From 24655ece76ad134c6ca586628e1ce157a179b43b Mon Sep 17 00:00:00 2001 From: oddlama Date: Wed, 10 May 2023 02:07:09 +0200 Subject: [PATCH] feat: add macvtap networking to microvms --- README.md | 1 + hosts/common/core/system.nix | 19 +++++++--- hosts/ward/default.nix | 12 ++++++- hosts/ward/net.nix | 36 +++++++++++++++++-- hosts/ward/secrets/secrets.nix.age | Bin 658 -> 662 bytes modules/microvms.nix | 54 ++++++++++++++++++----------- nix/lib.nix | 2 +- 7 files changed, 95 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index b310dd1..b212e30 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,7 @@ This is my personal nix config. - (Optional) ssh into the target (keys are already set up) - Run `install-system` and reboot - Retrieve the new host identity by using `ssh-keyscan | grep -o 'ed25519.*' > host//secrets/host.pub` +- (If the host has microvms, also retrieve their identities!) - Rekey the secrets for the new identity `nix run .#rekey` - Deploy again remotely via colmena diff --git a/hosts/common/core/system.nix b/hosts/common/core/system.nix index ade2851..0a092fb 100644 --- a/hosts/common/core/system.nix +++ b/hosts/common/core/system.nix @@ -12,10 +12,21 @@ libWithNet = (import "${inputs.lib-net}/net.nix" {inherit lib;}).lib; in lib.recursiveUpdate libWithNet { - net.cidr = rec { - hostCidr = n: x: "${libWithNet.net.cidr.host n x}/${libWithNet.net.cidr.length x}"; - ip = x: lib.head (lib.splitString "/" x); - canonicalize = x: libWithNet.net.cidr.make (libWithNet.net.cidr.length x) (ip x); + net = { + cidr = rec { + hostCidr = n: x: "${libWithNet.net.cidr.host n x}/${libWithNet.net.cidr.length x}"; + ip = x: lib.head (lib.splitString "/" x); + canonicalize = x: libWithNet.net.cidr.make (libWithNet.net.cidr.length x) (ip x); + }; + mac = { + # Adds offset to the given base address and ensures the result is in + # a locally administered range by replacing the second nibble with a 2. + addPrivate = base: offset: let + added = libWithNet.net.mac.add base offset; + pre = lib.substring 0 1 added; + suf = lib.substring 2 (-1) added; + in "${pre}2${suf}"; + }; }; }; diff --git a/hosts/ward/default.nix b/hosts/ward/default.nix index 7c5c2f5..7b4313b 100644 --- a/hosts/ward/default.nix +++ b/hosts/ward/default.nix @@ -3,6 +3,7 @@ inputs, lib, nixos-hardware, + nodeSecrets, pkgs, ... }: { @@ -25,7 +26,16 @@ boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" "r8169"]; - extra.microvms.test.system = "x86_64-linux"; + extra.microvms = let + macOffset = config.lib.net.mac.addPrivate nodeSecrets.networking.interfaces."wan-nic".mac; + in { + test = { + autostart = true; + mac = macOffset "00:00:00:00:00:01"; + macvtap = "wan"; + system = "x86_64-linux"; + }; + }; #services.authelia.instances.main = { # enable = true; diff --git a/hosts/ward/net.nix b/hosts/ward/net.nix index 3249c36..e71b5eb 100644 --- a/hosts/ward/net.nix +++ b/hosts/ward/net.nix @@ -13,7 +13,30 @@ in { boot.initrd.systemd.network = { enable = true; - networks = {inherit (config.systemd.network.networks) "10-wan";}; + networks."10-wan" = { + DHCP = "yes"; + #address = [ + # "192.168.178.2/24" + # "fd00::1/64" + #]; + #gateway = [ + #]; + matchConfig.MACAddress = nodeSecrets.networking.interfaces."wan-nic".mac; + networkConfig.IPv6PrivacyExtensions = "kernel"; + dhcpV4Config.RouteMetric = 20; + dhcpV6Config.RouteMetric = 20; + }; + }; + + systemd.network.netdevs."10-wan" = { + netdevConfig = { + Name = "wan"; + Kind = "macvtap"; + }; + extraConfig = '' + [MACVTAP] + Mode=bridge + ''; }; systemd.network.networks = { @@ -27,7 +50,14 @@ in { dhcpV4Config.RouteMetric = 10; dhcpV6Config.RouteMetric = 10; }; - "10-wan" = { + "10-wan-nic" = { + matchConfig.MACAddress = nodeSecrets.networking.interfaces."wan-nic".mac; + extraConfig = '' + [Network] + MACVTAP=wan + ''; + }; + "11-wan" = { DHCP = "yes"; #address = [ # "192.168.178.2/24" @@ -35,7 +65,7 @@ in { #]; #gateway = [ #]; - matchConfig.MACAddress = nodeSecrets.networking.interfaces.wan.mac; + matchConfig.Name = "wan"; networkConfig.IPv6PrivacyExtensions = "kernel"; dhcpV4Config.RouteMetric = 20; dhcpV6Config.RouteMetric = 20; diff --git a/hosts/ward/secrets/secrets.nix.age b/hosts/ward/secrets/secrets.nix.age index b2649156669be49cbff5f51ac1d6e226dc350e24..a32f4416bb560c4369aa98448d04e026781a9345 100644 GIT binary patch delta 641 zcmV-{0)G9H1(pSnAb)6WNlQ~WWinKGV{bH2d3I=FbYXgTOlx{|H*!}~NmoQ#L^pF` zMQvkLK?-Oyb9ioPGB7haIAnHdYguM%V{lYMSSwFfXGSwMRBmrtb!u5gY&A4)X9_Jo zAaH4REpRe5HXwL$Q)M_&AVF|!YcY0cLo`-tPkCWYT5B*$T7OzNYdA4UZftFKZ&h%0 zQ+Q!`W;b?6Q*a7+R&_IZMpG~~Xh$n@b4)c@OhI^7LrqFUGA~3+HA6OcayUU#S5h`{ zRWu4MJ|HwzPC_?oHZ5mzWnpt=Abn9OOnyfoU}PzLY*a}gTp@i5QhH=HO*1kza93eQ zQ!8*&WL7gvbbmK*FhgTmNJUs}I72uxFlB5xG)8iFQF2H_F;`1OOhRN>RY_|~SW0MN zFA6toa%*@`by#dwK~yVxbZRSaHD@--LqkwDM@4aR zXh%0rXk=kbadtE>F-m4}ZZTn4Qbc-0HAFLaZcOsIU zlyGCVhv4)0L(lCH2J(p}l*1qv1$1FN_SIcel<1(Y<(JD(C1Mx#pO=<~M2pIv8iEy+ znC{DUd>rbmb~vQQfyw~^se2@D3RxmXl~!^T5*JD+WBih)cGw@!f#9t4q}XmX b2{)--;IeY7m6i-d>sK~CZ->d;spflg)n)&> delta 637 zcmV-@0)qXP1(F4jAb&DLb~rO}LUcztMRP??Yi=@cc1ur6H(Ehvcu6^DHaBQcOl)j) zFlu^3MG9$TF)&jyT5D@?Z%b2Sb#ggwVRbT1H8e~#G)hS}Sx{McNlkf1a4%*~FbXX` zAaH4REpRe5HXwL$Q)M_&AVF+LST|T|PS1U$zD|&58Nl`{G-Xh9OEp?lQgTI2ST=5H zFK7yBD{4wMIZYHbz(MYXIDd2W^7S(Q!h$FYB5YzLNp33EiE8XYEE)?ICFYy zH8*c&adU1;VPiy1Z(>evFh*rdMS6E_c{f^YH&iw