Головна сторінка Огляд Довідка
Увійти
mark22k
/
dn42-wiki
дзеркало https://codeberg.org/mark22k/dn42-wiki.git
Слідкувати 1
Зірка 0
Відгалуження 0
Файли Проблеми 0 Wiki
Гілка: pages
Гілки Теги
dn42-wiki
/
howto
/
nixos.html

nixos.html 28 KB
Постійне посилання Історія Запис

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381 
  1. <!DOCTYPE html>
    2. 

  2. <html lang="en">
    3. 

  3.     <head>
    4. 

  4. <meta charset="UTF-8">
    5. 

  5. 

  6. 

  7. 

  8. <title>NixOS | dn42 wiki</title>
    9. 

  9. 

  10. <meta name="viewport" content="width=device-width, initial-scale=1.0">
    11. 

  11. <meta name="robots" content="index, follow">
    12. 

  12. <meta name="keywords" content="dn42,wiki,routing,bgp">
    13. 

  13. 

  14. <link rel="canonical" href="https://dn42.obl.ong/howto/nixos.html">
    15. 

  15. <link rel="icon" type="image/x-icon" href="/favicon.ico">
    16. 

  16. <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico">
    17. 

  17. 

  18. <link rel="author" type="text/html" href="/docs/people">
    19. 

  19. 

  20. <link rel="stylesheet" href="/css/normalize.css">
    21. 

  21. <link rel="stylesheet" href="/css/simple.min.css">
    22. 

  22. <link rel="stylesheet" href="/css/style.css">
    23. 

  23. <link rel="stylesheet" href="/css/menu.css">
    24. 

  24. 

  25. 

  26. </head>
    27. 

  27.     
    28. 

  28.     <body>
    29. 

  29. 

  30.         <header>
    31. 

  31. 

  32. 

  33. <b>dn42 wiki / NixOS</b>
    34. 

  34. 

  35. <div id="dn42_header">
    36. 

  36.     
    37. 

  37.     <p><a href="/"><img src="/dn42.png" alt="dn42" /></a></p>
    38. 

  38. 

  39. </div>
    40. 

  40. </header>
    41. 

  41. 

  42.         <main>
    43. 

  43.             <h1 id="nixos">NixOS</h1>
    44. 

  44. 

  45. <p>NixOS is a declarative Linux distribution based on the Nix package Manager. In this post I’ll explain how I setup dn42 in this environment. I currently only peer with wireguard and use bird2. NixOS uses configuration files to manage the system state and has a builtin container module.</p>
    46. 

  46. 

  47. <h2 id="container-disclaimer">container disclaimer</h2>
    48. 

  48. 

  49. <p>I had a spare IPv4 Address so I decided to use a container without a NAT and keep my host “clean” from dn42 Wireguard Interfaces and IP routes. However it’s pain full to debug since nixos-rebuild restarts the container on every minor change. So every time you change a firewall rule or debug a DNS setting nixos-rebuild restarts the container before the change takes effect and since BGP is BGP, it can be really frustrating.</p>
    50. 

  50. 

  51. <p>You may also want to have a look at this <a href="https://github.com/NixOS/nixpkgs/issues/43652">Issue</a> and <a href="https://github.com/NixOS/nixpkgs/pull/80169">Pull Request</a></p>
    52. 

  52. 

  53. <p>If you still want to give it a try, here you’ll find some inspiration from my setup. You can also use some of these nix expression in a non-container environment.</p>
    54. 

  54. 

  55. <h2 id="building-the-container">Building the container</h2>
    56. 

  56. 

  57. <p>Defining the container environment is the base part of the setup. Beginning with network setup, Private Network disables the passthrough of Host Interfaces into the container and adds a bridged Interface to the host default Interface (e.g. eth0). The localAddress is the container side address and the hostAddress is the one the Host gets. Inside the <code class="language-plaintext highlighter-rouge">container.&lt;name&gt;.config</code>, you can basicly import the same nix expression as from the Host and don’t need to add some special container parts.</p>
    58. 

  58. 

  59. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">containers</span><span class="o">.</span><span class="nv">dn42</span> <span class="o">=</span> <span class="p">{</span>
    60. 

  60.     <span class="nv">hostAddress</span> <span class="o">=</span> <span class="s2">"192.168.254.1"</span><span class="p">;</span> <span class="c"># Transfer Network</span>
    61. 

