From 0a582b523fd1a53cb1f15b31d1b54a49e8d65f28 Mon Sep 17 00:00:00 2001
From: seth <getchoo@tuta.io>
Date: Tue, 31 Oct 2023 03:26:11 -0400
Subject: turret: update config files & improve derivation

---
 systems/turret/default.nix               |  24 ++-
 systems/turret/files/etc/config/firewall | 258 ++++++++++++-------------------
 systems/turret/files/etc/config/network  |   1 +
 systems/turret/files/etc/config/wireless |  12 +-
 4 files changed, 111 insertions(+), 184 deletions(-)

(limited to 'systems')

diff --git a/systems/turret/default.nix b/systems/turret/default.nix
index faac3d2..90ec750 100644
--- a/systems/turret/default.nix
+++ b/systems/turret/default.nix
@@ -3,36 +3,30 @@
   openwrt-imagebuilder,
   ...
 }: let
-  inherit (pkgs) runCommand;
-  inherit (pkgs.stdenv) mkDerivation;
-  inherit (openwrt-imagebuilder.lib) build profiles;
-  wrtProfiles = profiles {
+  wrtProfiles = openwrt-imagebuilder.lib.profiles {
     inherit pkgs;
     release = "22.03.3";
   };
-  config = mkDerivation {
-    name = "openwrt-config-files";
-    src = ./files;
-    installPhase = ''
-      mkdir -p $out
-      cp -r * $out/
-    '';
-  };
+
   image =
     wrtProfiles.identifyProfile "netgear_wac104"
     // {
       packages = ["https-dns-proxy"];
 
-      files = runCommand "image-files" {} ''
+      files = pkgs.runCommand "image-files" {} ''
         mkdir -p $out/etc/uci-defaults
+
         cat > $out/etc/uci-defaults/99-custom <<EOF
         uci -q batch << EOI
         set system.@system[0].hostname='turret'
         commit
         EOI
         EOF
-        cp -fr ${config}/etc/* $out/etc/
+
+        # copy custom files
+        cp -fr ${./files}/* $out/
+        chmod 0644 $out/etc/{config,dropbear}/*
       '';
     };
 in
-  build image
+  openwrt-imagebuilder.lib.build image
diff --git a/systems/turret/files/etc/config/firewall b/systems/turret/files/etc/config/firewall
index b9a4647..c1e4f84 100644
--- a/systems/turret/files/etc/config/firewall
+++ b/systems/turret/files/etc/config/firewall
@@ -1,189 +1,121 @@
+
 config defaults
-	option syn_flood	1
-	option input		ACCEPT
-	option output		ACCEPT
-	option forward		REJECT
-# Uncomment this line to disable ipv6 rules
-#	option disable_ipv6	1
+	option syn_flood '1'
+	option input 'ACCEPT'
+	option output 'ACCEPT'
+	option forward 'REJECT'
 
 config zone
-	option name		lan
-	list   network		'lan'
-	option input		ACCEPT
-	option output		ACCEPT
-	option forward		ACCEPT
+	option name 'lan'
+	list network 'lan'
+	option input 'ACCEPT'
+	option output 'ACCEPT'
+	option forward 'ACCEPT'
 
 config zone
-	option name		wan
-	list   network		'wan'
-	list   network		'wan6'
-	option input		REJECT
-	option output		ACCEPT
-	option forward		REJECT
-	option masq		1
-	option mtu_fix		1
+	option name 'wan'
+	list network 'wan'
+	list network 'wan6'
+	option input 'REJECT'
+	option output 'ACCEPT'
+	option forward 'REJECT'
+	option masq '1'
+	option mtu_fix '1'
 
 config forwarding
-	option src		lan
-	option dest		wan
+	option src 'lan'
+	option dest 'wan'
 
-# We need to accept udp packets on port 68,
-# see https://dev.openwrt.org/ticket/4108
 config rule
-	option name		Allow-DHCP-Renew
-	option src		wan
-	option proto		udp
-	option dest_port	68
-	option target		ACCEPT
-	option family		ipv4
+	option name 'Allow-DHCP-Renew'
+	option src 'wan'
+	option proto 'udp'
+	option dest_port '68'
+	option target 'ACCEPT'
+	option family 'ipv4'
 
