pyrox.dev
1{ config, options, lib, pkgs, utils, ... }:
2
3with lib;
4with utils;
5
6let
7
8 cfg = config.networking;
9 opt = options.networking;
10 interfaces = attrValues cfg.interfaces;
11 hasVirtuals = any (i: i.virtual) interfaces;
12 hasSits = cfg.sits != { };
13 hasGres = cfg.greTunnels != { };
14 hasBonds = cfg.bonds != { };
15 hasFous = cfg.fooOverUDP != { }
16 || filterAttrs (_: s: s.encapsulation != null) cfg.sits != { };
17
18 slaves = concatMap (i: i.interfaces) (attrValues cfg.bonds)
19 ++ concatMap (i: i.interfaces) (attrValues cfg.bridges)
20 ++ concatMap (i: attrNames (filterAttrs (name: config: ! (config.type == "internal" || hasAttr name cfg.interfaces)) i.interfaces)) (attrValues cfg.vswitches);
21
22 slaveIfs = map (i: cfg.interfaces.${i}) (filter (i: cfg.interfaces ? ${i}) slaves);
23
24 rstpBridges = flip filterAttrs cfg.bridges (_: { rstp, ... }: rstp);
25
26 needsMstpd = rstpBridges != { };
27
28 bridgeStp = optional needsMstpd (pkgs.writeTextFile {
29 name = "bridge-stp";
30 executable = true;
31 destination = "/bin/bridge-stp";
32 text = ''
33 #!${pkgs.runtimeShell} -e
34 export PATH="${pkgs.mstpd}/bin"
35
36 BRIDGES=(${concatStringsSep " " (attrNames rstpBridges)})
37 for BRIDGE in $BRIDGES; do
38 if [ "$BRIDGE" = "$1" ]; then
39 if [ "$2" = "start" ]; then
40 mstpctl addbridge "$BRIDGE"
41 exit 0
42 elif [ "$2" = "stop" ]; then
43 mstpctl delbridge "$BRIDGE"
44 exit 0
45 fi
46 exit 1
47 fi
48 done
49 exit 1
50 '';
51 });
52
53 # We must escape interfaces due to the systemd interpretation
54 subsystemDevice = interface:
55 "sys-subsystem-net-devices-${escapeSystemdPath interface}.device";
56
57 addrOpts = v:
58 assert v == 4 || v == 6;
59 { options = {
60 address = mkOption {
61 type = types.str;
62 description = lib.mdDoc ''
63 IPv${toString v} address of the interface. Leave empty to configure the
64 interface using DHCP.
65 '';
66 };
67
68 prefixLength = mkOption {
69 type = types.addCheck types.int (n: n >= 0 && n <= (if v == 4 then 32 else 128));
70 description = lib.mdDoc ''
71 Subnet mask of the interface, specified as the number of
72 bits in the prefix (`${if v == 4 then "24" else "64"}`).
73 '';
74 };
75 };
76 };
77
78 routeOpts = v:
79 { options = {
80 address = mkOption {
81 type = types.str;
82 description = lib.mdDoc "IPv${toString v} address of the network.";
83 };
84
85 prefixLength = mkOption {
86 type = types.addCheck types.int (n: n >= 0 && n <= (if v == 4 then 32 else 128));
87 description = lib.mdDoc ''
88 Subnet mask of the network, specified as the number of
89 bits in the prefix (`${if v == 4 then "24" else "64"}`).
90 '';
91 };
92
93 type = mkOption {
94 type = types.nullOr (types.enum [
95 "unicast" "local" "broadcast" "multicast"
96 ]);
97 default = null;
98 description = lib.mdDoc ''
99 Type of the route. See the `Route types` section
100 in the `ip-route(8)` manual page for the details.
101
102 Note that `prohibit`, `blackhole`,
103 `unreachable`, and `throw` cannot
104 be configured per device, so they are not available here. Similarly,
105 `nat` hasn't been supported since kernel 2.6.
106 '';
107 };
108
109 via = mkOption {
110 type = types.nullOr types.str;
111 default = null;
112 description = lib.mdDoc "IPv${toString v} address of the next hop.";
113 };
114
115 options = mkOption {
116 type = types.attrsOf types.str;
117 default = { };
118 example = { mtu = "1492"; window = "524288"; };
119 description = lib.mdDoc ''
120 Other route options. See the symbol `OPTIONS`
121 in the `ip-route(8)` manual page for the details.
122 You may also specify `metric`,
123 `src`, `protocol`,
124 `scope`, `from`
125 and `table`, which are technically
126 not route options, in the sense used in the manual.
127 '';
128 };
129
130 };
131 };
132
133 gatewayCoerce = address: { inherit address; };
134
135 gatewayOpts = { ... }: {
136
137 options = {
138
139 address = mkOption {
140 type = types.str;
141 description = lib.mdDoc "The default gateway address.";
142 };
143
144 interface = mkOption {
145 type = types.nullOr types.str;
146 default = null;
147 example = "enp0s3";
148 description = lib.mdDoc "The default gateway interface.";
149 };
150
151 metric = mkOption {
152 type = types.nullOr types.int;
153 default = null;
154 example = 42;
155 description = lib.mdDoc "The default gateway metric/preference.";
156 };
157
158 };
159
160 };
161
162 interfaceOpts = { name, ... }: {
163
164 options = {
165 name = mkOption {
166 example = "eth0";
167 type = types.str;
168 description = lib.mdDoc "Name of the interface.";
169 };
170
171 tempAddress = mkOption {
172 type = types.enum (lib.attrNames tempaddrValues);
173 default = cfg.tempAddresses;
174 defaultText = literalExpression ''config.networking.tempAddresses'';
175 description = lib.mdDoc ''
176 When IPv6 is enabled with SLAAC, this option controls the use of
177 temporary address (aka privacy extensions) on this
178 interface. This is used to reduce tracking.
179
180 See also the global option
181 [](#opt-networking.tempAddresses), which
182 applies to all interfaces where this is not set.
183
184 Possible values are:
185 ${tempaddrDoc}
186 '';
187 };
188
189 useDHCP = mkOption {
190 type = types.nullOr types.bool;
191 default = null;
192 description = lib.mdDoc ''
193 Whether this interface should be configured with dhcp.
194 Null implies the old behavior which depends on whether ip addresses
195 are specified or not.
