pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 dhcpcd = if !config.boot.isContainer then pkgs.dhcpcd else pkgs.dhcpcd.override { udev = null; };
8
9 cfg = config.networking.dhcpcd;
10
11 interfaces = attrValues config.networking.interfaces;
12
13 enableDHCP = config.networking.dhcpcd.enable &&
14 (config.networking.useDHCP || any (i: i.useDHCP == true) interfaces);
15
16 # Don't start dhcpcd on explicitly configured interfaces or on
17 # interfaces that are part of a bridge, bond or sit device.
18 ignoredInterfaces =
19 map (i: i.name) (filter (i: if i.useDHCP != null then !i.useDHCP else i.ipv4.addresses != [ ]) interfaces)
20 ++ mapAttrsToList (i: _: i) config.networking.sits
21 ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.bridges))
22 ++ flatten (concatMap (i: attrNames (filterAttrs (_: config: config.type != "internal") i.interfaces)) (attrValues config.networking.vswitches))
23 ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.bonds))
24 ++ config.networking.dhcpcd.denyInterfaces;
25
26 arrayAppendOrNull = a1: a2: if a1 == null && a2 == null then null
27 else if a1 == null then a2 else if a2 == null then a1
28 else a1 ++ a2;
29
30 # If dhcp is disabled but explicit interfaces are enabled,
31 # we need to provide dhcp just for those interfaces.
32 allowInterfaces = arrayAppendOrNull cfg.allowInterfaces
33 (if !config.networking.useDHCP && enableDHCP then
34 map (i: i.name) (filter (i: i.useDHCP == true) interfaces) else null);
35
36 staticIPv6Addresses = map (i: i.name) (filter (i: i.ipv6.addresses != [ ]) interfaces);
37
38 noIPv6rs = concatStringsSep "\n" (map (name: ''
39 interface ${name}
40 noipv6rs
41 '') staticIPv6Addresses);
42
43 # Config file adapted from the one that ships with dhcpcd.
44 dhcpcdConf = pkgs.writeText "dhcpcd.conf"
45 ''
46 # Inform the DHCP server of our hostname for DDNS.
47 hostname
48
49 # A list of options to request from the DHCP server.
50 option domain_name_servers, domain_name, domain_search, host_name
51 option classless_static_routes, ntp_servers, interface_mtu
52
53 # A ServerID is required by RFC2131.
54 # Commented out because of many non-compliant DHCP servers in the wild :(
55 #require dhcp_server_identifier
56
57 # A hook script is provided to lookup the hostname if not set by
58 # the DHCP server, but it should not be run by default.
59 nohook lookup-hostname
60
61 # Ignore peth* devices; on Xen, they're renamed physical
62 # Ethernet cards used for bridging. Likewise for vif* and tap*
63 # (Xen) and virbr* and vnet* (libvirt).
64 denyinterfaces ${toString ignoredInterfaces} lo peth* vif* tap* tun* virbr* vnet* vboxnet* sit*
65
66 # Use the list of allowed interfaces if specified
67 ${optionalString (allowInterfaces != null) "allowinterfaces ${toString allowInterfaces}"}
68
69 # Immediately fork to background if specified, otherwise wait for IP address to be assigned
70 ${{
71 background = "background";
72 any = "waitip";
73 ipv4 = "waitip 4";
74 ipv6 = "waitip 6";
75 both = "waitip 4\nwaitip 6";
76 if-carrier-up = "";
77 }.${cfg.wait}}
78
79 ${optionalString (config.networking.enableIPv6 == false) ''
80 # Don't solicit or accept IPv6 Router Advertisements and DHCPv6 if disabled IPv6
81 noipv6
82 ''}
83
84 ${optionalString (config.networking.enableIPv6 && cfg.IPv6rs == null && staticIPv6Addresses != [ ]) noIPv6rs}
85 ${optionalString (config.networking.enableIPv6 && cfg.IPv6rs == false) ''
86 noipv6rs
87 ''}
88
89 ${cfg.extraConfig}
90 '';
91
92 exitHook = pkgs.writeText "dhcpcd.exit-hook"
93 ''
94 if [ "$reason" = BOUND -o "$reason" = REBOOT ]; then
95 # Restart ntpd. We need to restart it to make sure that it
96 # will actually do something: if ntpd cannot resolve the
97 # server hostnames in its config file, then it will never do
98 # anything ever again ("couldn't resolve ..., giving up on
99 # it"), so we silently lose time synchronisation. This also
100 # applies to openntpd.
101 /run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
102 fi
103
104 ${cfg.runHook}
105 '';
106
107in
108
109{
110
111 ###### interface
112
113 options = {
114
115 networking.dhcpcd.enable = mkOption {
116 type = types.bool;
117 default = true;
118 description = lib.mdDoc ''
119 Whether to enable dhcpcd for device configuration. This is mainly to
120 explicitly disable dhcpcd (for example when using networkd).
121 '';
122 };
123
124 networking.dhcpcd.persistent = mkOption {
125 type = types.bool;
126 default = false;
127 description = lib.mdDoc ''
128 Whenever to leave interfaces configured on dhcpcd daemon
129 shutdown. Set to true if you have your root or store mounted
130 over the network or this machine accepts SSH connections
131 through DHCP interfaces and clients should be notified when
132 it shuts down.