  61.     <span class="nv">hostAddress6</span> <span class="o">=</span> <span class="s2">"2001:db08::42"</span><span class="p">;</span> <span class="c"># Transfer Network</span>
    62. 

  62.     <span class="nv">localAddress</span> <span class="o">=</span> <span class="s2">"116.203.1.5"</span><span class="p">;</span>
    63. 

  63.     <span class="nv">localAddress6</span> <span class="o">=</span> <span class="s2">"2a01:4f8:c0c:4f7a::2/128"</span><span class="p">;</span>
    64. 

  64.     <span class="nv">privateNetwork</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    65. 

  65.     <span class="nv">autoStart</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    66. 

  66. 

  67.     <span class="nv">config</span> <span class="o">=</span> <span class="p">{</span> <span class="nv">config</span><span class="p">,</span> <span class="nv">pkgs</span><span class="p">,</span> <span class="o">...</span> <span class="p">}:</span> <span class="p">{</span>
    68. 

  68.         <span class="nv">imports</span> <span class="o">=</span> <span class="p">[</span>
    69. 

  69.             <span class="sx">./peers</span> <span class="c"># Folder with a config for every Peer</span>
    70. 

  70.             <span class="sx">./dns.nix</span> <span class="c"># Bind with the litschi.dn42 zone deligated</span>
    71. 

  71.             <span class="sx">./bird.nix</span> <span class="c"># Bird config for BGP Routing</span>
    72. 

  72.             <span class="sx">./networking.nix</span> <span class="c"># Static Network configuration (with firewall)</span>
    73. 

  73.             <span class="sx">./nginx.nix</span> <span class="c"># nginx config for litschi.dn42</span>
    74. 

  74.         <span class="p">];</span>
    75. 

  75.         <span class="nv">environment</span><span class="o">.</span><span class="nv">systemPackages</span> <span class="o">=</span> <span class="kn">with</span> <span class="nv">pkgs</span><span class="p">;</span> <span class="p">[</span> 
    76. 

  76.             <span class="c"># Network debug tools</span>
    77. 

  77.             <span class="nv">dnsutils</span>
    78. 

  78.             <span class="nv">mtr</span>
    79. 

  79.             <span class="nv">tcpdump</span>
    80. 

  80.             <span class="nv">wireguard-tools</span>
    81. 

  81.         <span class="p">];</span>
    82. 

  82.     <span class="p">}</span>
    83. 

  83. <span class="p">}</span>
    84. 

  84. </code></pre></div></div>
    85. 

  85. 

  86. <p>In theory the container should now be starting and you can get shell access  with <code class="language-plaintext highlighter-rouge">sudo nixos-container root-login &lt;name&gt;</code>.</p>
    87. 

  87. 

  88. <p>I mounted some host paths into the container for dns zone files and static homepage since the container is the only one providing .dn42 webservers.</p>
    89. 

  89. 

  90. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">containers</span><span class="o">.</span><span class="nv">dn42</span> <span class="o">=</span> <span class="p">{</span>
    91. 

  91.     <span class="nv">bindMounts</span> <span class="o">=</span> <span class="p">{</span>
    92. 

  92.         <span class="s2">"/var/www/dn42"</span> <span class="o">=</span> <span class="p">{</span>
    93. 

  93.             <span class="nv">hostPath</span> <span class="o">=</span> <span class="s2">"/var/www/dn42"</span><span class="p">;</span>
    94. 

  94.             <span class="nv">isReadOnly</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    95. 

  95.             <span class="nv">mountPoint</span> <span class="o">=</span> <span class="s2">"/var/www/dn42"</span><span class="p">;</span>
    96. 

  96.         <span class="p">};</span>
    97. 

  97.         <span class="s2">"/var/dns/dn42"</span> <span class="o">=</span> <span class="p">{</span>
    98. 

  98.             <span class="nv">hostPath</span> <span class="o">=</span> <span class="s2">"/var/dns/dn42"</span><span class="p">;</span>
    99. 

  99.             <span class="nv">isReadOnly</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    100. 

  100.             <span class="nv">mountPoint</span> <span class="o">=</span> <span class="s2">"/var/dns"</span><span class="p">;</span>
    101. 

  101.         <span class="p">};</span>
    102. 

  102.     <span class="p">};</span>
    103. 

  103. <span class="p">}</span>
    104. 

  104. </code></pre></div></div>
    105. 