196 '';
197 };
198
199 ipv4.addresses = mkOption {
200 default = [ ];
201 example = [
202 { address = "10.0.0.1"; prefixLength = 16; }
203 { address = "192.168.1.1"; prefixLength = 24; }
204 ];
205 type = with types; listOf (submodule (addrOpts 4));
206 description = lib.mdDoc ''
207 List of IPv4 addresses that will be statically assigned to the interface.
208 '';
209 };
210
211 ipv6.addresses = mkOption {
212 default = [ ];
213 example = [
214 { address = "fdfd:b3f0:482::1"; prefixLength = 48; }
215 { address = "2001:1470:fffd:2098::e006"; prefixLength = 64; }
216 ];
217 type = with types; listOf (submodule (addrOpts 6));
218 description = lib.mdDoc ''
219 List of IPv6 addresses that will be statically assigned to the interface.
220 '';
221 };
222
223 ipv4.routes = mkOption {
224 default = [];
225 example = [
226 { address = "10.0.0.0"; prefixLength = 16; }
227 { address = "192.168.2.0"; prefixLength = 24; via = "192.168.1.1"; }
228 ];
229 type = with types; listOf (submodule (routeOpts 4));
230 description = lib.mdDoc ''
231 List of extra IPv4 static routes that will be assigned to the interface.
232
233 ::: {.warning}
234 If the route type is the default `unicast`, then the scope
235 is set differently depending on the value of {option}`networking.useNetworkd`:
236 the script-based backend sets it to `link`, while networkd sets
237 it to `global`.
238 :::
239
240 If you want consistency between the two implementations,
241 set the scope of the route manually with
242 `networking.interfaces.eth0.ipv4.routes = [{ options.scope = "global"; }]`
243 for example.
244 '';
245 };
246
247 ipv6.routes = mkOption {
248 default = [];
249 example = [
250 { address = "fdfd:b3f0::"; prefixLength = 48; }
251 { address = "2001:1470:fffd:2098::"; prefixLength = 64; via = "fdfd:b3f0::1"; }
252 ];
253 type = with types; listOf (submodule (routeOpts 6));
254 description = lib.mdDoc ''
255 List of extra IPv6 static routes that will be assigned to the interface.
256 '';
257 };
258
259 macAddress = mkOption {
260 default = null;
261 example = "00:11:22:33:44:55";
262 type = types.nullOr (types.str);
263 description = lib.mdDoc ''
264 MAC address of the interface. Leave empty to use the default.
265 '';
266 };
267
268 mtu = mkOption {
269 default = null;
270 example = 9000;
271 type = types.nullOr types.int;
272 description = lib.mdDoc ''
273 MTU size for packets leaving the interface. Leave empty to use the default.
274 '';
275 };
276
277 virtual = mkOption {
278 default = false;
279 type = types.bool;
280 description = lib.mdDoc ''
281 Whether this interface is virtual and should be created by tunctl.
282 This is mainly useful for creating bridges between a host and a virtual
283 network such as VPN or a virtual machine.
284 '';
285 };
286
287 virtualOwner = mkOption {
288 default = "root";
289 type = types.str;
290 description = lib.mdDoc ''
291 In case of a virtual device, the user who owns it.
292 '';
293 };
294
295 virtualType = mkOption {
296 default = if hasPrefix "tun" name then "tun" else "tap";
297 defaultText = literalExpression ''if hasPrefix "tun" name then "tun" else "tap"'';
298 type = with types; enum [ "tun" "tap" ];
299 description = lib.mdDoc ''
300 The type of interface to create.
301 The default is TUN for an interface name starting
302 with "tun", otherwise TAP.
303 '';
304 };
305
306 proxyARP = mkOption {
307 default = false;
308 type = types.bool;
309 description = lib.mdDoc ''
310 Turn on proxy_arp for this device.
311 This is mainly useful for creating pseudo-bridges between a real
312 interface and a virtual network such as VPN or a virtual machine for
313 interfaces that don't support real bridging (most wlan interfaces).
314 As ARP proxying acts slightly above the link-layer, below-ip traffic
315 isn't bridged, so things like DHCP won't work. The advantage above
316 using NAT lies in the fact that no IP addresses are shared, so all
317 hosts are reachable/routeable.
318
319 WARNING: turns on ip-routing, so if you have multiple interfaces, you
320 should think of the consequence and setup firewall rules to limit this.
321 '';
322 };
323
324 wakeOnLan = {
325 enable = mkOption {
326 type = types.bool;
327 default = false;
328 description = lib.mdDoc "Whether to enable wol on this interface.";
329 };
330 };
331 };
332
333 config = {
334 name = mkDefault name;
335 };
336
337 # Renamed or removed options
338 imports =
339 let
340 defined = x: x != "_mkMergedOptionModule";
341 in [
342 (mkChangedOptionModule [ "preferTempAddress" ] [ "tempAddress" ]
343 (config:
344 let bool = getAttrFromPath [ "preferTempAddress" ] config;
345 in if bool then "default" else "enabled"
346 ))
347 (mkRenamedOptionModule [ "ip4" ] [ "ipv4" "addresses"])
348 (mkRenamedOptionModule [ "ip6" ] [ "ipv6" "addresses"])
349 (mkRemovedOptionModule [ "subnetMask" ] ''
350 Supply a prefix length instead; use option
351 networking.interfaces.<name>.ipv{4,6}.addresses'')
352 (mkMergedOptionModule
353 [ [ "ipAddress" ] [ "prefixLength" ] ]
354 [ "ipv4" "addresses" ]
355 (cfg: with cfg;
356 optional (defined ipAddress && defined prefixLength)
357 { address = ipAddress; prefixLength = prefixLength; }))
358 (mkMergedOptionModule
359 [ [ "ipv6Address" ] [ "ipv6PrefixLength" ] ]
360 [ "ipv6" "addresses" ]
361 (cfg: with cfg;
362 optional (defined ipv6Address && defined ipv6PrefixLength)
363 { address = ipv6Address; prefixLength = ipv6PrefixLength; }))
364
365 ({ options.warnings = options.warnings; options.assertions = options.assertions; })
366 ];
367
368 };
369
370 vswitchInterfaceOpts = {name, ...}: {
371
372 options = {
373
374 name = mkOption {
375 description = lib.mdDoc "Name of the interface";
376 example = "eth0";
377 type = types.str;
378 };
379
380 vlan = mkOption {
381 description = lib.mdDoc "Vlan tag to apply to interface";
382 example = 10;
383 type = types.nullOr types.int;
384 default = null;
385 };
386
387 type = mkOption {
388 description = lib.mdDoc "Openvswitch type to assign to interface";
389 example = "internal";
390 type = types.nullOr types.str;
391 default = null;
392 };
393 };
394 };
395
396 hexChars = stringToCharacters "0123456789abcdef";
397
398 isHexString = s: all (c: elem c hexChars) (stringToCharacters (toLower s));
399
400 tempaddrValues = {
401 disabled = {
402 sysctl = "0";
403 description = "completely disable IPv6 temporary addresses";
404 };
405 enabled = {
406 sysctl = "1";
407 description = "generate IPv6 temporary addresses but still use EUI-64 addresses as source addresses";
408 };
409 default = {
410 sysctl = "2";
411 description = "generate IPv6 temporary addresses and use these as source addresses in routing";
412 };
413 };
414 tempaddrDoc = concatStringsSep "\n"
415 (mapAttrsToList
416 (name: { description, ... }: ''- `"${name}"` to ${description};'')
417 tempaddrValues);
418
419 hostidFile = pkgs.runCommand "gen-hostid" { preferLocalBuild = true; } ''
420 hi="${cfg.hostId}"
421 ${if pkgs.stdenv.isBigEndian then ''
422 echo -ne "\x''${hi:0:2}\x''${hi:2:2}\x''${hi:4:2}\x''${hi:6:2}" > $out
423 '' else ''
424 echo -ne "\x''${hi:6:2}\x''${hi:4:2}\x''${hi:2:2}\x''${hi:0:2}" > $out
425 ''}
426 '';
427
428in
429
430{
431
432 ###### interface
433
434 options = {
435
436 networking.hostName = mkOption {
437 default = config.system.nixos.distroId;
438 defaultText = literalExpression "config.system.nixos.distroId";
439 # Only allow hostnames without the domain name part (i.e. no FQDNs, see
440 # e.g. "man 5 hostname") and require valid DNS labels (recommended
441 # syntax). Note: We also allow underscores for compatibility/legacy
442 # reasons (as undocumented feature):
443 type = types.strMatching
444 "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
445 description = lib.mdDoc ''
446 The name of the machine. Leave it empty if you want to obtain it from a
447 DHCP server (if using DHCP). The hostname must be a valid DNS label (see
448 RFC 1035 section 2.3.1: "Preferred name syntax", RFC 1123 section 2.1:
449 "Host Names and Numbers") and as such must not contain the domain part.
