Centralize IPv6 GUA prefix configuration

base.nix

@@ -1,183 +1,193 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 {
-  ######################################## Packages ###############################################
+  options.custom.gua_pref = lib.mkOption {
-  environment.systemPackages = with pkgs; [
+    type = with lib.types; nullOr (strMatching "^[0-9a-zA-Z:]+$");
-    tmux
+    default = null;
-    git
+    description = "IPv6 GUA Prefix to use in other confs";
-    nvi
-    p7zip
-    tree
-    btop
-    pwgen
-    ssss
-    dig
-    termshark
-  ];
-
-  ######################################## ZSH configuration ######################################
-  users.defaultUserShell = pkgs.zsh;
-  environment.shells = with pkgs; [ zsh ];
-  programs.zsh = {
-    enable = true;
-    autosuggestions.enable = true;
-    syntaxHighlighting.enable = true;
-    ohMyZsh = {
-      enable = true;
-      plugins = [
-        "history-substring-search"
-        "tmux"
-      ];
-      theme = "af-magic";
-    };
-    interactiveShellInit = ''
-      ZSH_TMUX_AUTOSTART=false
-      ZSH_TMUX_AUTOQUIT=false
-      ZSH_TMUX_CONFIG=/etc/tmux.conf
-    '';
-    promptInit = ''
-      if [ -n "$IN_NIX_SHELL" ]; then 
-        setopt PROMPT_SUBST
-        RPROMPT+='[nix]'
-      fi
-    '';
   };
 
-  ######################################## tmux configuration #####################################
+  config = {
-  programs.tmux.enable = true;
+    custom.gua_pref = "2001:14ba:a090:39";
-  programs.tmux.extraConfig = ''
-    unbind C-b
-    set -g prefix M-w
-    bind M-w send-prefix
 
-    bind s split-window -v
+    ######################################## Packages ###############################################
-    bind v split-window -h
+    environment.systemPackages = with pkgs; [
+      tmux
+      git
+      nvi
+      p7zip
+      tree
+      btop
+      pwgen
+      ssss
+      dig
+      termshark
+    ];
 
-    # Smart pane switching with awareness of Vim splits.
+    ######################################## ZSH configuration ######################################
-    bind -n C-h run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-h) || tmux select-pane -L"
+    users.defaultUserShell = pkgs.zsh;
-    bind -n C-j run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-j) || tmux select-pane -D"
+    environment.shells = with pkgs; [ zsh ];
-    bind -n C-k run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-k) || tmux select-pane -U"
+    programs.zsh = {
-    bind -n C-l run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-l) || tmux select-pane -R"
-
-    bind -n C-Left select-pane -L
-    bind -n C-Right select-pane -R
-    bind -n C-Up select-pane -U
-    bind -n C-Down select-pane -D
-
-    # resize panes more easily
-    bind -r h resize-pane -L 10
-    bind -r j resize-pane -D 10
-    bind -r k resize-pane -U 10
-    bind -r l resize-pane -R 10
-
-    bind M-c attach -c "#{pane_current_path}" 
-
-    set -s escape-time 0
-  '';
-
-  ######################################## SSH and fail2ban configuration #########################
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-  };
-  users.users.root.openssh.authorizedKeys.keys = [
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPiupf3xK6eWvno7R2rDYPuDxVvbmzWh5EkR1rquvV9hAAAABHNzaDo= vili@helium"
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHr/1uVk5cWRWAELvwVvBG+eAbkKqpH2gat1yKKO11roAAAABHNzaDo= vili@lithium"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOk8akyi6Ob1EOPugxnjdlMQs9rOAbxBbakT8olBFe7 backup_ssh"
-  ];
-
-  services.fail2ban = {
-    enable = true;
-    maxretry = 10;
-    bantime = "10m";
-    bantime-increment = {
       enable = true;
-      maxtime = "1d";
+      autosuggestions.enable = true;
+      syntaxHighlighting.enable = true;
+      ohMyZsh = {
+        enable = true;
+        plugins = [
+          "history-substring-search"
+          "tmux"
+        ];
+        theme = "af-magic";
+      };
+      interactiveShellInit = ''
+        ZSH_TMUX_AUTOSTART=false
+        ZSH_TMUX_AUTOQUIT=false
+        ZSH_TMUX_CONFIG=/etc/tmux.conf
+      '';
+      promptInit = ''
+        if [ -n "$IN_NIX_SHELL" ]; then 
+          setopt PROMPT_SUBST
+          RPROMPT+='[nix]'
+        fi
+      '';
     };
-    jails = {
+
-      DEFAULT.settings = {
+    ######################################## tmux configuration #####################################
-        findtime = 3600;
+    programs.tmux.enable = true;
+    programs.tmux.extraConfig = ''
+      unbind C-b
+      set -g prefix M-w
+      bind M-w send-prefix
+
+      bind s split-window -v
+      bind v split-window -h
+
+      # Smart pane switching with awareness of Vim splits.
+      bind -n C-h run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-h) || tmux select-pane -L"
+      bind -n C-j run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-j) || tmux select-pane -D"
+      bind -n C-k run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-k) || tmux select-pane -U"
+      bind -n C-l run "(tmux display-message -p '#{pane_current_command}' | grep -iq vim && tmux send-keys C-l) || tmux select-pane -R"
+
+      bind -n C-Left select-pane -L
+      bind -n C-Right select-pane -R
+      bind -n C-Up select-pane -U
+      bind -n C-Down select-pane -D
+
+      # resize panes more easily
+      bind -r h resize-pane -L 10
+      bind -r j resize-pane -D 10
+      bind -r k resize-pane -U 10
+      bind -r l resize-pane -R 10
+
+      bind M-c attach -c "#{pane_current_path}" 
+
+      set -s escape-time 0
+    '';
+
+    ######################################## SSH and fail2ban configuration #########################
+    services.openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
+    };
+    users.users.root.openssh.authorizedKeys.keys = [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPiupf3xK6eWvno7R2rDYPuDxVvbmzWh5EkR1rquvV9hAAAABHNzaDo= vili@helium"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHr/1uVk5cWRWAELvwVvBG+eAbkKqpH2gat1yKKO11roAAAABHNzaDo= vili@lithium"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOk8akyi6Ob1EOPugxnjdlMQs9rOAbxBbakT8olBFe7 backup_ssh"
+    ];
+
+    services.fail2ban = {
+      enable = true;
+      maxretry = 10;
+      bantime = "10m";
+      bantime-increment = {
+        enable = true;
+        maxtime = "1d";
+      };
+      jails = {
+        DEFAULT.settings = {
+          findtime = 3600;
+        };
       };
     };
-  };
 
