nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 let
   3   wg-intra-peers = import wireguard/wg-intra/peers.nix;
   4 in
   5 {
   6 networking = {
   7   hostName = hostName;
   8   domain = lib.mkDefault "localdomain";
   9   search = [ "sourcephile.fr" ];
  10   firewall = {
  11     enable = lib.mkDefault true;
  12     allowPing = lib.mkDefault true;
  13   };
  14 };
  15
  16 programs.mtr.enable = true;
  17 programs.usbtop.enable = true;
  18
  19 services.avahi = {
  20   enable = lib.mkDefault true;
  21   nssmdns = lib.mkDefault true;
  22   openFirewall = lib.mkDefault false;
  23   publish.enable = lib.mkDefault false;
  24 };
  25
  26 services.openssh = {
  27   enable = lib.mkDefault true;
  28   forwardX11 = lib.mkDefault true;
  29   openFirewall = lib.mkDefault false;
  30   listenAddresses = [
  31     { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
  32   ];
  33 };
  34 networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
  35   ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
  36 '';
  37 systemd.services.sshd.after = ["wireguard-wg-intra.service"];
  38 }