450 This means that the hostname must start with a letter or digit,
451 end with a letter or digit, and have as interior characters only
452 letters, digits, and hyphen. The maximum length is 63 characters.
453 Additionally it is recommended to only use lower-case characters.
454 If (e.g. for legacy reasons) a FQDN is required as the Linux kernel
455 network node hostname (uname --nodename) the option
456 boot.kernel.sysctl."kernel.hostname" can be used as a workaround (but
457 the 64 character limit still applies).
458
459 WARNING: Do not use underscores (_) or you may run into unexpected issues.
460 '';
461 # warning until the issues in https://github.com/NixOS/nixpkgs/pull/138978
462 # are resolved
463 };
464
465 networking.fqdn = mkOption {
466 readOnly = true;
467 type = types.str;
468 default = if (cfg.hostName != "" && cfg.domain != null)
469 then "${cfg.hostName}.${cfg.domain}"
470 else throw ''
471 The FQDN is required but cannot be determined. Please make sure that
472 both networking.hostName and networking.domain are set properly.
473 '';
474 defaultText = literalExpression ''"''${networking.hostName}.''${networking.domain}"'';
475 description = lib.mdDoc ''
476 The fully qualified domain name (FQDN) of this host. It is the result
477 of combining `networking.hostName` and `networking.domain.` Using this
478 option will result in an evaluation error if the hostname is empty or
479 no domain is specified.
480
481 Modules that accept a mere `networing.hostName` but prefer a fully qualified
482 domain name may use `networking.fqdnOrHostName` instead.
483 '';
484 };
485
486 networking.fqdnOrHostName = mkOption {
487 readOnly = true;
488 type = types.str;
489 default = if cfg.domain == null then cfg.hostName else cfg.fqdn;
490 defaultText = literalExpression ''
491 if cfg.domain == null then cfg.hostName else cfg.fqdn
492 '';
493 description = lib.mdDoc ''
494 Either the fully qualified domain name (FQDN), or just the host name if
495 it does not exists.
496
497 This is a convenience option for modules to read instead of `fqdn` when
498 a mere `hostName` is also an acceptable value; this option does not
499 throw an error when `domain` is unset.
500 '';
501 };
502
503 networking.hostId = mkOption {
504 default = null;
505 example = "4e98920d";
506 type = types.nullOr types.str;
507 description = lib.mdDoc ''
508 The 32-bit host ID of the machine, formatted as 8 hexadecimal characters.
509
510 You should try to make this ID unique among your machines. You can
511 generate a random 32-bit ID using the following commands:
512
513 `head -c 8 /etc/machine-id`
514
515 (this derives it from the machine-id that systemd generates) or
516
517 `head -c4 /dev/urandom | od -A none -t x4`
518
519 The primary use case is to ensure when using ZFS that a pool isn't imported
520 accidentally on a wrong machine.
521 '';
522 };
523
524 networking.enableIPv6 = mkOption {
525 default = true;
526 type = types.bool;
527 description = lib.mdDoc ''
528 Whether to enable support for IPv6.
529 '';
530 };
531
532 networking.defaultGateway = mkOption {
533 default = null;
534 example = {
535 address = "131.211.84.1";
536 interface = "enp3s0";
537 };
538 type = types.nullOr (types.coercedTo types.str gatewayCoerce (types.submodule gatewayOpts));
539 description = lib.mdDoc ''
540 The default gateway. It can be left empty if it is auto-detected through DHCP.
541 It can be specified as a string or an option set along with a network interface.
542 '';
543 };
544
545 networking.defaultGateway6 = mkOption {
546 default = null;
547 example = {
548 address = "2001:4d0:1e04:895::1";
549 interface = "enp3s0";
550 };
551 type = types.nullOr (types.coercedTo types.str gatewayCoerce (types.submodule gatewayOpts));
552 description = lib.mdDoc ''
553 The default ipv6 gateway. It can be left empty if it is auto-detected through DHCP.
554 It can be specified as a string or an option set along with a network interface.
555 '';
556 };
557
558 networking.defaultGatewayWindowSize = mkOption {
559 default = null;
560 example = 524288;
561 type = types.nullOr types.int;
562 description = lib.mdDoc ''
563 The window size of the default gateway. It limits maximal data bursts that TCP peers
564 are allowed to send to us.
565 '';
566 };
567
568 networking.nameservers = mkOption {
569 type = types.listOf types.str;
570 default = [];
571 example = ["130.161.158.4" "130.161.33.17"];
572 description = lib.mdDoc ''
573 The list of nameservers. It can be left empty if it is auto-detected through DHCP.
574 '';
575 };
576
577 networking.search = mkOption {
578 default = [];
579 example = [ "example.com" "home.arpa" ];
580 type = types.listOf types.str;
581 description = lib.mdDoc ''
582 The list of search paths used when resolving domain names.
583 '';
584 };
585
586 networking.domain = mkOption {
587 default = null;
588 example = "home.arpa";
589 type = types.nullOr types.str;
590 description = lib.mdDoc ''
591 The domain. It can be left empty if it is auto-detected through DHCP.
592 '';
593 };
594
595 networking.useHostResolvConf = mkOption {
596 type = types.bool;
597 default = false;
598 description = lib.mdDoc ''
599 In containers, whether to use the
600 {file}`resolv.conf` supplied by the host.
