hosts/nan2gua1/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy.nix
   5     ../../nixos/profiles/networking/ssh.nix
   6     ../../nixos/profiles/networking/wifi.nix
   7     ../../nixos/profiles/kubo.nix
   8     #../../nixos/profiles/openvpn/calyx.nix
   9     networking/nftables.nix
  10     openvpn/riseup.nix
  11   ];
  12   install.substituteOnDestination = true;
  13   #networking.domain = "sourcephile.fr";
  14   networking.useDHCP = false;
  15
  16   networking.nftables.ruleset = lib.mkAfter ''
  17     table inet filter {
  18       chain input {
  19         ip daddr 10.0.0.0/8 counter goto input-lan
  20         ip daddr 172.16.0.0/12 counter goto input-lan
  21         ip daddr 192.168.0.0/16 counter goto input-lan
  22         ip daddr 224.0.0.0/3 counter goto input-lan
  23         goto input-net
  24       }
  25       chain output {
  26         ip daddr 10.0.0.0/8 counter goto output-lan
  27         ip daddr 172.16.0.0/12 counter goto output-lan
  28         ip daddr 192.168.0.0/16 counter goto output-lan
  29         ip daddr 224.0.0.0/3 counter goto output-lan
  30         jump output-net
  31         log level warn prefix "output-net: " counter drop
  32       }
  33     }
  34   '';
  35
  36   networking.hosts = {
  37     #"80.67.180.129" = ["salons.sourcephile.fr"];
  38   };
  39
  40   networking.interfaces = { };
  41
  42   networking.networkmanager = {
  43     enable = true;
  44     unmanaged = [
  45     ];
  46   };
  47
  48   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  49     "host.key:${ssh/host.key.cred}"
  50   ];
  51
  52   programs.wireshark = {
  53     enable = true;
  54     package = pkgs.wireshark-qt;
  55   };
  56 }