IfState - Revision history

Saltrocks: Change link to current site wiki

2025-12-24T10:53:26Z

Change link to current site wiki

← Older revision		Revision as of 10:53, 24 December 2025
Line 15:		Line 15:
	systemd.services."<name>".serviceConfig.NetworkNamespacePath = "/var/run/netns/<netnsName>";		systemd.services."<name>".serviceConfig.NetworkNamespacePath = "/var/run/netns/<netnsName>";
	}		}
	</syntaxhighlight>When using [~~https://nixos.wiki/wiki/NixOS_Containers~~ nixos-containers], network namespaces allow you to configure the network outside the container. This separation simplifies management and ensures the container’s network setup is independent of its internal configuration.<syntaxhighlight lang="nixos">		</syntaxhighlight>When using [[NixOS Containers\|nixos-containers]], network namespaces allow you to configure the network outside the container. This separation simplifies management and ensures the container’s network setup is independent of its internal configuration.<syntaxhighlight lang="nixos">
	{		{
	containers."<name>".networkNamespace = "/var/run/netns/<netnsName>";		containers."<name>".networkNamespace = "/var/run/netns/<netnsName>";

Nicof2000: fix: ifstate website revision

2025-12-21T19:35:34Z

fix: ifstate website revision

← Older revision		Revision as of 19:35, 21 December 2025
Line 4:		Line 4:

	=== Examples ===		=== Examples ===
	You can find several examples on the [https://ifstate.net/2.0/examples/ IfState website]. Some include NixOS configuration instructions, while the more complex examples are covered in detail here.		You can find several examples on the [https://ifstate.net/2.2/examples/ IfState website]. Some include NixOS configuration instructions, while the more complex examples are covered in detail here.

	==== Network Namespaces (netns) ====		==== Network Namespaces (netns) ====

Nicof2000: dhcpv4: replace custom script with packaged udhcpc/default.script

2025-10-03T19:08:10Z

dhcpv4: replace custom script with packaged udhcpc/default.script

← Older revision		Revision as of 19:08, 3 October 2025
Line 167:		Line 167:
	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	{ lib, pkgs, ... }:		{ lib, pkgs, ... }:
	~~let~~
	~~script = pkgs.writeScript "ifstate-udhcp-script.sh" ''~~
	~~#! /bin/sh~~
	~~if [ "$1" = bound ]; then~~
	~~${lib.getExe' pkgs.iproute2 "ip"} address add "$ip/$mask" dev "$interface"~~
	~~if [ -n "$mtu" ]; then~~
	~~${lib.getExe' pkgs.iproute2 "ip"} link set mtu "$mtu" dev "$interface"~~
	fi
	~~if [ -n "$router" ]; then~~
	~~${lib.getExe' pkgs.iproute2 "ip"} route add default via "$router" dev "$interface"~~
	fi
	fi
	~~'';~~
	in
	{		{
	networking.ifstate = {		networking.ifstate = {
Line 186:		Line 172:
	settings = {		settings = {
	parameters.hooks.dhcp.script = pkgs.writeScript "ifstate-udhcp-wrapper-script.sh" ''		parameters.hooks.dhcp.script = pkgs.writeScript "ifstate-udhcp-wrapper-script.sh" ''
	${lib.getExe' pkgs.busybox "udhcpc"} --quit --now -i $IFS_IFNAME -b --script ${script}		${lib.getExe' pkgs.busybox "udhcpc"} --quit --now -i $IFS_IFNAME -b --script ${pkgs.busybox}/default.script
	'';		'';
	interfaces.eth1 = {		interfaces.eth1 = {

Nicof2000: dhcpv4: adjust formatting

2025-10-03T16:00:26Z

dhcpv4: adjust formatting

← Older revision		Revision as of 16:00, 3 October 2025
Line 191:		Line 191:
	addresses = [ ];		addresses = [ ];
	hooks = [		hooks = [
	{		{ name = "dhcp"; }
	name = "dhcp";
	}
	];		];
	link = {		link = {