  105. 

  106. <h3 id="network-setup">Network Setup</h3>
    107. 

  107. 

  108. <p>As mentioned above, I got a spare public IPv4 Address, but by adding it as <code class="language-plaintext highlighter-rouge">localAddress</code>, the container Part is configured static enough. But to forward traffic between Intferfaces <code class="language-plaintext highlighter-rouge">/proc/sys/net/</code> should configured</p>
    109. 

  109. 

  110. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">boot</span><span class="o">.</span><span class="nv">kernel</span><span class="o">.</span><span class="nv">sysctl</span> <span class="o">=</span> <span class="p">{</span>
    111. 

  111.     <span class="s2">"net.ipv4.ip_forward"</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span>
    112. 

  112.     <span class="s2">"net.ipv6.conf.all.forwarding"</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span>
    113. 

  113. <span class="p">};</span>
    114. 

  114. </code></pre></div></div>
    115. 

  115. <p>This allows our firewall to configure forwarding between peers and other tunnels. What is allowed to be forwarded can be configured in the firewall. Ferm has only few NixOS Options, but is pretty basic. Its configured with the <code class="language-plaintext highlighter-rouge">services.ferm.config</code> options, that contains just a string. Within this string there’s standard plain ferm config. Example config is attached below. 
    116. 

  116. If the dn42 address is not bound at any other Interface, you need to add it to the lo Interface to use it as source IP when routing via peers with dedicated transfer net.</p>
    117. 

  117. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">networking</span><span class="o">.</span><span class="nv">interfaces</span><span class="o">.</span><span class="nv">lo</span> <span class="o">=</span> <span class="p">{</span>
    118. 

  118.     <span class="nv">ipv4</span><span class="o">.</span><span class="nv">addresses</span> <span class="o">=</span> <span class="p">[</span>
    119. 

  119.         <span class="p">{</span>
    120. 

  120.             <span class="nv">address</span> <span class="o">=</span> <span class="s2">"172.23.73.65"</span><span class="p">;</span>
    121. 

  121.             <span class="nv">prefixLength</span> <span class="o">=</span> <span class="mi">32</span><span class="p">;</span>
    122. 

  122.         <span class="p">}</span>
    123. 

  123.     <span class="p">];</span>
    124. 

  124.     <span class="nv">ipv6</span><span class="o">.</span><span class="nv">addresses</span> <span class="o">=</span> <span class="p">[</span>
    125. 

  125.         <span class="p">{</span>
    126. 

  126.             <span class="nv">address</span> <span class="o">=</span> <span class="s2">"fd67:24bd:a1ea::1"</span><span class="p">;</span>
    127. 

  127.             <span class="nv">prefixLength</span> <span class="o">=</span> <span class="mi">128</span><span class="p">;</span>
    128. 

  128.         <span class="p">}</span>
    129. 

  129.     <span class="p">];</span>
    130. 

  130. <span class="p">};</span>
    131. 

  131. </code></pre></div></div>
    132. 

  132. 

  133. <h4 id="ferm-example">Ferm example</h4>
    134. 

  134. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">services</span><span class="o">.</span><span class="nv">ferm</span> <span class="o">=</span> <span class="p">{</span>
    135. 

  135.     <span class="nv">enable</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    136. 

  136.     <span class="nv">config</span> <span class="o">=</span> <span class="s2">''</span><span class="err">
    137. 

  137. </span><span class="s2">        domain ip table filter chain INPUT proto icmp ACCEPT;</span><span class="err">
    138. 

  138. </span><span class="s2">        domain ip6 table filter chain INPUT proto (ipv6-icmp icmp) ACCEPT;</span><span class="err">
    139. 

  139. </span><span class="s2">        domain (ip ip6) table filter {</span><span class="err">
    140. 

  140. </span><span class="s2">            chain INPUT {</span><span class="err">
    141. 

  141. </span><span class="s2">                policy DROP;</span><span class="err">
    142. 

  142. </span><span class="s2">                interface lo ACCEPT;</span><span class="err">
    143. 

  143. </span><span class="s2">                interface intern-+ ACCEPT;</span><span class="err">
    144. 

  144. </span><span class="s2">                # website</span><span class="err">
    145. 

  145. </span><span class="s2">                proto tcp dport (http https) ACCEPT;</span><span class="err">
    146. 

  146. </span><span class="s2">                # wireguard</span><span class="err">
    147. 

