hosts/patate/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/networking/ssh.nix
   6     networking/nftables.nix
   7   ];
   8   install.substituteOnDestination = false;
   9
  10   networking.nftables.ruleset = lib.mkAfter ''
  11     table inet filter {
  12       chain input {
  13         ip daddr 10.0.0.0/8 counter goto input-lan
  14         ip daddr 172.16.0.0/12 counter goto input-lan
  15         ip daddr 192.168.0.0/16 counter goto input-lan
  16         ip daddr 224.0.0.0/3 counter goto input-lan
  17         goto input-net
  18       }
  19       chain output {
  20         ip daddr 10.0.0.0/8 counter goto output-lan
  21         ip daddr 172.16.0.0/12 counter goto output-lan
  22         ip daddr 192.168.0.0/16 counter goto output-lan
  23         ip daddr 224.0.0.0/3 counter goto output-lan
  24         jump output-net
  25         log level warn prefix "output-net: " counter drop
  26       }
  27     }
  28   '';
  29
  30   networking.networkmanager.enable = true;
  31   services.avahi.enable = true;
  32   services.openssh.settings.X11Forwarding = true;
  33   services.vnstat.enable = true;
  34   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  35     "host.key:${ssh/host.key.cred}"
  36   ];
  37 }