601 '';
602 };
603
604 networking.localCommands = mkOption {
605 type = types.lines;
606 default = "";
607 example = "text=anything; echo You can put $text here.";
608 description = lib.mdDoc ''
609 Shell commands to be executed at the end of the
610 `network-setup` systemd service. Note that if
611 you are using DHCP to obtain the network configuration,
612 interfaces may not be fully configured yet.
613 '';
614 };
615
616 networking.interfaces = mkOption {
617 default = {};
618 example =
619 { eth0.ipv4.addresses = [ {
620 address = "131.211.84.78";
621 prefixLength = 25;
622 } ];
623 };
624 description = lib.mdDoc ''
625 The configuration for each network interface. If
626 {option}`networking.useDHCP` is true, then every
627 interface not listed here will be configured using DHCP.
628
629 Please note that {option}`systemd.network.netdevs` has more features
630 and is better maintained. When building new things, it is advised to
631 use that instead.
632 '';
633 type = with types; attrsOf (submodule interfaceOpts);
634 };
635
636 networking.vswitches = mkOption {
637 default = { };
638 example =
639 { vs0.interfaces = { eth0 = { }; lo1 = { type="internal"; }; };
640 vs1.interfaces = [ { name = "eth2"; } { name = "lo2"; type="internal"; } ];
641 };
642 description =
643 lib.mdDoc ''
644 This option allows you to define Open vSwitches that connect
645 physical networks together. The value of this option is an
646 attribute set. Each attribute specifies a vswitch, with the
647 attribute name specifying the name of the vswitch's network
648 interface.
649 '';
650
651 type = with types; attrsOf (submodule {
652
653 options = {
654
655 interfaces = mkOption {
656 description = lib.mdDoc "The physical network interfaces connected by the vSwitch.";
657 type = with types; attrsOf (submodule vswitchInterfaceOpts);
658 };
659
660 controllers = mkOption {
661 type = types.listOf types.str;
662 default = [];
663 example = [ "ptcp:6653:[::1]" ];
664 description = lib.mdDoc ''
665 Specify the controller targets. For the allowed options see `man 8 ovs-vsctl`.
666 '';
667 };
668
669 openFlowRules = mkOption {
670 type = types.lines;
671 default = "";
672 example = ''
673 actions=normal
674 '';
675 description = lib.mdDoc ''
676 OpenFlow rules to insert into the Open vSwitch. All `openFlowRules` are
677 loaded with `ovs-ofctl` within one atomic operation.
678 '';
679 };
680
681 # TODO: custom "openflow version" type, with list from existing openflow protocols
682 supportedOpenFlowVersions = mkOption {
683 type = types.listOf types.str;
684 example = [ "OpenFlow10" "OpenFlow13" "OpenFlow14" ];
685 default = [ "OpenFlow13" ];
686 description = lib.mdDoc ''
687 Supported versions to enable on this switch.
688 '';
689 };
690
691 # TODO: use same type as elements from supportedOpenFlowVersions
692 openFlowVersion = mkOption {
693 type = types.str;
694 default = "OpenFlow13";
695 description = lib.mdDoc ''
696 Version of OpenFlow protocol to use when communicating with the switch internally (e.g. with `openFlowRules`).
697 '';
698 };
699
700 extraOvsctlCmds = mkOption {
701 type = types.lines;
702 default = "";
703 example = ''
704 set-fail-mode <switch_name> secure
705 set Bridge <switch_name> stp_enable=true
706 '';
707 description = lib.mdDoc ''
708 Commands to manipulate the Open vSwitch database. Every line executed with `ovs-vsctl`.
709 All commands are bundled together with the operations for adding the interfaces
710 into one atomic operation.
711 '';
712 };
713
714 };
715
716 });
717
718 };
719
720 networking.bridges = mkOption {
721 default = { };
722 example =
723 { br0.interfaces = [ "eth0" "eth1" ];
724 br1.interfaces = [ "eth2" "wlan0" ];
725 };
726 description =
727 lib.mdDoc ''
728 This option allows you to define Ethernet bridge devices
729 that connect physical networks together. The value of this
730 option is an attribute set. Each attribute specifies a
731 bridge, with the attribute name specifying the name of the
732 bridge's network interface.
733 '';
734
735 type = with types; attrsOf (submodule {
736
737 options = {
738
739 interfaces = mkOption {
740 example = [ "eth0" "eth1" ];
741 type = types.listOf types.str;
742 description =
743 lib.mdDoc "The physical network interfaces connected by the bridge.";
744 };
745
746 rstp = mkOption {
747 default = false;
748 type = types.bool;
749 description = lib.mdDoc "Whether the bridge interface should enable rstp.";
750 };
751
752 };
753
754 });
755
756 };
757
758 networking.bonds =
759 let
760 driverOptionsExample = ''
761 {
762 miimon = "100";
763 mode = "active-backup";
764 }
765 '';
766 in mkOption {
767 default = { };
768 example = literalExpression ''
769 {
770 bond0 = {
771 interfaces = [ "eth0" "wlan0" ];
772 driverOptions = ${driverOptionsExample};
773 };
774 anotherBond.interfaces = [ "enp4s0f0" "enp4s0f1" "enp5s0f0" "enp5s0f1" ];
775 }
776 '';
777 description = lib.mdDoc ''
778 This option allows you to define bond devices that aggregate multiple,
779 underlying networking interfaces together. The value of this option is
780 an attribute set. Each attribute specifies a bond, with the attribute
781 name specifying the name of the bond's network interface
782 '';
783
784 type = with types; attrsOf (submodule {
785
786 options = {
787
788 interfaces = mkOption {
789 example = [ "enp4s0f0" "enp4s0f1" "wlan0" ];
790 type = types.listOf types.str;
791 description = lib.mdDoc "The interfaces to bond together";
792 };
793
794 driverOptions = mkOption {
795 type = types.attrsOf types.str;
796 default = {};
797 example = literalExpression driverOptionsExample;
798 description = lib.mdDoc ''
799 Options for the bonding driver.
800 Documentation can be found in
801 <https://www.kernel.org/doc/Documentation/networking/bonding.txt>
802 '';
803
804 };
805
806 lacp_rate = mkOption {
807 default = null;
808 example = "fast";
809 type = types.nullOr types.str;
810 description = lib.mdDoc ''
811 DEPRECATED, use `driverOptions`.
812 Option specifying the rate in which we'll ask our link partner
813 to transmit LACPDU packets in 802.3ad mode.
814 '';
815 };
816
817 miimon = mkOption {
818 default = null;
819 example = 100;
820 type = types.nullOr types.int;
821 description = lib.mdDoc ''
822 DEPRECATED, use `driverOptions`.
823 Miimon is the number of millisecond in between each round of polling
824 by the device driver for failed links. By default polling is not
825 enabled and the driver is trusted to properly detect and handle
826 failure scenarios.
