hosts/aubergine/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 with (import networking/names-and-numbers.nix);
   3 {
   4 imports = [
   5   networking/ftth.nix
   6   networking/ethernet.nix
   7   networking/wifi.nix
   8   networking/lte.nix
   9   networking/nftables.nix
  10   ../../nixos/profiles/networking.nix
  11   ../../nixos/profiles/dnscrypt-proxy2.nix
  12   ../../nixos/profiles/wireguard/wg-intra.nix
  13 ];
  14 install.substituteOnDestination = false;
  15 networking.domain = "wg";
  16 networking.useDHCP = false;
  17
  18 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  19 networking.nftables.ruleset = lib.mkAfter ''
  20   table inet filter {
  21     chain forward-to-net {
  22       #jump forward-connectivity
  23       counter accept
  24     }
  25     chain forward-from-net {
  26       ct state { established, related } accept
  27       log level warn prefix "forward-from-net: " counter drop
  28     }
  29     chain forward {
  30       log level warn prefix "forward: " counter drop
  31     }
  32   }
  33 '';
  34
  35 services.avahi.openFirewall = true;
  36 services.dnscrypt-proxy2.settings.listen_addresses = [
  37   "127.0.0.1:53"
  38   "[::1]:53"
  39 ];
  40
  41 networking.wireguard.wg-intra.peers = {
  42   mermet.enable = true;
  43   losurdo.enable = true;
  44   oignon.enable = true;
  45   patate.enable = true;
  46 };
  47
  48 }