hosts/oignon/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/wireguard/wg-intra.nix
   6     networking/nftables.nix
   7   ];
   8   install.substituteOnDestination = false;
   9   #networking.domain = "sourcephile.fr";
  10   networking.useDHCP = false;
  11
  12   networking.nftables.ruleset = lib.mkAfter ''
  13     table inet filter {
  14       chain input {
  15         goto input-net
  16       }
  17       chain output {
  18         ip daddr 10.0.0.0/8 counter goto output-lan
  19         ip daddr 172.16.0.0/12 counter goto output-lan
  20         ip daddr 192.168.0.0/16 counter goto output-lan
  21         ip daddr 224.0.0.0/3 counter goto output-lan
  22         jump output-net
  23         log level warn prefix "output-net: " counter drop
  24       }
  25     }
  26   '';
  27
  28   networking.interfaces = { };
  29
  30   networking.networkmanager = {
  31     enable = true;
  32     unmanaged = [
  33     ];
  34   };
  35   environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
  36     mode = "600";
  37     text = ''
  38       [connection]
  39       id=Prixtel
  40       uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
  41       type=gsm
  42       autoconnect=false
  43       permissions=user:julm:;
  44
  45       [gsm]
  46       apn=sl2sfr
  47       number=*99#
  48       home-only=true
  49
  50       [ppp]
  51
  52       [ipv4]
  53       method=auto
  54
  55       [ipv6]
  56       addr-gen-mode=stable-privacy
  57       method=disabled
  58
  59       [proxy]
  60     '';
  61   };
  62
  63   networking.wireguard.wg-intra.peers = {
  64     mermet.enable = true;
  65     losurdo.enable = true;
  66     patate.enable = true;
  67     aubergine.enable = true;
  68   };
  69
  70   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted =
  71     [ "ed25519.key:${inputs.self}/host/${hostName}/networking/ssh/ed25519.key.cred" ];
  72   services.openssh.hostKeys =
  73     [ { type = "ed25519"; path = "/run/credentials/sshd.service/ed25519.key"; }
  74     ];
  75
  76   environment.systemPackages = [
  77     pkgs.iw
  78     pkgs.modem-manager-gui
  79   ];
  80 }