  147. </span><span class="s2">                proto udp dport ( &lt;Wireguard Ports&gt; ) ACCEPT;</span><span class="err">
    148. 

  148. </span><span class="s2">                # bgp</span><span class="err">
    149. 

  149. </span><span class="s2">                proto tcp dport (179) ACCEPT;</span><span class="err">
    150. 

  150. </span><span class="s2">                # dns</span><span class="err">
    151. 

  151. </span><span class="s2">                proto (udp tcp) dport domain ACCEPT;</span><span class="err">
    152. 

  152. </span><span class="s2">                mod state state (INVALID) DROP;</span><span class="err">
    153. 

  153. </span><span class="s2">                mod state state (ESTABLISHED RELATED) ACCEPT;</span><span class="err">
    154. 

  154. </span><span class="s2">            }</span><span class="err">
    155. 

  155. </span><span class="s2">            chain OUTPUT {</span><span class="err">
    156. 

  156. </span><span class="s2">                policy ACCEPT;</span><span class="err">
    157. 

  157. </span><span class="s2">            }</span><span class="err">
    158. 

  158. </span><span class="s2">            chain FORWARD {</span><span class="err">
    159. 

  159. </span><span class="s2">                policy DROP;</span><span class="err">
    160. 

  160. </span><span class="s2">                # allow intern routing and dn42 forwarding</span><span class="err">
    161. 

  161. </span><span class="s2">                interface dn42-+ outerface dn42-+ ACCEPT;</span><span class="err">
    162. 

  162. </span><span class="s2">                interface intern-+ outerface intern-+ ACCEPT;</span><span class="err">
    163. 

  163. </span><span class="s2">                interface intern-+ outerface dn42-+ ACCEPT;</span><span class="err">
    164. 

  164. </span><span class="s2">                # but dn42 -&gt; intern only with execptions</span><span class="err">
    165. 

  165. </span><span class="s2">                interface dn42-+ outerface intern-+ {</span><span class="err">
    166. 

  166. </span><span class="s2">                    proto (ipv6-icmp icmp) ACCEPT; # Allow SSH Access from dn42 to devices behind intern-+ Interfaces</span><span class="err">
    167. 

  167. </span><span class="s2">                    proto tcp dport (ssh) ACCEPT;</span><span class="err">
    168. 

  168. </span><span class="s2">                    mod state state (ESTABLISHED) ACCEPT;</span><span class="err">
    169. 

  169. </span><span class="s2">                }</span><span class="err">
    170. 

  170. </span><span class="s2">            }</span><span class="err">
    171. 

  171. </span><span class="s2">        }</span><span class="err">
    172. 

  172. </span><span class="s2">    ''</span><span class="p">;</span>
    173. 

  173. <span class="p">};</span>
    174. 

  174. </code></pre></div></div>
    175. 

  175. 

  176. <h3 id="peering-with-wireguard">Peering with wireguard</h3>
    177. 

  177. 

  178. <p>Explained above, every peer gets a dedicated wireguard Interface and so a dedicated file. In the container config folder theres a peer subfolder and within a folder for dn42- (extern) Peers and intern- configs e.g. my Home Router or mobile devices.</p>
    179. 

  179. 

  180. <p>A sample wireguard config may look like this:</p>
    181. 

  181. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="p">{</span><span class="nv">config</span><span class="p">,</span> <span class="nv">pkgs</span><span class="p">,</span> <span class="o">...</span><span class="p">}:</span>
    182. 

  182. <span class="p">{</span>
    183. 

  183.     <span class="nv">networking</span><span class="o">.</span><span class="nv">wireguard</span><span class="o">.</span><span class="nv">interfaces</span><span class="o">.</span><span class="nv">dn42-peer</span> <span class="o">=</span> <span class="p">{</span>
    184. 

  184.         <span class="nv">privateKey</span> <span class="o">=</span> <span class="s2">""</span><span class="p">;</span>
    185. 

  185.         <span class="nv">allowedIPsAsRoutes</span> <span class="o">=</span> <span class="kc">false</span><span class="p">;</span>
    186. 

  186.         <span class="nv">listenPort</span> <span class="o">=</span> <span class="mi">42420</span><span class="p">;</span>
    187. 

  187. 

  188.         <span class="nv">peers</span> <span class="o">=</span> <span class="p">[</span>
    189. 