827 '';
828 };
829
830 mode = mkOption {
831 default = null;
832 example = "active-backup";
833 type = types.nullOr types.str;
834 description = lib.mdDoc ''
835 DEPRECATED, use `driverOptions`.
836 The mode which the bond will be running. The default mode for
837 the bonding driver is balance-rr, optimizing for throughput.
838 More information about valid modes can be found at
839 https://www.kernel.org/doc/Documentation/networking/bonding.txt
840 '';
841 };
842
843 xmit_hash_policy = mkOption {
844 default = null;
845 example = "layer2+3";
846 type = types.nullOr types.str;
847 description = lib.mdDoc ''
848 DEPRECATED, use `driverOptions`.
849 Selects the transmit hash policy to use for slave selection in
850 balance-xor, 802.3ad, and tlb modes.
851 '';
852 };
853
854 };
855
856 });
857 };
858
859 networking.macvlans = mkOption {
860 default = { };
861 example = literalExpression ''
862 {
863 wan = {
864 interface = "enp2s0";
865 mode = "vepa";
866 };
867 }
868 '';
869 description = lib.mdDoc ''
870 This option allows you to define macvlan interfaces which should
871 be automatically created.
872 '';
873 type = with types; attrsOf (submodule {
874 options = {
875
876 interface = mkOption {
877 example = "enp4s0";
878 type = types.str;
879 description = lib.mdDoc "The interface the macvlan will transmit packets through.";
880 };
881
882 mode = mkOption {
883 default = null;
884 type = types.nullOr types.str;
885 example = "vepa";
886 description = lib.mdDoc "The mode of the macvlan device.";
887 };
888
889 };
890
891 });
892 };
893
894 networking.fooOverUDP = mkOption {
895 default = { };
896 example =
897 {
898 primary = { port = 9001; local = { address = "192.0.2.1"; dev = "eth0"; }; };
899 backup = { port = 9002; };
900 };
901 description = lib.mdDoc ''
902 This option allows you to configure Foo Over UDP and Generic UDP Encapsulation
903 endpoints. See {manpage}`ip-fou(8)` for details.
904 '';
905 type = with types; attrsOf (submodule {
906 options = {
907 port = mkOption {
908 type = port;
909 description = lib.mdDoc ''
910 Local port of the encapsulation UDP socket.
911 '';
912 };
913
914 protocol = mkOption {
915 type = nullOr (ints.between 1 255);
916 default = null;
917 description = lib.mdDoc ''
918 Protocol number of the encapsulated packets. Specifying `null`
919 (the default) creates a GUE endpoint, specifying a protocol number will create
920 a FOU endpoint.
921 '';
922 };
923
924 local = mkOption {
925 type = nullOr (submodule {
926 options = {
927 address = mkOption {
928 type = types.str;
929 description = lib.mdDoc ''
930 Local address to bind to. The address must be available when the FOU
931 endpoint is created, using the scripted network setup this can be achieved
932 either by setting `dev` or adding dependency information to
933 `systemd.services.<name>-fou-encap`; it isn't supported
934 when using networkd.
935 '';
936 };
937
938 dev = mkOption {
939 type = nullOr str;
940 default = null;
941 example = "eth0";
942 description = lib.mdDoc ''
943 Network device to bind to.
944 '';
945 };
946 };
947 });
948 default = null;
949 example = { address = "203.0.113.22"; };
950 description = lib.mdDoc ''
951 Local address (and optionally device) to bind to using the given port.
952 '';
953 };
954 };
955 });
956 };
957
958 networking.sits = mkOption {
959 default = { };
960 example = literalExpression ''
961 {
962 hurricane = {
963 remote = "10.0.0.1";
964 local = "10.0.0.22";
965 ttl = 255;
966 };
967 msipv6 = {
968 remote = "192.168.0.1";
969 dev = "enp3s0";
970 ttl = 127;
971 };
972 }
973 '';
974 description = lib.mdDoc ''
975 This option allows you to define 6-to-4 interfaces which should be automatically created.
976 '';
977 type = with types; attrsOf (submodule {
978 options = {
979
980 remote = mkOption {
981 type = types.nullOr types.str;
982 default = null;
983 example = "10.0.0.1";
984 description = lib.mdDoc ''
985 The address of the remote endpoint to forward traffic over.
986 '';
987 };
988
989 local = mkOption {
990 type = types.nullOr types.str;
991 default = null;
992 example = "10.0.0.22";
993 description = lib.mdDoc ''
994 The address of the local endpoint which the remote
995 side should send packets to.
996 '';
997 };
998
999 ttl = mkOption {
1000 type = types.nullOr types.int;
1001 default = null;
1002 example = 255;
1003 description = lib.mdDoc ''
1004 The time-to-live of the connection to the remote tunnel endpoint.
1005 '';
1006 };
1007
1008 dev = mkOption {
1009 type = types.nullOr types.str;
1010 default = null;
1011 example = "enp4s0f0";
1012 description = lib.mdDoc ''
1013 The underlying network device on which the tunnel resides.
1014 '';
1015 };
1016
1017 encapsulation = with types; mkOption {
1018 type = nullOr (submodule {
1019 options = {
1020 type = mkOption {
1021 type = enum [ "fou" "gue" ];
1022 description = lib.mdDoc ''
1023 Selects encapsulation type. See
1024 {manpage}`ip-link(8)` for details.
1025 '';
1026 };
1027
1028 port = mkOption {
1029 type = port;
1030 example = 9001;
1031 description = lib.mdDoc ''
1032 Destination port for encapsulated packets.
1033 '';
1034 };
1035
1036 sourcePort = mkOption {
1037 type = nullOr types.port;
1038 default = null;
1039 example = 9002;
1040 description = lib.mdDoc ''
1041 Source port for encapsulated packets. Will be chosen automatically by
1042 the kernel if unset.
1043 '';
1044 };
1045 };
1046 });
1047 default = null;
1048 example = { type = "fou"; port = 9001; };
1049 description = lib.mdDoc ''
1050 Configures encapsulation in UDP packets.
1051 '';
1052 };
1053
1054 };
1055
1056 });
1057 };
1058
1059 networking.greTunnels = mkOption {
1060 default = { };
1061 example = literalExpression ''
1062 {
1063 greBridge = {
1064 remote = "10.0.0.1";
1065 local = "10.0.0.22";
1066 dev = "enp4s0f0";
1067 type = "tap";
1068 ttl = 255;
1069 };
1070 gre6Tunnel = {
1071 remote = "fd7a:5634::1";
1072 local = "fd7a:5634::2";
1073 dev = "enp4s0f0";
1074 type = "tun6";
1075 ttl = 255;
1076 };
1077 }
1078 '';
1079 description = lib.mdDoc ''
1080 This option allows you to define Generic Routing Encapsulation (GRE) tunnels.
1081 '';
1082 type = with types; attrsOf (submodule {
1083 options = {
1084
1085 remote = mkOption {
1086 type = types.nullOr types.str;
1087 default = null;
1088 example = "10.0.0.1";
1089 description = lib.mdDoc ''
1090 The address of the remote endpoint to forward traffic over.
1091 '';
1092 };
1093
1094 local = mkOption {
1095 type = types.nullOr types.str;
1096 default = null;
1097 example = "10.0.0.22";
1098 description = lib.mdDoc ''
1099 The address of the local endpoint which the remote
1100 side should send packets to.
