1 files changed, 58 insertions, 20 deletions

diff --git a/os/core/networking.nix b/os/core/networking.nix
index 6cfe4ad..638ecd4 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -10,22 +10,29 @@ in
 {
   options.os.core.network = {
     enable = lib.mkEnableOption "system-wide networking setup";
+    enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers";
+
+    isVM = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host.";
+    };
 
     ips = lib.mkOption {
       type = lib.types.attrsOf lib.types.str;
-      default = {
-        router = "10.0.0.1";
+      default = rec {
+        router = vm1-opnsense;
         host = "10.0.0.2";
-        vm1-opnsense = "10.0.0.3";
-        vm2-gateway = "10.0.0.4";
-        vm3-monitor = "10.0.0.5";
-        vm4-media = "10.0.0.6";
-        vm5-sandbox = "10.0.0.7";
-        vm6-storage = "10.0.0.8";
-        vm7-web = "10.0.0.9";
-        vm8-mail = "10.0.0.10";
-        vm9-relays = "10.0.0.11";
-        vm10-mc = "10.0.0.12";
+        vm1-opnsense = "10.0.0.1";
+        vm2-gateway = "10.0.0.3";
+        vm3-monitor = "10.0.0.4";
+        vm4-media = "10.0.0.5";
+        vm5-sandbox = "10.0.0.6";
+        vm6-storage = "10.0.0.7";
+        vm7-web = "10.0.0.8";
+        vm8-mail = "10.0.0.9";
+        vm9-relays = "10.0.0.10";
+        vm10-mc = "10.0.0.11";
       };
       description = "Central registry of static IP allocations for the cluster.";
     };
@@ -50,7 +57,7 @@ in
           };
           range = lib.mkOption {
             type = lib.types.str;
-            default = "10.0.0.0/8";
+            default = "10.0.0.0/24";
             description = "The broader subnet block representing the physical home network.";
           };
         };
@@ -116,6 +123,13 @@ in
         ];
       })
 
+      (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) {
+        networking = {
+          firewall.enable = true;
+          nftables.enable = true;
+        };
+      })
+
       (lib.mkIf (cfg.profile == "server") {
         networking = {
           useNetworkd = true;
@@ -123,24 +137,48 @@ in
         };
         systemd.network = {
           enable = true;
+          wait-online.enable = lib.mkIf (!cfg.isVM) false;
 
-          netdevs."10-br-srv" = {
-            netdevConfig = {
-              Name = "br-srv";
-              Kind = "bridge";
+          netdevs = lib.mkIf (!cfg.isVM) {
+            "10-br-srv" = {
+              netdevConfig = {
+                Name = "br-srv";
+                Kind = "bridge";
+              };
             };
           };
           networks."20-host-management" = {
-            matchConfig.Name = "br-srv";
-            address = [ "10.0.0.2/24" ];
-            gateway = [ "10.0.0.1" ];
+            matchConfig.Name = if cfg.isVM then "eth0" else "br-srv";
+            address = [ "${cfg.lan.ip}/24" ];
+            gateway = [ cfg.ips.router ];
             networkConfig.LinkLocalAddressing = "no";
           };
         };
         boot.kernel.sysctl = {
           "net.ipv4.ip_nonlocal_bind" = 1;
+          "net.ipv4.ip_forward" = 1;
         };
       })
+      (lib.mkIf
+        (
+          cfg.profile == "server"
+          && cfg.enableFirewall
+          && cfg.isVM
+          && config.networking.hostName != "vm2-gateway"
+        )
+        {
+          networking.nftables.enable = true;
+          networking.firewall = {
+            enable = true;
+            extraCommands = ''
+              nft add table ip nat 2>/dev/null || true
+              nft flush table ip nat
+              nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; }
+              nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect
+            '';
+          };
+        }
+      )
     ]
   );
 }