Nicof2000: add dhcpv4

2025-10-03T15:59:02Z

add dhcpv4

← Older revision		Revision as of 15:59, 3 October 2025
Line 164:		Line 164:
	</syntaxhighlight>		</syntaxhighlight>

			==== DHCPv4 ====
			<syntaxhighlight lang="nixos">
			{ lib, pkgs, ... }:
			let
			script = pkgs.writeScript "ifstate-udhcp-script.sh" ''
			#! /bin/sh
			if [ "$1" = bound ]; then
			${lib.getExe' pkgs.iproute2 "ip"} address add "$ip/$mask" dev "$interface"
			if [ -n "$mtu" ]; then
			${lib.getExe' pkgs.iproute2 "ip"} link set mtu "$mtu" dev "$interface"
			fi
			if [ -n "$router" ]; then
			${lib.getExe' pkgs.iproute2 "ip"} route add default via "$router" dev "$interface"
			fi
			fi
			'';
			in
			{
			networking.ifstate = {
			enable = true;
			settings = {
			parameters.hooks.dhcp.script = pkgs.writeScript "ifstate-udhcp-wrapper-script.sh" ''
			${lib.getExe' pkgs.busybox "udhcpc"} --quit --now -i $IFS_IFNAME -b --script ${script}
			'';
			interfaces.eth1 = {
			addresses = [ ];
			hooks = [
			{
			name = "dhcp";
			}
			];
			link = {
			state = "up";
			kind = "physical";
			};
			};
			};
			};
			}
			</syntaxhighlight>

	=== Known Issues ===		=== Known Issues ===

Nicof2000: diagram: fix format again

2025-09-12T18:02:47Z

diagram: fix format again

← Older revision		Revision as of 18:02, 12 September 2025
Line 65:		Line 65:

	To achieve this, you might want to isolate the provider network from your Global Routing Table (GRT) and bind the WireGuard endpoints. The <code>IfState</code> tool offers a link configuration option called <code>bind_netns</code>, which can be used with tunnel links (such as WireGuard, GRE, SIT, etc.) to implement this separation.		To achieve this, you might want to isolate the provider network from your Global Routing Table (GRT) and bind the WireGuard endpoints. The <code>IfState</code> tool offers a link configuration option called <code>bind_netns</code>, which can be used with tunnel links (such as WireGuard, GRE, SIT, etc.) to implement this separation.
	[[File:Ifstate-vpn-gw.png\|~~thumb~~\|~~345x345px~~]]		[[File:Ifstate-vpn-gw.png\|center\|frameless]]







	'''Important Note:''' If <code>enp0s3</code> is your provider interface, this configuration will move it into an external network namespace that contains nothing except the bound WireGuard endpoint. As a result, you won’t be able to access systemd services like your SSH server without an active WireGuard connection. Plan accordingly to avoid losing access to critical services.<syntaxhighlight lang="nixos">		'''Important Note:''' If <code>enp0s3</code> is your provider interface, this configuration will move it into an external network namespace that contains nothing except the bound WireGuard endpoint. As a result, you won’t be able to access systemd services like your SSH server without an active WireGuard connection. Plan accordingly to avoid losing access to critical services.<syntaxhighlight lang="nixos">

Nicof2000: setup diagram: fix formatting

2025-09-12T18:01:35Z

setup diagram: fix formatting

← Older revision		Revision as of 18:01, 12 September 2025
Line 66:		Line 66:
	To achieve this, you might want to isolate the provider network from your Global Routing Table (GRT) and bind the WireGuard endpoints. The <code>IfState</code> tool offers a link configuration option called <code>bind_netns</code>, which can be used with tunnel links (such as WireGuard, GRE, SIT, etc.) to implement this separation.		To achieve this, you might want to isolate the provider network from your Global Routing Table (GRT) and bind the WireGuard endpoints. The <code>IfState</code> tool offers a link configuration option called <code>bind_netns</code>, which can be used with tunnel links (such as WireGuard, GRE, SIT, etc.) to implement this separation.
	[[File:Ifstate-vpn-gw.png\|thumb\|345x345px]]		[[File:Ifstate-vpn-gw.png\|thumb\|345x345px]]







