Jack O'Sullivan
fdc65c544e
All checks were successful
CI / Check, build and cache Nix flake (push) Successful in 35m51s
76 lines
1.9 KiB
Nix
76 lines
1.9 KiB
Nix
index: { lib, pkgs, config, ... }:
|
|
let
|
|
inherit (builtins) attrNames concatMap;
|
|
inherit (lib) optional;
|
|
inherit (lib.my) net;
|
|
inherit (lib.my.c.home) prefixes vips;
|
|
|
|
pingScriptFor = ip: {
|
|
script = "${pkgs.iputils}/bin/ping -qnc 1 ${ip}";
|
|
interval = 1;
|
|
timeout = 1;
|
|
rise = 3;
|
|
fall = 3;
|
|
};
|
|
|
|
vlanIface = vlan: if vlan == "as211024" then vlan else "lan-${vlan}";
|
|
vrrpIPs = family: concatMap (vlan: (optional (family == "v6") {
|
|
addr = "fe80::1/64";
|
|
dev = vlanIface vlan;
|
|
}) ++ [
|
|
{
|
|
addr = "${vips.${vlan}.${family}}/${toString (net.cidr.length prefixes.${vlan}.${family})}";
|
|
dev = vlanIface vlan;
|
|
}
|
|
]) (attrNames vips);
|
|
mkVRRP = family: routerId: {
|
|
state = if index == 0 then "MASTER" else "BACKUP";
|
|
interface = "lan-core";
|
|
priority = 255 - index;
|
|
virtualRouterId = routerId;
|
|
virtualIps = vrrpIPs family;
|
|
trackScripts = [ "${family}Alive" ];
|
|
extraConfig = ''
|
|
notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
|
|
notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
users = with lib.my.c.ids; {
|
|
users.keepalived_script = {
|
|
uid = uids.keepalived_script;
|
|
isSystemUser = true;
|
|
group = "keepalived_script";
|
|
};
|
|
groups.keepalived_script.gid = gids.keepalived_script;
|
|
};
|
|
|
|
services = {
|
|
keepalived = {
|
|
enable = true;
|
|
enableScriptSecurity = true;
|
|
extraGlobalDefs = ''
|
|
vrrp_version 3
|
|
nftables keepalived
|
|
'';
|
|
vrrpScripts = {
|
|
v4Alive = pingScriptFor "1.1.1.1";
|
|
v6Alive = pingScriptFor "2600::";
|
|
};
|
|
vrrpInstances = {
|
|
v4 = mkVRRP "v4" 51;
|
|
v6 = mkVRRP "v6" 52;
|
|
};
|
|
extraConfig = ''
|
|
vrrp_sync_group main {
|
|
group {
|
|
v4
|
|
v6
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
}
|