  189.             <span class="p">{</span>
    190. 

  190.                 <span class="nv">publicKey</span> <span class="o">=</span> <span class="s2">""</span><span class="p">;</span>
    191. 

  191.                 <span class="nv">allowedIPs</span> <span class="o">=</span> <span class="p">[</span> <span class="s2">"0.0.0.0/0"</span> <span class="s2">"::/0"</span> <span class="p">];</span>
    192. 

  192.                 <span class="nv">endpoint</span> <span class="o">=</span> <span class="s2">"42.42.42.42:42421"</span><span class="p">;</span>
    193. 

  193.             <span class="p">}</span>
    194. 

  194.         <span class="p">];</span>
    195. 

  195.         <span class="nv">postSetup</span> <span class="o">=</span> <span class="s2">''</span><span class="err">
    196. 

  196. </span><span class="s2">            </span><span class="si">${</span><span class="nv">pkgs</span><span class="o">.</span><span class="nv">iproute</span><span class="si">}</span><span class="s2">/bin/ip addr add 169.254.0.1/32 peer 169.254.0.0/32 dev dn42-peer</span><span class="err">
    197. 

  197. </span><span class="s2">            </span><span class="si">${</span><span class="nv">pkgs</span><span class="o">.</span><span class="nv">iproute</span><span class="si">}</span><span class="s2">/bin/ip -6 addr add fe80::1220/64 dev dn42-peer</span><span class="err">
    198. 

  198. </span><span class="s2">        ''</span><span class="p">;</span>
    199. 

  199.     <span class="p">};</span>
    200. 

  200. <span class="p">}</span>
    201. 

  201. </code></pre></div></div>
    202. 

  202. 

  203. <p>As seen, the IP configuration is applied via ip-commands in the postSetup. This kinda works but isn’t a fancy solution. There’s room for improvements e.g. configuring static addresses and routes with networkd.</p>
    204. 

  204. 

  205. <h3 id="bgp-routing-with-bird2">BGP Routing with bird2</h3>
    206. 

  206. 

  207. <p>Like ferm, Bird2 is configured by <code class="language-plaintext highlighter-rouge">services.bird2.config</code> containing a string. In there the example bird2 config from <a href="/howto/Bird2">wiki.dn42</a> can be imported. Roa tables can be generated or downloaded from host providing them.</p>
    208. 

  208. 

  209. <h4 id="roa-updating-script">ROA Updating script</h4>
    210. 

  210. 

  211. <p>Sample example to update ROA’s :</p>
    212. 

  212. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="p">{</span> <span class="nv">pkgs</span><span class="p">,</span> <span class="nv">lib</span><span class="p">,</span> <span class="o">...</span> <span class="p">}:</span>
    213. 

  213. <span class="kd">let</span> <span class="nv">script</span> <span class="o">=</span> <span class="nv">pkgs</span><span class="o">.</span><span class="nv">writeShellScriptBin</span> <span class="s2">"update-roa"</span> <span class="s2">''</span><span class="err">
    214. 

  214. </span><span class="s2">    mkdir -p /etc/bird/</span><span class="err">
    215. 

  215. </span><span class="s2">    </span><span class="si">${</span><span class="nv">pkgs</span><span class="o">.</span><span class="nv">curl</span><span class="si">}</span><span class="s2">/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42_v6.conf https://dn42.burble.com/roa/dn42_roa_bird2_6.conf</span><span class="err">
    216. 

  216. </span><span class="s2">    </span><span class="si">${</span><span class="nv">pkgs</span><span class="o">.</span><span class="nv">curl</span><span class="si">}</span><span class="s2">/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42.conf https://dn42.burble.com/roa/dn42_roa_bird2_4.conf</span><span class="err">
    217. 

  217. </span><span class="s2">    </span><span class="si">${</span><span class="nv">pkgs</span><span class="o">.</span><span class="nv">bird2</span><span class="si">}</span><span class="s2">/bin/birdc c </span><span class="err">
    218. 

  218. </span><span class="s2">    </span><span class="si">${</span><span class="nv">pkgs</span><span class="o">.</span><span class="nv">bird2</span><span class="si">}</span><span class="s2">/bin/birdc reload in all</span><span class="err">
    219. 

  219. </span><span class="s2">    ''</span><span class="p">;</span>
    220. 

  220. <span class="kn">in</span>
    221. 

  221. <span class="p">{</span>
    222. 

