nixos

commit b42b2b321b368bc62e6b73c05e64f7a96c5200f1
parent b700a9365850455e78e5a831a914d53ea5b609f9
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sat, 27 Jan 2024 17:54:44 +0100

bgp

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
56
+++++++++++++++++++++++++++++++++++---------------------
M
nixos/worker-2/configuration.nix
 | 
64
++++++++++++++++++++++++++++++++++++----------------------------

2 files changed, 71 insertions(+), 49 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -444,7 +444,7 @@ in {
     bird2 = {
       enable = true;
       config = ''
-        router id 10.100.0.1;
+        router id 10.0.1.1;
         debug protocols all;
         ## Boilerplate from distro
         log syslog all;
@@ -464,30 +464,44 @@ in {
         protocol kernel {
           ipv6 { export all; };
         }
-        protocol static {
-          ipv4;                   # Again, IPv4 channel with default options
+
+        filter allowed_ips {
+          if net = 10.100.12.1/32 then accept;
         }
 
-        ## Sauce
-        protocol ospf MyOSPF {
-          ecmp no;
-          ## Boilerplate taken from Bird's example docs https://bird.network.cz/?get_doc&v=20&f=bird-6.html#ss6.8
+        protocol bgp worker2 {
+          local 10.0.2.1 as 64496;        # Use a private AS number
+          neighbor 10.0.2.2 as 65000;    # Our neighbor ...
+          multihop;                            # ... which is connected indirectly
           ipv4 {
-            export filter {
-              if source = RTS_BGP then {
-                ospf_metric1 = 100;
-                accept;
-              }
-              reject;
-            };
+            export filter allowed_ips;
+            import filter allowed_ips;
           };
-          area 0.0.0.0 {
-            networks {
-              10.100.12.1/32;
-            };
-            interface "floating1", "enp7s0" {
-              type ptp; # VPN tunnels should be point-to-point
-            };
+          ipv6 {
+            import all;
+            export none;
+          };
+          ipv4 multicast {
+            import all;
+            export none;
+          };
+        }
+
+        protocol bgp nordgedanken {
+          local 10.0.2.1 as 64496;        # Use a private AS number
+          neighbor 10.0.1.2 as 64495;    # Our neighbor ...
+          multihop;                            # ... which is connected indirectly
+          ipv4 {
+            export filter allowed_ips;
+            import filter allowed_ips;
+          };
+          ipv6 {
+            import all;
+            export none;
+          };
+          ipv4 multicast {
+            import all;
+            export none;
           };
         }
       '';
diff --git a/nixos/worker-2/configuration.nix b/nixos/worker-2/configuration.nix
@@ -544,17 +544,11 @@ in {
     bird2 = {
       enable = true;
       config = ''
-        router id 10.100.0.3;
+        router id 10.0.2.2;
         debug protocols all;
         ## Boilerplate from distro
         log syslog all;
-        protocol device {
-        }
-        protocol direct {
-          disabled;               # Disable by default
-          ipv4;                   # Connect to default IPv4 table
-          ipv6;                   # ... and to default IPv6 table
-        }
+
         protocol kernel {
           ipv4 {                  # Connect protocol to IPv4 table by channel
             export all;	# Export to protocol. default is export none
@@ -564,30 +558,44 @@ in {
         protocol kernel {
           ipv6 { export all; };
         }
-        protocol static {
-          ipv4;                   # Again, IPv4 channel with default options
+
+        filter allowed_ips {
+          if net = 10.100.12.1/32 then accept;
         }
 
-        ## Sauce
-        protocol ospf MyOSPF {
-          ecmp no;
-          ## Boilerplate taken from Bird's example docs https://bird.network.cz/?get_doc&v=20&f=bird-6.html#ss6.8
+        protocol bgp worker1 {
+          local 10.0.2.2 as 65000;        # Use a private AS number
+          neighbor 10.0.2.1 as 64496;    # Our neighbor ...
+          multihop;                            # ... which is connected indirectly
           ipv4 {
-            export filter {
-              if source = RTS_BGP then {
-                ospf_metric1 = 100;
-                accept;
-              }
-              reject;
-            };
+            export filter allowed_ips;
+            import filter allowed_ips;
           };
-          area 0.0.0.0 {
-            networks {
-              10.100.12.1/32;
-            };
-            interface "floating1", "enp7s0" {
-              type ptp; # VPN tunnels should be point-to-point
-            };
+          ipv6 {
+            import all;
+            export none;
+          };
+          ipv4 multicast {
+            import all;
+            export none;
+          };
+        }
+
+        protocol bgp nordgedanken {
+          local 10.0.2.2 as 65000;        # Use a private AS number
+          neighbor 10.0.1.2 as 64495;    # Our neighbor ...
+          multihop;                            # ... which is connected indirectly
+          ipv4 {
+            export filter allowed_ips;
+            import filter allowed_ips;
+          };
+          ipv6 {
+            import all;
+            export none;
+          };
+          ipv4 multicast {
+            import all;
+            export none;
           };
         }
       '';