jackos1998
14d9bba4eb
Clients were handed both routers' real addresses as resolvers, so a downed router meant per-query resolver timeouts. Serve pdns-recursor on the VRRP VIPs (with non-local bind so the backup can pre-bind them) and advertise the VIP via kea and radvd, so DNS follows the master. untrusted advertises Cloudflare over v6 to match its v4 config. ipsec started before the WAN's public IP was up: stream's wan carries a static modem address that satisfies wait-online before the DHCP lease, so libreswan loaded its mesh conns (left=<public IP>) unoriented and never initiated. Gate stream's wan-online.target on the DHCP default route instead, and mkForce ipsec onto wan-online.target only (dropping the strongswan/libreswan multi-user.target pull-in) so the gate actually holds on both boxes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
999 B
Nix
36 lines
999 B
Nix
index: { lib, pkgs, ... }:
|
|
let
|
|
inherit (lib) mkForce concatMapStringsSep;
|
|
inherit (lib.my) net;
|
|
inherit (lib.my.c.home) domain prefixes vips;
|
|
|
|
# untrusted uses external (Cloudflare) resolvers, matching the v4 kea config;
|
|
# trusted VLANs use the internal recursor via its floating VRRP VIP
|
|
rdnss = name:
|
|
if name == "untrusted"
|
|
then "2606:4700:4700::1111 2606:4700:4700::1001"
|
|
else vips."${name}".v6;
|
|
|
|
mkInterface = name: ''
|
|
interface lan-${name} {
|
|
AdvSendAdvert on;
|
|
AdvRASrcAddress { fe80::1; };
|
|
AdvLinkMTU ${toString prefixes."${name}".mtu};
|
|
prefix ${prefixes."${name}".v6} {};
|
|
RDNSS ${rdnss name} {};
|
|
DNSSL ${domain} dyn.${domain} ${lib.my.c.colony.domain} ${lib.my.c.britway.domain} {};
|
|
};
|
|
'';
|
|
in
|
|
{
|
|
# To be started by keepalived
|
|
systemd.services.radvd.wantedBy = mkForce [ ];
|
|
|
|
services = {
|
|
radvd = {
|
|
enable = true;
|
|
config = concatMapStringsSep "\n" mkInterface [ "hi" "lo" "untrusted" ];
|
|
};
|
|
};
|
|
}
|