  222.     <span class="nv">systemd</span><span class="o">.</span><span class="nv">timers</span><span class="o">.</span><span class="nv">dn42-roa</span> <span class="o">=</span> <span class="p">{</span>
    223. 

  223.         <span class="nv">description</span> <span class="o">=</span> <span class="s2">"Trigger a ROA table update"</span><span class="p">;</span>
    224. 

  224. 

  225.         <span class="nv">timerConfig</span> <span class="o">=</span> <span class="p">{</span>
    226. 

  226.             <span class="nv">OnBootSec</span> <span class="o">=</span> <span class="s2">"5m"</span><span class="p">;</span>
    227. 

  227.             <span class="nv">OnUnitInactiveSec</span> <span class="o">=</span> <span class="s2">"1h"</span><span class="p">;</span>
    228. 

  228.             <span class="nv">Unit</span> <span class="o">=</span> <span class="s2">"dn42-roa.service"</span><span class="p">;</span>
    229. 

  229.         <span class="p">};</span>
    230. 

  230. 

  231.         <span class="nv">wantedBy</span> <span class="o">=</span> <span class="p">[</span> <span class="s2">"timers.target"</span> <span class="p">];</span>
    232. 

  232.         <span class="nv">before</span> <span class="o">=</span> <span class="p">[</span> <span class="s2">"bird.service"</span> <span class="p">];</span>
    233. 

  233.     <span class="p">};</span>
    234. 

  234. 

  235.     <span class="nv">systemd</span><span class="o">.</span><span class="nv">services</span> <span class="o">=</span> <span class="p">{</span>
    236. 

  236.         <span class="nv">dn42-roa</span> <span class="o">=</span> <span class="p">{</span>
    237. 

  237.             <span class="nv">after</span> <span class="o">=</span> <span class="p">[</span> <span class="s2">"network.target"</span> <span class="p">];</span>
    238. 

  238.             <span class="nv">description</span> <span class="o">=</span> <span class="s2">"DN42 ROA Updated"</span><span class="p">;</span>
    239. 

  239.             <span class="nv">unitConfig</span> <span class="o">=</span> <span class="p">{</span>
    240. 

  240.                 <span class="nv">Type</span> <span class="o">=</span> <span class="s2">"one-shot"</span><span class="p">;</span>
    241. 

  241.             <span class="p">};</span>
    242. 

  242.             <span class="nv">serviceConfig</span> <span class="o">=</span> <span class="p">{</span>
    243. 

  243.                 <span class="nv">ExecStart</span> <span class="o">=</span> <span class="s2">"</span><span class="si">${</span><span class="nv">script</span><span class="si">}</span><span class="s2">/bin/update-roa"</span><span class="p">;</span>
    244. 

  244.             <span class="p">};</span>
    245. 

  245.         <span class="p">};</span>
    246. 

  246.     <span class="p">};</span>
    247. 

  247. <span class="p">}</span>
    248. 

  248. </code></pre></div></div>
    249. 

  249. 

  250. <h3 id="bird-looking-glass">Bird Looking Glass</h3>
    251. 

  251. 

  252. <p>There is now (thanks to <a href="https://github.com/NixOS/nixpkgs/pull/153481">Tchekda</a>) a direct way to setup a looking glass for bird on Nixos. <a href="https://github.com/NixOS/nixpkgs/blob/3aab5ebd436023ca8343a84804d51cd227dd01dd/nixos/modules/services/networking/bird-lg.nix">Documentation</a> and sample :</p>
    253. 

  253. 

  254. <div class="language-nix highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">bird-lg</span> <span class="o">=</span> <span class="p">{</span>
    255. 

  255.     <span class="nv">proxy</span> <span class="o">=</span> <span class="p">{</span>
    256. 

  256.         <span class="nv">enable</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    257. 

  257.         <span class="nv">allowedIPs</span> <span class="o">=</span> <span class="p">[</span> <span class="s2">"172.20.XX.XX"</span> <span class="s2">"172.20.XX.YY"</span> <span class="p">];</span>
    258. 

  258.     <span class="p">};</span>
    259. 

  259.     <span class="nv">frontend</span> <span class="o">=</span> <span class="p">{</span>
    260. 

  260.         <span class="nv">enable</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
    261. 

  261.         <span class="nv">netSpecificMode</span> <span class="o">=</span> <span class="s2">"dn42"</span><span class="p">;</span>
    262. 