133 '';
134 };
135
136 networking.dhcpcd.denyInterfaces = mkOption {
137 type = types.listOf types.str;
138 default = [];
139 description = lib.mdDoc ''
140 Disable the DHCP client for any interface whose name matches
141 any of the shell glob patterns in this list. The purpose of
142 this option is to blacklist virtual interfaces such as those
143 created by Xen, libvirt, LXC, etc.
144 '';
145 };
146
147 networking.dhcpcd.allowInterfaces = mkOption {
148 type = types.nullOr (types.listOf types.str);
149 default = null;
150 description = lib.mdDoc ''
151 Enable the DHCP client for any interface whose name matches
152 any of the shell glob patterns in this list. Any interface not
153 explicitly matched by this pattern will be denied. This pattern only
154 applies when non-null.
155 '';
156 };
157
158 networking.dhcpcd.extraConfig = mkOption {
159 type = types.lines;
160 default = "";
161 description = lib.mdDoc ''
162 Literal string to append to the config file generated for dhcpcd.
163 '';
164 };
165
166 networking.dhcpcd.IPv6rs = mkOption {
167 type = types.nullOr types.bool;
168 default = null;
169 description = lib.mdDoc ''
170 Force enable or disable solicitation and receipt of IPv6 Router Advertisements.
171 This is required, for example, when using a static unique local IPv6 address (ULA)
172 and global IPv6 address auto-configuration with SLAAC.
173 '';
174 };
175
176 networking.dhcpcd.runHook = mkOption {
177 type = types.lines;
178 default = "";
179 example = "if [[ $reason =~ BOUND ]]; then echo $interface: Routers are $new_routers - were $old_routers; fi";
180 description = lib.mdDoc ''
181 Shell code that will be run after all other hooks. See
182 `man dhcpcd-run-hooks` for details on what is possible.
183 '';
184 };
185
186 networking.dhcpcd.wait = mkOption {
187 type = types.enum [ "background" "any" "ipv4" "ipv6" "both" "if-carrier-up" ];
188 default = "any";
189 description = lib.mdDoc ''
190 This option specifies when the dhcpcd service will fork to background.
191 If set to "background", dhcpcd will fork to background immediately.
192 If set to "ipv4" or "ipv6", dhcpcd will wait for the corresponding IP
193 address to be assigned. If set to "any", dhcpcd will wait for any type
194 (IPv4 or IPv6) to be assigned. If set to "both", dhcpcd will wait for
195 both an IPv4 and an IPv6 address before forking.
196 The option "if-carrier-up" is equivalent to "any" if either ethernet
197 is plugged nor WiFi is powered, and to "background" otherwise.
198 '';
199 };
200
201 };
202
203
204 ###### implementation
205
206 config = mkIf enableDHCP {
207
208 assertions = [ {
209 # dhcpcd doesn't start properly with malloc ∉ [ libc scudo ]
210 # see https://github.com/NixOS/nixpkgs/issues/151696
211 assertion =
212 dhcpcd.enablePrivSep
213 -> elem config.environment.memoryAllocator.provider [ "libc" "scudo" ];
214 message = ''
215 dhcpcd with privilege separation is incompatible with chosen system malloc.
216 Currently only the `libc` and `scudo` allocators are known to work.
217 To disable dhcpcd's privilege separation, overlay Nixpkgs and override dhcpcd
218 to set `enablePrivSep = false`.
219 '';
220 } ];
221
222 systemd.services.dhcpcd = let
223 cfgN = config.networking;
224 hasDefaultGatewaySet = (cfgN.defaultGateway != null && cfgN.defaultGateway.address != "")
225 && (!cfgN.enableIPv6 || (cfgN.defaultGateway6 != null && cfgN.defaultGateway6.address != ""));
226 in
227 { description = "DHCP Client";
228
229 wantedBy = [ "multi-user.target" ] ++ optional (!hasDefaultGatewaySet) "network-online.target";
230 wants = [ "network.target" ];
231 before = [ "network-online.target" ];
232
233 restartTriggers = [ exitHook ];
234
235 # Stopping dhcpcd during a reconfiguration is undesirable
236 # because it brings down the network interfaces configured by
237 # dhcpcd. So do a "systemctl restart" instead.
238 stopIfChanged = false;
239
240 path = [ dhcpcd pkgs.nettools config.networking.resolvconf.package ];
241
242 unitConfig.ConditionCapability = "CAP_NET_ADMIN";
243
244 serviceConfig =
245 { Type = "forking";
246 PIDFile = "/run/dhcpcd/pid";
247 RuntimeDirectory = "dhcpcd";
248 ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd --quiet ${optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
249 ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
250 Restart = "always";
251 };
252 };
253
254 users.users.dhcpcd = {
255 isSystemUser = true;
256 group = "dhcpcd";
257 };
258 users.groups.dhcpcd = {};
259
260 environment.systemPackages = [ dhcpcd ];
261
262 environment.etc."dhcpcd.exit-hook".source = exitHook;
263
264 powerManagement.resumeCommands = mkIf config.systemd.services.dhcpcd.enable
265 ''
266 # Tell dhcpcd to rebind its interfaces if it's running.
267 /run/current-system/systemd/bin/systemctl reload dhcpcd.service
268 '';
269
270 };
271
272}