rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

router-ui: web management page for ports, devices, traffic, speedtest

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-08-15 12:15:54 +01:00
parent 3030d20034
commit 2f1e14495b
10 changed files with 1396 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

32
services/router.nix
View file

@ -10,13 +10,33 @@
# - dnsmasq: DHCP only (port 0 for DNS — AdGuard Home owns :53)
# - AdGuard Home (already running): DNS for LAN clients
#
# Port forwards live in ../ports.toml so they're easy to edit.
# Port forwards live in ../ports.toml and LAN devices (static reservations +
# block list) in ../devices.toml, so both are easy to edit — by hand, or via
# the router UI (services/router-ui.nix), which only ever writes those two
# TOML files and never generates Nix.
{ config, lib, pkgs, ... }:
let
portsData = builtins.fromTOML (builtins.readFile ../ports.toml);
destDefault = portsData.dest_default;
devices = (builtins.fromTOML (builtins.readFile ../devices.toml)).device or [ ];
reservedDevices = builtins.filter (d: d ? ip) devices;
blockedDevices = builtins.filter (d: d.blocked or false) devices;
# Drop everything from a blocked MAC arriving on the LAN. These are emitted
# at the TOP of the input and forward chains, ahead of the `ct state
# established,related accept` line — otherwise a device that was already
# talking keeps its existing flows alive indefinitely.
#
# ponytail: conntrack entries created before the block still linger until
# they time out (a few minutes). Add `conntrack -D -s <ip>` to the apply
# path if that wait ever matters.
# ponytail: MAC-based, so a device that randomises its MAC walks around it.
blockRules = lib.concatMapStringsSep "\n "
(d: ''iifname "eth0" ether saddr ${d.mac} drop comment "${d.name} blocked"'')
blockedDevices;
# Phase-1 transition list; empty now that eero is in bridge mode and
# eno1 is strictly the ISP-facing WAN.
trustedLegacyCidrs = [ ];
@ -116,6 +136,8 @@ in
content = ''
chain input {
type filter hook input priority 0; policy drop;
# Blocked devices first — before the conntrack accept.
${blockRules}
ct state established,related accept
ct state invalid drop
iifname "lo" accept
@ -136,6 +158,8 @@ in
}
chain forward {
type filter hook forward priority 0; policy drop;
# Blocked devices first — before the conntrack accept.
${blockRules}
ct state established,related accept
ct state invalid drop
# LAN → anywhere
@ -187,10 +211,8 @@ in
"option:router,10.0.0.1"
"option:dns-server,10.0.0.1"
];
# Static reservations — format: "MAC,label,IP"
dhcp-host = [
"f0:a7:31:6c:50:4b,camera-bedroom,10.0.0.39"
];
# Static reservations — format: "MAC,label,IP". From ../devices.toml.
dhcp-host = map (d: "${d.mac},${d.name},${d.ip}") reservedDevices;
# Helpful: log leases to the journal
log-dhcp = true;
};