-  ######################################## Localization ###########################################
+    ######################################## Localization ###########################################
-  i18n.defaultLocale = "en_US.UTF-8";
+    i18n.defaultLocale = "en_US.UTF-8";
 
-  i18n.extraLocaleSettings = {
+    i18n.extraLocaleSettings = {
-    LC_ADDRESS = "fi_FI.UTF-8";
+      LC_ADDRESS = "fi_FI.UTF-8";
-    LC_IDENTIFICATION = "fi_FI.UTF-8";
+      LC_IDENTIFICATION = "fi_FI.UTF-8";
-    LC_MEASUREMENT = "fi_FI.UTF-8";
+      LC_MEASUREMENT = "fi_FI.UTF-8";
-    LC_MONETARY = "fi_FI.UTF-8";
+      LC_MONETARY = "fi_FI.UTF-8";
-    LC_NAME = "fi_FI.UTF-8";
+      LC_NAME = "fi_FI.UTF-8";
-    LC_NUMERIC = "fi_FI.UTF-8";
+      LC_NUMERIC = "fi_FI.UTF-8";
-    LC_PAPER = "fi_FI.UTF-8";
+      LC_PAPER = "fi_FI.UTF-8";
-    LC_TELEPHONE = "fi_FI.UTF-8";
+      LC_TELEPHONE = "fi_FI.UTF-8";
-    LC_TIME = "fi_FI.UTF-8";
+      LC_TIME = "fi_FI.UTF-8";
-  };
-
-  services.xserver.xkb = {
-    layout = "us,";
-    variant = "de_se_fi,";
-  };
-  console = pkgs.lib.mkForce {
-    font = "Lat2-Terminus16";
-    useXkbConfig = true; # use xkbOptions in tty.
-  };
-  time.timeZone = "Europe/Helsinki";
-
-  ######################################## Memory management ######################################
-  zramSwap.enable = true;
-  swapDevices = [
-    {
-      device = "/var/lib/swapfile";
-      size = 8 * 1024;
-    }
-  ];
-
-  ######################################## Housekeeping ###########################################
-  system.autoUpgrade = {
-    enable = true;
-    dates = "04:00";
-    randomizedDelaySec = "30min";
-    allowReboot = true;
-    rebootWindow = {
-      lower = "03:30";
-      upper = "05:00";
     };
-  };
 
-  nix = {
+    services.xserver.xkb = {
-    settings = {
+      layout = "us,";
-      auto-optimise-store = true;
+      variant = "de_se_fi,";
-      tarball-ttl = 0;
     };
-    gc = {
+    console = pkgs.lib.mkForce {
-      automatic = true;
+      font = "Lat2-Terminus16";
-      options = "--delete-older-than 7d";
+      useXkbConfig = true; # use xkbOptions in tty.
-      dates = "05:00";
-      randomizedDelaySec = "30min";
     };
-  };
+    time.timeZone = "Europe/Helsinki";
 