	'''Important Note:''' If <code>enp0s3</code> is your provider interface, this configuration will move it into an external network namespace that contains nothing except the bound WireGuard endpoint. As a result, you won’t be able to access systemd services like your SSH server without an active WireGuard connection. Plan accordingly to avoid losing access to critical services.<syntaxhighlight lang="nixos">		'''Important Note:''' If <code>enp0s3</code> is your provider interface, this configuration will move it into an external network namespace that contains nothing except the bound WireGuard endpoint. As a result, you won’t be able to access systemd services like your SSH server without an active WireGuard connection. Plan accordingly to avoid losing access to critical services.<syntaxhighlight lang="nixos">

Nicof2000: add diagram of setup with netns to separate provider network from grt

2025-09-12T18:00:20Z

add diagram of setup with netns to separate provider network from grt

← Older revision		Revision as of 18:00, 12 September 2025
Line 65:		Line 65:

	To achieve this, you might want to isolate the provider network from your Global Routing Table (GRT) and bind the WireGuard endpoints. The <code>IfState</code> tool offers a link configuration option called <code>bind_netns</code>, which can be used with tunnel links (such as WireGuard, GRE, SIT, etc.) to implement this separation.		To achieve this, you might want to isolate the provider network from your Global Routing Table (GRT) and bind the WireGuard endpoints. The <code>IfState</code> tool offers a link configuration option called <code>bind_netns</code>, which can be used with tunnel links (such as WireGuard, GRE, SIT, etc.) to implement this separation.
			[[File:Ifstate-vpn-gw.png\|thumb\|345x345px]]

	'''Important Note:''' If <code>enp0s3</code> is your provider interface, this configuration will move it into an external network namespace that contains nothing except the bound WireGuard endpoint. As a result, you won’t be able to access systemd services like your SSH server without an active WireGuard connection. Plan accordingly to avoid losing access to critical services.<syntaxhighlight lang="nixos">		'''Important Note:''' If <code>enp0s3</code> is your provider interface, this configuration will move it into an external network namespace that contains nothing except the bound WireGuard endpoint. As a result, you won’t be able to access systemd services like your SSH server without an active WireGuard connection. Plan accordingly to avoid losing access to critical services.<syntaxhighlight lang="nixos">
Line 162:		Line 163:

	</syntaxhighlight>		</syntaxhighlight>


	=== Known Issues ===		=== Known Issues ===

Nicof2000 at 21:39, 1 September 2025

2025-09-01T21:39:40Z

@@ Line 1: / Line 1: @@
 [https://ifstate.net/2.0/ IfState] is a python 3 utility designed for declarative management of Linux network interfaces. It acts as a frontend to the kernel's Netlink interface, using the <code>pyroute2</code> library to configure network settings such as IP addresses, bridges, traffic control, and WireGuard in an idempotent manner—much like an <code>iproute2</code>/<code>ethtool</code>/<code>tc</code>/<code>wg</code> wrapper.
-It will be probably be available with NixOS 25.11 (see https://github.com/NixOS/nixpkgs/pull/431047).
+It is available since NixOS 25.11 (see https://github.com/NixOS/nixpkgs/pull/431047).
 === Examples ===
-You can find several examples on the [https://ifstate.net/2.0/examples/ IfState website]. Due to the fact that these are yaml examples, I decided to provide some nix examples here too:<syntaxhighlight lang="nixos">{
+You can find several examples on the [https://ifstate.net/2.0/examples/ IfState website]. Some include NixOS configuration instructions, while the more complex examples are covered in detail here.
 ==== Network Namespaces (netns) ====

Klinger: Category:Networking Category:Python

2025-08-17T13:33:10Z

Category:Networking Category:Python

← Older revision		Revision as of 13:33, 17 August 2025
Line 254:		Line 254:
	}		}
	</syntaxhighlight>		</syntaxhighlight>

			[[Category:Networking]]
			[[Category:Python]]