-# Allow IPv4 ping
 config rule
-	option name		Allow-Ping
-	option src		wan
-	option proto		icmp
-	option icmp_type	echo-request
-	option family		ipv4
-	option target		ACCEPT
+	option name 'Allow-Ping'
+	option src 'wan'
+	option proto 'icmp'
+	option icmp_type 'echo-request'
+	option family 'ipv4'
+	option target 'ACCEPT'
 
 config rule
-	option name		Allow-IGMP
-	option src		wan
-	option proto		igmp
-	option family		ipv4
-	option target		ACCEPT
+	option name 'Allow-IGMP'
+	option src 'wan'
+	option proto 'igmp'
+	option family 'ipv4'
+	option target 'ACCEPT'
 
-# Allow DHCPv6 replies
-# see https://github.com/openwrt/openwrt/issues/5066
 config rule
-	option name		Allow-DHCPv6
-	option src		wan
-	option proto		udp
-	option dest_port	546
-	option family		ipv6
-	option target		ACCEPT
+	option name 'Allow-DHCPv6'
+	option src 'wan'
+	option proto 'udp'
+	option dest_port '546'
+	option family 'ipv6'
+	option target 'ACCEPT'
 
 config rule
-	option name		Allow-MLD
-	option src		wan
-	option proto		icmp
-	option src_ip		fe80::/10
-	list icmp_type		'130/0'
-	list icmp_type		'131/0'
-	list icmp_type		'132/0'
-	list icmp_type		'143/0'
-	option family		ipv6
-	option target		ACCEPT
+	option name 'Allow-MLD'
+	option src 'wan'
+	option proto 'icmp'
+	option src_ip 'fe80::/10'
+	list icmp_type '130/0'
+	list icmp_type '131/0'
+	list icmp_type '132/0'
+	list icmp_type '143/0'
+	option family 'ipv6'
+	option target 'ACCEPT'
 
-# Allow essential incoming IPv6 ICMP traffic
 config rule
-	option name		Allow-ICMPv6-Input
-	option src		wan
-	option proto	icmp
-	list icmp_type		echo-request
-	list icmp_type		echo-reply
-	list icmp_type		destination-unreachable
-	list icmp_type		packet-too-big
-	list icmp_type		time-exceeded
-	list icmp_type		bad-header
-	list icmp_type		unknown-header-type
-	list icmp_type		router-solicitation
-	list icmp_type		neighbour-solicitation
-	list icmp_type		router-advertisement
-	list icmp_type		neighbour-advertisement
-	option limit		1000/sec
-	option family		ipv6
-	option target		ACCEPT
+	option name 'Allow-ICMPv6-Input'
+	option src 'wan'
+	option proto 'icmp'
+	list icmp_type 'echo-request'
+	list icmp_type 'echo-reply'
+	list icmp_type 'destination-unreachable'
+	list icmp_type 'packet-too-big'
+	list icmp_type 'time-exceeded'
+	list icmp_type 'bad-header'
+	list icmp_type 'unknown-header-type'
+	list icmp_type 'router-solicitation'
+	list icmp_type 'neighbour-solicitation'
+	list icmp_type 'router-advertisement'
+	list icmp_type 'neighbour-advertisement'
+	option limit '1000/sec'
+	option family 'ipv6'
+	option target 'ACCEPT'
 
-# Allow essential forwarded IPv6 ICMP traffic
 config rule
-	option name		Allow-ICMPv6-Forward
-	option src		wan
-	option dest		*
-	option proto		icmp
-	list icmp_type		echo-request
-	list icmp_type		echo-reply
-	list icmp_type		destination-unreachable
-	list icmp_type		packet-too-big
-	list icmp_type		time-exceeded
-	list icmp_type		bad-header
-	list icmp_type		unknown-header-type
-	option limit		1000/sec
-	option family		ipv6
-	option target		ACCEPT
+	option name 'Allow-ICMPv6-Forward'
+	option src 'wan'
+	option dest '*'
+	option proto 'icmp'
+	list icmp_type 'echo-request'
+	list icmp_type 'echo-reply'
+	list icmp_type 'destination-unreachable'
+	list icmp_type 'packet-too-big'
+	list icmp_type 'time-exceeded'
+	list icmp_type 'bad-header'
+	list icmp_type 'unknown-header-type'
+	option limit '1000/sec'
+	option family 'ipv6'
+	option target 'ACCEPT'
 
