]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine/networking.nix
radicle: update
[julm/julm-nix.git] / hosts / aubergine / networking.nix
1 { lib, ... }:
2 with lib;
3 with (import networking/names-and-numbers.nix);
4 {
5 imports = [
6 networking/ftth.nix
7 networking/ethernet.nix
8 networking/wifi.nix
9 networking/lte.nix
10 networking/nftables.nix
11 ../../nixos/profiles/dnscrypt-proxy2.nix
12 ../../nixos/profiles/networking/ssh.nix
13 ];
14 install.substituteOnDestination = false;
15 networking.domain = "wg";
16 networking.useDHCP = false;
17
18 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
19 networking.nftables.ruleset = mkAfter ''
20 table inet filter {
21 chain forward-to-lan {
22 #jump forward-connectivity
23 counter accept
24 }
25 chain forward-to-net {
26 #jump forward-connectivity
27 counter accept
28 }
29 chain forward-from-net {
30 ct state { established, related } accept
31 log level warn prefix "forward-from-net: " counter drop
32 }
33 chain forward {
34 log level warn prefix "forward: " counter drop
35 }
36 }
37 '';
38
39 networking.networkmanager.enable = true;
40 services.avahi = {
41 enable = true;
42 openFirewall = true;
43 nssmdns4 = true;
44 publish = {
45 enable = true;
46 addresses = true;
47 domain = true;
48 hinfo = true;
49 userServices = true;
50 workstation = true;
51 };
52 };
53 # WARNING: settings.listen_addresses are not merged...
54 # hence there all defined here.
55 services.dnscrypt-proxy2.settings.listen_addresses = [
56 "127.0.0.1:53"
57 "[::1]:53"
58 "${eth1IPv4}.1:53"
59 "${eth2IPv4}.1:53"
60 "${eth3IPv4}.1:53"
61 "${wifiIPv4}.1:53"
62 ];
63
64 services.openssh.settings.X11Forwarding = true;
65
66 services.vnstat.enable = true;
67
68 systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
69 "host.key:${ssh/host.key.cred}"
70 ];
71 }