配置NixOS为简单路由

设备

Intel N100 16G
enp1s0/enp3s0
WD 4TB/ WD 1TB
主机名定义为 aio

需求

路由 enp1s0为WAN/enp3s0为LAN 要求NAT以及DHCP
文件服务器将两块硬盘的内容使用samba共享
动画下载也就是AutoBangumi以及qbittorrent-nox

实现

分区与挂载

  fileSystems = {
    "/" =
    { device = "/dev/disk/by-uuid/34ccdcee-e0ae-43e6-aec3-9ba5904b704d";
      fsType = "ext4";
    };

    "/boot" = 
    { device = "/dev/disk/by-uuid/9513-000D";
      fsType = "vfat";
    };

    "/sdcard/windows" = {
      device = "/dev/disk/by-uuid/C0AE39E1AE39D0A0";
      fsType = "ntfs3";
      options = [ "nofail" "defaults" "uid=1000" "gid=1000" "umask=0000" ]; 
    };

    "/sdcard/d" = {
      device = "/dev/disk/by-uuid/1CF6-DFC3";
      fsType = "exfat";
      options = [ "nofail" "defaults" "rw" "uid=1000" "gid=1000" "umask=0000" ];
    };

    "/sdcard/e" = {
      device = "/dev/disk/by-uuid/7872A3FA8878CBCC";
      fsType = "ntfs3";
      options = [ "nofail" "defaults" "uid=1000" "gid=1000" "umask=0000" ];
    };
  };

路由功能

IP转发

  boot.kernel.sysctl = {
    # if you use ipv4, this is all you need
    "net.ipv4.conf.all.forwarding" = true;
  };

NixOS的默认配置中已开启DHCP

    networking.useDHCP = lib.mkDefault true;

为enp3s0设置静态地址

关闭防火墙

开启 masquerade NAT

  networking = {
    hostName = "aio"; # Define your hostname.
    firewall.enable = false; # Disable firewall to use nftables
    # Pick only one of the below networking options.
    #  networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
    networkmanager.enable = true;  # Easiest to use and most distros use this by default.

    interfaces = {
      enp3s0 = {
        useDHCP = false;
        ipv4.addresses = [{
          address = "192.168.2.1";
          prefixLength = 24;
        }];
      };
    };

    nftables = {
      enable = true;
      ruleset = ''
        table ip nat {
          chain postrouting {
            type nat hook postrouting priority 100; policy accept;
            oifname "enp1s0" masquerade
          }
        }
      '';
    };
  };

kea开启DHCP

dhcpd已经EOL，因此只能使用kea去配置DHCP。


  services.kea = {
    dhcp4 = {
      enable = true;
      settings = {
      interfaces-config = {
        interfaces = [
          "enp3s0"
        ];
      };
      lease-database = {
        name = "/var/lib/kea/dhcp4.leases";
        persist = true;
        type = "memfile";
      };
      rebind-timer = 2000;
      renew-timer = 1000;
      subnet4 = [
        {
          id = 1;
          pools = [
            {
              pool = "192.168.2.100 - 192.168.2.200";
            }
          ];
          subnet = "192.168.2.0/24";
          option-data = [
              { name = "routers"; data = "192.168.2.1"; }
              { name = "domain-name-servers"; data = "8.8.8.8, 114.114.114.114"; }
          ];
        }
      ];
        valid-lifetime = 4000;
      };
    };
  };

到这里基本的路由功能就已经完成了

dae分流

启用dae

  services.dae = {
      enable = true;
      configFile = "/home/wsl/.config/dae.dae";
      assets = with pkgs; [ v2ray-geoip v2ray-domain-list-community ];
  };

注意 dae 的配置文件中需要指定其服务的网络接口

global {
  lan_interface: enp3s0,docker0,virbr0 
  wan_interface: auto
  allow_insecure: false
}

文件服务器功能

  services.samba = {
    enable = true;
    securityType = "user";
    openFirewall = true;
    settings = {
      global = {
        "workgroup" = "WORKGROUP";
        "server string" = "smbnix";
        "netbios name" = "smbnix";
        "security" = "user";
        "hosts allow" = "0.0.0.0/0";
      };
      "d" = {
        "path" = "/sdcard/d";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
        "force user" = "wsl";
        "force group" = "wheel";
        "valid users" = "wsl";
      };
      "e" = {
        "path" = "/sdcard/e";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
        "force user" = "wsl";
        "force group" = "wheel";
        "valid users" = "wsl";
      };
    };
  };

  services.samba-wsdd = {
    enable = true;
    openFirewall = true;
  };

对于需要手动配置的用户部分，记不太清了，参考wiki。

动画下载功能

qbittorrent-nox

首先需要安装package

  environment.systemPackages = with pkgs; [
    qbittorrent-nox
  ];

其次需要定义一个服务

  systemd.services.qbittorrent-nox = {
    description = "qbittorrent-nox headless torrent client";
    after = [ "network.target" ];

    serviceConfig = {
      ExecStart = "${pkgs.qbittorrent-nox}/bin/qbittorrent-nox";
    };

    wantedBy = [ "multi-user.target" ];
  };

这样就可以自动启动了。另外下载器的帐号密码以及默认下载路径需要到webui中自行更改。

AutoBangumi

这里主要是如何启用docker

  virtualisation.docker.enable = true;
#  virtualisation.docker.rootless = {
#    enable = true;
#    setSocketVariable = true;
#  };
  users.extraGroups.docker.members = [ "wsl" ];

然后就按照ab官方教程去做就可以了。

设备

需求

实现