]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/networking.nix
aubergine: add julm to networkmanager
[julm/julm-nix.git] / nixos / profiles / networking.nix
1 { config, pkgs, lib, hostName, ... }:
2 let
3 wg-intra-peers = import wireguard/wg-intra/peers.nix;
4 in
5 {
6 imports = [
7 networking/nftables.nix
8 ];
9 networking = {
10 hostName = hostName;
11 domain = lib.mkDefault "localdomain";
12 #search = [ "sourcephile.fr" ];
13 firewall = {
14 enable = lib.mkDefault true;
15 allowPing = lib.mkDefault true;
16 };
17 networkmanager = {
18 enable = lib.mkDefault config.services.xserver.enable;
19 #dhcp = "dhcpcd";
20 logLevel = lib.mkDefault "INFO";
21 wifi = {
22 #backend = "iwd";
23 #backend = "wpa_supplicant";
24 powersave = lib.mkDefault false;
25 };
26 };
27 usePredictableInterfaceNames = true;
28 };
29
30 programs.mtr.enable = true;
31 programs.usbtop.enable = true;
32
33 services.avahi = {
34 enable = lib.mkDefault true;
35 nssmdns = lib.mkDefault true;
36 openFirewall = lib.mkDefault false;
37 publish.enable = lib.mkDefault false;
38 };
39 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
40 table inet filter {
41 chain output-lan {
42 skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
43 }
44 }
45 '' + lib.optionalString config.services.avahi.openFirewall ''
46 table inet filter {
47 chain input-lan {
48 udp dport mdns comment "avahi: multicast DNS"
49 }
50 }
51 '');
52
53 services.openssh = {
54 enable = lib.mkDefault true;
55 forwardX11 = lib.mkDefault true;
56 openFirewall = lib.mkDefault false;
57 listenAddresses = [
58 { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
59 ];
60 };
61 networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
62 ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
63 '';
64 systemd.services.sshd.after = ["wireguard-wg-intra.service"];
65 }