]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/networking.nix
aubergine: split networking file
[julm/julm-nix.git] / nixos / profiles / networking.nix
1 { config, pkgs, lib, hostName, ... }:
2 let
3 wg-intra-peers = import wireguard/wg-intra/peers.nix;
4 in
5 {
6 imports = [
7 networking/nftables.nix
8 ];
9 networking = {
10 hostName = hostName;
11 domain = lib.mkDefault "localdomain";
12 #search = [ "sourcephile.fr" ];
13 firewall = {
14 enable = lib.mkDefault true;
15 allowPing = lib.mkDefault true;
16 };
17 networkmanager = {
18 enable = lib.mkDefault config.services.xserver.enable;
19 #dhcp = "dhcpcd";
20 logLevel = lib.mkDefault "INFO";
21 wifi = {
22 #backend = "iwd";
23 #backend = "wpa_supplicant";
24 powersave = lib.mkDefault false;
25 };
26 };
27 usePredictableInterfaceNames = true;
28 };
29
30 programs.mtr.enable = true;
31 programs.usbtop.enable = true;
32 environment.systemPackages = [
33 pkgs.iperf
34 ];
35
36 services.avahi = {
37 enable = lib.mkDefault true;
38 nssmdns = lib.mkDefault true;
39 openFirewall = lib.mkDefault false;
40 publish.enable = lib.mkDefault false;
41 };
42 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
43 table inet filter {
44 chain output-lan {
45 skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
46 }
47 }
48 '' + lib.optionalString config.services.avahi.openFirewall ''
49 table inet filter {
50 chain input-lan {
51 udp dport mdns comment "avahi: multicast DNS"
52 }
53 }
54 '');
55
56 services.openssh = {
57 enable = lib.mkDefault true;
58 forwardX11 = lib.mkDefault true;
59 openFirewall = lib.mkDefault false;
60 listenAddresses = [
61 { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
62 ];
63 };
64
65 environment.etc."NetworkManager/dispatcher.d/congctl" = {
66 mode = "700";
67 source = pkgs.writeShellScript "congctl" ''
68 case $NM_DISPATCHER_ACTION in
69 up)
70 case $DEVICE_IP_IFACE in
71 # WLAN or WWAN
72 # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
73 wl*|ww*)
74 ip route show dev $DEVICE_IP_IFACE |
75 while read -r route; do
76 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
77 done
78 ip r >>/tmp/log
79 ;;
80 esac
81 ;;
82 esac
83 '';
84 };
85 }