bgpwtf/machines/modules/router.nix

# Generic configuration for any bgpwtf router.

{ config, pkgs, lib, ... }:

with builtins;

rec {
  imports = [
    ./routing.nix
    ./rename-interfaces.nix
    ./rsh-unbound.nix
    ./bootstrap.nix
    ./prometheus.nix
  ];

  environment.systemPackages = with pkgs; [
    tcpdump htop dstat file strace gdb mtr
    vim wget curl htop dstat whois bind
    rxvt-unicode-unwrapped.terminfo dhcpcd efibootmgr
  ];
  networking.useDHCP = false;
  networking.firewall.enable = false;
  networking.useNetworkd = true;
  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  boot.kernel.sysctl."net.ipv4.conf.*.accept_redirects" = 0;
  boot.kernel.sysctl."net.ipv4.conf.*.send_redirects" = 0;
  boot.kernel.sysctl."net.ipv4.conf.*.accept_source_route" = 0;
  boot.kernel.sysctl."net.ipv4.conf.*.proxy_arp" = 0;
  boot.kernel.sysctl."net.ipv4.conf.*.secure_redirects" = 1;
  boot.kernel.sysctl."net.ipv4.conf.*.bootp_relay" = 0;
  boot.kernel.sysctl."net.ipv4.conf.*.arp_filter" = 1;
  boot.kernel.sysctl."net.ipv4.conf.*.arp_ignore" = 1;
  boot.kernel.sysctl."net.ipv4.conf.*.arp_announce" = 2;
  boot.kernel.sysctl."net.ipv4.conf.*.rp_filter" = 0;
  boot.kernel.sysctl."net.ipv6.conf.*.forwarding" = 1;
  boot.kernel.sysctl."net.ipv6.conf.*.accept_ra" = 0;
  boot.kernel.sysctl."net.ipv6.conf.*.autoconf" = 0;
  boot.kernel.sysctl."net.ipv6.conf.*.router_solicitations" = 0;
  boot.kernel.sysctl."net.ipv6.route.max_size" = 2147483647;

  # Limit nscd memory usage, as it sometimes just blows up and the OOMkiller
  # sucks at picking it up.
  systemd.services.nscd.serviceConfig.MemoryMax = "1G";

  # enable coredumpctl
  systemd.coredump.enable = true;

  # Use Chrony instead of systemd-timesyncd
  time.timeZone = "Europe/Warsaw";
  services.chrony.enable = true;
  networking.nameservers = [ "8.8.8.8" ];

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;
  services.openssh.passwordAuthentication = false;
  # Allow for slightly more unauthenticated connections between dropping them,
  # otherwise public bruteforcing will cause DoS preventing actual users from
  # logging in.
  services.openssh.extraConfig = ''
    MaxStartups 100:30:1000
  '';
  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG599UildOrAq+LIOQjKqtGMwjgjIxozI1jtQQRKHtCP q3k@mimeomia"
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQb3YQoiYFZLKwvHYKbu1bMqzNeDCAszQhAe1+QI5SLDOotclyY/vFmOReZOsmyMFl71G2d7d+FbYNusUnNNjTxRYQ021tVc+RkMdLJaORRURmQfEFEKbai6QSFTwErXzuoIzyEPK0lbsQuGgqT9WaVnRzHJ2Q/4+qQbxAS34PuR5NqEkmn4G6LMo3OyJ5mwPkCj9lsqz4BcxRaMWFO3mNcwGDfSW+sqgc3E8N6LKrTpZq3ke7xacpQmcG5DU9VO+2QVPdltl9jWbs3gXjmF92YRNOuKPVfAOZBBsp8JOznfx8s9wDgs7RwPmDpjIAJEyoABqW5hlXfqRbTnfnMvuR informatic@InformaticPC"
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGkMgEVwQM8yeuFUYL2TwlJIq9yUNBmHnwce46zeL2PK2CkMz7sxT/om7sp/K5XDiqeD05Nioe+Dr3drP6B8uI33S5NgxPIfaqQsRS+CBEgk6cqFlcdlKETU/DT+/WsdoO173n7mgGeafPInEuQuGDUID0Fl099kIxtqfAhdeZFMM6/szAZEZsElLJ8K6dp1Ni/jmnXCZhjivZH3AZUlnqrmtDG7FY1bgcOfDXAal45LItughGPtrdiigXe9DK2fW3+9DBZZduh5DMJTNlphAZ+nfSrbyHVKUg6WsgMSprur4KdU47q1QwzqqvEj75JcdP1jOWoZi4F6VJDte9Wb9lhD1jGgjxY9O6Gs4CH35bx15W7CN9hgNa0C8NbPJe/fZYIeMZmJ1m7O2xmnYwP8j+t7RNJWu7Pa3Em4mOEXvhBF07Zfq+Ye/4SluoRgADy5eII2x5fFo5EBhInxK0/X8wF6XZvysalVifoCh7T4Edejoi91oAxFgYAxbboXGlod0eEHIi2hla8SM9+IBHOChmgawKBYp2kzAJyAmHNBF+Pah9G4arVCj/axp/SJZDZbJQoI7UT/fJzEtvlb5RWrHXRq+y6IvjpUq4pzpDWW04+9UMqEEXRmhWOakHfEVM9rN8h3aJBflLUBBnh0Z/hVsKNh8bCRHaKtah8TrD9i+wMw== patryk.jakuszew@gmail.com"
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC33naG1ptCvUcRWX9cj9wXM1nW1lyQC4SvMJzWlr9aMD96O8hQ2JMkuIUgUJvorAY02QRplQ2BuoVoVkdkzwjMyi1bL3OdgcKo7Z1yByClGTTocqNJYY0lcUb6EJH8+6e6F9ydrQlSxNzL1uCaA7phZr+yPcmAmWbSfioXn98yXNkE0emHxzJv/nypJY56sDCMC2IXDRd8L2goDtPwgPEW7bWfAQdIFMJ75xOidZOTxJ8eqyXLw/kxY5UlyX66jdoYz1sE5XUHuoQl1AOG9UdlMo0aMhUvP4pX5l7r7EnA9OttKMFB3oWqkVK/R6ynZ52YNOU5BZ9V+Ppaj34W0xNu+p0mbHcCtXYCTrf/OU0hcZDbDaNTjs6Vtcm2wYw9iAKX7Tex+eOMwUwlrlcyPNRV5BTot7lGNYfauHCSIuWJKN4NhCLR/NtVNh4/94eKkPTwJsY6XqDcS7q49wPAs4DAH7BJgsbHPOqygVHrY0YYEfz3Pj0HTxJHQMCP/hQX4fXEGt0BjgoVJbXPAQtPyeg0JuxiUg+b4CgVVfQ6R060MlM1BZzhmh+FY5MJH6nJppS0aHYCvSg8Z68NUlCPKy0jpcyfuAIWQWwSGG1O010WShQG2ELsvNdg5/4HVdCGNl5mmoom6JOd72FOZyQlHDFfeQUQRn9HOeCq/c51rK99SQ== bartek@IHM"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTR292kx/2CNuWYIsZ6gykQ036aBGrmheIuZa6S1D2x implr@thonk"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGfIRe1nH6vwjQTjqHNnkKAdr1VYqGEeQnqInmf3A6UN ar@khas"
  ];
}