1101 '';
1102 };
1103
1104 dev = mkOption {
1105 type = types.nullOr types.str;
1106 default = null;
1107 example = "enp4s0f0";
1108 description = lib.mdDoc ''
1109 The underlying network device on which the tunnel resides.
1110 '';
1111 };
1112
1113 ttl = mkOption {
1114 type = types.nullOr types.int;
1115 default = null;
1116 example = 255;
1117 description = lib.mdDoc ''
1118 The time-to-live/hoplimit of the connection to the remote tunnel endpoint.
1119 '';
1120 };
1121
1122 type = mkOption {
1123 type = with types; enum [ "tun" "tap" "tun6" "tap6" ];
1124 default = "tap";
1125 example = "tap";
1126 apply = v: {
1127 tun = "gre";
1128 tap = "gretap";
1129 tun6 = "ip6gre";
1130 tap6 = "ip6gretap";
1131 }.${v};
1132 description = lib.mdDoc ''
1133 Whether the tunnel routes layer 2 (tap) or layer 3 (tun) traffic.
1134 '';
1135 };
1136 };
1137 });
1138 };
1139
1140 networking.vlans = mkOption {
1141 default = { };
1142 example = literalExpression ''
1143 {
1144 vlan0 = {
1145 id = 3;
1146 interface = "enp3s0";
1147 };
1148 vlan1 = {
1149 id = 1;
1150 interface = "wlan0";
1151 };
1152 }
1153 '';
1154 description =
1155 lib.mdDoc ''
1156 This option allows you to define vlan devices that tag packets
1157 on top of a physical interface. The value of this option is an
1158 attribute set. Each attribute specifies a vlan, with the name
1159 specifying the name of the vlan interface.
1160 '';
1161
1162 type = with types; attrsOf (submodule {
1163
1164 options = {
1165
1166 id = mkOption {
1167 example = 1;
1168 type = types.int;
1169 description = lib.mdDoc "The vlan identifier";
1170 };
1171
1172 interface = mkOption {
1173 example = "enp4s0";
1174 type = types.str;
1175 description = lib.mdDoc "The interface the vlan will transmit packets through.";
1176 };
1177
1178 };
1179
1180 });
1181
1182 };
1183
1184 networking.wlanInterfaces = mkOption {
1185 default = { };
1186 example = literalExpression ''
1187 {
1188 wlan-station0 = {
1189 device = "wlp6s0";
1190 };
1191 wlan-adhoc0 = {
1192 type = "ibss";
1193 device = "wlp6s0";
1194 mac = "02:00:00:00:00:01";
1195 };
1196 wlan-p2p0 = {
1197 device = "wlp6s0";
1198 mac = "02:00:00:00:00:02";
1199 };
1200 wlan-ap0 = {
1201 device = "wlp6s0";
1202 mac = "02:00:00:00:00:03";
1203 };
1204 }
1205 '';
1206 description =
1207 lib.mdDoc ''
1208 Creating multiple WLAN interfaces on top of one physical WLAN device (NIC).
1209
1210 The name of the WLAN interface corresponds to the name of the attribute.
1211 A NIC is referenced by the persistent device name of the WLAN interface that
1212 `udev` assigns to a NIC by default.
1213 If a NIC supports multiple WLAN interfaces, then the one NIC can be used as
1214 `device` for multiple WLAN interfaces.
1215 If a NIC is used for creating WLAN interfaces, then the default WLAN interface
1216 with a persistent device name form `udev` is not created.
1217 A WLAN interface with the persistent name assigned from `udev`
1218 would have to be created explicitly.
1219 '';
1220
1221 type = with types; attrsOf (submodule {
1222
1223 options = {
1224
1225 device = mkOption {
1226 type = types.str;
1227 example = "wlp6s0";
1228 description = lib.mdDoc "The name of the underlying hardware WLAN device as assigned by `udev`.";
1229 };
1230
1231 type = mkOption {
1232 type = types.enum [ "managed" "ibss" "monitor" "mesh" "wds" ];
1233 default = "managed";
1234 example = "ibss";
1235 description = lib.mdDoc ''
1236 The type of the WLAN interface.
1237 The type has to be supported by the underlying hardware of the device.
1238 '';
1239 };
1240
1241 meshID = mkOption {
1242 type = types.nullOr types.str;
1243 default = null;
1244 description = lib.mdDoc "MeshID of interface with type `mesh`.";
1245 };
1246
1247 flags = mkOption {
1248 type = with types; nullOr (enum [ "none" "fcsfail" "control" "otherbss" "cook" "active" ]);
1249 default = null;
1250 example = "control";
1251 description = lib.mdDoc ''
1252 Flags for interface of type `monitor`.
1253 '';
1254 };
1255
1256 fourAddr = mkOption {
1257 type = types.nullOr types.bool;
1258 default = null;
1259 description = lib.mdDoc "Whether to enable `4-address mode` with type `managed`.";
1260 };
1261
1262 mac = mkOption {
1263 type = types.nullOr types.str;
1264 default = null;
1265 example = "02:00:00:00:00:01";
1266 description = lib.mdDoc ''
1267 MAC address to use for the device. If `null`, then the MAC of the
1268 underlying hardware WLAN device is used.
1269
1270 INFO: Locally administered MAC addresses are of the form:
1271 - x2:xx:xx:xx:xx:xx
1272 - x6:xx:xx:xx:xx:xx
1273 - xA:xx:xx:xx:xx:xx
1274 - xE:xx:xx:xx:xx:xx
1275 '';
1276 };
1277
1278 };
1279
1280 });
1281
1282 };
1283
1284 networking.useDHCP = mkOption {
1285 type = types.bool;
1286 default = true;
1287 description = lib.mdDoc ''
1288 Whether to use DHCP to obtain an IP address and other
1289 configuration for all network interfaces that are not manually
1290 configured.
1291 '';
1292 };
1293
1294 networking.useNetworkd = mkOption {
1295 default = false;
1296 type = types.bool;
1297 description = lib.mdDoc ''
1298 Whether we should use networkd as the network configuration backend or
1299 the legacy script based system. Note that this option is experimental,
1300 enable at your own risk.