  262.         <span class="nv">servers</span> <span class="o">=</span> <span class="p">[</span> <span class="s2">"node1"</span> <span class="s2">"node2"</span> <span class="p">];</span>
    263. 

  263.         <span class="nv">domain</span> <span class="o">=</span> <span class="s2">"domain.dn42"</span><span class="p">;</span>
    264. 

  264.     <span class="p">};</span>
    265. 

  265. <span class="p">};</span>
    266. 

  266. </code></pre></div></div>
    267. 

  267. 

  268. <h3 id="services">Services</h3>
    269. 

  269. 

  270. <p>I also run services like a nameserver for .litschi.dn42 zones and a nginx webserver within this container. Since Host path for <code class="language-plaintext highlighter-rouge">/var/www/dn42</code> and <code class="language-plaintext highlighter-rouge">/var/dns/dn42</code> are booth binded into the container, zone config and e.g. website and be edited directly from Host without need the rebuild the hole container.</p>
    271. 

  271. 

  272. <h3 id="sample-configuration">Sample configuration</h3>
    273. 

  273. 

  274. <p>You can find a sample Wireguard + Bird configuration made by Tchekda ready for dn42 on <a href="https://github.com/Tchekda/nixos-configuration/tree/master/llitt/dn42">this</a> repository</p>
    275. 

  275. 

  276. 

  277. 

  278. 

  279.             <div id="menu-container" class="menu-container">
    280. 

  280.                 <hr>
    281. 

  281.                 <div id="menu" class="menu">
    282. 

  282.                     
    283. 

  283.                     <ul>
    284. 

  284.   <li><a href="/Home">Home</a>
    285. 

  285.     <ul>
    286. 

  286.       <li><a href="/howto/Getting-Started">Getting Started</a></li>
    287. 

  287.       <li><a href="/howto/Registry-Authentication">Registry Authentication</a></li>
    288. 

  288.       <li><a href="/howto/Address-Space">Address Space</a></li>
    289. 

  289.       <li><a href="/howto/BGP-communities">BGP communities</a></li>
    290. 

  290.       <li><a href="/FAQ">FAQ</a></li>
    291. 

  291.     </ul>
    292. 

  292.   </li>
    293. 

  293.   <li>How-To
    294. 

  294.     <ul>
    295. 

  295.       <li><a href="/howto/wireguard">Wireguard</a></li>
    296. 

  296.       <li><a href="/howto/openvpn">Openvpn</a></li>
    297. 

  297.       <li><a href="/howto/IPsec-with-PublicKeys">IPsec With Public Keys</a></li>
    298. 

  298.       <li><a href="/howto/tinc">Tinc</a></li>
    299. 

  299.       <li><a href="/howto/GRE-on-FreeBSD">GRE on FreeBSD</a></li>
    300. 

  300.       <li><a href="/howto/GRE-on-OpenBSD">GRE on OpenBSD</a></li>
    301. 

  301.       <li><a href="/howto/IPv6-Multicast">IPv6 Multicast (PIM-SM)</a></li>
    302. 

  302.       <li><a href="/howto/multicast">SSM Multicast</a></li>
    303. 

  303.       <li><a href="/howto/mpls">MPLS</a></li>
    304. 

  304.       <li><a href="/howto/Bird2">Bird2</a></li>
    305. 

  305.       <li><a href="/howto/frr">FRRouting</a></li>
    306. 

  306.       <li><a href="/howto/OpenBGPD">OpenBGPD</a></li>
    307. 

  307.       <li><a href="/howto/mikrotik">Mikrotik RouterOS</a></li>
    308. 

  308.       <li><a href="/howto/EdgeOS-Config">EdgeRouter</a></li>
    309. 

  309.       <li><a href="/howto/Static-routes-on-Windows">Static routes on Windows</a></li>
    310. 

  310.       <li><a href="/howto/networksettings">Universal Network Requirements</a></li>
    311. 

  311.       <li><a href="/howto/vyos1.4.x">VyOS</a></li>
    312. 

  312.       <li><a href="/howto/nixos">NixOS</a></li>
    313. 

  313.     </ul>
    314. 

  314.   </li>
    315. 

  315.   <li>Services
    316. 

  316.     <ul>
    317. 

  317.       <li><a href="/services/IRC">IRC</a></li>
    318. 

