "127.0.0.1" cfg.hosts )
209 ( concatStringsSep " " ( remove "localhost" cfg.hosts."127.0.0.1" ));
210 userLocalHosts6 = optionalString
211 ( builtins.hasAttr "::1" cfg.hosts )
212 ( concatStringsSep " " ( remove "localhost" cfg.hosts."::1" ));
213 otherHosts = allToString ( removeAttrs cfg.hosts [ "127.0.0.1" "::1" ]);
214 in
215 ''
216 127.0.0.1 ${userLocalHosts} localhost
217 ${optionalString cfg.enableIPv6 ''
218 ::1 ${userLocalHosts6} localhost
219 ''}
220 ${otherHosts}
221 ${cfg.extraHosts}
222 '';
223
224 # /etc/host.conf: resolver configuration file
225 "host.conf".text = cfg.hostConf;
226
227 # /etc/resolvconf.conf: Configuration for openresolv.
228 "resolvconf.conf".text =
229 ''
230 # This is the default, but we must set it here to prevent
231 # a collision with an apparently unrelated environment
232 # variable with the same name exported by dhcpcd.
233 interface_order='lo lo[0-9]*'
234 '' + optionalString config.services.nscd.enable ''
235 # Invalidate the nscd cache whenever resolv.conf is
236 # regenerated.
237 libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
238 '' + optionalString (length resolvconfOptions > 0) ''
239 # Options as described in resolv.conf(5)
240 resolv_conf_options='${concatStringsSep " " resolvconfOptions}'
241 '' + optionalString hasLocalResolver ''
242 # This hosts runs a full-blown DNS resolver.
243 name_servers='127.0.0.1'
244 '' + optionalString dnsmasqResolve ''
245 dnsmasq_conf=/etc/dnsmasq-conf.conf
246 dnsmasq_resolv=/etc/dnsmasq-resolv.conf
247 '' + cfg.extraResolvconfConf + ''
248 '';
249
250 } // optionalAttrs config.services.resolved.enable {
251 # symlink the static version of resolv.conf as recommended by upstream:
252 # https://www.freedesktop.org/software/systemd/man/systemd-resolved.html#/etc/resolv.conf
253 "resolv.conf".source = "${pkgs.systemd}/lib/systemd/resolv.conf";
254 } // optionalAttrs (config.services.resolved.enable && dnsmasqResolve) {
255 "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
256 };
257
258 networking.proxy.envVars =
259 optionalAttrs (cfg.proxy.default != null) {
260 # other options already fallback to proxy.default
261 no_proxy = "127.0.0.1,localhost";
262 } // optionalAttrs (cfg.proxy.httpProxy != null) {
263 http_proxy = cfg.proxy.httpProxy;
264 } // optionalAttrs (cfg.proxy.httpsProxy != null) {
265 https_proxy = cfg.proxy.httpsProxy;
266 } // optionalAttrs (cfg.proxy.rsyncProxy != null) {
267 rsync_proxy = cfg.proxy.rsyncProxy;
268 } // optionalAttrs (cfg.proxy.ftpProxy != null) {
269 ftp_proxy = cfg.proxy.ftpProxy;
270 } // optionalAttrs (cfg.proxy.allProxy != null) {
271 all_proxy = cfg.proxy.allProxy;
272 } // optionalAttrs (cfg.proxy.noProxy != null) {
273 no_proxy = cfg.proxy.noProxy;
274 };
275
276 # Install the proxy environment variables
277 environment.sessionVariables = cfg.proxy.envVars;
278
279 # This is needed when /etc/resolv.conf is being overriden by networkd
280 # and other configurations. If the file is destroyed by an environment
281 # activation then it must be rebuilt so that applications which interface
282 # with /etc/resolv.conf directly don't break.
283 system.activationScripts.resolvconf = stringAfter [ "etc" "specialfs" "var" ]
284 ''
285 # Systemd resolved controls its own resolv.conf
286 rm -f /run/resolvconf/interfaces/systemd
287 ${optionalString config.services.resolved.enable ''
288 rm -rf /run/resolvconf/interfaces
289 mkdir -p /run/resolvconf/interfaces
290 ln -s /run/systemd/resolve/resolv.conf /run/resolvconf/interfaces/systemd
291 ''}
292
293 # Make sure resolv.conf is up to date if not managed by systemd
294 ${optionalString (!config.services.resolved.enable) ''
295 ${pkgs.openresolv}/bin/resolvconf -u
296 ''}
297 '';
298
299 };
300
301 }