1301 '';
1302 };
1303
1304 networking.tempAddresses = mkOption {
1305 default = if cfg.enableIPv6 then "default" else "disabled";
1306 defaultText = literalExpression ''
1307 if ''${config.${opt.enableIPv6}} then "default" else "disabled"
1308 '';
1309 type = types.enum (lib.attrNames tempaddrValues);
1310 description = lib.mdDoc ''
1311 Whether to enable IPv6 Privacy Extensions for interfaces not
1312 configured explicitly in
1313 [](#opt-networking.interfaces._name_.tempAddress).
1314
1315 This sets the ipv6.conf.*.use_tempaddr sysctl for all
1316 interfaces. Possible values are:
1317
1318 ${tempaddrDoc}
1319 '';
1320 };
1321
1322 };
1323
1324
1325 ###### implementation
1326
1327 config = {
1328
1329 warnings = concatMap (i: i.warnings) interfaces;
1330
1331 assertions =
1332 (forEach interfaces (i: {
1333 # With the linux kernel, interface name length is limited by IFNAMSIZ
1334 # to 16 bytes, including the trailing null byte.
1335 # See include/linux/if.h in the kernel sources
1336 assertion = stringLength i.name < 16;
1337 message = ''
1338 The name of networking.interfaces."${i.name}" is too long, it needs to be less than 16 characters.
1339 '';
1340 })) ++ (forEach slaveIfs (i: {
1341 assertion = i.ipv4.addresses == [ ] && i.ipv6.addresses == [ ];
1342 message = ''
1343 The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
1344 '';
1345 })) ++ (forEach interfaces (i: {
1346 assertion = i.tempAddress != "disabled" -> cfg.enableIPv6;
1347 message = ''
1348 Temporary addresses are only needed when IPv6 is enabled.
1349 '';
1350 })) ++ (forEach interfaces (i: {
1351 assertion = (i.virtual && i.virtualType == "tun") -> i.macAddress == null;
1352 message = ''
1353 Setting a MAC Address for tun device ${i.name} isn't supported.
1354 '';
1355 })) ++ [
1356 {
1357 assertion = cfg.hostId == null || (stringLength cfg.hostId == 8 && isHexString cfg.hostId);
1358 message = "Invalid value given to the networking.hostId option.";
1359 }
1360 ];
1361
1362 boot.kernelModules = [ ]
1363 ++ optional hasVirtuals "tun"
1364 ++ optional hasSits "sit"
1365 ++ optional hasGres "gre"
1366 ++ optional hasBonds "bonding"
1367 ++ optional hasFous "fou";
1368
1369 boot.extraModprobeConfig =
1370 # This setting is intentional as it prevents default bond devices
1371 # from being created.
1372 optionalString hasBonds "options bonding max_bonds=0";
1373
1374 boot.kernel.sysctl = {
1375 "net.ipv4.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
1376 "net.ipv6.conf.all.disable_ipv6" = mkDefault (!cfg.enableIPv6);
1377 "net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
1378 # networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr"
1379 "net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl;
1380 } // listToAttrs (forEach interfaces
1381 (i: nameValuePair "net.ipv4.conf.${replaceStrings ["."] ["/"] i.name}.proxy_arp" i.proxyARP))
1382 // listToAttrs (forEach interfaces
1383 (i: let
1384 opt = i.tempAddress;
1385 val = tempaddrValues.${opt}.sysctl;
1386 in nameValuePair "net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr" val));
1387
1388 security.wrappers = {
1389 ping = {
1390 owner = "root";
1391 group = "root";
1392 capabilities = "cap_net_raw+p";
1393 source = "${pkgs.iputils.out}/bin/ping";
1394 };
1395 };
1396 security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
1397 /run/wrappers/bin/ping {
1398 include <abstractions/base>
1399 include <nixos/security.wrappers>
1400 rpx /run/wrappers/wrappers.*/ping,
1401 }
1402 /run/wrappers/wrappers.*/ping {
1403 include <abstractions/base>
1404 include <nixos/security.wrappers>
1405 r /run/wrappers/wrappers.*/ping.real,
1406 mrpx ${config.security.wrappers.ping.source},
1407 capability net_raw,
1408 capability setpcap,
1409 }
1410 '');
1411
1412 # Set the host and domain names in the activation script. Don't
1413 # clear it if it's not configured in the NixOS configuration,
1414 # since it may have been set by dhcpcd in the meantime.
1415 system.activationScripts.hostname = let
1416 effectiveHostname = config.boot.kernel.sysctl."kernel.hostname" or cfg.hostName;
1417 in optionalString (effectiveHostname != "") ''
1418 hostname "${effectiveHostname}"
1419 '';
1420 system.activationScripts.domain =
1421 optionalString (cfg.domain != null) ''
1422 domainname "${cfg.domain}"
1423 '';
1424
1425 environment.etc.hostid = mkIf (cfg.hostId != null) { source = hostidFile; };
1426 boot.initrd.systemd.contents."/etc/hostid" = mkIf (cfg.hostId != null) { source = hostidFile; };
1427
1428 # static hostname configuration needed for hostnamectl and the
1429 # org.freedesktop.hostname1 dbus service (both provided by systemd)
1430 environment.etc.hostname = mkIf (cfg.hostName != "")
1431 {
1432 text = cfg.hostName + "\n";
1433 };
1434
1435 environment.systemPackages =
1436 [ pkgs.host
1437 pkgs.iproute2
1438 pkgs.iputils
1439 pkgs.nettools
1440 ]
1441 ++ optionals config.networking.wireless.enable [
1442 pkgs.wirelesstools # FIXME: obsolete?
1443 pkgs.iw
1444 ]
1445 ++ bridgeStp;
1446
1447 # The network-interfaces target is kept for backwards compatibility.
1448 # New modules must NOT use it.
1449 systemd.targets.network-interfaces =
1450 { description = "All Network Interfaces (deprecated)";
1451 wantedBy = [ "network.target" ];
1452 before = [ "network.target" ];
1453 after = [ "network-pre.target" ];
1454 unitConfig.X-StopOnReconfiguration = true;
1455 };
1456
1457 systemd.services = {
1458 network-local-commands = {
1459 description = "Extra networking commands.";
1460 before = [ "network.target" ];
1461 wantedBy = [ "network.target" ];
1462 after = [ "network-pre.target" ];
1463 unitConfig.ConditionCapability = "CAP_NET_ADMIN";
1464 path = [ pkgs.iproute2 ];
1465 serviceConfig.Type = "oneshot";
1466 serviceConfig.RemainAfterExit = true;
1467 script = ''
1468 # Run any user-specified commands.
