{ lib , notnft , router-lib , ... }: { options.router-settings = { routerMac = lib.mkOption { description = "router's mac address"; type = lib.types.str; }; serverMac = lib.mkOption { description = "server's mac address"; type = lib.types.str; }; vacuumMac = lib.mkOption { description = "robot vacuum's mac address"; type = lib.types.str; }; naughtyMacs = lib.mkOption { description = "misbehaving (using wrong DNS server) clients' macs"; type = with lib.types; listOf str; }; network = lib.mkOption { description = "network gateway+cidr (ex: 192.168.1.1/24)"; type = router-lib.types.cidr4; }; network6 = lib.mkOption { description = "network gateway+cidr6 (ex: fd00:1234:5678:90ab::1/64)"; type = router-lib.types.cidr6; }; netnsNet = lib.mkOption { description = "private inter-netns communication network cidr+main netns addr (ex: 192.168.2.1/24)"; type = router-lib.types.cidr4; }; netnsNet6 = lib.mkOption { description = "private inter-netns communication network cidr6+main netns addr6 (ex: fd01:ba09:8765:4321::1/64)"; type = router-lib.types.cidr6; }; wanNetnsAddr = lib.mkOption { description = "ip to assign to wan netns"; type = router-lib.types.ipv4; }; wanNetnsAddr6 = lib.mkOption { description = "ipv6 to assign to wan netns"; type = router-lib.types.ipv6; }; country_code = lib.mkOption { description = "wlan country_code (ex: US)"; type = lib.types.str; }; ssid = lib.mkOption { description = "wlan ssid"; type = lib.types.str; }; wpa_passphrase = lib.mkOption { description = "wlan passphrase"; type = lib.types.str; }; wireguard = lib.mkOption { description = "wireguard config"; type = lib.types.attrs; }; dhcpReservations = lib.mkOption { description = "dhcp reservations (ipv4)"; default = [ ]; type = lib.types.listOf (lib.types.submodule { options.ipAddress = lib.mkOption { type = router-lib.types.ipv4; description = "device's ip address"; }; options.macAddress = lib.mkOption { type = lib.types.str; description = "device's mac address"; }; }); }; dhcp6Reservations = lib.mkOption { description = "dhcp reservations (ipv6)"; default = [ ]; type = lib.types.listOf (lib.types.submodule { options.ipAddress = lib.mkOption { type = router-lib.types.ipv6; description = "device's ip address"; }; options.macAddress = lib.mkOption { type = lib.types.str; description = "device's mac address"; }; }); }; dnatRules = lib.mkOption { description = "dnat (port forwarding) rules"; default = [ ]; type = lib.types.listOf (lib.types.submodule { options.inVpn = lib.mkOption { type = lib.types.bool; default = false; description = "whether this is a vpn port forward"; }; options.mode = lib.mkOption { type = lib.types.str; default = ""; description = '' forward mode. snat = snat to router ip so routing is always correct; this mangles source ip and may not be desirable mark = change ct mark if the sport/saddr match the target rule = add an ip rule that does the above none = do nothing default = snat for target=router, mark otherwise ''; }; # at least one of target4/target6 must be set options.port = lib.mkOption { type = notnft.types.expression; description = "source port (nft expr)"; }; options.target4 = lib.mkOption { default = null; type = with lib.types; nullOr (submodule { options.address = lib.mkOption { type = router-lib.types.ipv4; description = "ipv4 address"; }; options.port = lib.mkOption { type = nullOr port; description = "target port"; default = null; }; }); description = "port forwarding target (ipv4)"; }; options.target6 = lib.mkOption { default = null; type = with lib.types; nullOr (submodule { options.address = lib.mkOption { type = router-lib.types.ipv6; description = "ipv6 address"; }; options.port = lib.mkOption { type = nullOr port; description = "target port"; default = null; }; }); description = "port forwarding target (ipv6)"; }; options.tcp = lib.mkOption { type = lib.types.bool; description = "whether to forward tcp"; }; options.udp = lib.mkOption { type = lib.types.bool; description = "whether to forward udp"; }; }); }; }; }