nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 let
   3   wg-intra-peers = import wireguard/wg-intra/peers.nix;
   4 in
   5 {
   6 imports = [
   7   networking/nftables.nix
   8 ];
   9 networking = {
  10   hostName = hostName;
  11   domain = lib.mkDefault "localdomain";
  12   #search = [ "sourcephile.fr" ];
  13   firewall = {
  14     enable = lib.mkDefault true;
  15     allowPing = lib.mkDefault true;
  16   };
  17   networkmanager = {
  18     enable = lib.mkDefault config.services.xserver.enable;
  19     #dhcp = "dhcpcd";
  20     logLevel = lib.mkDefault "INFO";
  21     wifi = {
  22       #backend = "iwd";
  23       #backend = "wpa_supplicant";
  24       powersave = lib.mkDefault false;
  25     };
  26   };
  27   usePredictableInterfaceNames = true;
  28 };
  29
  30 programs.mtr.enable = true;
  31 programs.usbtop.enable = true;
  32 environment.systemPackages = [
  33   pkgs.iperf
  34 ];
  35
  36 services.avahi = {
  37   enable = lib.mkDefault true;
  38   nssmdns = lib.mkDefault true;
  39   openFirewall = lib.mkDefault false;
  40   publish.enable = lib.mkDefault false;
  41 };
  42 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
  43   table inet filter {
  44     chain output-lan {
  45       skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
  46     }
  47   }
  48 '' + lib.optionalString config.services.avahi.openFirewall ''
  49   table inet filter {
  50     chain input-lan {
  51       udp dport mdns comment "avahi: multicast DNS"
  52     }
  53   }
  54 '');
  55
  56 services.openssh = {
  57   enable = lib.mkDefault true;
  58   forwardX11 = lib.mkDefault true;
  59   openFirewall = lib.mkDefault false;
  60   # Enable to switch-to-configuration
  61   # with the same remotely and locally
  62   listenAddresses = [
  63     { addr = "127.0.0.1"; port = 22; }
  64   ];
  65 };
  66
  67 environment.etc."NetworkManager/dispatcher.d/congctl" = {
  68   mode = "700";
  69   source = pkgs.writeShellScript "congctl" ''
  70     case $NM_DISPATCHER_ACTION in
  71       up)
  72         case $DEVICE_IP_IFACE in
  73           # WLAN or WWAN
  74           # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
  75           wl*|ww*)
  76             ip route show dev $DEVICE_IP_IFACE |
  77             while read -r route; do
  78               ip route change $route dev $DEVICE_IP_IFACE congctl westwood
  79             done
  80             ip r >>/tmp/log
  81           ;;
  82         esac
  83       ;;
  84     esac
  85   '';
  86 };
  87 }