51f8ccef1a
- mango-dns -> wan-dns-update (module, script, systemd units): same job (keep ipv6-test.0ff.space's AAAA pointed at the current WAN address), now named for what actually provides the uplink (Nokia tethering). - Drop the dead `networking.dhcpcd.extraConfig` block in hosts/pinix/configuration.nix (end0 is the tnix maintenance link now, not an uplink; router-uplink.nix's mkForce for wan0 already won here). - Fix stale "Mango" wording in configuration.nix and localServices/tailscale.nix to describe the actual Nokia/pinix-router-dns setup. - Remove the now-dead transitional `enp1s0u1u2` dhcpcd stanza in router-uplink.nix -- wan0 has been the stable name across several reconnects/reboots. Not touched: scripts/pinix-reachability-probe.sh, scripts/configure-mango-dns.sh, docs/pinix-reboot-probe.md, docs/pinix-bind.md -- built entirely around the old Mango DNAT setup (uci/nft on the Mango itself), need their own rework for the Nokia uplink rather than a rename. Noted in docs/pinix-router-migration.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5FvfdKcQjEFQ4aLrepcS1
91 lines
3.1 KiB
Nix
91 lines
3.1 KiB
Nix
{ config, lib, pkgs, inputs, ... }:
|
|
|
|
# Raspberry Pi 4, bestehende Hardware statt Neuanschaffung -- Kriterien in
|
|
# docs/operator-prompt.md §0 (Energieeffizienz, vorhandene Hardware
|
|
# weiterverwenden). Lokales Bauen ist hier ausdrücklich vorgesehen: weil
|
|
# die Konfiguration deklarativ ist, lässt sich die Maschine verlustfrei
|
|
# auf das Nötige reduzieren und dann direkt auf der Zielhardware testen
|
|
# -- eine Abhängigkeit weniger. Siehe docs/pinix-minimalbetrieb.md und
|
|
# den Abschnitt "Lokal auf pinix bauen" in CLAUDE.md. SD-Karten-Verschleiß
|
|
# bleibt ein Abwägungsgrund, kein Verbot.
|
|
{
|
|
imports =
|
|
[
|
|
./hardware-configuration.nix
|
|
./router-uplink.nix
|
|
./router-lan.nix
|
|
../user/drone.nix
|
|
../globalServices/default.nix
|
|
./localServices/default.nix
|
|
# ./disko.nix
|
|
];
|
|
|
|
|
|
networking.firewall.allowedTCPPorts = [22 8050 8012 8026 3000 9000];
|
|
networking = {
|
|
wireless.enable = true;
|
|
wireless.secretsFile = config.age.secrets.wirelessSecretsFile.path;
|
|
# wireless.networks.idea.pskRaw = "ext:psk_mango";
|
|
wireless.networks.Vodafone-E6EF.pskRaw = "ext:psk_home";
|
|
interfaces.wlan0.useDHCP = true;
|
|
# Fester Wartungszugang von tnix (192.168.50.2), unabhängig vom Uplink.
|
|
# useDHCP/SLAAC überschreibt ../router-uplink.nix (mkForce false).
|
|
interfaces.end0.useDHCP = true;
|
|
interfaces.end0.ipv4.addresses = [
|
|
{ address = "192.168.50.1"; prefixLength = 24; }
|
|
];
|
|
};
|
|
|
|
documentation.nixos.enable = false;
|
|
|
|
#boot.kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
|
|
boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" ];
|
|
boot.loader.grub.enable = false;
|
|
boot.loader.generic-extlinux-compatible.enable = true;
|
|
|
|
# fileSystems."/".device = "/dev/disk/by-label/NIXOS_SD";
|
|
# fileSystems."/".fsType = "ext4";
|
|
# fileSystems."/".options = [ "noatime" ];
|
|
|
|
nixpkgs.config.allowUnfree = true;
|
|
nixpkgs.config.allowUnsupportedSystems = true;
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
nix.settings.trusted-users = [ "root" "builder" "@wheel" ];
|
|
|
|
networking.hostName = "pinix"; # Define your hostname.
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
console = {
|
|
keyMap = "de";
|
|
};
|
|
|
|
environment.variables = {
|
|
EDITOR = "nvim";
|
|
VISUAL = "nvim";
|
|
};
|
|
|
|
|
|
system.stateVersion = "25.11"; # Did you read the comment?
|
|
|
|
|
|
# Aufgeraeumt am 13.09.2026: end0 ist seit der Router-Migration
|
|
# (docs/pinix-router-migration.md) der feste Wartungslink zu tnix, kein
|
|
# Uplink mehr -- das fruehere "interface end0 / nooption routers" hier war
|
|
# ohnehin schon tot (router-uplink.nix setzt networking.dhcpcd.extraConfig
|
|
# per mkForce fuer wan0 und gewinnt).
|
|
|
|
# MagicDNS ist aus (localServices/tailscale.nix), damit der DNS64-Resolver
|
|
# von router-uplink.nix (pinix-router-dns) greift. Ersatz für die
|
|
# Tailnet-Namen:
|
|
networking.hosts =
|
|
(lib.mapAttrs' (name: ip: lib.nameValuePair ip [ name ]) config.tailnetIPs)
|
|
// {
|
|
# The new identity services reach each other through their public TLS
|
|
# names, but must not hairpin through the WAN's public NAT66 path.
|
|
"127.0.0.1" = [
|
|
"dex.${config.domain2}"
|
|
"head.${config.domain2}"
|
|
];
|
|
};
|
|
}
|