-  ######################################## Misc. ##################################################
+    ######################################## Memory management ######################################
-  nixpkgs.config.allowUnfree = true;
+    zramSwap.enable = true;
+    swapDevices = [
+      {
+        device = "/var/lib/swapfile";
+        size = 8 * 1024;
+      }
+    ];
 
-  networking = {
+    ######################################## Housekeeping ###########################################
-    # Easiest to use and most distros use this by default.
+    system.autoUpgrade = {
-    networkmanager = {
       enable = true;
-      # Use EUI-64 addresses by default, so that addresses are predictable
+      dates = "04:00";
-      settings."connection"."ipv6.addr-gen-mode" = 0;
+      randomizedDelaySec = "30min";
+      allowReboot = true;
+      rebootWindow = {
+        lower = "03:30";
+        upper = "05:00";
+      };
     };
-    # IPv6 privacy addresses for outgoing traffic
-    tempAddresses = "default";
-  };
 
-  users.mutableUsers = false; # Force all user management to happen throught nix-files
+    nix = {
+      settings = {
+        auto-optimise-store = true;
+        tarball-ttl = 0;
+      };
+      gc = {
+        automatic = true;
+        options = "--delete-older-than 7d";
+        dates = "05:00";
+        randomizedDelaySec = "30min";
+      };
+    };
 
-  boot.loader = {
+    ######################################## Misc. ##################################################
-    systemd-boot.enable = pkgs.lib.mkDefault true;
+    nixpkgs.config.allowUnfree = true;
-    efi.canTouchEfiVariables = pkgs.lib.mkDefault true;
+
-    timeout = pkgs.lib.mkDefault 0;
+    networking = {
+      # Easiest to use and most distros use this by default.
+      networkmanager = {
+        enable = true;
+        # Use EUI-64 addresses by default, so that addresses are predictable
+        settings."connection"."ipv6.addr-gen-mode" = 0;
+      };
+      # IPv6 privacy addresses for outgoing traffic
+      tempAddresses = "default";
+    };
+
+    users.mutableUsers = false; # Force all user management to happen throught nix-files
+
+    boot.loader = {
+      systemd-boot.enable = pkgs.lib.mkDefault true;
+      efi.canTouchEfiVariables = pkgs.lib.mkDefault true;
+      timeout = pkgs.lib.mkDefault 0;
+    };
   };
 }

machine-confs/helium.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   networking = {
     hostName = "helium";
@@ -6,9 +6,9 @@
     wg-quick.interfaces = {
       wg0 = {
         autostart = true;
-        address = [ "2001:14ba:a090:39ff::2/64" ];
+        address = [ "${config.custom.gua_pref}ff::2/64" ];
         dns = [
-          "2001:14ba:a090:39ff::1"
+          "${config.custom.gua_pref}ff::1"
           "vsinerva.fi"
         ];
         privateKeyFile = "/root/wireguard-keys/privatekey-home";
@@ -50,7 +50,7 @@
   };
   services.clatd = {
     enable = true;
-    settings.clat-v6-addr = "2001:14ba:a090:39ff::c2";
+    settings.clat-v6-addr = "${config.custom.gua_pref}ff::c2";
   };
   systemd.services.clatd.wants = [ "wg-quick-wg0.service" ];
 

machine-confs/lithium.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   networking = {
     hostName = "lithium";
@@ -6,9 +6,9 @@
     wg-quick.interfaces = {
       wg0 = {
         autostart = true;
-        address = [ "2001:14ba:a090:39ff::3/64" ];
+        address = [ "${config.custom.gua_pref}ff::3/64" ];
         dns = [
-          "2001:14ba:a090:39ff::1"
+          "${config.custom.gua_pref}ff::1"
           "vsinerva.fi"
         ];
         privateKeyFile = "/root/wireguard-keys/privatekey-home";
@@ -32,7 +32,7 @@
   };
   services.clatd = {
     enable = true;
-    settings.clat-v6-addr = "2001:14ba:a090:39ff::c3";
+    settings.clat-v6-addr = "${config.custom.gua_pref}ff::c3";
   };
   systemd.services.clatd.wants = [ "wg-quick-wg0.service" ];
 

services/siit-dc.nix

@@ -1,6 +1,5 @@
-{ ... }:
+{ config, ... }:
 let
-  gua_pref = "2001:14ba:a090:39";
   v4_pref = "192.168.251";
 in
 {
@@ -8,12 +7,12 @@ in
     jool = {
       enable = true;
       siit.default = {
-        global.pool6 = "${gua_pref}46::/96";
+        global.pool6 = "${config.custom.gua_pref}46::/96";
 
         # Explicit address mappings
         eamt = [
           {
-            "ipv6 prefix" = "${gua_pref}d1:be24:11ff:fe42:dd76/128";
+            "ipv6 prefix" = "${config.custom.gua_pref}d1:be24:11ff:fe42:dd76/128";
             "ipv4 prefix" = "${v4_pref}.1/32";
           }
         ];