  318.       <li><a href="/services/Whois">Whois registry</a></li>
    319. 

  319.       <li><a href="/services/DNS">DNS</a></li>
    320. 

  320.       <li><a href="/services/IX-Collection">IX Collection</a></li>
    321. 

  321.       <li><a href="/services/Clearnet-Domains">Public DNS</a></li>
    322. 

  322.       <li><a href="/services/Looking-Glasses">Looking Glasses</a></li>
    323. 

  323.       <li><a href="/services/Automatic-Peering">Automatic Peering</a></li>
    324. 

  324.       <li><a href="/services/Repository-Mirrors">Repository Mirrors</a></li>
    325. 

  325.       <li><a href="/services/Distributed-Wiki">Distributed Wiki</a></li>
    326. 

  326.       <li><a href="/services/Certificate-Authority">Certificate Authority</a></li>
    327. 

  327.       <li><a href="/services/Route-Collector">Route Collector</a></li>
    328. 

  328.     </ul>
    329. 

  329.   </li>
    330. 

  330.   <li>Internal
    331. 

  331.     <ul>
    332. 

  332.       <li><a href="/internal/Internal-Services">Internal services</a></li>
    333. 

  333.       <li><a href="/internal/Interconnections">Interconnections</a></li>
    334. 

  334.       <li><a href="/internal/APIs">APIs</a></li>
    335. 

  335.       <li><a href="/internal/ShowAndTell">Show and Tell</a></li>
    336. 

  336.       <li><a href="/internal/Historical-Services">Historical services</a></li>
    337. 

  337.     </ul>
    338. 

  338.   </li>
    339. 

  339.   <li>Historical
    340. 

  340.     <ul>
    341. 

  341.       <li><a href="/historical/Bird">Bird 1</a></li>
    342. 

  342.       <li><a href="/historical/Quagga">Quagga</a></li>
    343. 

  343.     </ul>
    344. 

  344.   </li>
    345. 

  345.   <li>External Tools
    346. 

  346.     <ul>
    347. 

  347.       <li><a href="https://paste.dn42.us">Paste Board</a></li>
    348. 

  348.       <li><a href="https://git.dn42.dev">Git Repositories</a></li>
    349. 

  349.     </ul>
    350. 

  350.   </li>
    351. 

  351. </ul>
    352. 

  352. 

  353. <hr />
    354. 

  354. 

  355. 

  356.                 </div>
    357. 

  357.             </div>
    358. 

  358.         </main>
    359. 

  359.         
    360. 

  360.         <footer><div class="center">
    361. 

  361.     <div id="dn42_footer">
    362. 

  362.         
    363. 

  363.         <table>
    364. 

  364.   <tbody>
    365. 

  365.     <tr>
    366. 

  366.       <td>Hosted by: <a href="mailto:dn42@burble.com">BURBLE-MNT</a>, <a href="mailto:nurtic-vibe@grmml.net">GRMML-MNT</a>, <a href="mailto:xuu@dn42.us">XUU-MNT</a>, <a href="mailto:janeric@ortgies.it">JAN-MNT</a>, <a href="mailto:lare@lare.cc">LARE-MNT</a>, <a href="mailto:danny@saru.moe">SARU-MNT</a>, <a href="mailto:androw95220@gmail.com">ANDROW-MNT</a>, <a href="mailto:dn42@mk16.de">MARK22K-MNT</a></td>
    367. 

  367.       <td>Accessible via: <a href="https://wiki.dn42">dn42</a>, <a href="https://dn42.dev/">dn42.dev</a>, <a href="https://dn42.eu/">dn42.eu</a>, <a href="https://wiki.dn42.us/">wiki.dn42.us</a>, <a href="https://dn42.de/">dn42.de</a> (IPv6-only), <a href="https://dn42.cc/">dn42.cc</a> (wiki-ng), <a href="https://dn42.wiki/">dn42.wiki</a>, <a href="https://dn42.pp.ua/">dn42.pp.ua</a>, <a href="https://dn42.obl.ong/">dn42.obl.ong</a></td>
    368. 

  368.     </tr>
    369. 

  369.   </tbody>
    370. 

  370. </table>
    371. 

  371. 

  372.     </div>
    373. 

  373. </div>
    374. 

  374. </footer>
    375. 

  375. 

  376.         
    377. 

  377. 

  378.     </body>
    379. 

  379. 

  380. </html>
    381. 

  381.