5 ms·

My router (a VM with passed through network card) is currently running on NixOS, I’m really happy so far, it makes kernel patching (which in my case is required

My router (a VM with passed through network card) is currently running on NixOS, I’m really happy so far, it makes kernel patching (which in my case is required for the nic to work properly at 2500BASE-T) much easier than manually patching and building the kernel every time. It also gives me the guarantee that I will be able to rebuild the exact same host almost bit by bit in the future, in case of necessity, which is important for something like a router (I also take vm snapshots but upgrades are crucial for something potentially facing the internet and handling firewall). Looking forward to move away from proxmox to a fully NixOS virtualisation host too.

rb2k_ 4y ago
Did you base your router config on some existing template or did you just built it up from scratch?
- Asdrubalini 4y ago
  I based much of the configuration on [1] but I took the nftables rules from the official nftables wiki. [1] https://francis.begyn.be/blog/nixos-home-router https://francis.begyn.be/blog/nixos-home-router
madjam002 4y ago
Yeah I used to use pfSense but hated having a load of config and firewall rules created manually, it all felt quite brittle. Moved to NixOS almost 5 years ago now and haven’t looked back, my router config is in Git and I’m able to make changes with confidence. Best part is making a change/installing an update and being able to rollback if I mess something up. I also use Nixus to push new configs which has a nifty feature where it will autorollback if you e.g make a config change that locks you out of SSH. I also moved from ESXI to NixOS for a virtualisation host more recently and that has been great as these machines are inherently long lived so you can’t apply the “cattle not pets” mindset here, but I feel like I can make changes and install updates with confidence. It also helped when I migrated to a Threadripper build where there were some strange quirks which needed Linux kernel patches, it’s nice being able to do this declaratively and to store everything in a versioned Git repo.
- Asdrubalini 4y ago
  Wow, didn’t know about Nixus, thanks!
- colordrops 4y ago
  Can you share your router configs? I'd love to have a NixOS based router.
  - astro1 4y ago
    https://gitea.c3d2.de/zentralwerk/network https://gitea.c3d2.de/zentralwerk/network
  - notemaker 4y ago
    https://skogsbrus.xyz/blog/2022/06/12/router https://skogsbrus.xyz/blog/2022/06/12/router
  - ochoseis 4y ago
    One drawback I realized about NixOS as a router for home use is that if you need to share administration of the network, then it has to be easy for non-experts. In that case something like OpenWRT might be a better choice.
    - pmarreck 4y ago
      Well, at least the config file options are relatively straightforward, but you're right in that a GUI makes more sense for genpop
- ochoseis 4y ago
  How are you managing the VM’s on NixOS? A couple years ago I was searching for a good way to declaratively manage them, and the best I came up with was libvirt + terraform + nixos-generators for images. It feels like you should just be able to set them up as systemd units, but I couldn’t figure it out. microvm has caught my eye recently but I haven’t played with it yet: https://github.com/astro/microvm.nix https://github.com/astro/microvm.nix

rb2k_ 4y ago

Did you base your router config on some existing template or did you just built it up from scratch?

Asdrubalini 4y ago
I based much of the configuration on [1] but I took the nftables rules from the official nftables wiki. [1] https://francis.begyn.be/blog/nixos-home-router https://francis.begyn.be/blog/nixos-home-router

madjam002 4y ago

Yeah I used to use pfSense but hated having a load of config and firewall rules created manually, it all felt quite brittle. Moved to NixOS almost 5 years ago now and haven’t looked back, my router config is in Git and I’m able to make changes with confidence. Best part is making a change/installing an update and being able to rollback if I mess something up. I also use Nixus to push new configs which has a nifty feature where it will autorollback if you e.g make a config change that locks you out of SSH. I also moved from ESXI to NixOS for a virtualisation host more recently and that has been great as these machines are inherently long lived so you can’t apply the “cattle not pets” mindset here, but I feel like I can make changes and install updates with confidence. It also helped when I migrated to a Threadripper build where there were some strange quirks which needed Linux kernel patches, it’s nice being able to do this declaratively and to store everything in a versioned Git repo.

Asdrubalini 4y ago
Wow, didn’t know about Nixus, thanks!
colordrops 4y ago
Can you share your router configs? I'd love to have a NixOS based router.
- astro1 4y ago
  https://gitea.c3d2.de/zentralwerk/network https://gitea.c3d2.de/zentralwerk/network
- notemaker 4y ago
  https://skogsbrus.xyz/blog/2022/06/12/router https://skogsbrus.xyz/blog/2022/06/12/router
- ochoseis 4y ago
  One drawback I realized about NixOS as a router for home use is that if you need to share administration of the network, then it has to be easy for non-experts. In that case something like OpenWRT might be a better choice.
  - pmarreck 4y ago
    Well, at least the config file options are relatively straightforward, but you're right in that a GUI makes more sense for genpop
ochoseis 4y ago
How are you managing the VM’s on NixOS? A couple years ago I was searching for a good way to declaratively manage them, and the best I came up with was libvirt + terraform + nixos-generators for images. It feels like you should just be able to set them up as systemd units, but I couldn’t figure it out. microvm has caught my eye recently but I haven’t played with it yet: https://github.com/astro/microvm.nix https://github.com/astro/microvm.nix