<eyJhb>
Anyone have a basic NixOS configuration for their own router they would like to share, before I start messing up my pfSense install and wiping it?
<q3k>
what kind of router?
<q3k>
i have some bgp router stuff, not sure if you're looking for that or a home gateway sort of deal
<eyJhb>
q3k: Configs, not router hardware, already have the hardware (SuperMicro stuff) :D
<q3k>
but generally i'd just do it incrementally instead of trying to copy others' configs
<q3k>
no i undesrtand that
<eyJhb>
But I think I have a bare minimum configuration now, so I can just get ethernet now
<q3k>
but i'm not sure what sort of router _logic_ you're looking for
<eyJhb>
Ah
<eyJhb>
Currently, just anything bare minimum that gives me internet
<q3k>
that's easy
<q3k>
just follow the nixos installation manual
<eyJhb>
After that, I need to setup my OpenVPN client, and forward ports using that again
<q3k>
unless by 'gives me internet' you mean acts as a NAT
<q3k>
okay, you likely mean the whole home gateway stuff, i don't have an example for that
<eyJhb>
Acts as NAT, this is afterall router channel :D
<q3k>
router is an overloaded terms
<q3k>
internet routers generally don't NAT
<q3k>
you're looking for 'home gateway' if you wanna be nitpicky
<q3k>
anyway, start simple (maybe in a VM), build up on that
<q3k>
if you stumble on some issues just ping someone here
<eyJhb>
Yeah, don't know how I will get much internet while I am doing it, so I have just downloaded a bunch of confs, and hoping that my minimal config will work. Because I don't know how well my Android AP will work
<q3k>
honestly, start in a VM, then port the config
<q3k>
if you get it to work in a simulated environment, then you can just transplat configuration.nix to the real thing and it should just work
<eyJhb>
Well, VM would require a dev setup in the form of a minimal network
<q3k>
that's like 5 clicks in virt-manager if you're using libvirt :P
<eyJhb>
That is a future plan as well! I am using my much hated VirtualBox.. Only hate it because it needs to recompile. .Every ... Single.. Upgrade... :p
pie_ has quit [Ping timeout: 265 seconds]
<eyJhb>
Well well well, something works q3k ! :p
<eyJhb>
Now I should probably setup some DNS server on my .. gateway? Or what did we end up calling it , and fine tune the configuration a little bit :D
<q3k>
give it a cute name
<eyJhb>
Isn't "srrouter" a cute name? :/
<q3k>
nsd and unbound!
<q3k>
that's my to-go combo for a recursor and authoritative nameserver
<q3k>
nothing ready to share, my dns is still running on an ubuntu box
<qyliss>
I run unbound on my VPS
<eyJhb>
Damn :p Lets see how many times I will loose my internet
<qyliss>
it was services.unbound.enable = true; for me
<eyJhb>
I probably need to edit allowedAccess as well, else it seems good-to-go
<q3k>
yep
<q3k>
also forwardAddresses if you want to forward instaead of recursing
<eyJhb>
I would use forwardAddresses if I want nsd+unbound, right?
<q3k>
no, if you want to use something like your ISP DNS or 8.8.8.8 for your DNS
<q3k>
for nsd, you want to use stub zones, and I think those are not exposed directly as nixos options, you have to append a config
<q3k>
something like
<q3k>
stub-zone:
<q3k>
name: "foo.example.com"
<q3k>
stub-addr: 127.0.0.1@5353
<q3k>
and then run nsd on port 5353
<cransom>
is there a good reason to use nsd+unbound over dnsmasq? i've been using dnsmasq for forever as the dhcp+dns functionality is basically essential to me and bind+dhcpd of old was painful to setup/maintain.
<q3k>
dnsmasq is somewhat simplistic
<q3k>
it can't do things like stub zones, only simple hosts-style overrides
<q3k>
not sure it can do things like dhcp proxying either
<q3k>
you might not need those, but I do, hence why I automatically recommnd nsd/unbound/isc_dhcp
<cransom>
on the plus side, dnsmasq doesn't redirect you to a climate strike page when are looking for docs on it with no option to find what you really want after reading their plea.
<qyliss>
wouldn't call that a plus side
<q3k>
wasn't that troubleshooters site unrealted to official docs?
<qyliss>
although, what are you talking about? I can see unbound's docs fine