 config rule
-	option name		Allow-IPSec-ESP
-	option src		wan
-	option dest		lan
-	option proto		esp
-	option target		ACCEPT
+	option name 'Allow-IPSec-ESP'
+	option src 'wan'
+	option dest 'lan'
+	option proto 'esp'
+	option target 'ACCEPT'
 
 config rule
-	option name		Allow-ISAKMP
-	option src		wan
-	option dest		lan
-	option dest_port	500
-	option proto		udp
-	option target		ACCEPT
-
-
-### EXAMPLE CONFIG SECTIONS
-# do not allow a specific ip to access wan
-#config rule
-#	option src		lan
-#	option src_ip	192.168.45.2
-#	option dest		wan
-#	option proto	tcp
-#	option target	REJECT
-
-# block a specific mac on wan
-#config rule
-#	option dest		wan
-#	option src_mac	00:11:22:33:44:66
-#	option target	REJECT
-
-# block incoming ICMP traffic on a zone
-#config rule
-#	option src		lan
-#	option proto	ICMP
-#	option target	DROP
-
-# port redirect port coming in on wan to lan
-#config redirect
-#	option src			wan
-#	option src_dport	80
-#	option dest			lan
-#	option dest_ip		192.168.16.235
-#	option dest_port	80
-#	option proto		tcp
-
-# port redirect of remapped ssh port (22001) on wan
-#config redirect
-#	option src		wan
-#	option src_dport	22001
-#	option dest		lan
-#	option dest_port	22
-#	option proto		tcp
-
-### FULL CONFIG SECTIONS
-#config rule
-#	option src		lan
-#	option src_ip	192.168.45.2
-#	option src_mac	00:11:22:33:44:55
-#	option src_port	80
-#	option dest		wan
-#	option dest_ip	194.25.2.129
-#	option dest_port	120
-#	option proto	tcp
-#	option target	REJECT
+	option name 'Allow-ISAKMP'
+	option src 'wan'
+	option dest 'lan'
+	option dest_port '500'
+	option proto 'udp'
+	option target 'ACCEPT'
 
-#config redirect
-#	option src		lan
-#	option src_ip	192.168.45.2
-#	option src_mac	00:11:22:33:44:55
-#	option src_port		1024
-#	option src_dport	80
-#	option dest_ip	194.25.2.129
-#	option dest_port	120
-#	option proto	tcp
diff --git a/systems/turret/files/etc/config/network b/systems/turret/files/etc/config/network
index c71cf98..cb24fec 100644
--- a/systems/turret/files/etc/config/network
+++ b/systems/turret/files/etc/config/network
@@ -26,4 +26,5 @@ config interface 'lan'
 config interface 'wan'
 	option device 'lan1'
 	option proto 'dhcp'
+	option type 'bridge'
 
diff --git a/systems/turret/files/etc/config/wireless b/systems/turret/files/etc/config/wireless
index c8bb9d7..115fc2c 100644
--- a/systems/turret/files/etc/config/wireless
+++ b/systems/turret/files/etc/config/wireless
@@ -4,31 +4,31 @@ config wifi-device 'radio0'
 	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
 	option band '2g'
 	option disabled '0'
-	option htmode 'HT40'
-	option channel '1'
 	option cell_density '0'
+	option htmode 'HT20'
+	option channel 'auto'
 
 config wifi-iface 'default_radio0'
 	option device 'radio0'
-	option network 'lan'
 	option mode 'ap'
 	option ssid 'Box-2.4G'
 	option encryption 'psk2'
 	option key 'REPLACEME'
+	option network 'lan wan'
 
 config wifi-device 'radio1'
 	option type 'mac80211'
 	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
 	option band '5g'
 	option disabled '0'
-	option htmode 'VHT40'
-	option channel '36'
 	option cell_density '0'
+	option htmode 'VHT80'
+	option channel 'auto'
 
 config wifi-iface 'default_radio1'
 	option device 'radio1'
-	option network 'lan'
 	option mode 'ap'
 	option ssid 'Box-5G'
 	option key 'REPLACEME'
 	option encryption 'psk2'
+	option network 'lan wan'
-- 
cgit v1.2.3