]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/networking.nix
tmux: use resize-pane -Z
[julm/julm-nix.git] / nixos / profiles / networking.nix
1 { config, pkgs, lib, hostName, ... }:
2 with lib;
3 {
4 imports = [
5 networking/nftables.nix
6 ];
7
8 boot.kernel.sysctl = {
9 # Improve MTU detection
10 # This can thaw TCP connections stalled by a host
11 # requiring a lower MTU along the path,
12 # though it would do so after a little delay
13 # so it's better to set a low MTU when possible.
14 "net/ipv4/tcp_mtu_probing" = 1;
15
16 # Use TCP BBR to significantly increase throughput
17 # and reduce latency for connections.
18 "net/ipv4/tcp_congestion_control" = mkDefault "bbr";
19
20 # BBR must be used with the fq or fq_codel qdisc with pacing enabled,
21 # since pacing is integral to the BBR design and implementation.
22 # BBR without pacing would not function properly,
23 # and may incur unnecessary high packet loss rates.
24 #
25 # See https://github.com/systemd/systemd/issues/9725#issuecomment-412287161
26 # See https://github.com/systemd/systemd/issues/9725#issuecomment-413796842
27 # > The best all-round general purpose default for linux remains fq_codel.
28 "net/core/default_qdisc" = mkDefault "fq_codel";
29
30 # Request Explicit Congestion Notification (ECN)
31 # only for incoming connections (not outgoing).
32 # See https://github.com/systemd/systemd/issues/9748#issuecomment-1261352478
33 # > My answer to the ECN situation remains - turn it on
34 # > - see if it works - don't inflict your decision on others.
35 # > $ sysctl -w net.ipv4.tcp_ecn=1
36 # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub ecn' \
37 # > --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
38 # > $ sysctl -w net.ipv4.tcp_ecn=2
39 # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub noecn' \
40 # > --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
41 # > you can then use flent-gui *.flent.gz to generate a variety of plots,
42 # > especially comparison plots.
43 "net/ipv4/tcp_ecn" = mkDefault 2;
44 };
45
46 networking = {
47 inherit hostName;
48 domain = mkDefault "wg";
49 #search = [ "sourcephile.fr" ];
50 firewall = {
51 enable = mkDefault true;
52 allowPing = mkDefault true;
53 };
54 networkmanager = {
55 #dhcp = "dhcpcd";
56 logLevel = mkDefault "INFO";
57 wifi = {
58 #backend = "iwd";
59 #backend = "wpa_supplicant";
60 powersave = mkDefault false;
61 };
62 };
63 usePredictableInterfaceNames = true;
64 };
65
66 programs.mtr.enable = true;
67 programs.traceroute.enable = mkDefault true;
68 programs.usbtop.enable = true;
69
70 services.avahi = {
71 nssmdns = mkDefault true;
72 openFirewall = mkDefault false;
73 publish.enable = mkDefault false;
74 };
75 networking.nftables.ruleset = mkIf config.services.avahi.enable (''
76 table inet filter {
77 chain output-lan {
78 skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
79 }
80 }
81 '' + optionalString config.services.avahi.openFirewall ''
82 table inet filter {
83 chain input-lan {
84 udp dport mdns comment "avahi: multicast DNS"
85 }
86 }
87 '');
88
89 services.openssh.enable = mkDefault true;
90
91 # Fix https://github.com/NixOS/nixpkgs/issues/180175 by removing -s (aka. --wait-for-startup)
92 systemd.services.NetworkManager-wait-online = lib.mkIf config.networking.networkmanager.enable {
93 unitConfig.StartLimitIntervalSec = 0;
94 serviceConfig = {
95 ExecStart = [ "" "${pkgs.networkmanager}/bin/nm-online -q" ];
96 Restart = "on-failure";
97 RestartSec = 1;
98 };
99 };
100 environment.etc."NetworkManager/dispatcher.d/congctl" = {
101 mode = "700";
102 source = pkgs.writeShellScript "congctl" ''
103 case $NM_DISPATCHER_ACTION in
104 up)
105 case $DEVICE_IP_IFACE in
106 # WLAN or WWAN
107 # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
108 wl*|ww*)
109 ip route show dev $DEVICE_IP_IFACE |
110 while read -r route; do
111 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
112 done
113 ;;
114 esac
115 ;;
116 esac
117 '';
118 };
119
120 # The notion of "online" is a broken concept
121 #systemd.services.NetworkManager-wait-online.enable = false;
122 #systemd.network.wait-online.enable = false;
123
124 # Do not take down the network for too long when upgrading,
125 # This also prevents failures of services that are restarted instead of stopped.
126 # It will use `systemctl restart` rather than stopping it with `systemctl stop`
127 # followed by a delayed `systemctl start`.
128 systemd.services.systemd-networkd.stopIfChanged = false;
129
130 # Services that are only restarted might be not able
131 # to resolve when resolved is stopped before.
132 systemd.services.systemd-resolved.stopIfChanged = false;
133 }