]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/networking.nix
nix: update inputs
[julm/julm-nix.git] / nixos / profiles / networking.nix
1 { config, pkgs, lib, hostName, ... }:
2 let
3 wg-intra-peers = import wireguard/wg-intra/peers.nix;
4 in
5 {
6 networking = {
7 hostName = hostName;
8 domain = lib.mkDefault "localdomain";
9 search = [ "sourcephile.fr" ];
10 firewall = {
11 enable = lib.mkDefault true;
12 allowPing = lib.mkDefault true;
13 };
14 };
15
16 programs.mtr.enable = true;
17 programs.usbtop.enable = true;
18
19 services.avahi = {
20 enable = lib.mkDefault true;
21 nssmdns = lib.mkDefault true;
22 openFirewall = lib.mkDefault false;
23 publish.enable = lib.mkDefault false;
24 };
25
26 services.openssh = {
27 enable = lib.mkDefault true;
28 forwardX11 = lib.mkDefault true;
29 openFirewall = lib.mkDefault false;
30 listenAddresses = [
31 { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
32 ];
33 };
34 networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
35 ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
36 '';
37 systemd.services.sshd.after = ["wireguard-wg-intra.service"];
38 }