]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/networking.nix
drawing: add darktable
[julm/julm-nix.git] / nixos / profiles / networking.nix
1 { config, pkgs, lib, hostName, ... }:
2 with lib;
3 {
4 imports = [
5 networking/nftables.nix
6 ];
7
8 boot.kernel.sysctl = {
9 # Improve MTU detection
10 # This can thaw TCP connections stalled by a host
11 # requiring a lower MTU along the path,
12 # though it would do so after a little delay
13 # so it's better to set a low MTU when possible.
14 "net/ipv4/tcp_mtu_probing" = 1;
15 };
16
17 networking = {
18 inherit hostName;
19 domain = mkDefault "wg";
20 #search = [ "sourcephile.fr" ];
21 firewall = {
22 enable = mkDefault true;
23 allowPing = mkDefault true;
24 };
25 networkmanager = {
26 enable = mkDefault config.services.xserver.enable;
27 #dhcp = "dhcpcd";
28 logLevel = mkDefault "INFO";
29 wifi = {
30 #backend = "iwd";
31 #backend = "wpa_supplicant";
32 powersave = mkDefault false;
33 };
34 };
35 usePredictableInterfaceNames = true;
36 };
37
38 programs.mtr.enable = true;
39 programs.traceroute.enable = mkDefault true;
40 programs.usbtop.enable = true;
41
42 services.avahi = {
43 nssmdns = mkDefault true;
44 openFirewall = mkDefault false;
45 publish.enable = mkDefault false;
46 };
47 networking.nftables.ruleset = mkIf config.services.avahi.enable (''
48 table inet filter {
49 chain output-lan {
50 skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
51 }
52 }
53 '' + optionalString config.services.avahi.openFirewall ''
54 table inet filter {
55 chain input-lan {
56 udp dport mdns comment "avahi: multicast DNS"
57 }
58 }
59 '');
60
61 services.openssh = {
62 enable = mkDefault true;
63 forwardX11 = mkDefault true;
64 openFirewall = mkDefault false;
65 };
66
67 environment.etc."NetworkManager/dispatcher.d/congctl" = {
68 mode = "700";
69 source = pkgs.writeShellScript "congctl" ''
70 case $NM_DISPATCHER_ACTION in
71 up)
72 case $DEVICE_IP_IFACE in
73 # WLAN or WWAN
74 # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
75 wl*|ww*)
76 ip route show dev $DEVICE_IP_IFACE |
77 while read -r route; do
78 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
79 done
80 ;;
81 esac
82 ;;
83 esac
84 '';
85 };
86 }