nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 let
   3   wg-intra-peers = import wireguard/wg-intra/peers.nix;
   4 in
   5 {
   6 networking = {
   7   hostName = hostName;
   8   domain = lib.mkDefault "localdomain";
   9   #search = [ "sourcephile.fr" ];
  10   firewall = {
  11     enable = lib.mkDefault true;
  12     allowPing = lib.mkDefault true;
  13   };
  14   networkmanager = {
  15     enable = lib.mkDefault config.services.xserver.enable;
  16     #dhcp = "dhcpcd";
  17     logLevel = lib.mkDefault "INFO";
  18     wifi = {
  19       #backend = "iwd";
  20       #backend = "wpa_supplicant";
  21       powersave = lib.mkDefault false;
  22     };
  23   };
  24   usePredictableInterfaceNames = true;
  25 };
  26
  27 programs.mtr.enable = true;
  28 programs.usbtop.enable = true;
  29
  30 services.avahi = {
  31   enable = lib.mkDefault true;
  32   nssmdns = lib.mkDefault true;
  33   openFirewall = lib.mkDefault false;
  34   publish.enable = lib.mkDefault false;
  35 };
  36 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
  37    add rule inet filter fw2lan skuid root udp sport 5353 udp dport 5353
  38 '' + lib.optionalString config.services.avahi.openFirewall ''
  39    add rule inet filter lan2fw udp dport 5353 comment "Avahi"
  40 '');
  41
  42 services.openssh = {
  43   enable = lib.mkDefault true;
  44   forwardX11 = lib.mkDefault true;
  45   openFirewall = lib.mkDefault false;
  46   listenAddresses = [
  47     { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
  48   ];
  49 };
  50 networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
  51   ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
  52 '';
  53 systemd.services.sshd.after = ["wireguard-wg-intra.service"];
  54 }