1469 ${cfg.localCommands}
1470 '';
1471 };
1472 };
1473 services.mstpd = mkIf needsMstpd { enable = true; };
1474
1475 virtualisation.vswitch = mkIf (cfg.vswitches != { }) { enable = true; };
1476
1477 services.udev.packages = [
1478 (pkgs.writeTextFile rec {
1479 name = "ipv6-privacy-extensions.rules";
1480 destination = "/etc/udev/rules.d/98-${name}";
1481 text = let
1482 sysctl-value = tempaddrValues.${cfg.tempAddresses}.sysctl;
1483 in ''
1484 # enable and prefer IPv6 privacy addresses by default
1485 ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.bash}/bin/sh -c 'echo ${sysctl-value} > /proc/sys/net/ipv6/conf/$name/use_tempaddr'"
1486 '';
1487 })
1488 (pkgs.writeTextFile rec {
1489 name = "ipv6-privacy-extensions.rules";
1490 destination = "/etc/udev/rules.d/99-${name}";
1491 text = concatMapStrings (i:
1492 let
1493 opt = i.tempAddress;
1494 val = tempaddrValues.${opt}.sysctl;
1495 msg = tempaddrValues.${opt}.description;
1496 in
1497 ''
1498 # override to ${msg} for ${i.name}
1499 ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr=${val}"
1500 '') (filter (i: i.tempAddress != cfg.tempAddresses) interfaces);
1501 })
1502 ] ++ lib.optional (cfg.wlanInterfaces != {})
1503 (pkgs.writeTextFile {
1504 name = "99-zzz-40-wlanInterfaces.rules";
1505 destination = "/etc/udev/rules.d/99-zzz-40-wlanInterfaces.rules";
1506 text =
1507 let
1508 # Collect all interfaces that are defined for a device
1509 # as device:interface key:value pairs.
1510 wlanDeviceInterfaces =
1511 let
1512 allDevices = unique (mapAttrsToList (_: v: v.device) cfg.wlanInterfaces);
1513 interfacesOfDevice = d: filterAttrs (_: v: v.device == d) cfg.wlanInterfaces;
1514 in
1515 genAttrs allDevices (d: interfacesOfDevice d);
1516
1517 # Convert device:interface key:value pairs into a list, and if it exists,
1518 # place the interface which is named after the device at the beginning.
1519 wlanListDeviceFirst = device: interfaces:
1520 if hasAttr device interfaces
1521 then mapAttrsToList (n: v: v//{_iName=n;}) (filterAttrs (n: _: n==device) interfaces) ++ mapAttrsToList (n: v: v//{_iName=n;}) (filterAttrs (n: _: n!=device) interfaces)
1522 else mapAttrsToList (n: v: v // {_iName = n;}) interfaces;
1523
1524 # Udev script to execute for the default WLAN interface with the persistend udev name.
1525 # The script creates the required, new WLAN interfaces interfaces and configures the
1526 # existing, default interface.
1527 curInterfaceScript = device: current: new: pkgs.writeScript "udev-run-script-wlan-interfaces-${device}.sh" ''
1528 #!${pkgs.runtimeShell}
1529 # Change the wireless phy device to a predictable name.
1530 ${pkgs.iw}/bin/iw phy `${pkgs.coreutils}/bin/cat /sys/class/net/$INTERFACE/phy80211/name` set name ${device}
1531
1532 # Add new WLAN interfaces
1533 ${flip concatMapStrings new (i: ''
1534 ${pkgs.iw}/bin/iw phy ${device} interface add ${i._iName} type managed
1535 '')}
1536
1537 # Configure the current interface
1538 ${pkgs.iw}/bin/iw dev ${device} set type ${current.type}
1539 ${optionalString (current.type == "mesh" && current.meshID!=null) "${pkgs.iw}/bin/iw dev ${device} set meshid ${current.meshID}"}
1540 ${optionalString (current.type == "monitor" && current.flags!=null) "${pkgs.iw}/bin/iw dev ${device} set monitor ${current.flags}"}
1541 ${optionalString (current.type == "managed" && current.fourAddr!=null) "${pkgs.iw}/bin/iw dev ${device} set 4addr ${if current.fourAddr then "on" else "off"}"}
1542 ${optionalString (current.mac != null) "${pkgs.iproute2}/bin/ip link set dev ${device} address ${current.mac}"}
1543 '';
1544
1545 # Udev script to execute for a new WLAN interface. The script configures the new WLAN interface.
1546 newInterfaceScript = new: pkgs.writeScript "udev-run-script-wlan-interfaces-${new._iName}.sh" ''
1547 #!${pkgs.runtimeShell}
1548 # Configure the new interface
1549 ${pkgs.iw}/bin/iw dev ${new._iName} set type ${new.type}
1550 ${optionalString (new.type == "mesh" && new.meshID!=null) "${pkgs.iw}/bin/iw dev ${new._iName} set meshid ${new.meshID}"}
1551 ${optionalString (new.type == "monitor" && new.flags!=null) "${pkgs.iw}/bin/iw dev ${new._iName} set monitor ${new.flags}"}
1552 ${optionalString (new.type == "managed" && new.fourAddr!=null) "${pkgs.iw}/bin/iw dev ${new._iName} set 4addr ${if new.fourAddr then "on" else "off"}"}
1553 ${optionalString (new.mac != null) "${pkgs.iproute2}/bin/ip link set dev ${new._iName} address ${new.mac}"}
1554 '';
1555
1556 # Udev attributes for systemd to name the device and to create a .device target.
1557 systemdAttrs = n: ''NAME:="${n}", ENV{INTERFACE}="${n}", ENV{SYSTEMD_ALIAS}="/sys/subsystem/net/devices/${n}", TAG+="systemd"'';
1558 in
1559 flip (concatMapStringsSep "\n") (attrNames wlanDeviceInterfaces) (device:
1560 let
1561 interfaces = wlanListDeviceFirst device wlanDeviceInterfaces.${device};
1562 curInterface = elemAt interfaces 0;
1563 newInterfaces = drop 1 interfaces;
1564 in ''
1565 # It is important to have that rule first as overwriting the NAME attribute also prevents the
1566 # next rules from matching.
1567 ${flip (concatMapStringsSep "\n") (wlanListDeviceFirst device wlanDeviceInterfaces.${device}) (interface:
1568 ''ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", ENV{INTERFACE}=="${interface._iName}", ${systemdAttrs interface._iName}, RUN+="${newInterfaceScript interface}"'')}
1569
1570 # Add the required, new WLAN interfaces to the default WLAN interface with the
1571 # persistent, default name as assigned by udev.
1572 ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", NAME=="${device}", ${systemdAttrs curInterface._iName}, RUN+="${curInterfaceScript device curInterface newInterfaces}"
1573 # Generate the same systemd events for both 'add' and 'move' udev events.
1574 ACTION=="move", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", NAME=="${device}", ${systemdAttrs curInterface._iName}
1575 '');
1576 });
1577 };
1578
1579}