nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 {
   3 imports = [
   4   networking/nftables.nix
   5 ];
   6 networking = {
   7   hostName = hostName;
   8   domain = lib.mkDefault "wg";
   9   #search = [ "sourcephile.fr" ];
  10   firewall = {
  11     enable = lib.mkDefault true;
  12     allowPing = lib.mkDefault true;
  13   };
  14   networkmanager = {
  15     enable = lib.mkDefault config.services.xserver.enable;
  16     #dhcp = "dhcpcd";
  17     logLevel = lib.mkDefault "INFO";
  18     wifi = {
  19       #backend = "iwd";
  20       #backend = "wpa_supplicant";
  21       powersave = lib.mkDefault false;
  22     };
  23   };
  24   usePredictableInterfaceNames = true;
  25 };
  26
  27 programs.mtr.enable = true;
  28 programs.usbtop.enable = true;
  29 environment.systemPackages = [
  30   pkgs.iperf
  31 ];
  32
  33 services.avahi = {
  34   enable = lib.mkDefault true;
  35   nssmdns = lib.mkDefault true;
  36   openFirewall = lib.mkDefault false;
  37   publish.enable = lib.mkDefault false;
  38 };
  39 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
  40   table inet filter {
  41     chain output-lan {
  42       skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
  43     }
  44   }
  45 '' + lib.optionalString config.services.avahi.openFirewall ''
  46   table inet filter {
  47     chain input-lan {
  48       udp dport mdns comment "avahi: multicast DNS"
  49     }
  50   }
  51 '');
  52
  53 services.openssh = {
  54   enable = lib.mkDefault true;
  55   forwardX11 = lib.mkDefault true;
  56   openFirewall = lib.mkDefault false;
  57   # Enable to switch-to-configuration
  58   # with the same ssh call remotely and locally
  59   listenAddresses = [
  60     { addr = "127.0.0.1"; port = 22; }
  61   ];
  62 };
  63
  64 environment.etc."NetworkManager/dispatcher.d/congctl" = {
  65   mode = "700";
  66   source = pkgs.writeShellScript "congctl" ''
  67     case $NM_DISPATCHER_ACTION in
  68       up)
  69         case $DEVICE_IP_IFACE in
  70           # WLAN or WWAN
  71           # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
  72           wl*|ww*)
  73             ip route show dev $DEVICE_IP_IFACE |
  74             while read -r route; do
  75               ip route change $route dev $DEVICE_IP_IFACE congctl westwood
  76             done
  77             ip r >>/tmp/log
  78           ;;
  79         esac
  80       ;;
  81     esac
  82   '';
  83 };
  84 }